aswin1906/github-advisory-2023 huggingface dataset:
Pixelfed may allow unauthorized actor to view private posts (GHSA-qh6w-pq52-qxxq)
Aliases: CVE-2023-0914
Published: 2023-02-19T03:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pixelfed/pixelfed'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.11.4'}]}]}]

Improper Authorization in GitHub repository pixelfed/pixelfed 0.11.4 and prior.
MongoDB .NET/C# Driver vulnerable to Deserialization of Untrusted Data (GHSA-7j9m-j397-g4wx)
Aliases: CVE-2022-48282
Published: 2023-02-21T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'MongoDB.Driver'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.19.0'}]}]}]

Under very specific circumstances, a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0
wallabag contains Improper Authorization via export feature (GHSA-qwx8-mxxx-mg96)
Aliases: CVE-2023-0609
Published: 2023-02-02T19:26:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-alpha.1'}, {'fixed': '2.5.3'}]}]}]

# Description

The export feature lets a user export a single entry or a set of entries in a given format (_e.g. PDF, MOBI, TXT_).

For example, `https://yourinstance.wallabag.org/export/45.pdf` will export the entry with id 45 in PDF format.

Since wallabag 2.0.0-alpha.1, this feature is vulnerable to an insecure direct object reference attack. A logged user can export any single entry without ownership validation.

This is due to a lack of access validation in the `downloadEntryAction` method.

**You should immediately patch your instance to version 2.5.3 or higher if you have more than one user and/or having open registration.**

# Resolution

A user check is now done in the vulnerable method before sending the exported entry.

The `Entry` retrieval through a `ParamConverter` has also been replaced with a call to the `EntryRepository` in order to prevent any information disclosure through response discrepancy.

# Workaround

If you are unable to update to the latest version or if you want to temporarily limit risk of exploitation, you may consider blocking requests to the endpoint `/export/*`.

E.g. with nginx:

``` nginx
    location /export {
        deny all;
    }
```

# Credits

We would like to thank @bAuh0lz for reporting this issue through huntr.dev.

Reference: https://www.huntr.dev/bounties/3adef66f-fc86-4e6d-a540-2ffa59342ff0/
OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting (GHSA-mjv2-6jv4-vrg7)
Aliases: CVE-2023-0867
Published: 2023-02-23T15:33:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '31.0.4'}]}]}]

Multiple stored and reflected cross-site scripting vulnerabilities in webapp jsp pages in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to confidential session information.
Incorrect parsing of nameless cookies leads to __Host- cookies bypass (GHSA-px8h-6qxv-m22q)
Aliases: CVE-2023-23934
Published: 2023-02-15T15:37:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Werkzeug'}, 'ecosystem_specific': {'affected_functions': ['werkzeug.http.parse_cookie']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.3'}]}]}]

Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.

Werkzeug <= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.
Privilege escalation in Apache ShenYu (GHSA-vf8h-2wwj-jq22)
Aliases: CVE-2022-42735
Published: 2023-02-15T12:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.shenyu:shenyu-admin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.1'}]}]}]

Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu. ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own. This issue affects Apache ShenYu: 2.5.0. Upgrade to Apache ShenYu 2.5.1 or apply patch https://github.com/apache/shenyu/pull/3958.
Uncontrolled Resource Consumption in golang.org/x/image (GHSA-qgc7-mgm3-q253)
Aliases: CVE-2022-41727
Published: 2023-02-17T13:59:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'golang.org/x/image'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0'}]}]}]

An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of service.
Arbitrary file deletion in ureport (GHSA-6fcj-9vfw-jq2m)
Aliases: CVE-2023-24188
Published: 2023-02-13T21:31:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.bstek.ureport:ureport2-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.9'}]}]}]

ureport v2.2.9 was discovered to contain an arbitrary file deletion vulnerability.
modoboa Cross-site Scripting vulnerability (GHSA-mgmm-cmhj-2h5f)
Aliases: CVE-2023-0949
Published: 2023-02-22T09:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.5'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.45.
Arbitrary code execution in de.tum.in.ase:artemis-java-test-sandbox (GHSA-98hq-4wmw-98w9)
Published: 2023-02-10T23:52:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'de.tum.in.ase:artemis-java-test-sandbox'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.2'}]}]}]

### Summary
Because of the missing `checkLink(String)` override in the SecurityManager, students can load libraries and execute arbitrary code.

### Details
Using `System.load(String)` or `System.loadLibrary​(String)` students can load and execute arbitrary code.

```java
private static native void start(List<String> args);

public static void main(String[] args) {
  System.load(new File("path_to_lib.so").getAbsolutePath());
  start(List.of(args));
}
```

Adding this to the security manager (and a translation) should fix the issue:
```java
@Override
public void checkExec(String cmd) {
  try {
    if (enterPublicInterface())
      return;
    throw new SecurityException(localized("security.error_link")); //$NON-NLS-1$
  } finally {
    exitPublicInterface();
  }
}
```

### PoC
See details.

### Impact
Arbitrary code execution.
Cross-site Scripting in Jenkins JUnit Plugin (GHSA-ph74-8rgx-64c5)
Aliases: CVE-2023-25761
Published: 2023-02-15T15:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:junit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1166.va'}]}]}]

Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control test case class names in the JUnit resources processed by the plugin.
wallabag subject to Improper Authorization via annotations (GHSA-mrqx-mjc4-vfh3)
Aliases: CVE-2023-0610
Published: 2023-02-02T19:26:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-beta.1'}, {'fixed': '2.5.3'}]}]}]

### Impact
The annotations feature lets users add annotations on highlighted parts of an entry.

The controller does not validate authorization on `PUT` and `DELETE` requests which lets a logged user modify or delete any annotation using their ID on their endpoints `example.org/annotations/{id}`.

These vulnerable requests also disclose highlighted parts of the entry to the attacker.

You should immediately patch your instance to version 2.5.3 or higher if you have more than one user and/or having open registration.

### Resolution

A user check is now done in the vulnerable methods before applying change on an annotation.

The Annotation retrieval through a `ParamConverter` has also been replaced with a call to the `AnnotationRepository` in order to prevent any information disclosure through response discrepancy.

### Workarounds



### Credits

We would like to thank @bAuh0lz for reporting this issue through huntr.dev.

Reference: https://huntr.dev/bounties/8fdd9b31-d89b-4bbe-9557-20b960faf926/
Panic due to malformed WALs in go.etcd.io/etcd (GHSA-p4g4-wgrh-qrg2)
Aliases: CVE-2020-15106
Published: 2023-02-07T22:59:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/etcd-io/etcd/wal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.10'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'go.etcd.io/etcd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0-alpha.5.0.20200423152442-f4b650b51dc4'}]}]}]

### Vulnerability type
Data Validation

### Detail
The size of a record is stored in the length field of a WAL file and no additional validation is done on this data. Therefore, it is possible to forge an extremely large frame size that can unintentionally panic at the expense of any RAFT participant trying to decode the WAL.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)
Server-Side Request Forgery in Plone CMS (GHSA-47p5-p3jw-w78w)
Aliases: CVE-2021-33926
Published: 2023-02-17T18:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Plone'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3'}, {'fixed': '5.2.5'}]}]}]

An issue in Plone CMS allows attacker to access sensitive information via the RSS feed protlet.
User data in TPM attestation vulnerable to MITM (GHSA-r2h5-3hgw-8j34)
Published: 2023-02-17T20:51:24Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/edgelesssys/constellation/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.5.1'}}]

### Impact
Attestation *user data* (such as the digest of the public key in an aTLS connection) was bound to the issuer's TPM, but not to its PCR state. An attacker could intercept a node initialization, initialize the node themselves, and then impersonate an uninitialized node to the validator. In practice, this meant that a CSP insider with sufficient privileges would have been able to join a node under their control to a Constellation cluster.

### Patches
The issue has been patched in [v2.5.2](https://github.com/edgelesssys/constellation/releases/tag/v2.5.2).

### Workarounds
none
Code injection in pdf_info (GHSA-9fh3-j99m-f4v7)
Aliases: CVE-2022-36231
Published: 2023-02-24T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'pdf_info'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.5.3'}]}]}]

pdf_info 0.5.3 is vulnerable to Command Execution. An attacker using a specially crafted payload may execute OS commands by using command chaining because during object initalization there is no validation performed and the user provided path is used.
Pixelfed allows user enumeration via reset password functionality (GHSA-vjxx-jgcx-9fq2)
Aliases: CVE-2023-0901
Published: 2023-02-18T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pixelfed/pixelfed'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.11.4'}]}]}]

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pixelfed/pixelfed 0.11.4 and prior.
Microweber Cross-site Scripting vulnerability (GHSA-c2rc-8m9f-g4fh)
Aliases: CVE-2023-1081
Published: 2023-02-28T03:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3.2'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber 1.3.2 and prior. A patch is available and anticipated to be part of version 1.3.3.
@claviska/jquery-minicolors vulnerable to Cross-site Scripting (GHSA-crh5-vv2v-c82q)
Aliases: CVE-2021-32850
Published: 2023-02-21T00:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@claviska/jquery-minicolors'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.6'}]}]}]

jQuery MiniColors is a color picker built on jQuery. Prior to version 2.3.6, jQuery MiniColors is prone to cross-site scripting when handling untrusted color names. This issue is patched in version 2.3.6.
MrSwitch hello.js vulnerable to prototype pollution (GHSA-g3vf-47fv-8f3c)
Aliases: CVE-2021-26505
Published: 2023-08-11T15:30:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'hellojs'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.18.8'}]}]}]

A prototype pollution vulnerability in MrSwitch hello.js prior to version 1.18.8 allows remote attackers to execute arbitrary code via `hello.utils.extend` function.
apache-airflow-providers-apache-drill Improper Input Validation vulnerability (GHSA-mq4v-6vg4-796c)
Aliases: CVE-2023-39553
Published: 2023-08-11T09:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-drill'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.3'}]}]}]

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.

Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server.
This issue affects Apache Airflow Drill Provider before 2.4.3.
It is recommended to upgrade to a version that is not affected.
Mattermost does not validate requesting user permissions before updating admin details (GHSA-6xjj-v76v-fwpj)
Aliases: CVE-2023-4107
Published: 2023-08-11T09:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.8.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.8.7'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.9.0'}, {'fixed': '7.9.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.9.5'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.10.0'}, {'fixed': '7.10.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.10.3'}}]

Mattermost fails to properly validate the requesting user permissions when updating a system admin, allowing a user manager to update a system admin's details such as email, first name and last name.
Apache XML Graphics Batik Server-Side Request Forgery vulnerability (GHSA-gq5f-xv48-2365)
Aliases: CVE-2022-44729
Published: 2023-08-22T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.xmlgraphics:batik-bridge'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0'}, {'fixed': '1.17'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.xmlgraphics:batik-svgrasterizer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0'}, {'fixed': '1.17'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.xmlgraphics:batik-transcoder'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0'}, {'fixed': '1.17'}]}]}]

Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Jenkins Shortcut Job Plugin stored cross-site scripting vulnerability (GHSA-jg35-vf67-gg2j)
Aliases: CVE-2023-40346
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:shortcut-job'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5'}]}]}]

Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure shortcut jobs.

Shortcut Job Plugin 0.5 escapes the shortcut redirection URL.
Ghost vulnerable to arbitrary file read via symlinks in content import (GHSA-9c9v-w225-v5rg)
Aliases: CVE-2023-40028
Published: 2023-08-15T20:35:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'ghost'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.59.1'}]}]}]

### Impact

A vulnerability in Ghost allows authenticated users to upload files which are symlinks. This can be exploited to perform an arbitrary file read of any file on the operating system.

Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder

### Vulnerable versions

This security vulnerability is present in Ghost ≤ v5.59.0.

### Patches

v5.59.1 contains a fix for this issue.

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@ghost.org](mailto:security@ghost.org)
Apache Tomcat Open Redirect vulnerability (GHSA-q3mw-pvr8-9ggc)
Aliases: CVE-2023-41080
Published: 2023-08-25T21:30:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0-M1'}, {'fixed': '11.0.0-M11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.1.0-M1'}, {'fixed': '10.1.13'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0-M1'}, {'fixed': '9.0.80'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.5.0'}, {'fixed': '8.5.93'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.5.0'}, {'fixed': '8.5.93'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0-M1'}, {'fixed': '9.0.80'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.1.0-M1'}, {'fixed': '10.1.13'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0-M1'}, {'fixed': '11.0.0-M11'}]}]}]

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92.

The vulnerability is limited to the ROOT (default) web application.
OpenNMS privilege elevation vulnerability (GHSA-w5gq-xrrp-3fxf)
Aliases: CVE-2023-0872
Published: 2023-08-14T18:32:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms-webapp-rest'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '31.0.8'}, {'fixed': '32.0.2'}]}]}]

The Horizon REST API includes a users endpoint in OpenNMS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

OpenNMS thanks Erik Wynter for reporting this issue.
Weaviate denial of service vulnerability (GHSA-8697-479h-5mfp)
Aliases: CVE-2023-38976
Published: 2023-08-22T18:03:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/weaviate/weaviate'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.20.0'}, {'fixed': '1.20.6'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/weaviate/weaviate'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.19.0'}, {'fixed': '1.19.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/weaviate/weaviate'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.18.6'}]}]}]

### Impact
This vulnerability is a type conversion issue that affects users of Weaviate Server versions 1.20.0 and earlier.
Who is impacted: Users of Weaviate Server versions 1.20.0 and earlier are impacted by this vulnerability.

### Patches
A patch has been developed for this vulnerability.
Patch releases 1.20.6, 1.19.13, and 1.18.6 are fixing this vulnerability in each respective minor version release.
Users are strongly recommended to upgrade to one of these patched versions to address the vulnerability.
Keeping software up-to-date is crucial to avoid security vulnerabilities.

### Workarounds
There are no known workarounds to fix or remediate this vulnerability without upgrading.
Users must upgrade to a patched version to mitigate the risk.

### References 
* https://github.com/weaviate/weaviate/releases/tag/v1.18.6
* https://github.com/weaviate/weaviate/releases/tag/v1.19.13
* https://github.com/weaviate/weaviate/releases/tag/v1.20.6
ntpd has Dependency on Vulnerable Third-Party Component (GHSA-37xq-q42p-rv3p)
Published: 2023-08-24T22:18:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ntpd'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.7'}]}]}]

### During startup, an attacker that can man-in-the-middle traffic to and from NTS key exchange servers can trigger a very expensive key validation process due to a vulnerability in webpki.

### Impact
This vulnerability can lead to excessive cpu usage on startup on clients configured to use NTS

### Patches
Affected users are recommended to upgrade to version 0.3.7

### References
See also https://github.com/rustsec/advisory-db/blob/main/crates/rustls-webpki/RUSTSEC-2023-0053.md
Path traversal in ZIPFoundation (GHSA-c2cc-3569-6jh2)
Aliases: CVE-2023-39138
Published: 2023-08-31T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'https://github.com/weichsel/ZIPFoundation'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9.16'}]}]}]

An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.
Jenkins Folders Plugin cross-site request forgery vulnerability (GHSA-22c3-whjv-hrfm)
Aliases: CVE-2023-40337
Published: 2023-08-16T15:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:cloudbees-folder'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.848.ve3b'}]}]}]

Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to copy a view inside a folder.

Folders Plugin 6.848.ve3b_fd7839a_81 requires POST requests for the affected HTTP endpoint.
Spring-Kafka has Java Deserialization vulnerability When Improperly Configured (GHSA-crqf-q9fp-hwjw)
Aliases: CVE-2023-34040
Published: 2023-08-24T15:31:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.kafka:spring-kafka'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.9.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.kafka:spring-kafka'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.10'}]}]}]

In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed, but only if unusual configuration was applied. An attacker would have to construct a malicious serialized object in one of the deserialization exception record headers.

Specifically, an application is vulnerable when all of the following are true:

  *  The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record
  *  The user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull container properties to true.
  *  The user allows untrusted sources to publish to a Kafka topic


By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The ErrorHandlingDeserializer prevents the vulnerability by removing any such malicious headers before processing the record.
Alluxio vulnerable to arbitrary code execution (GHSA-xrrh-h86w-pwfj)
Aliases: CVE-2023-38889
Published: 2023-08-15T18:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.alluxio:alluxio-parent'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.9.3'}]}]}]

An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String).
PrestaShop file deletion via CustomerMessage (GHSA-v4gr-v679-42p7)
Aliases: CVE-2023-39530
Published: 2023-08-09T14:39:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.1.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 8.1.0'}}]

### Impact
It is possible to delete files from the server via the CustomerMessage API

### Patches
8.1.1

### Found by
Kto94 (via Yeswehack)

### Workarounds
none

### References
none
Answer has Race Condition within a Thread (GHSA-52h8-c876-989c)
Aliases: CVE-2023-4127
Published: 2023-08-03T06:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.1'}]}]}]

Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.
`ed25519-dalek` Double Public Key Signing Function Oracle Attack (GHSA-w5vr-6qhr-36cc)
Published: 2023-08-14T21:10:29Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ed25519-dalek'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}]

Versions of `ed25519-dalek` prior to v2.0 model private and public keys as separate types which can be assembled into a `Keypair`, and also provide APIs for serializing and deserializing 64-byte private/public keypairs.

Such APIs and serializations are inherently unsafe as the public key is one of the inputs used in the deterministic computation of the `S` part of the signature, but not in the `R` value. An adversary could somehow use the signing function as an oracle that allows arbitrary public keys as input can obtain two signatures for the same message sharing the same `R` and only differ on the `S` part.

Unfortunately, when this happens, one can easily extract the private key.

Revised public APIs in v2.0 of `ed25519-dalek` do NOT allow a decoupled private/public keypair as signing input, except as part of specially labeled "hazmat" APIs which are clearly labeled as being dangerous if misused.
Soketi was exposed to Sandbox Escape vulnerability via vm2 (GHSA-g6w6-h933-4rc5)
Published: 2023-08-03T19:44:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@soketi/soketi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.0'}]}]}]

### Impact
_What kind of vulnerability is it? Who is impacted?_
Anyone who might have used Soketi with the `cluster` driver (or through PM2).

### Patches
_Has the problem been patched? What versions should users upgrade to?_
Get the latest version of Soketi.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
None. It's advised to upgrade to the latest version.

### References
_Are there any links users can visit to find out more?_
- https://github.com/advisories/GHSA-cchq-frgv-rjh5
- https://github.com/patriksimek/vm2/issues/533
- https://github.com/Unitech/pm2/issues/5643
PrestaShop path traversal (GHSA-m9r4-3fg7-pqm2)
Aliases: CVE-2023-39525
Published: 2023-08-09T14:35:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.1.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 8.1.0'}}]

### Impact
In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path.

### Patches
8.1.1

### Found by
Aleksey Solovev (Positive Technologies)

### Workarounds
none

### References
none
Angular critical CSS inlining Cross-site Scripting Vulnerability Advisory (GHSA-r3hf-q8q7-fv2p)
Published: 2023-08-09T12:51:51Z
Affected: [{'package': {'ecosystem': 'npm', 'name': '@nguniversal/common'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '16.1.0'}, {'fixed': '16.1.2'}]}]}]

### Impact
Angular Universal applications on 16.1.0 and 16.1.1 using critical CSS inlining are vulnerable to a [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) attack where an attacker can trick another user into visiting a page which injects malicious JavaScript.

Angular CLI applications without Universal do perform critical CSS inlining as well, however exploiting this requires a malicious actor to already have access to modify source code directly.

### Patches
`@nguniversal/common` should be upgraded to 16.1.2 or higher. 16.2.0-rc.0 is safe.

### Workarounds
The easiest solution is likely to upgrade Universal to 16.1.2 or downgrade to 16.0.x or lower. Alternatively you can [override](https://docs.npmjs.com/cli/v9/configuring-npm/package-json#overrides) specifically the `critters` dependency with version `0.0.20` in your `package.json`.

```json
{
  "overrides": {
    "critters": "0.0.20"
  }
}
```

### References

* [Angular Blog Post](https://blog.angular.io/notice-of-xss-issue-affecting-angular-universal-16-1-0-16-1-1-95dbae068f)
Filename spoofing in archive (GHSA-r285-q736-9v95)
Aliases: CVE-2023-39137
Published: 2023-08-31T00:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Pub', 'name': 'archive'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.3.7'}}]

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.
OpenNMS vulnerable to Cross-site Scripting (GHSA-qfw7-pfxx-h9q2)
Aliases: CVE-2023-40311
Published: 2023-08-14T18:32:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms-webapp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '31.0.8'}, {'fixed': '32.0.2'}]}]}]

Multiple stored XSS were found on different JSP files with unsanitized parameters in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that allow an attacker to store on database and then load on JSPs or Angular templates. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.
PrestaShop XSS injection through Validate::isCleanHTML method (GHSA-xw2r-f8xv-c8xp)
Aliases: CVE-2023-39527
Published: 2023-08-09T14:37:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1.0'}, {'fixed': '8.1.1'}]}], 'versions': ['8.1.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.8.10'}]}]}]

### Impact
xss injection through `isCleanHTML` method

### Patches
1.7.8.10
8.0.5
8.1.1

### Found by
Aleksey Solovev (Positive Technologies)

### Workarounds

### References
odoh-rs's Invalid Slice Split Results in Server Panic (GHSA-gpcv-p28p-fv2p)
Aliases: CVE-2023-3766
Published: 2023-08-03T16:35:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'odoh-rs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.2'}]}]}]

A vulnerability was discovered in the odoh-rs rust crate that stems from faulty logic during the parsing of encrypted queries. This issue specifically occurs when processing encrypted query data received from remote clients.

### Impact
An attacker with knowledge of this vulnerability could craft and send specially designed encrypted queries to targeted ODOH servers running with odoh-rs. Upon successful exploitation, the server will crash abruptly, disrupting its normal operation and rendering the service temporarily unavailable.

### Patches
Users are encouraged to update their odoh-rs's rust crate to v1.0.2.
Critters Cross-site Scripting Vulnerability (GHSA-cx3j-qqxj-9597)
Aliases: CVE-2023-3481
Published: 2023-08-11T18:57:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'critters'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.17'}, {'fixed': '0.0.20'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.0.19'}}]

### Impact
Critters version 0.0.17-0.0.19 have an issue when parsing the HTML which leads to a potential [cross-site scripting (XSS)](https://owasp.org/www-community/attacks/xss/) bug.

### Patches
The bug has been fixed in `v0.0.20`.

### Workarounds
Upgrading Critters version to `>0.0.20` is the easiest fix. This is a non breaking version upgrade so we recommend all users to use `v0.0.20`.
llama-index vulnerable to arbitrary code execution (GHSA-2xxc-73fv-36f7)
Aliases: CVE-2023-39662
Published: 2023-08-15T18:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'llama-index'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.7.13'}]}]}]

An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEngine function.
pf4j vulnerable to remote code execution via the zippluginPath parameter (GHSA-3r28-rgp9-qgv4)
Aliases: CVE-2023-40826
Published: 2023-08-29T00:32:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.pf4j:pf4j'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.9.0'}]}]}]

An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zippluginPath parameter.
Blst has logical error in SigValidate in Go bindings (GHSA-8c37-7qx3-4c4p)
Published: 2023-08-09T20:57:57Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/supranational/blst'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.3.0'}, {'fixed': '0.3.11'}]}]}]

### Impact

Blst versions v0.3.0 through 0.3.10 failed to perform a signature group-check if the call to `SigValidate` in the Go bindings was complemented with a check for infinity. Formally speaking, infinity, or the identity element of the elliptic curve group, is a member of the group, and the group-check should allow it. An initial review of blst users on GitHub did not uncover any use of this function with the complementary infinity check. This optional check was added as a convenience feature because despite infinity being a legitimate member of the group, individual signatures should never be infinite (as it is equivalent to having zero for the secret key), and observing one should raise a flag. 

### Description

The vulnerable function is declared as `SigValidate(sigInfcheck bool) bool` and if called with `sigInfcheck` argument set to `true`, the group-check was omitted. The group-check is required to be performed on untrusted input, because the pairing, the corner-stone operation of the signature scheme, is defined only on points that are members of a specific cyclic group, which is a subset of all the possible points on elliptic curves in question. Submitting an untrusted point outside the group opens up the possibility of accepting an alternative signature for a chosen message.

It should be noted that the SigValidate call is not the only way to perform the group-checks. There are optional checks integrated into various other verification methods, such as `Verify`, `AggregateVerify`, etc., as well as signature aggregation methods, such as `PairingAggregate*`. The reason why there are multiple options is that the group-check is a relatively expensive operation, and application developers are arguably entitled the freedom to choose when it's performed.

### Patches

This issue has been resolved in the v0.3.11 release and users are advised to update if their application is affected or alternatively omit the complementary infinity check.

### Credits

A special thanks to Yunjong Jeong (@blukat29) for the discovery and disclosure of this vulnerability.
Jenkins Gogs Plugin vulnerable to unsafe default behavior and information disclosure (GHSA-qxwc-wchr-5h29)
Aliases: CVE-2023-40348
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:gogs-webhook'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.15'}]}]}]

Jenkins Gogs Plugin provides a webhook endpoint at `/gogs-webhook` that can be used to trigger builds of jobs. In Gogs Plugin 1.0.15 and earlier, an option to specify a Gogs secret for this webhook is provided, but not enabled by default.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified job name.

Additionally, the output of the webhook endpoint includes whether a job corresponding to the attacker-specified job name exists, even if the attacker has no permission to access it.

As of publication of this advisory, there is no fix.
XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer (GHSA-h8cm-3v5f-rgp6)
Aliases: CVE-2023-40176
Published: 2023-08-21T19:59:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1-milestone-2'}, {'fixed': '14.10.5'}]}]}]

### Impact

Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights).

The problem is present [since version 4.1M2](https://jira.xwiki.org/browse/XWIKI-7847) when the time zone user preference was introduced.

### Patches

The issue has been fixed in XWiki 14.10.5 and 15.1RC1 by https://github.com/xwiki/xwiki-platform/commit/d11ca5d781f8a42a85bc98eb82306c1431e764d4 . The main fix is in the [``displayer_timezone.vm``](https://github.com/xwiki/xwiki-platform/commit/d11ca5d781f8a42a85bc98eb82306c1431e764d4#diff-57ffb6e10fa8768e59948f2becf755699570d97b78bb12a9623e0de49e6c5c7d) precisely at this [line](https://github.com/xwiki/xwiki-platform/commit/d11ca5d781f8a42a85bc98eb82306c1431e764d4#diff-57ffb6e10fa8768e59948f2becf755699570d97b78bb12a9623e0de49e6c5c7dR40):

    $!escapetool.xml($value)

By escaping the displayed time zone value we make sure the attacker's payload is not executed.

### Workarounds

If you want to fix this problem on older versions of XWiki that have not been patched then you need to edit ``displayer_timezone.vm`` and escape the displayed time zone value [here](https://github.com/xwiki/xwiki-platform/blob/xwiki-platform-14.10.4/xwiki-platform-core/xwiki-platform-web/xwiki-platform-web-templates/src/main/resources/templates/displayer_timezone.vm#L32):

```
- $!value
+ $!escapetool.xml($value)
```

### References

* JIRA issue https://jira.xwiki.org/browse/XWIKI-20276
* Fix https://github.com/xwiki/xwiki-platform/commit/d11ca5d781f8a42a85bc98eb82306c1431e764d4

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been found and reported by @michitux .
langchain vulnerable to arbitrary code execution (GHSA-7gfq-f96f-g85j)
Aliases: CVE-2023-36281
Published: 2023-08-22T21:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.171'}]}]}]

An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via the via the a json file to the load_prompt parameter.