aswin1906/github-advisory-2023 huggingface dataset:
Pimcore customers' list user password hash is disclosed (GHSA-j65r-g7q2-f8v3)
Aliases: CVE-2023-2881
Published: 2023-05-25T16:57:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/customer-management-framework-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.10'}]}]}]

### Impact
The customer view exposes the hashed password along with other deails. An attacker is then able to enum password of a particular id, likewise we can replace id with other user , for example 1015, password hash can be disclosed which can be further cracked with hashcat

### Patches
Update to version 3.3.10 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/d1d58c10313f080737dc1e71fab3beb12488a1e6.patch

### Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/d1d58c10313f080737dc1e71fab3beb12488a1e6.patch manually.

### References
https://huntr.dev/bounties/db6c32f4-742e-4262-8fd5-cefd0f133416/
CraftCMS stored XSS in Quick Post widget error message (GHSA-3wxg-w96j-8hq9)
Aliases: CVE-2023-33194
Published: 2023-05-26T13:54:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-RC1'}, {'fixed': '4.4.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.8.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.8.5'}}]

### Summary
The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.

### Details
Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save.

### PoC
1. Login at admin
2. Go to setting
3. Create a Section
4. On Entry page, click Edit label
5. Inject the XSS payload into the label and save
6. On the admin dashboard choose new widget -> Quick Post
7. In Quick Post, click save with blank slug; The XSS will be executed

    "errors":{"title":["<script>alert('nono')</script> cannot be blank."],"slug":["Slug cannot be blank."]

Fixed in https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888
Jenkins Ansible Plugin job configuration form does not mask variables (GHSA-97wp-63wq-hfwh)
Aliases: CVE-2023-32983
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:ansible'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '205.v4cb'}]}]}]

Jenkins Ansible Plugin allows the specification of extra variables that can be passed to Ansible. These extra variables are commonly used to pass secrets.

Ansible Plugin 204.v8191fd551eb_f and earlier stores these extra variables unencrypted in job `config.xml` files on the Jenkins controller as part of its configuration.

These extra variables can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system.

Additionally, the job configuration form does not mask these extra variables, increasing the potential for attackers to observe and capture them.

Ansible Plugin 205.v4cb_c48657c21 masks extra variables displayed on the configuration form, and stores them encrypted once job configurations are saved again.
Algernon engine and themes vulnerable to Cross-site Scripting (GHSA-g47h-fgcw-g4ph)
Aliases: CVE-2023-26131
Published: 2023-05-31T06:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/xyproto/algernon'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.15.2'}]}]}]

All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting (XSS) via the `themes.NoPage(filename, theme)` function due to improper user input sanitization. Exploiting this vulnerability is possible when a file/resource is not found.
appium-desktop OS Command Injection vulnerability (GHSA-xq6j-x8pq-g3gr)
Aliases: CVE-2023-2479
Published: 2023-05-02T15:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'appium-desktop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.14.1'}]}]}]

appium-desktop v1.14.1 and prior is vulnerable to OS Command Injection.
TestComplete support Plugin vulnerable to stored Cross-site Scripting (GHSA-5wpg-qcmj-48wh)
Aliases: CVE-2023-33002
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:TestComplete'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.8.1'}]}]}]

TestComplete support Plugin 2.8.1 and earlier does not escape the TestComplete project name in its test result page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.
pimcore/customer-management-framework-bundle has SQL Injection vulnerability in Segment Assignment query (GHSA-25fx-3c2q-cq46)
Aliases: CVE-2023-2756
Published: 2023-05-17T15:48:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/customer-management-framework-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.10'}]}]}]

### Impact
An administrator user can use the inheritable segments feature to execute his own blind SQL queries.

A user with administrator privileges can run any SQL query on database. This can be used to retrieve sensitive data, change database information or any other malicious activity against the database.

### Patches
Update to version 3.3.10 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch

### Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/76df151737b7964ce5169fdf9e27a0ad801757fe.patch manually.

### References
https://huntr.dev/bounties/cf398528-819f-456e-88e7-c06d268d3f44/
Missing authorization in Liferay portal (GHSA-w6f8-mxf5-4vf8)
Aliases: CVE-2023-33948
Published: 2023-05-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4.3.67'}, {'fixed': '7.4.3.68'}]}], 'versions': ['7.4.3.67']}]

The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
Stored cross site scripting in Craft CMS (GHSA-7x94-jx75-3gh6)
Aliases: CVE-2023-2817
Published: 2023-05-26T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-RC1'}, {'fixed': '4.4.12'}]}]}]

A post-authentication stored cross-site scripting vulnerability exists in Craft CMS versions <= 4.4.11. HTML, including script tags can be injected into field names which, when the field is added to a category or section, will trigger when users visit the Categories or Entries pages respectively. This issue was patched in version 4.4.12.
Insecure Default Initialization In Liferay Portal (GHSA-g9mr-9xfc-4gf7)
Aliases: CVE-2023-33949
Published: 2023-05-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.3.1'}]}]}]

In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don't control. The portal property `company.security.strangers.verify` should be set to true.
Jenkins CAS Plugin Session Fixation vulnerability (GHSA-hjh8-9gxh-cx4x)
Aliases: CVE-2023-32997
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:cas-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.3'}]}]}]

Jenkins CAS Plugin 1.6.2 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

CAS Plugin 1.6.3 invalidates the existing session on login.
Cross-site scripting in Liferay Portal (GHSA-x82q-mr23-27jc)
Aliases: CVE-2023-33940
Published: 2023-05-24T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4.0'}, {'fixed': '7.4.3.31'}]}]}]

Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.
mlflow Path Traversal vulnerability (GHSA-wjq3-7jxx-whj9)
Aliases: CVE-2023-2780
Published: 2023-05-17T21:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mlflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.0'}]}]}]

mlflow prior to 2.3.0 is vulnerable to path traversal due to a bypass of the fix for CVE-2023-1177.
Jenkins Tag Profiler Plugin missing permission check (GHSA-cpc3-gm2x-mrvp)
Aliases: CVE-2023-33004
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:tag-profiler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.2'}]}]}]

Jenkins Tag Profiler Plugin 0.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to reset profiler statistics.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
mflow vulnerable to directory traversal (GHSA-wc6j-5g83-xfm6)
Aliases: CVE-2023-30172
Published: 2023-05-11T03:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mlflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0rc0'}]}]}]

A directory traversal vulnerability in the /get-artifact API method of the mlflow platform prior to v2.0.0 allows attackers to read arbitrary files on the server via the path parameter.
Embedding untrusted input inside CSV files leads to Formula Injection/CSV Injection (GHSA-mq3x-qgwx-3rfw)
Aliases: CVE-2023-2629
Published: 2023-05-11T20:41:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/customer-management-framework-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.9'}]}]}]

### Impact
The pimcore application is vulnerable to Formula Injection/CSV Injection via the Firstname, Lastname, Street, Zip & City input fields. These vulnerabilities allow unauthenticated attackers to execute arbitrary code via a crafted excel file.

Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.

### Patches
Update to version 3.3.9 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch

### Workarounds
Apply patch https://github.com/pimcore/customer-data-framework/commit/4e0105c3a78d20686a0c010faef27d2297b98803.patch manually.

### References
https://huntr.dev/bounties/821ff465-4754-42d1-9376-813c17f16a01/
Duplicate Advisory: Cross-site Scripting (XSS) in Predefined Properties delete (GHSA-j93v-cx26-2xc4)
Published: 2023-05-10T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-q7cc-m6jw-m262. This link is maintained to preserve external references.

## Original DescriptionCross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
Apache OpenMeetings Improper Authentication vulnerability (GHSA-v9rm-7rv9-r3fw)
Aliases: CVE-2023-29032
Published: 2023-05-12T09:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.openmeetings:openmeetings-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.3'}, {'fixed': '7.1.0'}]}]}]

An attacker that has gained access to certain private information can use this to act as other user.

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 3.1.3 before 7.1.0
Under-validated ComSpec and cmd.exe resolution in Mutagen projects (GHSA-fwj4-72fm-c93g)
Published: 2023-05-05T02:18:26Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mutagen-io/mutagen'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.6'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mutagen-io/mutagen'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.17.0'}, {'fixed': '0.17.1'}]}]}]

### Impact

Mutagen projects offer shell-based execution functionality.  On Windows, the shell is resolved using the standard `%ComSpec%` mechanism, with a fallback to a `%PATH%`-based search for `cmd.exe`.  While this is the standard practice on Windows systems, it presents somewhat risky behavior.

Firstly, `%ComSpec%` could, in theory, be set maliciously.  Unfortunately, there's not much that can be done to prevent this attack surface, because `%ComSpec%` is the official mechanism for shell specification on Windows.  We can, however, validate that it points to an absolute path, which one would expect for a properly set value.

Secondly, a fallback to a relative `cmd.exe` path, resolved via `%PATH%`, could be risky.  The risk is largely mitigated by changes in Go 1.19 and later, but prior to that a malicious `cmd.exe` could been resolved in the current working directory.  To mitigate this issue, Mutagen now uses the `%SystemRoot%` environment variable (also validated to be an absolute path) to resolve `cmd.exe` in the event that `%ComSpec%` is not set correctly.


### Patches

The problem has been patched in Mutagen v0.16.6 and v0.17.1. Earlier versions of Mutagen are no longer supported and will not be patched. Versions of Mutagen after v0.18.0 will also have the patch merged.


### Workarounds

Maintain control of the environment variable settings on your system, in particular the `ComSpec` environment variable.

### References

More information on `%ComSpec%` can be found [online](https://en.wikipedia.org/wiki/COMSPEC).

More information on Go's `PATH`-based lookup changes can be found [here](https://go.dev/blog/path-security), [here](https://go.dev/doc/go1.19#os-exec-path), and [here](https://github.com/golang/go/issues/43947).

A [similar issue](https://github.com/python/cpython/issues/101283) that was addressed within the Python subprocess module also provides additional discussion.
Mattermost Incorrect Authorization vulnerability (GHSA-7g2v-2frm-rg94)
Aliases: CVE-2023-2515
Published: 2023-05-12T09:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.1.8'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.2.0'}, {'fixed': '7.7.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.8.0'}, {'fixed': '7.8.3'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.9.0'}, {'fixed': '7.9.2'}]}]}]

Mattermost fails to restrict a user with permissions to edit other users and to create personal access tokens from elevating their privileges to system admin
Uncontrolled Recursion in HTTP2ToRawGRPCServerCodec (GHSA-4rhq-vq24-88gw)
Aliases: CVE-2021-36154
Published: 2023-05-22T20:29:44Z
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/grpc/grpc-swift'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.0'}]}]}]

### Impact

Affected gRPC Swift servers are vulnerable to uncontrolled recursion and stack consumption when parsing certain payloads. This may lead to a denial of service.

### Patches

The problem has been fixed in 1.2.0.

### Workarounds

No workaround is available. Users must upgrade.
Cross Site Scripting in thorsten/phpmyfaq (GHSA-5xq3-7mw9-wj5p)
Aliases: CVE-2023-2427
Published: 2023-05-05T21:31:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.13'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to version 3.1.13.
Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs (GHSA-83fm-w79m-64r5)
Published: 2023-05-01T13:43:58Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mlflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.1'}]}]}]

### Impact

Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the ``mlflow server`` or ``mlflow ui`` commands using an MLflow version older than **MLflow 2.3.1** may be vulnerable to a remote file access exploit if they are not limiting who can query their server (for example, by using a cloud VPC, an IP allowlist for inbound requests, or authentication / authorization middleware).

This issue only affects users and integrations that run the ``mlflow server`` and ``mlflow ui`` commands. Integrations that do not make use of ``mlflow server`` or ``mlflow ui`` are unaffected; for example, the Databricks Managed MLflow product and MLflow on Azure Machine Learning do not make use of these commands and are not impacted by these vulnerabilities in any way.

The vulnerability is very similar to https://nvd.nist.gov/vuln/detail/CVE-2023-1177, and a separate CVE will be published and updated here shortly.

### Patches

This vulnerability has been patched in MLflow 2.3.1, which was released to PyPI on April 27th, 2023. If you are using ``mlflow server`` or ``mlflow ui`` with the MLflow Model Registry, we recommend upgrading to MLflow 2.3.1 as soon as possible.

### Workarounds
If you are using the MLflow open source ``mlflow server`` or ``mlflow ui`` commands, we strongly recommend limiting who can access your MLflow Model Registry and MLflow Tracking servers using a cloud VPC, an IP allowlist for inbound requests, authentication / authorization middleware, or another access restriction mechanism of your choosing.

If you are using the MLflow open source ``mlflow server`` or ``mlflow ui`` commands, we also strongly recommend limiting the remote files to which your MLflow Model Registry and MLflow Tracking servers have access. For example, if your MLflow Model Registry or MLflow Tracking server uses cloud-hosted blob storage for MLflow artifacts, make sure to restrict the scope of your server's cloud credentials such that it can only access files and directories related to MLflow.

### References
Cross Site Scripting in thorsten/phpmyfaq (GHSA-5mf7-p346-7rm8)
Aliases: CVE-2023-2550
Published: 2023-05-05T21:31:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.13'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to  version 3.1.13.
thorsten/phpmyfaq vulnerable to cross-site scripting (GHSA-94r7-63g8-c4jw)
Aliases: CVE-2023-2999
Published: 2023-05-31T03:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.14'}]}]}]

thorsten/phpmyfaq prior to 3.1.14 is vulnerable to a stored cross-site scripting attack perpetuated by an actor logged in as admin.
Cross-site scripting in Liferay Portal (GHSA-p9xg-9378-cqp7)
Aliases: CVE-2023-33943
Published: 2023-05-24T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4.3.21'}, {'fixed': '7.4.3.63'}]}]}]

Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1) First Name, (2) Middle Name, (3) Last Name, or (4) Job Title text field.
Vyper vulnerable to integer overflow in loop (GHSA-6r8q-pfpv-7cgj)
Aliases: CVE-2023-32058
Published: 2023-05-12T20:21:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.8'}]}]}]

### Impact

Due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter.

In the following example, calling `test` returns `354`, meaning that the variable `a` did store `354` a value out of bound for the type `uint8`.

```Vyper
@external
def test() -> uint16:
    x:uint8 = 255
    a:uint8 = 0
    for i in range(x, x+100):
        a = i
    return convert(a,uint16)
```

The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable.

thanks to @trocher for reporting

### Patches

patched in 3de1415ee77a9244eb04bdb695e249d3ec9ed868

### Workarounds
Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignment (GHSA-3p37-3636-q8wv)
Aliases: CVE-2023-31146
Published: 2023-05-12T20:21:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.8'}]}]}]

### Impact
during codegen, the length word of a dynarray is written before the data, which can result in OOB array access in the case where the dynarray is on both the lhs and rhs of an assignment. here is a minimal example producing the issue:
```vyper
a:DynArray[uint256,3]
@external
def test() -> DynArray[uint256,3]:
    self.a = [1,2,3]
    self.a = empty(DynArray[uint256,3])
    self.a = [self.a[0],self.a[1],self.a[2]]
    return self.a # return [1,2,3]
```

and here is an example demonstrating the issue can cause data corruption across call frames:

```vyper
@external
def test() -> DynArray[uint256,3]:
    self.a()
    return self.b() # return [1,2,3]

@internal
def a():
    a: uint256 = 0    
    b: uint256 = 1    
    c: uint256 = 2    
    d: uint256 = 3

@internal
def b() -> DynArray[uint256,3]:
    a: DynArray[uint256,3] = empty(DynArray[uint256,3])
    a = [a[0],a[1],a[2]]
    return a
```

examples involving append and pop:
```vyper
@internal
def foo():
    c: DynArray[uint256, 1] = []
    c.append(c[0])
```

```vyper
@internal
def foo():
    c: DynArray[uint256, 1] = [1]
    c[0] = c.pop()
```

the expected behavior in all of the above cases is to revert due to oob array access.

### Patches
patched in 4f8289a81206f767df1900ac48f485d90fc87edb

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
_Are there any links users can visit to find out more?_
Remote Code Execution Vulnerability in Validation Placeholders in CodeIgniter4 (GHSA-m6m8-6gq8-c9fj)
Aliases: CVE-2023-32692
Published: 2023-05-22T19:49:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'codeigniter4/framework'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.3.5'}]}]}]

### Impact
This vulnerability allows attackers to execute arbitrary code when you use Validation Placeholders.

The vulnerability exists in the Validation library, and validation methods in the controller and in-model validation are also vulnerable because they use the Validation library internally.

### Patches
Upgrade to v4.3.5 or later.

### Workarounds
Setting validation rules with an array.

E.g.:
```php
$validation->setRules([
    'email' => ['required', 'valid_email, 'is_unique[users.email,id,{id}]'],
]);
```

### References
- https://codeigniter4.github.io/userguide/libraries/validation.html#validation-placeholders
- https://codeigniter4.github.io/userguide/incoming/controllers.html#validating-data
- https://codeigniter4.github.io/userguide/models/model.html#in-model-validation
Jenkins LoadComplete support Plugin Cross-site Scripting vulnerability (GHSA-7p6g-gr9g-vfx6)
Aliases: CVE-2023-33007
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:loadcomplete'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0'}]}]}]

Jenkins LoadComplete support Plugin 1.0 and earlier does not escape the LoadComplete test name in its test result page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

As of publication of this advisory, there is no fix.
Jenkins Code Dx Plugin cross-site request forgery vulnerability (GHSA-gx2j-5vc3-3794)
Aliases: CVE-2023-2195
Published: 2023-05-16T21:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:codedx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Jenkins Code Dx Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Code Dx Plugin 4.0.0 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Uncontrolled Resource Consumption in OPC UA .NET Standard Reference Server (GHSA-vpf7-r2fv-75m9)
Aliases: CVE-2023-27321
Published: 2023-05-05T02:19:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'OPCFoundation.NetStandard.Opc.Ua.Server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.371.86'}]}]}]

This security update resolves a vulnerability in the OPC UA .NET Standard Reference Server that allows
remote attackers to send malicious requests that consume all memory available to the server.

https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-27321.pdf
LavaLite CMS vulnerable to host header injection attack (GHSA-94q4-v5g6-qp7x)
Aliases: CVE-2023-27237
Published: 2023-05-12T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'lavalite/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.0.0'}]}]}]

LavaLite CMS v 9.0.0 was discovered to be vulnerable to a host header injection attack.
in-toto vulnerable to Configuration Read From Local Directory (GHSA-wc64-c5rv-32pf)
Aliases: CVE-2023-32076
Published: 2023-05-11T20:47:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'in-toto'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.4.0'}}]

### Impact

The in-toto configuration is read from various directories and allows users to configure the behavior of the framework. The files are from directories following the XDG base directory specification [1]. Among the files read is `.in_totorc` which is a hidden file in the directory in which in-toto is run. If an attacker controls the inputs to a supply chain step, they can mask their activities by also passing in an `.in_totorc` file that includes the necessary exclude patterns and settings.

RC files are widely used in other systems [2] and security issues have been discovered in their implementations as well [3]. We found in our conversations with in-toto adopters that `in_totorc` is not their preferred way to configure in-toto. As none of the options supported in `in_totorc` is unique, and can be set elsewhere using API parameters or CLI arguments, we decided to drop support for `in_totorc`.

### Other Recommendations

Sandbox functionary code as recommended in https://github.com/in-toto/docs/security/advisories/GHSA-p86f-xmg6-9q4x.

### References

[1] https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
[2] https://spec.editorconfig.org/
[3] https://github.blog/2022-04-12-git-security-vulnerability-announced/
Apache Airflow vulnerable to Privilege Context Switching Error (GHSA-jchm-fm4q-c2fp)
Aliases: CVE-2023-25754
Published: 2023-05-08T12:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.0'}]}]}]

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow. This issue affects Apache Airflow: before 2.6.0.
Apache Airflow vulnerable to stored Cross-site Scripting (GHSA-vcf6-3wv2-5vcr)
Aliases: CVE-2023-29247
Published: 2023-05-08T12:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.0'}]}]}]

Task instance details page in the UI is vulnerable to stored cross-site scripting. This issue affects Apache Airflow before 2.6.0.
Jenkins Email Extension Plugin Cross-Site Request Forgery vulnerability (GHSA-2f89-66v2-9p53)
Aliases: CVE-2023-32980
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:email-ext'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.96.1'}]}]}]

Jenkins Email Extension Plugin 2.96 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This allows attackers to make another user stop watching an attacker-specified job.

Email Extension Plugin 2.96.1 requires POST requests for the affected HTTP endpoint.
Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled (GHSA-6phf-6h5g-97j2)
Aliases: CVE-2023-32697
Published: 2023-05-23T20:07:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xerial:sqlite-jdbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.6.14.1'}, {'fixed': '3.41.2.2'}]}]}]

## Summary

Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. 

## Impacted versions : 

3.6.14.1-3.41.2.1
 
## References

https://github.com/xerial/sqlite-jdbc/releases/tag/3.41.2.2
Cross-site scripting in Liferay Portal (GHSA-v6m2-j92j-2h78)
Aliases: CVE-2023-33937
Published: 2023-05-24T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.1.0'}, {'fixed': '7.3.1'}]}]}]

Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form's `name` field.
Craft CMS stored XSS in review volume (GHSA-cjmm-x9x9-m2w5)
Aliases: CVE-2023-33196
Published: 2023-05-26T13:55:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-RC1'}, {'fixed': '4.4.7'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.4.6'}}]

### Summary
XSS can be triggered by review volumes

### PoC

    1. Access setting tab
    2. Create new assets
    3. In assets name inject payload: "<script>alert(1337)</script>
    4. Click Utilities tab
    5. Choose all volumes, or volume trigger xss
    6. Click Update asset indexes.
    7. Wait to assets update success.
    8. Progress complete.
    9. Click on review button will trigger XSS

### Root cause
Function: index.php?p=admin/actions/asset-indexes/process-indexing-session&v=1680710595770
After loading completed, progess will load: 
"skippedEntries"
and
"missingEntries"
These parameters is not yet filtered, I just tried "skippedEntries" but I think it will be work with "missingEntries"

### My reponse:
{
  "session": {
    "id": 10,
    "indexedVolumes": {
      "6": "\"<script>alert(1337)</script>"
    },
    "totalEntries": 2235,
    "processedEntries": 2235,
    "cacheRemoteImages": true,
    "listEmptyFolders": false,
    "isCli": false,
    "actionRequired": true,
    "dateCreated": "Apr 5, 2023, 9:03:16 AM",
    "skippedEntries": [
      "\"<script>alert(1337)</script>/assetpreviews/Image.php",
      "\"<script>alert(1337)</script>/assetpreviews/Pdf.php"
    ],
    "missingEntries": {
      "folders": [],
      "files": []
    },
    "processIfRootEmpty": false
  },
  "skipDialog": false
}



Resolved in https://github.com/craftcms/cms/commit/053d7119697e480ff81c5723bb9a33eaa49e0fc7
ruby-saml vulnerable to XPath injection (GHSA-r364-2pj4-pf7f)
Aliases: CVE-2015-20108
Published: 2023-05-27T21:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'ruby-saml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0'}]}]}]

`xml_security.rb` in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and code execution because prepared statements are not used.
XWiki Platform vulnerable to RXSS via editor parameter - importinline template (GHSA-j9h5-vcgv-2jfm)
Aliases: CVE-2023-32071
Published: 2023-05-09T17:46:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-distribution-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2-milestone-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-distribution-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.4'}]}]}]

### Impact

It's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment.

To reproduce:
* add an attachment to a page (for example, your user profile)
* add `?xpage=importinline&editor=%22%3E%3Cimg%20src%20onerror=alert(document.domain)%3E` to the page view URL as in `https://myhost/xwiki/bin/view/XWiki/MyUser?xpage=importinline&editor=%22%3E%3Cimg%20src%20onerror=alert(document.domain)%3E`

### Patches

This has been patched in XWiki 15.0-rc-1, 14.10.4 and 14.4.8.

### Workarounds

The easiest is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described on https://github.com/xwiki/xwiki-platform/commit/28905f7f518cc6f21ea61fe37e9e1ed97ef36f01

### References

https://jira.xwiki.org/browse/XWIKI-20340
https://app.intigriti.com/company/submissions/e95a7ad5-7029-4627-abf0-3e3e3ea0b4ce/XWIKI-E93DFEYK

### Attribution

This vulnerability has been reported on Intigriti by René de Sain @renniepak.
Cross-site scripting in Liferay Portal (GHSA-pfwc-4frf-4gf8)
Aliases: CVE-2023-33944
Published: 2023-05-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.3.4'}, {'fixed': '7.4.3.69'}]}]}]

Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a container type layout fragment's `URL` text field.
Starlette has Path Traversal vulnerability in StaticFiles (GHSA-v5gw-mw7f-84px)
Aliases: CVE-2023-29159
Published: 2023-05-17T03:49:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'starlette'}, 'ecosystem_specific': {'affected_functions': ['starlette.staticfiles.StaticFiles.lookup_path']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.13.5'}, {'fixed': '0.27.0'}]}]}]

### Summary
When using `StaticFiles`, if there's a file or directory that starts with the same name as the `StaticFiles` directory, that file or directory is also exposed via `StaticFiles` which is a path traversal vulnerability.

### Details
The root cause of this issue is the usage of `os.path.commonprefix()`:
https://github.com/encode/starlette/blob/4bab981d9e870f6cee1bd4cd59b87ddaf355b2dc/starlette/staticfiles.py#L172-L174

As stated in the Python documentation (https://docs.python.org/3/library/os.path.html#os.path.commonprefix) this function returns the longest prefix common to paths.

When passing a path like `/static/../static1.txt`, `os.path.commonprefix([full_path, directory])` returns `./static` which is the common part of `./static1.txt` and `./static`, It refers to `/static/../static1.txt` because it is considered in the staticfiles directory. As a result, it becomes possible to view files that should not be open to the public.

The solution is to use `os.path.commonpath` as the Python documentation explains that `os.path.commonprefix` works a character at a time, it does not treat the arguments as paths.

### PoC
In order to reproduce the issue, you need to create the following structure:

```
├── static
│   ├── index.html
├── static_disallow
│   ├── index.html
└── static1.txt
```

And run the `Starlette` app with:

```py
import uvicorn
from starlette.applications import Starlette
from starlette.routing import Mount
from starlette.staticfiles import StaticFiles


routes = [
    Mount("/static", app=StaticFiles(directory="static", html=True), name="static"),
]

app = Starlette(routes=routes)


if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8000)
```

And running the commands:

```shell
curl --path-as-is 'localhost:8000/static/../static_disallow/'
curl --path-as-is 'localhost:8000/static/../static1.txt'
```
The `static1.txt` and the directory `static_disallow` are exposed.

### Impact
Confidentiality is breached: An attacker may obtain files that should not be open to the public.

### Credits
Security researcher **Masashi Yamane of LAC Co., Ltd** reported this vulnerability to **JPCERT/CC Vulnerability Coordination Group** and they contacted us to coordinate a patch for the security issue.
Path Traversal in Ghost (GHSA-wf7x-fh6w-34r6)
Aliases: CVE-2023-32235
Published: 2023-05-05T06:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'ghost'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.42.1'}]}]}]

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
Ghost vulnerable to information disclosure of private API fields (GHSA-r97q-ghch-82j9)
Aliases: CVE-2023-31133
Published: 2023-05-03T21:57:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'ghost'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.46.1'}]}]}]

### Impact

Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.

Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.

Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below.

### Patches

v5.46.1 contains a fix for this issue.

### Workarounds

Add a block for requests to `/ghost/api/content/*` where the `filter` query parameter contains `password` or `email`.

### For more information

If you have any questions or comments about this advisory:

* Email us at [security@ghost.org](mailto:security@ghost.org)
Synapse Outgoing federation to specific hosts can be disabled by sending malicious invites (GHSA-f3wc-3vxv-xmvr)
Aliases: CVE-2023-32323
Published: 2023-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'matrix-synapse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.74.0'}]}]}]

### Impact

A malicious user on a Synapse homeserver X with permission to create certain state events can disable outbound federation from X to an arbitrary homeserver Y.

Synapse instances with federation disabled are not affected.

#### Details

The Matrix protocol allows homeservers to provide an `invite_room_state` field on a [room invite](https://spec.matrix.org/v1.5/client-server-api/#mroommember) containing a [summary of room state](https://spec.matrix.org/v1.5/client-server-api/#stripped-state).  In versions of Synapse up to and including v1.73.0, Synapse did not limit the size of `invite_room_state`, meaning that it was possible to create an arbitrarily large invite event.

An attacker with an account on a vulnerable Synapse homeserver X could exploit this by having X create an over-sized invite event in a room with a user from another homeserver Y. Once acknowledged by the invitee's homeserver, the invite event would be sent in a batch of events to Y. If the malicious invite is so large that the entire batch is rejected as too large, X's outgoing traffic to Y would become "stuck", meaning that messages and state events created by X would remain unseen by Y.

### Patches

Synapse 1.74 refuses to create oversized `invite_room_state` fields. Server operators should upgrade to Synapse 1.74 or newer urgently.

### Workarounds

There are no robust workarounds.

This attack needs an account on Synapse homeserver X to deny federation from X to another homeserver Y. As a partial mitigation, Synapse operators can disable open registration to limit the ability of attackers to create new accounts on homeserver X.

If homeserver X has been attacked in this way, restarting it will resume outgoing federation by entering "catchup mode". For catchup mode to ignore the oversized invites, every attacked room must have a correctly-sized event sent by X which is newer than any oversized invite. This is difficult to arrange, and does not prevent the attacker from repeating their attack.

### References

- https://github.com/matrix-org/synapse/issues/14492 was caused by this issue.
- https://github.com/matrix-org/synapse/issues/14642  includes the patch described above.

### For more information

If you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).
LavaLite vulnerable to web cache poisoning  (GHSA-6vcf-cfjp-qxcw)
Aliases: CVE-2023-27238
Published: 2023-05-12T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'lavalite/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.0.0'}]}]}]

LavaLite CMS v 9.0.0 was discovered to be vulnerable to web cache poisoning.
Stored cross site scripting in Microbin (GHSA-mphm-gqh9-q59x)
Aliases: CVE-2023-27075
Published: 2023-05-04T03:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'microbin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.1'}]}]}]

A cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.