aswin1906/github-advisory-2023 huggingface dataset:
TeamPass vulnerable to stored Cross-site Scripting (GHSA-8vm8-38pc-8xhh)
Aliases: CVE-2023-3084
Published: 2023-06-03T12:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
XWiki Platform's Mail.MailConfig can be edited by any user with edit rights (GHSA-g75c-cjr6-39mc)
Aliases: CVE-2023-34465
Published: 2023-06-20T16:44:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-mail-send-default'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.8-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-mail-send-default'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-mail-send-default'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1'}]}]}]

### Impact

`Mail.MailConfig` can be edited by any logged-in user by default. Consequently, they can:
- change the mail obfuscation configuration
- view and edit the mail sending configuration, including the smtp domain name and credentials.

### Patches
The problem has been patched on XWiki 14.4.8, 15.1, and 14.10.6.

### Workarounds
The rights of the `Mail.MailConfig` page can be manually updated so that only a set of trusted users can view, edit and delete it (e.g., the `XWiki.XWikiAdminGroup` group).
On 14.4.8+, 15.1-rc-1+, or 14.10.5+, if at startup `Mail.MailConfig` does not have any rights defined, `view`, `edit ` and `delete` rights are automatically granted to the `XWiki.XWikiAdminGroup` group.
See the corresponding [patch](https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4).

### References
- https://jira.xwiki.org/browse/XWIKI-20519 + https://jira.xwiki.org/browse/XWIKI-20671
- https://github.com/xwiki/xwiki-platform/commit/d28d7739089e1ae8961257d9da7135d1a01cb7d4
- https://github.com/xwiki/xwiki-platform/commit/8910b8857d3442d2e8142f655fdc0512930354d1


### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
Duplicate Advisory: elFinder vulnerable to path traversal in LocalVolumeDriver connector (GHSA-3p2q-mh7q-9pxj)
Published: 2023-06-19T03:30:19Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'studio-42/elfinder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.62'}]}]}]

### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-wm5g-p99q-66g4. This link is maintained to preserve external references.

### Original Description
_joinPath in elFinderVolumeLocalFileSystem.class.php in elFinder before 2.1.62 allows path traversal in the PHP LocalVolumeDriver connector.
JeecgBoot vulnerable to SQL injection in queryFilterTableDictInfo (GHSA-cvgc-465m-cw9g)
Aliases: CVE-2023-34603
Published: 2023-06-19T06:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.1'}]}]}]

JeecgBoot up to v 3.5.1 was discovered to contain a SQL injection vulnerability via the component `queryFilterTableDictInfo` in method `org.jeecg.modules.api.controller.SystemApiController`.
cheqd-node subject to Cosmos SDK "Barberry" vulnerability (GHSA-8qxh-2gh8-r923)
Published: 2023-06-12T18:34:26Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cheqd/cheqd-node'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.4'}]}]}]

### Impact
This [vulnerability dubbed "Barberry" affects the Cosmos SDK framework](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825) used by `cheqd-node` as base.

It impacts the way Cosmos SDK handles vesting accounts, and can therefore be a high-impact vulnerability for any network running the framework.

There is no vulnerability in the DID/resource modules for `cheqd-node`.

### Patches
Node operators are requested to upgrade to [cheqd-node v1.4.4](https://github.com/cheqd/cheqd-node/releases/tag/v1.4.4). This is not a state-breaking release and does not require a coordinated upgrade across all node operators.

This vulnerability was patched in [Cosmos SDK v0.46.13](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13). Since this version switches to Go v1.19 and also changes the namespace of many Cosmos protobuf packages, the Barberry fix was [backported to cheqd's fork of Cosmos SDK](https://github.com/cheqd/cosmos-sdk/releases/tag/v0.46.10-barberry).

### Mitigation
When at least ~**33**% of the voting power of the network has deployed the recommended version of the software, any attack would be unsuccessful but cause a chain halt.

Once at least ~**67**% of the voting power of the network has deployed recommended version of the software, the attack would be unsuccessful _without_ a chain halt.

### Workarounds
No. Node operators are recommended to upgrade to the latest release version.

### References
- ["Barberry" vulnerability security advisory](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825)
- [Cosmos SDK v0.46.13 release notes](https://github.com/cosmos/cosmos-sdk/releases/tag/v0.46.13)
Gradio vulnerable to arbitrary file read and proxying of arbitrary URLs (GHSA-3qqg-pgqq-3695)
Aliases: CVE-2023-34239
Published: 2023-06-09T22:51:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'gradio'}, 'ecosystem_specific': {'affected_functions': ['gradio.blocks.Blocks.from_config', 'gradio.blocks.Blocks.render']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.34.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.33.1'}}]

### Impact
There are two separate security vulnerabilities here: (1) a security vulnerability that allows users to read arbitrary files on the machines that are running shared Gradio apps (2) the ability of users to use machines that are sharing Gradio apps to proxy arbitrary URLs

### Patches
Both problems have been solved, please upgrade `gradio` to `3.34.0` or higher

### Workarounds
Not possible to workaround except by taking down any shared Gradio apps

### References
Relevant PRs:
* https://github.com/gradio-app/gradio/pull/4406
* https://github.com/gradio-app/gradio/pull/4370
Apache StreamPipes Improper Privilege Management vulnerability (GHSA-pm73-x2h5-cmj3)
Aliases: CVE-2023-31469
Published: 2023-06-23T09:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.streampipes:streampipes-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.69.0'}, {'fixed': '0.92.0'}]}]}]

A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles.
The issue is resolved by upgrading to StreamPipes 0.92.0.
PocketMine-MP vulnerable to improperly checked dropped item count leading to server crash (GHSA-h87r-f4vc-mchv)
Published: 2023-06-06T01:51:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.18.1'}]}]}]

### Impact
In 4.18.0, the network handling of inventories was completely revamped. Due to this, a bug was introduced which allowed players to request that the server drop more of an item than they had available in their hotbar.

This did not lead to any duplication issues, but instead led to a server crash, and is believed to have been exploited in the wild.

### Patches
This was fixed in 58974765a68f63a9968a7ff3a06f584ff2ee08d2, which was released in 4.18.1.

### Workarounds
Handle `InventoryTransactionPacket` in `DataPacketReceiveEvent`, and verify that the item count dropped isn't more than the available item count. However, it's complicated to do this, so it's not recommended.
Apache Airflow ODBC Provider Argument Injection vulnerability (GHSA-9766-v29c-4vm7)
Aliases: CVE-2023-34395
Published: 2023-06-27T12:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-odbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.
In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.
Starting version 4.0.0 driver can be set only from the hook constructor.
This issue affects Apache Airflow ODBC Provider: before 4.0.0.
jsonij vulnerable to stack exhaustion (GHSA-66gv-5m8q-rrjc)
Aliases: CVE-2023-34614
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cc.plural:jsonij'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.5.2'}]}]}]

An issue was discovered jmarsden/jsonij through 0.5.2 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in deletespace template (GHSA-x234-mg7q-m8g8)
Aliases: CVE-2023-35159
Published: 2023-06-22T19:59:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.4-milestone-1'}, {'fixed': '14.10.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1-rc-1'}]}]}]

### Impact
Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS).
It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as:

> xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain)

This vulnerability exists since XWiki 3.4-milestone-1.

### Patches
The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

### Workarounds

It's possible to workaround the vulnerability by editing the template deletespace.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.

### References

  * Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20612
  * Introduction of the macro used for fixing all those vulnerabilities: https://jira.xwiki.org/browse/XWIKI-20583
  * Commit containing the actual fix in the template: https://github.com/xwiki/xwiki-platform/commit/5c20ff5e3bdea50f1053fe99a27e011b8d0e4b34

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
git-url-parse crate vulnerable to Regular Expression Denial of Service (GHSA-qfh9-8p57-mjjj)
Aliases: CVE-2023-33290
Published: 2023-06-12T15:30:28Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'git-url-parse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.4.4'}]}]}]

The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to `normalize_url` in `lib.rs`, a similar issue to CVE-2023-32758 (Python).
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in DeleteApplication page (GHSA-4xm7-5q79-3fch)
Aliases: CVE-2023-35161
Published: 2023-06-22T20:00:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.2-milestone-1'}, {'fixed': '14.10.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-appwithinminutes-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1-rc-1'}]}]}]

### Impact
Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS).
It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:

> xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu&resolve=true&xredirect=javascript:alert(document.domain)

This vulnerability exists since XWiki 6.2-milestone-1.

### Patches

The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

### Workarounds

It's possible to workaround the vulnerability by editing the page AppWithinMinutes.DeleteApplication to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.

### References

  * Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20614
  * Introduction of the macro used for fixing all those vulnerabilities: https://jira.xwiki.org/browse/XWIKI-20583
  * Commit containing the actual fix in the page: https://github.com/xwiki/xwiki-platform/commit/8f5a889b7cd140770e54f5b4195d88058790e305

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
RuoYi Uncontrolled Resource Consumption vulnerability (GHSA-g3hh-q55f-9g3w)
Aliases: CVE-2023-3163
Published: 2023-06-08T15:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.ruoyi:ruoyi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.7.7'}]}]}]

A vulnerability was found in y_project RuoYi up to 4.7.7. It has been classified as problematic. Affected is the function filterKeyword. The manipulation of the argument value leads to resource consumption. VDB-231090 is the identifier assigned to this vulnerability.
XWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template (GHSA-fp7h-f9f5-x4q7)
Aliases: CVE-2023-34464
Published: 2023-06-20T16:44:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1-rc-1'}]}]}]

### Impact

Any user who can edit a document in a wiki like the user profile can create a stored XSS attack by putting plain HTML code into that document and then tricking another user to visit that document with the `displaycontent` or `rendercontent` template and plain output syntax. For example, edit any document with the wiki editor and set the content to `<script>alert(1)</script>` , save and then append the parameters `?viewer=displaycontent&sheet=&outputSyntax=plain`. If this displays an alert, the installation is vulnerable. If a user with programming rights is tricked into visiting such a URL, arbitrary actions be performed with this user's rights, impacting the confidentiality, integrity, and availability of the whole XWiki installation.

### Patches
This has been patched in XWiki 14.4.8, 14.10.5 and 15.1RC1 by setting the content type of the response to plain text when the output syntax is not an HTML syntax.

### Workarounds
The [patch](https://github.com/xwiki/xwiki-platform/commit/53e8292a31ec70fba5e1d705a4ac443658b9e6df#diff-e332fba67335bd2202bdac144be7cd244a16cef0ccee741f9c20025a981027d5) can be manually applied to the `rendercontent.vm` template in an existing installation to patch this vulnerability without upgrading.

### References
* https://jira.xwiki.org/browse/XWIKI-20290
* https://github.com/xwiki/xwiki-platform/commit/53e8292a31ec70fba5e1d705a4ac443658b9e6df
Kubelet vulnerable to bypass of seccomp profile enforcement (GHSA-xc8m-28vv-4pjc)
Aliases: CVE-2023-2431
Published: 2023-06-16T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.24.14'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.25.0'}, {'fixed': '1.25.10'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.26.0'}, {'fixed': '1.26.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'k8s.io/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.27.0'}, {'fixed': '1.27.2'}]}]}]

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.
Untrusted data fed into `Data.init(base32Encoded:)` can result in exposing server memory and/or crash (GHSA-pqwh-c2f3-vxmq)
Aliases: CVE-2021-32742
Published: 2023-06-09T19:31:54Z
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/vapor/vapor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.47.2'}]}]}]

### Impact
A bug in the `Data.init(base32Encoded:)` function opens up the potential for exposing server memory and/or crashing the server (Denial of Service) for applications where untrusted data can end up in said function. Vapor does not currently use this function itself so this only impact applications that use the impacted function directly or through other dependencies.

### Patches
This issue has been patched in 4.47.2.

### Workarounds
Use an alternative to Vapor's built-in `Data.init(base32Encoded:)`.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Vapor](https://github.com/vapor/vapor)
* Ask in [Discord](http://vapor.team)
nuxt Code Injection vulnerability (GHSA-gc34-5v43-h7v8)
Aliases: CVE-2023-3224
Published: 2023-06-13T18:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'nuxt'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.4.0'}, {'fixed': '3.4.3'}]}]}]

he Nuxt dev server between versions 3.4.0 and 3.4.3 is vulnerable to code injection when it is exposed publicly.
ke_search (aka Faceted Search) vulnerable to Cross-Site Scripting (GHSA-f4m6-x2xj-jc7w)
Aliases: CVE-2023-35783
Published: 2023-06-16T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'tpwd/ke_search'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'tpwd/ke_search'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.6.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'tpwd/ke_search'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.3'}]}]}]

The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via indexed data.
Froxlor vulnerable to Improper Restriction of Excessive Authentication Attempts (GHSA-chw4-88xc-79w6)
Aliases: CVE-2023-3173
Published: 2023-06-09T03:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.20'}]}]}]

Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
Teampass Cross-site Scripting vulnerability (GHSA-qmw8-x364-xxxm)
Aliases: CVE-2023-3191
Published: 2023-06-10T09:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting (XSS) vectors in the application.
XWiki Platform vulnerable to reflected cross-site scripting via xredirect parameter in restore template (GHSA-mwxj-g7fw-7hc8)
Aliases: CVE-2023-35158
Published: 2023-06-22T19:59:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-skin-resources'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4-rc-1'}, {'fixed': '14.10.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-skin-resources'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1-rc-1'}]}]}]

### Impact
Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS).
It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:

> /xwiki/bin/view/XWiki/Main?xpage=restore&showBatch=true&xredirect=javascript:alert(document.domain)

This vulnerability exists since XWiki 9.4-rc-1.

### Patches

The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. 

### Workarounds

It's possible to workaround the vulnerability by editing the template restore.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.

### References

  * Vulnerability in restore template: https://jira.xwiki.org/browse/XWIKI-20352
  * Introduction of the macro used for fixing this vulnerability: https://jira.xwiki.org/browse/XWIKI-20583
  * Commit containing the actual fix in the template: https://github.com/xwiki/xwiki-platform/commit/d5472100606c8355ed44ada273e91df91f682738

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

Both vulnerabilities about the delete and restore templates have been reported by René de Sain @renniepak.
pipreqs vulnerable to Dependency Confusion (GHSA-v4f4-23wc-99mh)
Aliases: CVE-2023-31543
Published: 2023-06-30T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pipreqs'}, 'ecosystem_specific': {'affected_functions': ['pipreqs.pipreqs.get_import_local', 'pipreqs.pipreqs.init']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.3.0'}, {'fixed': '0.4.12'}]}]}]

A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
Denial of Service via reachable assertion (GHSA-r6ww-5963-7r95)
Aliases: CVE-2022-24777
Published: 2023-06-09T19:33:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'https://github.com/grpc/grpc-swift.git'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.2'}]}]}]

A grpc-swift server is vulnerable to a denial of service attack via a reachable assertion. This was due to incorrect logic when handling `GOAWAY` frames.

The attack is low-effort: it takes very little resources to construct and send the required sequence of frames. The impact on availability is high as the server will crash, dropping all in flight connections and requests.

The issue was discovered by automated fuzz testing and is resolved by fixing the relevant state handling code.
PocketMine MP vulnerable to uncontrolled resource consumption via mismatched type of 'InventoryTransactionPacket' (GHSA-42qm-8v8m-m78c)
Published: 2023-06-01T19:10:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.18.0-ALPHA2'}]}]}]

### Impact
A "mismatch" type `InventoryTransactionPacket` is sent by the client to request a resync of all currently open inventories.

Since PocketMine-MP does not rate-limit these "mismatch" transactions, and the syncing of inventories is not deferred until, e.g. the end of the current tick, they can be used as a very cheap bandwidth multiplier by making the server send out many MB of data (network serialized inventory items can be very large, especially when dealing with large amounts of NBT).

This is not currently known to have been exploited in the wild.

### Patches
This problem was fixed in 4.18.0-ALPHA2 by ca6d51498f12427a947467da8fcad7811418e6cc alongside the introduction of the `ItemStackRequest` system implementation.

### Workarounds
Plugins can handle `DataPacketReceiveEvent` for `InventoryTransactionPacket` and check if the type is `MismatchTransactionData`. If it is, apply some kind of rate limit (e.g. max 1 per tick).
Gatsby develop server has Local File Inclusion vulnerability (GHSA-c6f8-8r25-c4gc)
Aliases: CVE-2023-34238
Published: 2023-06-09T22:52:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'gatsby'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.25.7'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.25.6'}}, {'package': {'ecosystem': 'npm', 'name': 'gatsby'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.9.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.9.0'}}]

### Impact

The Gatsby framework prior to versions 4.25.7 and 5.9.1 contain a Local File Inclusion vulnerability in the `__file-code-frame` and `__original-stack-frame` paths, exposed when running the Gatsby develop server (`gatsby develop`).

The following steps can be used to reproduce the vulnerability:

```
# Create a new Gatsby project
$ npm init gatsby
$ cd my-gatsby-site

# Start the Gatsby develop server
$ gatsby develop

# Execute the Local File Inclusion vulnerability in __file-code-frame
$ curl "http://127.0.0.1:8000/__file-code-frame?filePath=/etc/passwd&lineNumber=1"

# Execute the Local File Inclusion vulnerability in __original-stack-frame
$ curl "http://127.0.0.1:8000/__original-stack-frame?moduleId=/etc/hosts&lineNumber=1&skipSourceMap=1"
```

It should be noted that by default `gatsby develop` is only accessible via the localhost `127.0.0.1`, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as `--host 0.0.0.0`, `-H 0.0.0.0`, or the `GATSBY_HOST=0.0.0.0` environment variable.


### Patches

A patch has been introduced in `gatsby@5.9.1` and `gatsby@4.25.7` which mitigates the issue.


### Workarounds

As stated above, by default `gatsby develop` is only exposed to the localhost `127.0.0.1`.  For those using the develop server in the default configuration no risk is posed.  If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.


### Credits

We would like to thank Maxwell Garrett of Assetnote for bringing the `__file-code-frame` issue to our attention.


### For more information

Email us at [security@gatsbyjs.com](mailto:security@gatsbyjs.com).
Vulnerable OpenSSL included in cryptography wheels (GHSA-5cpq-8wj7-hf2v)
Published: 2023-06-02T17:13:10Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'cryptography'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.5'}, {'fixed': '41.0.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 40.0.2'}}]

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.5-40.0.2 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://www.openssl.org/news/secadv/20230530.txt.

If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
NodCMS Cross Site Scripting vulnerability (GHSA-7xqx-xwg9-jx34)
Aliases: CVE-2020-20697
Published: 2023-06-20T15:31:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'khodakhah/nodcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.0'}]}]}]

Cross Site Scripting vulnerability in khodakhah NodCMS v.3.0 allows an attacker with administrative privileges to execute arbitrary code and gain access to sensitive information via a crafted script to the address parameter.
Moodle vulnerable to SQL Injection (GHSA-49mv-vfcp-8gg9)
Aliases: CVE-2023-35132
Published: 2023-06-22T21:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.1'}]}], 'versions': ['4.2.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.4'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.9'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0'}, {'fixed': '3.11.15'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.22'}]}]}]

A limited SQL injection risk was identified on the Mnet SSO access control page. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
TeamPass vulnerable to Improper Access Control (GHSA-g3jr-6vj4-3x82)
Aliases: CVE-2023-3095
Published: 2023-06-04T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
Moodle vulnerable to Server Side Request Forgery (GHSA-xxp4-mf4h-6cwm)
Aliases: CVE-2023-35133
Published: 2023-06-22T21:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.1'}]}], 'versions': ['4.2.0']}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.4'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.9'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0'}, {'fixed': '3.11.15'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.22'}]}]}]

An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.
flatnest Prototype Pollution vulnerability (GHSA-7px2-3c2p-q4v4)
Aliases: CVE-2023-26135
Published: 2023-06-30T06:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'flatnest'}, 'ecosystem_specific': {'affected_functions': ['flatnest.nest']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.0'}]}]}]

All versions of the package flatnest are vulnerable to Prototype Pollution via the `nest()` function in `flatnest/nest.js` file.
Solon vulnerable to deserialization of untrusted data (GHSA-7q8c-49f4-4c8q)
Aliases: CVE-2023-35839
Published: 2023-06-19T03:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.noear:solon'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.3'}]}]}]

Solon before 2.3.3 allows Deserialization of Untrusted Data.
XWiki Platform vulnerable to reflected cross-site scripting via back and xcontinue parameters in resubmit template (GHSA-r8xc-xxh3-q5x3)
Aliases: CVE-2023-35160
Published: 2023-06-22T19:59:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5-milestone-2'}, {'fixed': '14.10.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-web-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1-rc-1'}]}]}]

### Impact
Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS).
It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as:

 > xwiki/bin/view/XWiki/Main?xpage=resubmit&resubmit=javascript:alert(document.domain)&xback=javascript:alert(document.domain)

This vulnerability exists since XWiki 2.5-milestone-2.

### Patches

The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

### Workarounds

It's possible to workaround the vulnerability by editing the template resubmit.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets.

### References

  * Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20343
  * Introduction of the macro used for fixing all those vulnerabilities: https://jira.xwiki.org/browse/XWIKI-20583
  * Commit containing the actual fix in the page: https://github.com/xwiki/xwiki-platform/commit/dbc92dcdace33823ffd1e1591617006cb5fc6a7f

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been reported by René de Sain @renniepak.
Langchain OS Command Injection vulnerability (GHSA-x32c-59v5-h7fg)
Aliases: CVE-2023-34540
Published: 2023-06-14T15:30:39Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['langchain.utilities.jira.JiraAPIWrapper.run']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.225'}]}]}]

Langchain 0.0.171 is vulnerable to Arbitrary Code Execution via command injection in the `jira.run()` command
@keystone-6/core's bundled cuid package known to be insecure (GHSA-5fp6-4xw3-xqq3)
Published: 2023-06-12T18:37:31Z
Affected: [{'package': {'ecosystem': 'npm', 'name': '@keystone-6/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.3.1'}]}]}]

### Summary
The `cuid` package used by `@keystone-6/*` and upstream dependencies is deprecated and [marked as insecure by the author](https://github.com/paralleldrive/cuid#status-deprecated-due-to-security-use-cuid2-instead).

As reported by the author
> Cuid and other k-sortable and non-cryptographic ids (Ulid, ObjectId, KSUID, all UUIDs) are all insecure. Use @paralleldrive/cuid2 instead.

### What are doing about this?
- [We are waiting on Prisma](https://github.com/keystonejs/keystone/issues/8282) to add support for [`cuid2`](https://github.com/paralleldrive/cuid2)
- Alternatively, we might default to a random string ourselves

### What can I do about this?
We have added a work-around for users who want to provide custom identifiers in https://github.com/keystonejs/keystone/pull/8645

### What if I need a `cuid`?
The features marked as a security vulnerability by @paralleldrive are sometimes actually needed ([as written in the README of `cuid`](https://github.com/paralleldrive/cuid#motivation)) - the problem is the inherent risks that features like this can have.

You might actually want the features of a monotonically increasing (auto-increment, k-sortable), and timestamp-based id as part of your application, and keystone should support that - but you might not want them by _default_.
This is why this security advisory has been accepted by me (@dcousens), we currently use cuid identifiers by default, and that should change.

### Impact
I have accepted this security advisory on the basis that we don't need this kind of identifier typically, and the need for them should be driven by an application's requirements, not a convenient default.
github.com/lestrrat-go/jwx vulnerable to Potential Padding Oracle Attack (GHSA-rm8v-mxj3-5rmq)
Published: 2023-06-14T17:24:36Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/lestrrat-go/jwx/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.11'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.0.10'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/lestrrat-go/jwx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.26'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.2.25'}}]

### Summary

Decrypting AES-CBC encrypted JWE has Potential Padding Oracle Attack Vulnerability.

### Details

On [v2.0.10](https://github.com/lestrrat-go/jwx/releases/tag/v2.0.10), decrypting AES-CBC encrypted JWE may return an error "failed to generate plaintext from decrypted blocks: invalid padding":

https://github.com/lestrrat-go/jwx/blob/8840ffd4afc5839f591ff0e9ba9034af52b1643e/jwe/internal/aescbc/aescbc.go#L210-L213

Reporting padding error causes [Padding Oracle Attack](https://en.wikipedia.org/wiki/Padding_oracle_attack) Vulnerability.
RFC 7516 JSON Web Encryption (JWE) says that we **MUST NOT** do this.

> 11.5.  Timing Attacks
> To mitigate the attacks described in RFC 3218 [RFC3218], the
> recipient MUST NOT distinguish between format, padding, and length
> errors of encrypted keys.  It is strongly recommended, in the event
> of receiving an improperly formatted key, that the recipient
> substitute a randomly generated CEK and proceed to the next step, to
> mitigate timing attacks.

In addition, the time to remove padding depends on the length of the padding.
It may leak the length of the padding by Timing Attacks.

https://github.com/lestrrat-go/jwx/blob/796b2a9101cf7e7cb66455e4d97f3c158ee10904/jwe/internal/aescbc/aescbc.go#L33-L66

To mitigate Timing Attacks, it MUST be done in constant time.

### Impact

The authentication tag is verified, so it is not an immediate attack.
fast-xml-parser vulnerable to Regex Injection via Doctype Entities (GHSA-6w63-h3fj-q4vw)
Aliases: CVE-2023-34104
Published: 2023-06-06T17:33:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'fast-xml-parser'}, 'ecosystem_specific': {'affected_functions': ['fast-xml-parser.XMLParser']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.4'}]}]}]

### Impact
"fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time.

### Patches
The problem has been resolved in v4.2.4

### Workarounds
Avoid using DOCTYPE parsing by `processEntities: false` option.

### References
_Are there any links users can visit to find out more?_
Sealos billing system permission control defect (GHSA-vpxf-q44g-w34w)
Aliases: CVE-2023-36815
Published: 2023-06-30T20:36:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/labring/sealos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.2.0'}]}]}]

### Summary

There is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account. sealos. io/v1/Payment, resulting in the ability to recharge any amount of 1 RMB.

### Details

The reason is that sealos is in arrears. Egg pain, we can't create a terminal anymore. Let's charge for it:

Then it was discovered that the charging interface had returned all resource information. Unfortunately, based on previous vulnerability experience, the namespace of this custom resource is still under the current user's control and may have permission to correct it.

### PoC
disable by publish

### Impact

+ sealos public cloud user
+ CWE-287 Improper Authentication
TeamPass vulnerable to stored Cross-site Scripting (GHSA-c6fv-3jm9-6r8f)
Aliases: CVE-2023-3083
Published: 2023-06-03T09:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.9.
thorsten/phpmyfaq is vulnerable to cross-site scripting (XSS) (GHSA-6449-vf6p-9hfp)
Aliases: CVE-2023-0312
Published: 2023-01-16T00:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
Withdrawn: safeurl-python contains Server-Side Request Forgery (GHSA-rw83-v3pw-m362)
Published: 2023-01-30T06:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'safeurl-python'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2'}]}]}]

## Withdrawn

This advisory has been withdrawn as a duplicate of [GHSA-jgh8-vchw-q3g7](https://github.com/advisories/GHSA-jgh8-vchw-q3g7).

## Original Description

isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leading to SSRF.
Froxlor contains Static Code Injection (GHSA-w7w4-qjgg-372x)
Aliases: CVE-2023-0566
Published: 2023-01-30T00:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.10'}]}]}]

Static Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.
XpressEngine vulnerable to Unrestricted Upload of File with Dangerous Type (GHSA-8r5j-22j5-w4cm)
Aliases: CVE-2021-26642
Published: 2023-01-20T18:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'xpressengine/xpressengine'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.15'}]}]}]

When uploading an image file to a bulletin board developed with XpressEngine, a vulnerability in which an arbitrary file can be uploaded due to insufficient verification of the file. A remote attacker can use this vulnerability to execute arbitrary code on the server where the bulletin board is running.
Squalor SQL Injection vulnerability (GHSA-3hc7-2xcc-7p8f)
Aliases: CVE-2020-36645
Published: 2023-01-07T21:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/square/squalor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0'}]}]}]

A vulnerability, which was classified as critical, was found in square squalor. This affects an unknown part. The manipulation leads to sql injection. Upgrading to version v0.0.0 is able to address this issue. The name of the patch is f6f0a47cc344711042eb0970cb423e6950ba3f93. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217623.
Duplicate of GHSA-4xh4-v2pq-jvhm (GHSA-9f2c-xxfm-32mj)
Published: 2023-01-11T06:30:20Z
Affected: [{'package': {'ecosystem': 'Pub', 'name': 'personnummer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.3'}]}]}]

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of [GHSA-4xh4-v2pq-jvhm](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm). This link is maintained to preserve external references.

## Original Description

The personnummer implementation before 3.0.3 for Dart mishandles numbers in which the last four digits match the ^000[0-9]$ regular expression.
Session fixation vulnerability in Jenkins OpenID Plugin  (GHSA-f976-24hc-mjvr)
Aliases: CVE-2023-24444
Published: 2023-01-26T21:30:18Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:openid'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4'}]}]}]

Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.