aswin1906/github-advisory-2023 huggingface dataset:
Reflected XSS in Gotify's /docs via import of outdated Swagger UI (GHSA-3244-8mff-w398)
Published: 2023-01-10T22:48:43Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gotify/server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.2.2'}}]

### Impact

Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files.

Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX.

An attacker can execute arbitrary JavaScript and potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify.

### Patches

The vulnerability has been fixed in version 2.2.3.

### References

https://github.com/gotify/server/pull/541
Kraken has arbitrary file read vulnerability via component testfs (GHSA-hj4g-4w36-x8hp)
Aliases: CVE-2022-47747
Published: 2023-01-20T18:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/uber/kraken'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.4'}]}]}]

kraken <= 0.1.4 has an arbitrary file read vulnerability via the component `testfs`.
ruby-git has potential remote code execution vulnerability (GHSA-pfpr-3463-c6jh)
Aliases: CVE-2022-46648
Published: 2023-01-09T21:55:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'git'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.13.0'}]}]}]

The git gem, between versions 1.2.0 and 1.12.0, incorrectly parsed the output of the `git ls-files` command using `eval()` to unescape quoted file names. If a file name was added to the git repository contained special characters, such as `\n`, then the `git ls-files` command would print the file name in quotes and escape any special characters. If the `Git#ls_files` method encountered a quoted file name it would use `eval()` to unquote and unescape any special characters, leading to potential remote code execution. Version 1.13.0 of the git gem was released which correctly parses any quoted file names.
CakePHP vulnerable to Cross-site Scripting in some development error pages (GHSA-xwhj-pqcg-8rcr)
Published: 2023-01-20T23:35:17Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.4.0'}, {'fixed': '3.4.14'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.5.0'}, {'fixed': '3.5.17'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.6.0'}, {'fixed': '3.6.4'}]}]}]

CakePHP 3.4 prior to 3.4.14, 3.5 prior to 3.5.17, and 3.6 prior to 3.6.4 contains a cross-site-scripting (XSS) vulnerability in the development only `missing route` and `duplicate named route` error pages.
a12nserver vulnerable to potential SQL Injections via Knex dependency (GHSA-crhg-xgrg-vvcc)
Published: 2023-01-13T21:34:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@curveball/a12n-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.20.0'}, {'fixed': '0.23.0'}]}]}]

### Impact

Users of a12nserver that use MySQL might be vulnerable to SQL injection bugs. 

If you use a12nserver and MySQL, update as soon as possible. This SQL injection bug might let an attacker obtain OAuth2 Access Tokens for users unrelated to those that permitted OAuth2 clients.

### Patches

The knex dependency has been updated to 2.4.0 in a12nserver 0.23.0

### Workarounds

No further workarounds

### References

* https://github.com/knex/knex/issues/1227
* https://nvd.nist.gov/vuln/detail/CVE-2016-20018
* https://www.ghostccamm.com/blog/knex_sqli/
Pyload Insufficient Session Expiration vulnerability (GHSA-rv9x-wmw4-44qj)
Aliases: CVE-2023-0227
Published: 2023-01-12T03:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyload-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0b3.dev36'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.5.0b3.dev35'}}]

Pyload 0.5.0b3.dev35 has an Insufficient Session Expiration vulnerability. A patch is available and anticipated to be part of version 0.5.0b3.dev36.
ExifTool vulnerable to arbitrary code execution (GHSA-q95h-cqrv-8jv5)
Published: 2023-01-20T19:33:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'exiftool_vendored'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.25.0'}]}]}]

### Impact
Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads

### Patches
ExifTool has already been patched in version 12.24. `exiftool_vendored.rb`, which vendors ExifTool, includes this patch in [v12.25.0](https://github.com/exiftool-rb/exiftool_vendored.rb/releases/tag/v12.25.0).

### Workarounds
No

### References
https://twitter.com/wcbowling/status/1385803927321415687
https://nvd.nist.gov/vuln/detail/CVE-2021-22204

### For more information
If you have any questions or comments about this advisory:

Open an issue in [exiftool_vendored.rb](https://github.com/exiftool-rb/exiftool_vendored.rb/issues)
Apache Superset Open Redirect vulnerability (GHSA-fcg4-pm6h-9xx2)
Aliases: CVE-2022-43721
Published: 2023-01-16T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'versions': ['2.0.0']}]

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Code injection in electerm (GHSA-x73w-g8hx-v7rp)
Aliases: CVE-2020-23256
Published: 2023-01-20T21:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'electerm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3.22'}]}]}]

An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.
dssp vulnerable to Improper Restriction of XML External Entity Reference (GHSA-77cc-w3wm-6whp)
Aliases: CVE-2016-15011
Published: 2023-01-06T12:31:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'be.e_contract.dssp:dssp-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.2'}]}]}]

A vulnerability classified as problematic was found in e-Contract dssp up to 1.3.1. Affected by this vulnerability is the function `checkSignResponse` of the file `dssp-client/src/main/java/be/e_contract/dssp/client/SignResponseVerifier.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.3.2 can address this issue. The name of the patch is ec4238349691ec66dd30b416ec6eaab02d722302. It is recommended to upgrade the affected component. The identifier VDB-217549 was assigned to this vulnerability.
@builder.io/qwik vulnerable to Cross-site Scripting (GHSA-hm7f-rq7q-j9xp)
Aliases: CVE-2023-0410
Published: 2023-01-20T03:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@builder.io/qwik'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.2'}]}]}]

@builder.io/qwik prior to version 0.16.2 is vulnerable to cross-site scripting due to attribute names and the class attribute values not being properly handled.
Apache Superset has Improper Access Control (GHSA-8f5j-mgx9-5hm5)
Aliases: CVE-2022-45438
Published: 2023-01-16T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'versions': ['2.0.0']}]

When explicitly enabling the feature flag `DASHBOARD_CACHE` (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
global-modules-path Command Injection vulnerability (GHSA-vvj3-85vf-fgmw)
Aliases: CVE-2022-21191
Published: 2023-01-13T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'global-modules-path'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0'}]}]}]

Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
Missing permission checks in Jenkins GitHub Pull Request Builder Plugin (GHSA-w4v5-54p8-m4j5)
Aliases: CVE-2023-24435
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:ghprb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.42.2'}]}]}]

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Duplicate Advisory: Keycloak allows impersonation and lockout due to email trust not being handled correctly (GHSA-vhvq-jh34-3fc8)
Published: 2023-01-13T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '20.0.2'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-c7xw-p58w-h6fj. This link is maintained to preserve external references. 

## Original Description
A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.
Fix for arbitrary file deletion in customer media allows for remote code execution (GHSA-5vpv-xmcj-9q85)
Aliases: CVE-2021-41143
Published: 2023-01-27T00:54:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.4.22'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '20.0.0'}, {'fixed': '20.0.19'}]}]}]

### Impact
Magento admin users with access to the customer media could execute code on the server.
phpMyFAQ Improper Authentication vulnerability (GHSA-g92r-9rxw-cmgx)
Aliases: CVE-2023-0311
Published: 2023-01-16T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Improper Authentication in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Apache James server allows an attacker with local access to access private user data in transit (GHSA-v6vp-62vc-84qw)
Aliases: CVE-2022-45935
Published: 2023-01-06T12:31:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.james:james-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.7.2'}]}]}]

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions.
Inline SVG vulnerable to Cross-site Scripting (GHSA-p33q-4h4m-j994)
Aliases: CVE-2020-36644
Published: 2023-01-07T12:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'inline_svg'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.2'}]}]}]

A vulnerability has been found in jamesmartin Inline SVG up to 1.7.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file `lib/inline_svg/action_view/helpers.rb` of the component `URL Parameter Handler`. The manipulation of the argument filename leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.7.2 is able to address this issue. The name of the patch is f5363b351508486021f99e083c92068cf2943621. It is recommended to upgrade the affected component. The identifier VDB-217597 was assigned to this vulnerability.
Improper Certificate Validation in pyload-ng (GHSA-8v53-23mx-hcf9)
Aliases: CVE-2023-0509
Published: 2023-01-27T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyload-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0b3.dev44'}]}]}]

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.
Apache Shiro Interpretation Conflict vulnerability (GHSA-7cxr-h8wm-fg4c)
Aliases: CVE-2023-22602
Published: 2023-01-14T12:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.shiro:shiro-root'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.0'}]}]}]

When using Apache Shiro before 1.11.0 together with Spring Boot 2.6+, a specially crafted HTTP request may cause an authentication bypass. The authentication bypass occurs when Shiro and Spring Boot are using different pattern-matching techniques. Both Shiro and Spring Boot < 2.6 default to Ant style pattern matching. Mitigation: Update to Apache Shiro 1.11.0, or set the following Spring Boot configuration value: `spring.mvc.pathmatch.matching-strategy = ant_path_matcher`
Froxlor contains Weak Password Requirements (GHSA-pm72-27mg-fc28)
Aliases: CVE-2023-0564
Published: 2023-01-29T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.10'}]}]}]

Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
mercurius has Uncaught Exception when using subscriptions (GHSA-cm8h-q92v-xcfc)
Aliases: CVE-2023-22477
Published: 2023-01-09T21:55:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'mercurius'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '11.5.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'mercurius'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.13.2'}]}]}]

### Impact

Any users of Mercurius until version v11.5.0 are subjected to a denial of service attack by sending a malformed packet over WebSocket to `/graphql`.

### Patches

This was patched in https://github.com/mercurius-js/mercurius/pull/940.
The patch was released as v11.5.0 and v8.13.2.

### Workarounds

Disable subscriptions.

### References

Reported publicly as https://github.com/mercurius-js/mercurius/issues/939.
The same problem was solved in https://github.com/fastify/fastify-websocket/pull/228
Parse Server option `masterKeyIps` vulnerability to IP spoofing (GHSA-vm5r-c87r-pf6x)
Aliases: CVE-2023-22474
Published: 2023-01-31T22:21:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'parse-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.4.1'}]}]}]

### Impact

Parse Server uses the request header `x-forwarded-for` to determine the client IP address. If Parse Server doesn't run behind a proxy server, then a client can set this header and Parse Server will trust the value of the header. The incorrect client IP address will be used by various features in Parse Server. This allows to circumvent the security mechanism of the Parse Server option `masterKeyIps` by setting an allowed IP address as the `x-forwarded-for` header value.

### Patches

The mechanism to determine the client IP address has been rewritten. The correct IP address determination now requires to set the Parse Server option `trustProxy` accordingly, see the express framework's [trust proxy](https://expressjs.com/en/guide/behind-proxies.html) setting.

### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-vm5r-c87r-pf6x
- https://expressjs.com/en/guide/behind-proxies.html
phpMyFAQ Stored Cross-site Scripting vulnerability (GHSA-25c3-7fvj-v45j)
Aliases: CVE-2023-0309
Published: 2023-01-16T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Sisimai Inefficient Regular Expression Complexity vulnerability (GHSA-vm74-j4wq-82xj)
Aliases: CVE-2022-4891
Published: 2023-01-17T21:30:22Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'sisimai'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.25.14p12'}]}]}]

A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function `to_plain` of the file `lib/sisimai/string.rb`. The manipulation leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. Upgrading to version 4.25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218452.
MITM based Zip Slip in `org.hl7.fhir.publisher:org.hl7.fhir.publisher` (GHSA-xr8x-pxm6-prjg)
Published: 2023-01-23T22:04:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.hl7.fhir.publisher:org.hl7.fhir.publisher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.30'}]}]}]

### Impact
MITM can enable Zip-Slip.

### Vulnerability

#### Vulnerability 1: `Publisher.java`

There is no validation that the zip file being unpacked has entries that are not maliciously writing outside of the intended destination directory.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/Publisher.java#L3598-L3610

#### Vulnerability 2: `WebSourceProvider.java`

There is a check for malicious zip entries here, but it is not covered by test cases and could potentially be reverted in future changes.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/web/WebSourceProvider.java#L104-L112

#### Vulnerability 3: `ZipFetcher.java`

This retains the path for Zip files in FetchedFile entries, which could later be used to output malicious entries to another compressed file or file system.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/ZipFetcher.java#L57-L106

#### Vulnerability 4: `IGPack2NpmConvertor.java`

The loadZip method retains the path for entries in the zip file, which could later be used to output malicious entries to another compressed file or file system.

https://github.com/HL7/fhir-ig-publisher/blob/87313e92de6dd6cea816449e0edd225e054a7891/org.hl7.fhir.publisher.core/src/main/java/org/hl7/fhir/igtools/publisher/IGPack2NpmConvertor.java#L442-L463
skeemas Inefficient Regular Expression Complexity vulnerability (GHSA-qv66-f876-vjvr)
Aliases: CVE-2018-25074
Published: 2023-01-11T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'skeemas'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.5'}]}]}]

A vulnerability was found in Prestaul skeemas and classified as problematic. This issue affects some unknown processing of the file validators/base.js. The manipulation of the argument uri leads to inefficient regular expression complexity. The name of the patch is 65e94eda62dc8dc148ab3e59aa2ccc086ac448fd. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218003.
Invalid push request payload crashes Parse Server (GHSA-mxhg-rvwx-x993)
Aliases: CVE-2023-32688
Published: 2023-05-22T19:50:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'parse-server-push-adapter'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.3'}]}]}]

### Impact

The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.

### Patches

Invalid push notification payload is caught and an logged.

### Workarounds
n/a

### References
- https://github.com/parse-community/parse-server-push-adapter/security/advisories/GHSA-mxhg-rvwx-x993
- https://github.com/parse-community/parse-server-push-adapter/pull/217
Jenkins SAML Single Sign On(SSO) Plugin unconditionally disables SSL/TLS certificate validation (GHSA-9m92-qwpc-qm78)
Aliases: CVE-2023-32994
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:miniorange-saml-sp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.0'}]}]}]

Jenkins SAML Single Sign On(SSO) Plugin 2.1.0 and earlier unconditionally disables SSL/TLS certificate validation for connections to miniOrange or the configured IdP to retrieve SAML metadata.

This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

SAML Single Sign On(SSO) Plugin 2.2.0 performs SSL/TLS certificate validation when connecting to miniOrange or the configured IdP to retrieve SAML metadata.
Jenkins Azure VM Agents Plugin missing permission checks (GHSA-q77x-cxrq-988j)
Aliases: CVE-2023-32988
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:azure-vm-agents'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '853.v4a'}]}]}]

Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Azure VM Agents Plugin 853.v4a_1a_dd947520 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Jenkins WSO2 Oauth Plugin cross-site request forgery vulnerability (GHSA-7xgj-j9hp-c692)
Aliases: CVE-2023-33006
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:wso2id-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0'}]}]}]

Jenkins WSO2 Oauth Plugin 1.0 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request. 

This vulnerability allows attackers to trick users into logging in to the attacker’s account.

As of publication of this advisory, there is no fix.
Jenkins Pipeline: Job Plugin vulnerable to stored Cross-site Scripting (GHSA-2wvv-phhw-qvmc)
Aliases: CVE-2023-32977
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins.workflow:workflow-job'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1295.v395eb'}]}]}]

Jenkins Pipeline: Job Plugin 1292.v27d8cc3e2602 and earlier does not escape the display name of the build that caused an earlier build to be aborted, when "Do not allow concurrent builds" is set.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to set build display names immediately.

The Jenkins security team is not aware of any plugins that allow the exploitation of this vulnerability, as the build name must be set before the build starts.
Pipeline: Job Plugin 1295.v395eb_7400005 escapes the display name of the build that caused an earlier build to be aborted.
Synapse Denial of service due to incorrect application of event authorization rules during state resolution (GHSA-p9qp-c452-f9r7)
Aliases: CVE-2022-39374
Published: 2023-05-24T17:21:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'matrix-synapse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.62.0'}, {'fixed': '1.68.0'}]}]}]

### Impact
If Synapse and a malicious homeserver are both joined to the same room, the malicious homeserver can trick Synapse into accepting previously rejected events into its view of the current state of that room. This can be exploited in a way that causes all further messages and state changes sent in that room from the vulnerable homeserver to be rejected.

Synapse homeservers are affected by this issue if and only if they are joined to rooms which members of untrusted homeservers are joined or invited to. 

- Synapse homeservers in rooms available over public federation **are** affected.
- Synapse homeservers with federation disabled are not affected.
- Synapse homeservers in a closed federation containing only trusted servers are not affected.
- Synapse homeservers which are only joined to rooms with federation disabled[^1] are not affected.

### Patches
Administrators of homeservers with federation enabled are advised to upgrade to 1.68.0 or higher.

### Workarounds
 * Federation can be disabled by setting [`federation_domain_whitelist`](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#federation_domain_whitelist) to an empty list (`[]`). from the vulnerable homeserver to be rejected. This issue has been patched in version 1.68.0

### References
- https://github.com/matrix-org/synapse/pull/13723

[^1]: See `m.federate` in the [`m.room.create` definition](https://spec.matrix.org/v1.4/client-server-api/#mroomcreate).

### For more information

If you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).
jsreport vulnerable to code injection (GHSA-g7rj-q722-245g)
Aliases: CVE-2023-2583
Published: 2023-05-08T18:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'jsreport'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.11.3'}]}]}]

jsreport prior to 3.11.3 had a version of vm2 vulnerable to CVE-2023-29017 hard coded in the package.json of the jsreport-core component. An attacker can use this vulnerability to obtain the authority of the jsreport playground server, or construct a malicious webpage/html file and send it to the user to attack the installed jsreport client.
n8n Information Disclosure vulnerability (GHSA-r9xw-p7wj-w792)
Aliases: CVE-2023-27564
Published: 2023-05-10T15:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'n8n'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.216.1'}]}]}]

The n8n package prior to 0.216.1 for Node.js allows Information Disclosure.
Pimcore Cross-site Scripting vulnerability (GHSA-q3p4-v2cm-q945)
Aliases: CVE-2023-2730
Published: 2023-05-16T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.3.3'}]}]}]

Pimcore prior to 10.3.3 is vulnerable to stored cross-site scripting at the `Title field` in `SEO & Settings` tab of `Document`.
html inputs of type password recorded in plaintext when converted to text inputs (GHSA-9qpj-qq2r-5mcc)
Aliases: CVE-2023-33187
Published: 2023-05-26T13:52:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'highlight.run'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.0'}]}]}]

### Impact
Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `type="password"` inputs. A customer may assume that switching to `type="text"` would also not record this input; hence, they would not add additional `highlight-mask` css-class obfuscation to this part of the DOM, resulting in unintentional recording of a password value when a `Show Password` button is used.

### Patches
`highlight.run@6.0.0` resolves the issue via https://github.com/rrweb-io/rrweb/pull/1184
This patch tracks changes to the `type` attribute of an input to ensure an input that used to be a `type="password"` continues to be obfuscated. 

### Workarounds
We have deployed a change to our data ingest to obfuscate passwords server side from older clients.
This means that upgrading to the latest version of highlight.run is not necessary but recommended to prevent potential network transfer of recorded password data to our backend.

### References
https://github.com/rrweb-io/rrweb/pull/1184
Double spend in snarkjs (GHSA-xp5g-jhg3-3rg2)
Aliases: CVE-2023-33252
Published: 2023-05-22T00:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'snarkjs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.6.11'}]}]}]

iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus.
Spring Boot Welcome Page Denial of Service (GHSA-xf96-w227-r7c4)
Aliases: CVE-2023-20883
Published: 2023-05-26T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.boot:spring-boot-autoconfigure'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.boot:spring-boot-autoconfigure'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.12'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.boot:spring-boot-autoconfigure'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.15'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.boot:spring-boot-autoconfigure'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.15'}]}]}]

In Spring Boot versions 3.0.0 - 3.0.6, 2.7.0 - 2.7.11, 2.6.0 - 2.6.14, 2.5.0 - 2.5.14 and older unsupported versions, there is potential for a denial-of-service (DoS) attack if Spring MVC is used together with a reverse proxy cache.

Specifically, an application is vulnerable if all of the conditions are true:

* The application has Spring MVC auto-configuration enabled. This is the case by default if Spring MVC is on the classpath.
* The application makes use of Spring Boot's welcome page support, either static or templated.
* Your application is deployed behind a proxy which caches 404 responses.

Your application is NOT vulnerable if any of the following are true:

* Spring MVC auto-configuration is disabled. This is true if WebMvcAutoConfiguration is explicitly excluded, if Spring MVC is not on the classpath, or if spring.main.web-application-type is set to a value other than SERVLET.
* The application does not use Spring Boot's welcome page support.
* You do not have a proxy which caches 404 responses.


Affected Spring Products and Versions

Spring Boot

3.0.0 to 3.0.6 2.7.0 to 2.7.11 2.6.0 to 2.6.14 2.5.0 to 2.5.14

Older, unsupported versions are also affected
Mitigation

Users of affected versions should apply the following mitigations:

* 3.0.x users should upgrade to 3.0.7+
* 2.7.x users should upgrade to 2.7.12+
* 2.6.x users should upgrade to 2.6.15+
* 2.5.x users should upgrade to 2.5.15+

Users of older, unsupported versions should upgrade to 3.0.7+ or 2.7.12+.

Workarounds: configure the reverse proxy not to cache 404 responses and/or not to cache responses to requests to the root (/) of the application.
Mutagen list and monitor operations do not neutralize control characters in text controlled by remote endpoints (GHSA-jmp2-wc4p-wfh2)
Aliases: CVE-2023-30844
Published: 2023-05-05T02:25:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mutagen-io/mutagen'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.6'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mutagen-io/mutagen-compose'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mutagen-io/mutagen'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.17.0'}, {'fixed': '0.17.1'}]}]}]

### Impact

Mutagen command line operations, as well as the log output from `mutagen daemon run`, are susceptible to control characters that could be provided by remote endpoints.  This can cause terminal corruption, either intentional or unintentional, if these characters are present in error messages, file paths/names, and/or log output.  This could be used as an attack vector if synchronizing with an untrusted remote endpoint, synchronizing files not under control of the user, or forwarding to/from an untrusted remote endpoint.  On very old systems with terminals susceptible to issues such as [CVE-2003-0069](https://nvd.nist.gov/vuln/detail/CVE-2003-0069), the issue could theoretically cause code execution.


### Patches

The problem has been patched in Mutagen v0.16.6 and v0.17.1.  Earlier versions of Mutagen are no longer supported and will not be patched.  Versions of Mutagen after v0.18.0 will also have the patch merged.

One caveat is that the templating functionality of Mutagen's `list` and `monitor` commands has been only partially patched.  In particular, the `json` template function already provided escaping and no patching was necessary.  However, raw template output has been left unescaped because this raw output may be necessary for commands which embed Mutagen.  To aid these commands, a new `shellSanitize` template function has been added which provides control character neutralization in strings.


### Workarounds

Avoiding synchronization of untrusted files or interaction with untrusted remote endpoints should mitigate any risk.


### References

A similar issue can be seen in kubernetes/kubernetes#101695.
n8n Privilege Escalation vulnerability (GHSA-97cp-mr4m-9mcf)
Aliases: CVE-2023-27563
Published: 2023-05-10T15:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'n8n'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.216.1'}]}]}]

The n8n package prior to 0.216.1 for Node.js allows Escalation of Privileges.
swift-nio-http2 vulnerable to denial of service via mishandled HPACK variable length integer encoding (GHSA-w3f6-pc54-gfw7)
Aliases: CVE-2022-24667
Published: 2023-05-18T17:28:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio-http2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.19.2'}]}]}]

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HPACK-encoded header block. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. It is fixed in 1.19.2 and later releases.

There are a number of implementation errors in the parsing of HPACK-encoded header blocks that allow maliciously crafted HPACK header blocks to cause crashes in processes using swift-nio-http2. Each of these crashes is triggered instead of an integer overflow.

A malicious HPACK header block could be sent on any of the HPACK-carrying frames in a HTTP/2 connection (HEADERS and PUSH_PROMISE), at any position.

Sending a HPACK header block does not require any special permission, so any HTTP/2 connection peer may send one. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack.

The attack is low-effort: it takes very little resources to send an appropriately crafted field block. The impact on availability is high: receiving a frame carrying this field block immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted field blocks, so attackers require very few resources to achieve a substantial denial of service.

The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the field block in memory-safe code and the crash is triggered instead of an integer overflow. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks.

The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services.

The issue is fixed by rewriting the parsing code to correctly handle all conditions in the function. The principal issue was found by automated fuzzing by oss-fuzz, but several associated bugs in the same code were found by code audit and fixed at the same time.
Pimcore Cross-site Scripting (XSS) in name field of Custom Reports (GHSA-m6m9-gr85-79vm)
Aliases: CVE-2023-2614
Published: 2023-05-10T21:26:32Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.21 or apply this patch manually:
https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7.patch

### Workarounds
Apply patches manually:
https://github.com/pimcore/pimcore/commit/c36ef54ce33f7b5e74b7b0ab9eabfed47c018fc7.patch

### References
https://huntr.dev/bounties/1a5e6c65-2c5e-4617-9411-5b47a7e743a6/
Vert.x STOMP server process client frames that would not send initially a connect frame (GHSA-gvrq-cg5r-7chp)
Aliases: CVE-2023-32081
Published: 2023-05-12T20:20:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.vertx:vertx-stomp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.9.16'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'io.vertx:vertx-stomp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.4.2'}]}]}]

### Impact
A Vert.x STOMP server processes client STOMP frames without checking that the client send an initial CONNECT frame replied with a successful CONNECTED frame. The client can subscribe to a destination or publish message without prior authentication. Any Vert.x STOMP server configured with an authentication handler is impacted.

### Patches
The issue is patched in Vert.x 4.4.2 and Vert.x 3.9.16

### Workarounds
No trivial workaround.
Answer Missing Authorization vulnerability (GHSA-qmqw-r4x6-3w2q)
Aliases: CVE-2023-2590
Published: 2023-05-09T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.9'}]}]}]

A missing authorization in GitHub repository answerdev/answer prior to 1.0.9 can lead to a user rating their own answer as the best answer.
github.com/ipfs/kubo affected by DOS Bitswap unbounded persistent memory leak (GHSA-qvqg-6rp8-4p9h)
Published: 2023-05-11T20:40:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ipfs/kubo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.19.0'}]}]}]

### Impact
An attacker is able allocate arbitrarily many bytes in the Bitswap server by sending many `WANT_BLOCK` and or `WANT_HAVE` requests which are queued in an unbounded queue, with allocations that persist even if the connection is closed.

This affects users accepting or connecting untrusted connections such as by running in the public swarm and no pnet config.
Nodes that are not publicly reachable but connects to untrusted nodes are also vulnerable to the untrusted nodes being connected to since libp2p connections are blindly bidirectional.

### Patches
- 19feb15833c6f4d6e7f1e1b132efaae96d76481d [`boxo`](https://github.com/ipfs/boxo) update in Kubo
- GHSA-m974-xj4j-7qv5 patches in boxo

### Workarounds

Use [PNET](https://github.com/ipfs/kubo/blob/master/docs/experimental-features.md#private-networks), [swarm filters](https://github.com/ipfs/kubo/blob/master/docs/config.md#swarmaddrfilters) or [resource manager allows list](https://pkg.go.dev/github.com/libp2p/go-libp2p/p2p/host/resource-manager#readme-allowlisting-multiaddrs-to-mitigate-eclipse-attacks) to block untrusted connections.

Note that using the resource manager will disrupt both client and server features because the bitswap protocol is a message based protocol mixing requests and responses.

### References
- GHSA-m974-xj4j-7qv5
- [CVE-2023-25568](https://nvd.nist.gov/vuln/detail/CVE-2023-25568)
Jenkins NS-ND Integration Performance Publisher Plugin displays credentials without masking (GHSA-gqxr-hvrw-6hfh)
Aliases: CVE-2023-33000
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:cavisson-ns-nd-integration'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.11.0.48'}]}]}]

Jenkins NS-ND Integration Performance Publisher Plugin stores credentials in job config.xml files on the Jenkins controller as part of its configuration.

While these credentials are stored encrypted on disk, in NS-ND Integration Performance Publisher Plugin 4.8.0.149 and earlier, the job configuration form does not mask these credentials, increasing the potential for attackers to observe and capture them.

NS-ND Integration Performance Publisher Plugin 4.11.0.48 masks credentials displayed on the configuration form.
Jenkins Code Dx Plugin displays API keys in plain text (GHSA-352v-hhmh-2w8h)
Aliases: CVE-2023-2633
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:codedx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Jenkins Code Dx Plugin 3.1.0 and earlier stores Code Dx server API keys unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These API keys can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these API keys, increasing the potential for attackers to observe and capture them.

Code Dx Plugin 4.0.0 no longer stores the API keys directly, instead accessing them through its newly added Credentials Plugin integration. Affected jobs need to be reconfigured.
n158 vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function (GHSA-549h-r7g9-2qpf)
Aliases: CVE-2023-26127
Published: 2023-05-27T06:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'n158'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.1'}]}]}]

All versions of the package n158 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports' function.

**Note:**

To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment.