aswin1906/github-advisory-2023 huggingface dataset:
semver-tags is vulnerable to Command Injection via the getGitTagsRemote function (GHSA-8h3g-hcwp-6hxq)
Aliases: CVE-2022-25853
Published: 2023-02-06T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'semver-tags'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.4.10'}]}]}]

All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization.
Regular Expression Denial of Service in Headers (GHSA-r6ch-mqf9-qc9w)
Aliases: CVE-2023-24807
Published: 2023-02-16T20:46:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'undici'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.19.1'}]}]}]

### Impact
The `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function.

### Patches

This vulnerability was patched in v5.19.1.

### Workarounds
There is no workaround. Please update to an unaffected version.

### References

* https://hackerone.com/bugs?report_id=1784449

### Credits

Carter Snook reported this vulnerability.
Answer vulnerable to Cross-site Scripting (GHSA-6cvf-m58q-h9wf)
Aliases: CVE-2023-0934
Published: 2023-02-21T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.5'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.5.
Insecure Permissions issue in jeecg-boot (GHSA-4f48-qpch-4ppx)
Aliases: CVE-2021-37305
Published: 2023-02-03T18:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-base'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4.5'}]}]}]

An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.
markdown-it-py Denial of Service vulnerability (GHSA-vrjv-mxr7-vjf8)
Aliases: CVE-2023-26303
Published: 2023-02-23T00:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'markdown-it-py'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.0'}]}]}]

Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially crafted input.
Missing Authorization in Jenkins Azure Credentials Plugin (GHSA-7j55-28qq-676g)
Aliases: CVE-2023-25766
Published: 2023-02-15T15:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:azure-credentials'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '253.v887e0f9e898b'}]}]}]

A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Cross site scripting in automad/automad (GHSA-q3c8-65q7-9v78)
Aliases: CVE-2021-37502
Published: 2023-02-03T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'automad/automad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.8.0'}]}]}]

Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding a user.
laravel-admin has Arbitrary File Upload vulnerability (GHSA-g857-47pm-3r32)
Aliases: CVE-2023-24249
Published: 2023-02-27T21:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'encore/laravel-admin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.8.19'}]}]}]

An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.
No protection against brute-force attacks on login page (GHSA-7968-h4m4-ghm9)
Aliases: CVE-2023-25156
Published: 2023-02-15T18:10:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'kiwitcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.0'}]}]}]

### Impact
Previous versions of Kiwi TCMS do not impose rate limits which makes it easier to attempt brute-force attacks against the login page.

### Patches
Users should upgrade to v12.0 or later.

### Workarounds
Users may install and configure a rate-limiting proxy in front of Kiwi TCMS. For example nginx.

### References
[Disclosed by spyata](https://huntr.dev/bounties/2b1a9be9-45e9-490b-8de0-26a492e79795/)
XML External Entity Reference in Apache NiFi (GHSA-hxjp-q6c3-38fx)
Aliases: CVE-2023-22832
Published: 2023-02-10T09:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.20.0'}]}]}]

The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configurations that include the ExtractCCDAAttributes Processor are vulnerable to malicious XML documents that contain Document Type Declarations with XML External Entity references. The resolution disables Document Type Declarations and disallows XML External Entity resolution in the ExtractCCDAAttributes Processor.
OCI image importer memory exhaustion in github.com/containerd/containerd (GHSA-259w-8hf6-59c2)
Aliases: CVE-2023-25153
Published: 2023-02-16T14:12:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/containerd/containerd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.18'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/containerd/containerd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.6.0'}, {'fixed': '1.6.18'}]}]}]

### Impact

When importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file where a limit was not applied could cause a denial of service.

### Patches

This bug has been fixed in containerd 1.6.18 and 1.5.18.  Users should update to these versions to resolve the issue.

### Workarounds

Ensure that only trusted images are used and that only trusted users have permissions to import images. 

### Credits

The containerd project would like to thank [David Korczynski](https://github.com/DavidKorczynski) and [Adam Korczynski](https://github.com/AdamKorcz) of ADA Logics for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md) during a security fuzzing audit sponsored by CNCF.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)

To report a security issue in containerd:
* [Report a new vulnerability](https://github.com/containerd/containerd/security/advisories/new)
* Email us at [security@containerd.io](mailto:security@containerd.io)
golang.org/x/crypto/ssh Man-in-the-Middle attack (GHSA-xhjq-w7xm-p8qj)
Aliases: CVE-2017-3204
Published: 2023-02-07T22:39:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'golang.org/x/crypto/ssh'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20170330155735-e4e2799dd7aa'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'golang.org/x/crypto'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20170330155735-e4e2799dd7aa'}]}]}]

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks if ClientConfig.HostKeyCallback is not set. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.
apollo-portal has potential CSRF issue (GHSA-fmxq-v8mg-qh25)
Aliases: CVE-2023-25569
Published: 2023-02-22T21:58:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.ctrip.framework.apollo:apollo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

### Impact
A low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin.

### Patches
Cookie SameSite strategy was set to Lax in #4664 and was released in [v2.1.0](https://github.com/apolloconfig/apollo/releases/tag/v2.1.0).

### Workarounds
To fix the potential issue without upgrading, simply follow the advice that does not visit unknown source pages.

### References
[Apollo Security Guidence](https://www.apolloconfig.com/#/en/usage/apollo-user-guide?id=_71-security-related)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [issue](https://github.com/apolloconfig/apollo/issues)
* Email us at [apollo-config@googlegroups.com](mailto:apollo-config@googlegroups.com)
partial_sort contains Out-of-bounds Read in release mode (GHSA-5x36-7567-3cw6)
Published: 2023-02-28T20:31:05Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'partial_sort'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.0'}]}]}]

Affected versions of this crate were using a debug assertion to validate the `last` parameter of `partial_sort()`. This would allow invalid inputs to cause an out-of-bounds read instead of immediately panicking, when compiled without debug assertions.

All writes are bounds-checked, so the out-of-bounds memory access is read-only. This also means that the first attempted out-of-bounds write will panic, limiting the possible reads.

The accessible region is further limited by an initial bounds-checked read at `(last / 2) - 1`, i.e., it is proportional to the size of the vector.

This bug has been fixed in v0.2.0.
Command Injection in thorsten/phpmyfaq (GHSA-6vp5-vv9p-7q62)
Aliases: CVE-2023-0789
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Command Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
Baremetrics date range picker vulnerable to Cross-site Scripting (GHSA-465f-mxxh-grc4)
Aliases: CVE-2021-32859
Published: 2023-02-21T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'baremetrics-calendar'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.14'}]}]}]

The Baremetrics date range picker is a solution for selecting both date ranges and single dates from a single calender view. Versions 1.0.14 and prior are prone to cross-site scripting (XSS) when handling untrusted `placeholder` entries. An attacker who is able to influence the field `placeholder` when creating a `Calendar` instance is able to supply arbitrary `html` or `javascript` that will be rendered in the context of a user leading to XSS. There are no known patches for this issue.
rttys SQL Injection vulnerability (GHSA-54q4-74p3-mgcw)
Aliases: CVE-2022-38867
Published: 2023-02-16T00:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/zhaojh329/rttys'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'last_affected': '4.0.2'}]}]}]

SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, and 4.0.2 in api.go, allows attackers to execute arbitrary code.
OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting (GHSA-g57g-rvpg-2f2c)
Aliases: CVE-2023-0868
Published: 2023-02-23T15:33:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms-webapp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '31.0.4'}]}]}]

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies.
Cross Site Scripting in OpenNMS (GHSA-7v39-jjj6-j4j4)
Aliases: CVE-2023-0869
Published: 2023-02-23T15:33:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms-web-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '31.0.3'}]}]}]

Cross-site scripting in outage/list.htm in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information.
openssl-src contains Double free after calling `PEM_read_bio_ex` (GHSA-v5w6-wcm8-jm4q)
Aliases: CVE-2022-4450
Published: 2023-02-08T22:22:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '111.25.0'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '300.0.0'}, {'fixed': '300.0.12'}]}]}]

The function `PEM_read_bio_ex()` reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to buffers containing the relevant decoded data. The caller is responsible for freeing those buffers. It is possible to construct a PEM file that results in 0 bytes of payload data. In this case `PEM_read_bio_ex()` will return a failure code but will populate the header argument with a pointer to a buffer that has already been freed. If the caller also frees this buffer then a double free will occur. This will most likely lead to a crash. This could be exploited by an attacker who has the ability to supply malicious PEM files for parsing to achieve a denial of service attack.

The functions `PEM_read_bio()` and `PEM_read()` are simple wrappers around `PEM_read_bio_ex()` and therefore these functions are also directly affected.

These functions are also called indirectly by a number of other OpenSSL functions including `PEM_X509_INFO_read_bio_ex()` and
`SSL_CTX_use_serverinfo_file()` which are also vulnerable. Some OpenSSL internal uses of these functions are not vulnerable because the caller does not free the header argument if `PEM_read_bio_ex()` returns a failure code. These locations include the `PEM_read_bio_TYPE()` functions as well as the decoders introduced in OpenSSL 3.0.
vantage6 vulnerable to Observable Response Discrepancy (GHSA-36gx-9q6h-g429)
Aliases: CVE-2022-39228
Published: 2023-02-28T23:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vantage6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.8.0'}]}]}]

### Impact
We are incorporating the password policies listed in https://github.com/vantage6/vantage6/issues/59. One measure is that we don't let the user know in case of wrong username/password combination if the username actually exists, to prevent that bots can guess usernames. However, if a wrong password is entered a number of times, the user account is blocked temporarily. This way you could still find out which usernames exist.

### Patches
Update to 3.8.0+

### Workarounds
No

### References
https://github.com/vantage6/vantage6/issues/59

### For more information
If you have any questions or comments about this advisory:
* Email us at [vantage6@iknl.nl](mailto:vantage6@iknl.nl)
Kubernetes apimachinery packages vulnerable to unbounded recursion in JSON or YAML parsing (GHSA-74fp-r6jw-h4mp)
Published: 2023-02-08T00:35:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'k8s.io/apimachinery'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20190927203648-9ce6eca90e73'}]}]}]

CVE-2019-11253 is a denial of service vulnerability in the kube-apiserver, allowing authorized users sending malicious YAML or JSON payloads to cause kube-apiserver to consume excessive CPU or memory, potentially crashing and becoming unavailable. 

When creating a ConfigMap object which has recursive references contained in it, excessive CPU usage can occur. This appears to be an instance of a "Billion Laughs" attack which is quite well known as an XML parsing issue.

Applying this manifest to a cluster causes the client to hang for some time with considerable CPU usage.

```yaml
apiVersion: v1
data:
  a: &a ["web","web","web","web","web","web","web","web","web"]
  b: &b [*a,*a,*a,*a,*a,*a,*a,*a,*a]
  c: &c [*b,*b,*b,*b,*b,*b,*b,*b,*b]
  d: &d [*c,*c,*c,*c,*c,*c,*c,*c,*c]
  e: &e [*d,*d,*d,*d,*d,*d,*d,*d,*d]
  f: &f [*e,*e,*e,*e,*e,*e,*e,*e,*e]
  g: &g [*f,*f,*f,*f,*f,*f,*f,*f,*f]
  h: &h [*g,*g,*g,*g,*g,*g,*g,*g,*g]
  i: &i [*h,*h,*h,*h,*h,*h,*h,*h,*h]
kind: ConfigMap
metadata:
  name: yaml-bomb
  namespace: default
```
### Specific Go Packages Affected
- k8s.io/apimachinery/pkg/runtime/serializer/json
- k8s.io/apimachinery/pkg/util/json
Openshift Enterprise source-to-image vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) (GHSA-w55j-f7vx-6q37)
Aliases: CVE-2018-1103
Published: 2023-02-06T23:49:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/openshift/source-to-image/pkg/tar'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.10'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/openshift/source-to-image'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.10-0.20180427153919-f5cbcbc5cc6f'}]}]}]

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command.
Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2 (GHSA-hxp2-xqf3-v83h)
Published: 2023-02-07T18:24:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/pion/dtls'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pion/dtls/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.4'}]}]}]

### Impact

When attempting to unmarshal a Server Hello request we could attempt to unmarshal into a buffer that was too small. This could result in a panic leading the program to crash.

This issue could be abused to cause a denial of service.

### Workaround

None
Apache Airflow Sqoop Provider Improper Input Validation vulnerability (GHSA-j69x-v4wc-3fpf)
Aliases: CVE-2023-25693
Published: 2023-02-24T12:31:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-sqoop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.1'}]}]}]

Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.
Code Injection in froxlor/froxlor (GHSA-vp4r-h765-5mwp)
Aliases: CVE-2023-0877
Published: 2023-02-17T03:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.11'}]}]}]

Code Injection in GitHub repository froxlor/froxlor prior to 2.0.11.
OpenNMS has potential Insertion of Sensitive Information into Log File vulnerability (GHSA-9xpj-mvp2-3943)
Aliases: CVE-2023-0815
Published: 2023-02-23T15:33:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '31.0.4'}]}]}]

Potential Insertion of Sensitive Information into Jetty Log Files in multiple versions of OpenNMS Meridian and Horizon could allow disclosure of usernames and passwords if the logging level is set to debug.
openssl-src contains `NULL` dereference during PKCS7 data verification (GHSA-vrh7-x64v-7vxq)
Aliases: CVE-2023-0401
Published: 2023-02-08T22:21:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '300.0.0'}, {'fixed': '300.0.12'}]}]}]

A `NULL` pointer can be dereferenced when signatures are being verified on PKCS7 `signed` or `signedAndEnveloped` data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available the digest initialization will fail. There is a missing check for the return value from the initialization function which later leads to invalid usage of the digest API most likely leading to a crash. The unavailability of an algorithm can be caused by using FIPS enabled configuration of providers or more commonly by not loading the legacy provider.

PKCS7 data is processed by the SMIME library calls and also by the time stamp (TS) library calls. The TLS implementation in OpenSSL does not call these functions however third party applications would be affected if they call these functions to verify signatures on untrusted data.
Undertow client not checking server identity presented by server certificate in https connections (GHSA-pfcc-3g6r-8rg8)
Aliases: CVE-2022-4492
Published: 2023-02-23T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.undertow:undertow-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.3.5.Final'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'io.undertow:undertow-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.24.Final'}]}]}]

The undertow client is not checking the server identity presented by the server certificate in https connections. This should be performed by default in https and in http/2.
Switcher Client contains Regular Expression Denial of Service (ReDoS) (GHSA-wqxw-8h5g-hq56)
Aliases: CVE-2023-23925
Published: 2023-02-02T01:33:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'switcher-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.4'}]}]}]

### Impact
Unsanitized input flows into Strategy match operation (EXIST), where it is used to build a regular expression. This may result in a Regular expression Denial of Service attack (reDOS).

### Patches
Patched in 3.1.4

### Workarounds
Avoid using Strategy settings that use REGEX in conjunction with EXIST and NOT_EXIST operations.
Cross-site Scripting (XSS) in wallabag/wallabag  (GHSA-3x2c-87cq-qx49)
Aliases: CVE-2023-0736
Published: 2023-02-08T00:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.4'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository wallabag/wallabag prior to 2.5.4.
Cross-site scripting vulnerability found in answerdev/answer (GHSA-65px-4cpf-697r)
Aliases: CVE-2023-0740
Published: 2023-02-08T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.4'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
IPython vulnerable to command injection via set_term_title (GHSA-29gw-9793-fvw7)
Aliases: CVE-2023-24816
Published: 2023-02-10T19:55:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'IPython'}, 'ecosystem_specific': {'affected_functions': ['IPython.utils.terminal.set_term_title']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.10'}]}]}]

IPython provides an interactive Python shell and Jupyter kernel to use Python interactively. Versions prior to 8.10.0 are vulnerable to command injection in the `set_term_title` [function](https://github.com/ipython/ipython/blob/3f0bf05f072a91b2a3042d23ce250e5e906183fd/IPython/utils/terminal.py#L103-L117) under specific conditions. This has been patched in version 8.10.0.

### Impact 
Users are only vulnerable when calling this function in Windows in a Python environment where [ctypes](https://docs.python.org/3/library/ctypes.html) is not available. The dependency on ctypes in `IPython.utils._process_win32` prevents the vulnerable code from ever being reached (making it effectively dead code). However, as a library that could be used by another tool, `set_term_title` could introduce a vulnerability for dependencies. Currently `set_term_title` is only called with (semi-)trusted input that contain the current working directory of the current IPython session. If an attacker can control directory names, and manage to get a user to `cd` into this directory, then the attacker can execute arbitrary commands contained in the folder names.
Broken Access Control in 3rd party TYPO3 extension "femanager" (GHSA-3p9x-xxx6-2w4p)
Aliases: CVE-2023-25014
Published: 2023-02-02T03:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'in2code/femanager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.5.3'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'in2code/femanager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.3.4'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'in2code/femanager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.1.0'}]}]}]

A missing access check in the `InvitationController` allows an unauthenticated user to delete all frontend users.
rangy vulnerable to Prototype Pollution (GHSA-65rp-mhqf-8gj3)
Aliases: CVE-2023-26102
Published: 2023-02-24T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'rangy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3.1'}]}]}]

All versions of the package rangy are vulnerable to Prototype Pollution when using the `extend()` function in file `rangy-core.js`.The function uses recursive merge which can lead an attacker to modify properties of the Object.prototype.
Cross-site Scripting in thorsten/phpmyfaq (GHSA-c38p-vw6j-qjpr)
Aliases: CVE-2023-0791
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
RestEasy Reactive implementation of Quarkus allows Creation of Temporary File With Insecure Permissions (GHSA-j75r-vf64-6rrh)
Aliases: CVE-2023-0481
Published: 2023-02-24T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.quarkus.resteasy.reactive:resteasy-reactive-common-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0.Alpha4'}]}]}]

In RestEasy Reactive implementation of Quarkus the insecure `File.createTempFile()` is used in the `FileBodyHandler` class which creates temp files with insecure permissions that could be read by a local user.
Answer contains Improper Access Control vulnerability (GHSA-4cwh-8w4g-jxxh)
Aliases: CVE-2023-0744
Published: 2023-02-08T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.4'}]}]}]

Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4.
XSS vulnerability in drag-and-drop upload of phpMyAdmin (GHSA-6hr3-44gx-g6wh)
Aliases: CVE-2023-25727
Published: 2023-02-13T06:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'phpmyadmin/phpmyadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.9.11'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'phpmyadmin/phpmyadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0'}, {'fixed': '5.2.1'}]}]}]

In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-and-drop interface. By disabling the configuration directive `$cfg['enable_drag_drop_import']`, users will be unable to use the drag and drop upload which would protect against the vulnerability.
XML External Entity Reference in ureport (GHSA-fhj6-gr87-g4cj)
Aliases: CVE-2023-24187
Published: 2023-02-14T03:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.bstek.ureport:ureport2-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.9'}]}]}]

An XML External Entity (XXE) vulnerability in ureport v2.2.9 allows attackers to execute arbitrary code via uploading a crafted XML file to /ureport/designer/saveReportFile.
GeoServer OGC Filter SQL Injection Vulnerabilities (GHSA-7g5f-wrx8-5ccf)
Aliases: CVE-2023-25157
Published: 2023-02-22T19:15:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.geoserver.community:gs-jdbcconfig'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.21.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.geoserver.community:gs-jdbcconfig'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.22.0'}, {'fixed': '2.22.2'}]}]}]

### Impact

GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols.  CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages.

SQL Injection Vulnerabilities have been found with:

* ``PropertyIsLike`` filter, when used with a String field and any database DataStore, or with a PostGIS DataStore with encode functions enabled
* ``strEndsWith`` function, when used with a PostGIS DataStore with encode functions enabled
* ``strStartsWith`` function, when used with a PostGIS DataStore with encode functions enabled
* ``FeatureId`` filter, when used with any database table having a String primary key column and when prepared statements are disabled
* ``jsonArrayContains`` function, when used with a String or JSON field and with a PostGIS or Oracle DataStore (GeoServer 2.22.0+ only)
* ``DWithin`` filter, when used with an Oracle DataStore

### Patches

* GeoSever 2.21.4
* GeoServer 2.22.2
* GeoServer 2.20.7
* GeoServer 2.19.7
* GeoServer 2.18.7

### Workarounds

1. Disabling the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` vulnerabilities (Like filters have no mitigation, if there is a string field in the feature type published).
2. Enabling the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` vulnerability.

### References

* [OGC Filter SQL Injection Vulnerabilities](https://github.com/geotools/geotools/security/advisories/GHSA-99c3-qc2q-p94m) (GeoTools)
* [OGC Filter Injection Vulnerability Statement](https://geoserver.org/vulnerability/2023/02/20/ogc-filter-injection.html) (GeoServer Blog)
Stored cross site scripting in changedetection.io (GHSA-68wj-c2jw-5pp9)
Aliases: CVE-2023-24769
Published: 2023-02-18T00:31:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'changedetection.io'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.40.2'}]}]}]

Changedetection.io before 0.40.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter under the "Add a new change detection watch" function.
Cross-Site Request Forgery in XXL Job (GHSA-pv4m-h859-jwmq)
Aliases: CVE-2023-0674
Published: 2023-02-04T09:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.xuxueli:xxl-job'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.3.1'}]}]}]

A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-220196.
Broken Access Control in 3rd party TYPO3 extension "femanager" (GHSA-mm8v-wmqx-8h2j)
Aliases: CVE-2023-25013
Published: 2023-02-02T03:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'in2code/femanager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.5.3'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'in2code/femanager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.3.4'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'in2code/femanager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.1.0'}]}]}]

A missing access check in the `InvitationController` allows an unauthenticated user with a valid invitation link to set the password of all frontend users.
SameSite Attribute vulnerability in pimCore (GHSA-r2vq-p658-p274)
Aliases: CVE-2023-25240
Published: 2023-02-13T21:31:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.16'}]}]}]

An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.
Cross-site Scripting in UDX Stateless Media Plugin (GHSA-9j2p-8qqf-h55c)
Aliases: CVE-2022-4905
Published: 2023-02-13T21:31:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wpcloud/wp-stateless'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.0'}]}]}]

A vulnerability was found in UDX Stateless Media Plugin 3.1.1. It has been declared as problematic. This vulnerability affects the function setup_wizard_interface of the file lib/classes/class-settings.php. The manipulation of the argument settings leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 3.2.0 is able to address this issue. The name of the patch is 6aee7ae0b0beeb2232ce6e1c82aa7e2041ae151a. It is recommended to upgrade the affected component. VDB-220750 is the identifier assigned to this vulnerability.
Sling App CMS Cross-site Scripting vulnerability (GHSA-rghh-ghf7-7943)
Aliases: CVE-2023-22849
Published: 2023-02-04T21:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.sling:org.apache.sling.cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.6'}]}]}]

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in multiple features. Upgrade to Apache Sling App CMS >= 1.1.6
Improper Restriction of Excessive Authentication Attempts in modoboa (GHSA-q9ww-gjpw-p9g6)
Aliases: CVE-2023-0860
Published: 2023-02-16T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.4'}]}]}]

Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4.
Deserialization of Untrusted Data in thinkphp (GHSA-j2h2-g882-x9j2)
Aliases: CVE-2022-45982
Published: 2023-02-08T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'topthink/think'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '6.1.1'}]}]}]

thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
Symfony storing cookie headers in HttpCache (GHSA-h7vf-5wrv-9fhv)
Aliases: CVE-2022-24894
Published: 2023-02-01T18:48:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '4.4.50'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.4.20'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.20'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1.0'}, {'fixed': '6.1.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.2.0'}, {'fixed': '6.2.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '4.4.50'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.4.20'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.20'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1.0'}, {'fixed': '6.1.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.2.0'}, {'fixed': '6.2.6'}]}]}]

Description
-----------

The Symfony HTTP cache system acts as a reverse proxy: it caches HTTP responses (including headers) and returns them to clients.

In a recent `AbstractSessionListener` change, the response might now contain a `Set-Cookie` header. If the Symfony HTTP cache system is enabled, this header might be stored and returned to some other clients. An attacker can use this vulnerability to retrieve the victim's session.

Resolution
----------

The `HttpStore` constructor now takes a parameter containing a list of private headers that are removed from the HTTP response headers.
The default value for this parameter is `Set-Cookie`, but it can be overridden or extended by the application.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb) for branch 4.4.

Credits
-------

We would like to thank Soner Sayakci for reporting the issue and Nicolas Grekas for fixing it.
Cross-Site Request Forgery in Jenkins Azure Credentials Plugin (GHSA-rr93-7c6x-8v4v)
Aliases: CVE-2023-25767
Published: 2023-02-15T15:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:azure-credentials'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '253.v887e0f9e898b'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.
Denial of service vulnerability when parsing multipart request body (GHSA-p24m-863f-fm6q)
Aliases: CVE-2023-25578
Published: 2023-02-15T17:42:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'starlite'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.51.2'}]}]}]

### Summary

The request body parsing in `starlite` allows a potentially unauthenticated
 attacker to consume a large amount of CPU time and RAM.

### Details

The multipart body parser processes an unlimited number of file parts.
The multipart body parser processes an unlimited number of field parts.

### Impact

This is a remote, potentially unauthenticated Denial of Service vulnerability.

This vulnerability affects applications with a request handler that accepts
 a `Body(media_type=RequestEncodingType.MULTI_PART)`.

The large amount of CPU time required for processing requests can block all
 available worker processes and significantly delay or slow down the processing
 of legitimate user requests.
The large amount of RAM accumulated while processing requests can lead to
 Out-Of-Memory kills.
Complete DoS is achievable by sending many concurrent multipart requests in a
 loop.
MultipartParser denial of service with too many fields or files (GHSA-74m5-2c7w-9w3x)
Published: 2023-02-14T21:31:28Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'starlette'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.25.0'}]}]}]

### Impact

The `MultipartParser` using the package `python-multipart` accepts an unlimited number of multipart parts (form fields or files).

Processing too many parts results in high CPU usage and high memory usage, eventually leading to an <abbr title="out of memory">OOM</abbr> process kill.

This can be triggered by sending too many small form fields with no content, or too many empty files.

For this to take effect application code has to:

* Have `python-multipart` installed and
* call `request.form()`
  * or via another framework like FastAPI, using form field parameters or `UploadFile` parameters, which in turn calls `request.form()`.

### Patches

The vulnerability is solved in Starlette 0.25.0 by making the maximum fields and files customizable and with a sensible default (1000). 

Applications will be secure by just upgrading their Starlette version to 0.25.0 (or FastAPI to 0.92.0).

If application code needs to customize the new max field and file number, there are new `request.form()` parameters (with the default values):

* `max_files=1000`
* `max_fields=1000`

### Workarounds

Applications that don't install `python-multipart` or that don't use form fields are safe.

In older versions, it's also possible to instead of calling `request.form()` call `request.stream()` and parse the form data in internal code.

In most cases, the best solution is to upgrade the Starlette version.

### References

This was reported in private by @das7pad via internal email. He also coordinated the fix across multiple frameworks and parsers.

The details about how `multipart/form-data` is structured and parsed are in the [RFC 7578](https://www.rfc-editor.org/rfc/rfc7578).
Regular Expression Denial of Service in simple-markdown (GHSA-j533-2g8v-pmpg)
Aliases: CVE-2019-25102
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'simple-markdown'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.1'}]}]}]

A vulnerability, which was classified as problematic, was found in simple-markdown 0.6.0. Affected is an unknown function of the file simple-markdown.js. The manipulation with the input <<<<<<<<<<:/:/:/:/:/:/:/:/:/:/ leads to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 0.6.1 is able to address this issue. The name of the patch is 015a719bf5cdc561feea05500ecb3274ef609cd2. It is recommended to upgrade the affected component. VDB-220638 is the identifier assigned to this vulnerability.
Weak Password Requirements in thorsten/phpmyfaq (GHSA-fxrq-xhj9-rf5j)
Aliases: CVE-2023-0793
Published: 2023-02-12T15:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.11.