aswin1906/github-advisory-2023 huggingface dataset:
XWiki Platform users may execute anything with superadmin right through comments and async macro (GHSA-9cqm-5wf7-wcj7)
Aliases: CVE-2023-26471
Published: 2023-03-03T22:49:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-async-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.6-rc-1'}, {'fixed': '13.10.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-async-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-async-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.9'}]}]}]

### Impact

Comments are supposed to be executed with the right of superadmin but in restricted mode (anything dangerous is disabled) but the async macro is not taking into account the restricted mode.

This means that any user with comment right can use the async macro to make it execute any wiki content with the right of superadmin as in:

{{async}}
{{groovy}}println "it works !"{{/groovy}}
{{/async}}

### Patches

This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.

### Workarounds

The only known workaround consists in applying [the following patch](https://github.com/xwiki/xwiki-platform/commit/00532d9f1404287cf3ec3a05056640d809516006) and rebuilding and redeploying `org.xwiki.platform:xwiki-platform-rendering-async-macro`.

### References

* https://jira.xwiki.org/browse/XWIKI-20234

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
thorsten/phpmyfaq vulnerable privilege escalation from improper privilege management  (GHSA-xww4-w6ff-5q3g)
Aliases: CVE-2023-1762
Published: 2023-03-31T03:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to privilege escalation from improper privilege management. Any user with the ability to add a new user can create a user with super admin rights. This has been fixed in 3.1.12.
Cross-site Scripting in django-ajax-utilities (GHSA-p4g9-c9qr-wmg5)
Aliases: CVE-2017-20182
Published: 2023-03-10T03:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'django-ajax-utilities'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.8'}]}]}]

A vulnerability was found in Mobile Vikings Django AJAX Utilities and classified as problematic. This issue affects the function Pagination of the file django_ajax/static/ajax-utilities/js/pagination.js of the component Backslash Handler. The manipulation of the argument url leads to cross site scripting. The attack may be initiated remotely. The patch is on commit  329eb1dd1580ca1f9d4f95bc69939833226515c9 which has been inclused in release 1.2.8. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-222611.
Cross-site Scripting (XSS) in pimcore/pimcore (GHSA-8jv7-vwrc-mv4g)
Aliases: CVE-2023-1286
Published: 2023-03-09T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.19.
Spring Framework vulnerable to denial of service via specially crafted SpEL expression (GHSA-564r-hj7v-mcr5)
Aliases: CVE-2023-20861
Published: 2023-03-23T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework:spring-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework:spring-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.3.0'}, {'fixed': '5.3.26'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework:spring-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.2.23.RELEASE'}]}]}]

In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial-of-service (DoS) condition.
Moodle vulnerable to Cross-site Scripting (GHSA-77jm-f3vj-xvx2)
Aliases: CVE-2023-28331
Published: 2023-03-23T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.13'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.20'}]}]}]

Content output by the database auto-linking filter required additional sanitizing to prevent an XSS risk.
`out_reference::Out::from_raw` should be `unsafe` (GHSA-p7mj-xvxg-grff)
Published: 2023-03-13T20:49:24Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'out-reference'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.0'}, {'fixed': '0.2.0'}]}]}]

`Out::from_raw` in affected versions allows writing a value to invalid memory address without requiring `unsafe`.

The soundness issue has been addressed by making `Out::from_raw` an unsafe function.
Reflected XSS in Application Logger module (GHSA-2xpm-cmvw-3jcc)
Published: 2023-03-16T18:34:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14606.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14606.patch manually.

### References
https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356/
Arbitrary local file read vulnerability during template rendering  (GHSA-2rq5-699j-x7p6)
Aliases: CVE-2023-25345
Published: 2023-03-15T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'swig-templates'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.4'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'swig'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.2'}]}]}]

Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the include or extends tags.
Stud42 vulnerable to denial of service (GHSA-3hwm-922r-47hw)
Published: 2023-03-31T19:33:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'atomys.codes/stud42'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.23.0'}]}]}]

A security vulnerability has been identified in the GraphQL parser used by the API of s42.app. An attacker can overload the parser and cause the API pod to crash. With a bit of threading, the attacker can bring down the entire API, resulting in an unhealthy stream. This vulnerability can be exploited by sending a specially crafted request to the API with a large payload.

An attacker can exploit this vulnerability to cause a denial of service (DoS) attack on the s42.app API, resulting in unavailability of the API for legitimate users.
angular vulnerable to regular expression denial of service via the angular.copy() utility (GHSA-2vrf-hf26-jrp5)
Aliases: CVE-2023-26116
Published: 2023-03-30T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'angular'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.8.3'}]}]}]

All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility function due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
OpenZeppelin Contracts contains Incorrect Calculation (GHSA-878m-3g6q-594q)
Aliases: CVE-2023-26488
Published: 2023-03-03T20:02:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.8.0'}, {'fixed': '4.8.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@openzeppelin/contracts-upgradeable'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.8.0'}, {'fixed': '4.8.2'}]}]}]

### Impact

The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by `balanceOf`.

The issue exclusively presents with batches of size 1.

### Patches

The issue has been patched in 4.8.2.

<!-- ### References -->
Duplicate Advisory: Grafana Stored Cross-site Scripting vulnerability (GHSA-3cgw-hfw7-wc7j)
Published: 2023-03-23T09:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.5.22'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.2.15'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.3.0'}, {'fixed': '9.3.11'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-qrrg-gw7w-vp76](https://github.com/advisories/GHSA-qrrg-gw7w-vp76). This link is maintained to preserve external references.

## Original Description
Grafana is an open-source platform for monitoring and observability. Grafana had a stored XSS vulnerability in the Graphite FunctionDescription tooltip. The stored XSS vulnerability was possible due the value of the Function Description was not properly sanitized. An attacker needs to have control over the Graphite data source in order to manipulate a function description and a Grafana admin needs to configure the data source, later a Grafana user needs to select a tampered function and hover over the description. Users may upgrade to version 8.5.22, 9.2.15 and 9.3.11 to receive a fix.
Duplicate Advisory: pullit Command Injection vulnerability (GHSA-2w9p-xf5h-qwj3)
Published: 2023-03-27T03:30:16Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'pullit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}]}], 'database_specific': {'last_known_affected_version_range': '< 1.4.0'}}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-8px5-63x9-5c7p](https://github.com/advisories/GHSA-8px5-63x9-5c7p). This link is maintained to preserve external references.

## Original Description
The pullit package before 1.4.0 for Node.js allows OS Command Injection because `eval()` is used on an attacker-supplied Git branch name.
Juju controller - Arbitrary file reading vulnerability (GHSA-x5rv-w9pm-8qp8)
Aliases: CVE-2023-0092
Published: 2023-03-01T19:17:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/juju/juju'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.22'}, {'fixed': '2.9.38'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/juju/juju'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.3'}]}]}]

### Impact
An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.

### Patches
Patched in juju 2.9.38 and juju 3.0.3
[juju/juju#ef803e2](https://github.com/juju/juju/commit/ef803e2a13692d355b784b7da8b4b1f01dab1556)

### Workarounds
Limit read access to the controller model to only trusted users.
phpseclib Infinite Loop vulnerability (GHSA-hm7p-r324-hhf3)
Aliases: CVE-2023-27560
Published: 2023-03-03T06:30:17Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'phpseclib/phpseclib'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.19'}]}]}]

Math/PrimeField.php in phpseclib has an infinite loop with composite primefields. This vulnerability was introduced in version 3.0.0, and has been patched in 3.0.19. The CVE for this issue originally identified the the vulnerable version as 2.x, however, the vulnerable functionality was not introduced until version 3.
teler-waf subject to Bypass of Common Web Attack Threat Rule with HTML Entities Payload (GHSA-9f95-hhg4-pg4f)
Aliases: CVE-2023-26046
Published: 2023-03-01T19:19:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kitabisa/teler-waf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.1'}]}]}]

### Description

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. Versions prior to v0.1.1 are vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application. The vulnerability exists due to teler-waf failure to properly sanitize and filter HTML entities in user input.

### Impact

An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions.

### Patches

Version [v0.1.1](https://github.com/kitabisa/teler-waf/releases/tag/v0.1.1) includes a patch for this vulnerability.

### Workarounds

We advised updating their installations to version `v0.1.1` and frontwards immediately.
tripleo-ansible may disclose important configuration details from an OpenStack deployment (GHSA-w4x6-6w3r-9h2m)
Aliases: CVE-2022-3146
Published: 2023-03-23T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tripleo-ansible'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '6.0.0'}]}]}]

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file. This issue leads to information disclosure of important configuration details from the OpenStack deployment.
Moodle SQL Injection vulnerability (GHSA-72w2-j52c-7682)
Aliases: CVE-2023-28329
Published: 2023-03-23T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.13'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.20'}]}]}]

Insufficient validation of profile field availability condition resulted in an SQL injection risk (by default only available to teachers and managers).
Potential network policy bypass when routing IPv6 traffic  (GHSA-8fg8-jh2h-f2hc)
Aliases: CVE-2023-27594
Published: 2023-03-17T18:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.15'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.8'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.1'}]}]}]

## Impact

Under specific conditions, Cilium may misattribute the source IP address of traffic to a cluster, identifying external traffic as coming from the host on which Cilium is running. As a consequence, network policies for that cluster might be bypassed, depending on the specific network policies enabled. Only IPv6 traffic is impacted by this vulnerability.

This issue only manifests when:
* Cilium is routing IPv6 traffic, and
* Kube-proxy is used for service handling, and
* NodePorts are used to route traffic to pods.

IPv6 is disabled by default. Cilium's kube-proxy replacement feature is not affected by this vulnerability.

## Patches

The problem has been fixed and is available on versions >=1.11.15, >=1.12.8, >=1.13.1

## Workarounds

Disable IPv6 routing (IPv6 is disabled by default).

## Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to Yusuke Suzuki for both highlighting and fixing the issue.

## For more information

If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
Cilium eBPF filters may be temporarily removed during agent restart (GHSA-r5x6-w42p-jhpp)
Aliases: CVE-2023-27595
Published: 2023-03-17T18:22:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.1'}]}]}]

### Impact

When Cilium is started, there is a short period when Cilium eBPF programs are not attached to the host. During this period, the host does not implement any of Cilium's featureset. This can cause disruption to newly established connections during this period due to the lack of Load Balancing, or can cause Network Policy bypass due to the lack of Network Policy enforcement during the window. This vulnerability impacts any Cilium-managed endpoints on the node (such as Kubernetes Pods), as well as the host network namespace (including Host Firewall).

### Patches

This vulnerability is fixed by https://github.com/cilium/cilium/pull/24336, included in Cilium 1.13.1 or later. Cilium releases 1.12.x, 1.11.x and earlier are not affected.

### Workarounds

There are no known workarounds.

### Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to Louis DeLosSantos and Timo Beckers for investigating and fixing the issue.

### For more information

If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
Sensitive Information in Error Messages in Apache Airflow (GHSA-h6g5-wqqr-3mw3)
Aliases: CVE-2023-25695
Published: 2023-03-15T12:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.2'}]}]}]

Generation of Error Message Containing Sensitive Information vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.5.2. The traceback contains information that might be useful for a potential attacker to better target their attack (Python/Airflow version, node name). This information should not be shown if traceback is shown to unauthenticated user.
Pimcore vulnerable to Cross Site Scripting in Documents Link Editable (GHSA-97cp-8873-v2gf)
Aliases: CVE-2023-1115
Published: 2023-03-01T23:02:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.18'}]}]}]

### Impact
An attacker can use XSS to send a malicious script to any user through Document Page Link Editable -> Advanced -> Attributes

### Patches
Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/pull/14500.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14500.patch manually.

### References
https://huntr.dev/bounties/cfa80332-e4cf-4d64-b3e5-e10298628d17/
Duplicate Advisory: pimcore is vulnerable to cross-site scripting in classes module (GHSA-3r5c-h7g6-cqw7)
Published: 2023-03-29T18:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.20'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-4f25-2x2c-vg6v](https://github.com/advisories/GHSA-4f25-2x2c-vg6v). This link is maintained to preserve external references.

## Original Description
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
Teampass SQL Injection vulnerability (GHSA-ppxm-q2h4-v7mm)
Aliases: CVE-2023-1545
Published: 2023-03-21T12:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0.22'}]}]}]

SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.22.
Cross site scripting vulnerability in update-center2  (GHSA-pqg3-xfx2-fmqp)
Aliases: CVE-2023-27905
Published: 2023-03-10T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci:update-center2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.13'}, {'fixed': '3.15'}]}]}]

Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.
TensorFlow vulnerable to seg fault in `tf.raw_ops.Print` (GHSA-qjqc-vqcf-5qvj)
Aliases: CVE-2023-25660
Published: 2023-03-24T21:58:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
When the parameter `summarize` of `tf.raw_ops.Print` is zero, the new method `SummarizeArray<bool>` will reference to a nullptr, leading to a seg fault.

```python
import tensorflow as tf

tf.raw_ops.Print(input =  tf.constant([1, 1, 1, 1],dtype=tf.int32),
                            data =  [[False, False, False, False], [False], [False, False, False]],
                            message =  'tmp/I',
                            first_n = 100,
                            summarize = 0)
```

### Patches
We have patched the issue in GitHub commit [6d423b8bcc9aa9f5554dc988c1c16d038b508df1](https://github.com/tensorflow/tensorflow/commit/6d423b8bcc9aa9f5554dc988c1c16d038b508df1).

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team
Gophish vulnerable to Cross-site Scripting via crafted landing page (GHSA-55m9-hm92-xm8j)
Aliases: CVE-2022-45004
Published: 2023-03-22T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gophish/gophish'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.12.1'}]}]}]

Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.
`cilium-cli` disables etcd authorization for clustermesh clusters (GHSA-6f27-3p6c-p5jc)
Aliases: CVE-2023-28114
Published: 2023-03-21T22:30:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium-cli'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.13.2'}]}]}]

### Impact

`cilium-cli`, when used to configure cluster mesh functionality, can remove the enforcement of user permissions on the `etcd` store used to mirror local cluster information to remote clusters. 

Due to an incorrect mount point specification, the settings specified by the `initContainer` that configures `etcd` users and their permissions are overwritten when using `cilium-cli` to configure a cluster mesh. An attacker who has already gained access to a valid key and certificate for an `etcd` cluster compromised in this manner could then modify state in that `etcd` cluster.

### Patches

This issue is patched in `cilium-cli` 0.13.2

All previous versions of `cilium-cli` are affected. Users who have set up cluster meshes using the Cilium Helm chart are not affected.

### Workarounds

Use Cilium's [Helm charts](https://artifacthub.io/packages/helm/cilium/cilium) to create your cluster instead.

### Acknowledgements

The Cilium community has worked together with members of Isovalent to prepare these mitigations. Special thanks to Marco Iorio for investigating and fixing the issue.

### For more information
If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: [security@cilium.io](mailto:security@cilium.io) - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
Ruby URI component ReDoS issue (GHSA-hv5j-3h9f-99c2)
Aliases: CVE-2023-28755
Published: 2023-03-31T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'uri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.12.0'}, {'fixed': '0.12.1'}]}], 'versions': ['0.12.0']}, {'package': {'ecosystem': 'RubyGems', 'name': 'uri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.11.0'}, {'fixed': '0.11.1'}]}], 'versions': ['0.11.0']}, {'package': {'ecosystem': 'RubyGems', 'name': 'uri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.10.1'}, {'fixed': '0.10.2'}]}], 'versions': ['0.10.1']}, {'package': {'ecosystem': 'RubyGems', 'name': 'uri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.0.1'}]}]}]

A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. The URI parser mishandles invalid URLs that have specific characters. It causes an increase in execution time for parsing strings to URI objects. The fixed versions are 0.12.1, 0.11.1, 0.10.2 and 0.10.0.1.
smarty Cross-site Scripting vulnerability in Javascript escaping  (GHSA-7j98-h7fp-4vwj)
Aliases: CVE-2023-28447
Published: 2023-03-29T18:31:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'smarty/smarty'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.3.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'smarty/smarty'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.48'}]}]}]

### Impact
An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthorized access to sensitive user data, manipulation of the web application's behavior, or unauthorized actions performed on behalf of the user.

### Patches
Please upgrade to the most recent version of Smarty v3 or v4.

### For more information
If you have any questions or comments about this advisory please open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Mattermost vulnerable to information disclosure  (GHSA-8jhh-3jf2-pfwr)
Aliases: CVE-2023-1775
Published: 2023-03-31T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.3.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.10.10'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.7.0'}, {'fixed': '7.7.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.7.1'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.1.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.1.5'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.39.3'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.7.2'}}]

When running in a High Availability configuration, Mattermost fails to sanitize some of the `user_updated` and` post_deleted` events broadcast to all users, leading to disclosure of sensitive information to some of the users with currently connected Websocket clients.

[Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00138
Moodle Cross-site Scripting vulnerability (GHSA-786g-xv8v-9h93)
Aliases: CVE-2021-36398
Published: 2023-03-07T00:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11'}, {'fixed': '3.11.1'}]}], 'versions': ['3.11']}]

In Moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.
directus vulnerable to HTML Injection in Password Reset email to custom Reset URL (GHSA-4hmq-ggrm-qfc6)
Aliases: CVE-2023-27474
Published: 2023-03-07T20:35:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'directus'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.23.0'}]}]}]

### Impact

Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. 

### Patches

The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or later, or remove the custom reset url from the configured allow list.

### Workarounds

Disable the custom reset URL allow list.
Snappier vulnerable to buffer overrun due to improper restriction of operations within the bounds of a memory buffer (GHSA-838x-pcvx-6p5w)
Aliases: CVE-2023-28638
Published: 2023-03-27T22:23:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'Snappier'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '1.1.1'}]}], 'versions': ['1.1.0']}]

### Impact
This is a buffer overrun vulnerability that can affect any user of Snappier 1.1.0. In this release, much of the code was rewritten to use byte references rather than pointers to pinned buffers. This change generally improves performance and reduces workload on the garbage collector. However, when the garbage collector performs compaction and rearranges memory, it must update any byte references on the stack to refer to the updated location. The .NET garbage collector can only update these byte references if they still point within the buffer or to a point one byte past the end of the buffer. If they point outside this area, the buffer itself may be moved while the byte reference stays the same.

There are several places in 1.1.0 where byte references very briefly point outside the valid areas of buffers. These are at locations in the code being used for buffer range checks. While the invalid references are never dereferenced directly, if a GC compaction were to occur during the brief window when they are on the stack then it could invalidate the buffer range check and allow other operations to overrun the buffer.

This should be very difficult for an attacker to trigger intentionally. It would require a repetitive bulk attack with the hope that a GC compaction would occur at precisely the right moment during one of the requests. However, one of the range checks with this problem is a check based on input data in the decompression buffer, meaning malformed input data could be used to increase the chance of success.

Note that any resulting buffer overrun is likely to cause access to protected memory, which will then cause an exception and the process to be terminated. Therefore, the most likely result of an attack is a denial of service.

### Patches
This is patched in release 1.1.1.

### Workarounds
Pinning any buffers to a fixed location before using them for compression or decompression should mitigate some, but not all, of these cases. At least one temporary decompression buffer is internal to the library and never pinned.
Kubernetes vulnerable to path traversal (GHSA-2394-5535-8j88)
Aliases: CVE-2022-3162
Published: 2023-03-01T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.25.0'}, {'fixed': '1.25.4'}]}], 'database_specific': {'last_known_affected_version_range': '< 1.25.3'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.24.0'}, {'fixed': '1.24.8'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.23.0'}, {'fixed': '1.23.14'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.22.0'}, {'fixed': '1.22.16'}]}]}]

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
Answer vulnerable to Cross-site Scripting (GHSA-5w78-v688-cx9q)
Aliases: CVE-2023-1238
Published: 2023-03-07T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
TensorFlow has Floating Point Exception in TFLite in conv kernel (GHSA-5w96-866f-6rm8)
Aliases: CVE-2023-27579
Published: 2023-03-24T21:53:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
Constructing a tflite model with a paramater `filter_input_channel` of less than 1 gives a FPE.


### Patches
We have patched the issue in GitHub commit [34f8368c535253f5c9cb3a303297743b62442aaa](https://github.com/tensorflow/tensorflow/commit/34f8368c535253f5c9cb3a303297743b62442aaa).

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability was reported by Wang Xuan of Qihoo 360 AIVul Team.
Veracode Scan Jenkins Plugin vulnerable to information disclosure (GHSA-c4jr-vjm4-27hq)
Aliases: CVE-2023-25721
Published: 2023-03-28T21:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.veracode.jenkins:veracode-scan'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.3.19.0'}]}]}]

Veracode Scan Jenkins Plugin before 23.3.19.0 is vulnerable to information disclosure of proxy credentials in job logs under specific configurations.

Users are potentially affected if they:
- are using Veracode Scan Jenkins Plugin prior to 23.3.19.0
- AND have configured Veracode Scan to run on remote agent jobs
- AND have enabled the "Connect using proxy" option
- AND have configured the proxy settings with proxy credentials
- AND a Jenkins admin has enabled debug in global system settings.

By default, even in this configuration only the job owner or Jenkins admin can view the job log.
Moodle may allow students to bypass sequential navigation during a quiz attempt (GHSA-948f-j464-rfj2)
Aliases: CVE-2022-40208
Published: 2023-03-24T21:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.3'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.9'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.16'}]}]}]

In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.
Versionize::deserialize implementation for FamStructWrapper<T> is lacking bound checks, potentially leading to out of bounds memory accesses (GHSA-8vxc-r5wp-vgvc)
Aliases: CVE-2023-28448
Published: 2023-03-24T22:00:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'versionize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.1'}, {'fixed': '0.1.10'}]}]}]

### Impact

An issue was discovered in the `Versionize::deserialize` implementation provided by the `versionize` crate for `vmm_sys_util::fam::FamStructWrapper`, which can lead to out of bounds memory accesses.

### Patches

The impact started with version 0.1.1. The issue was corrected in version 0.1.10 by inserting a check that verifies, for any deserialized header, the lengths of compared flexible arrays are equal and aborting deserialization otherwise.

### Workarounds
\-

### References
- https://github.com/firecracker-microvm/versionize/pull/53
SQL Injection in Funadmin (GHSA-pvp6-53r9-8vxh)
Aliases: CVE-2023-24777
Published: 2023-03-09T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'funadmin/funadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.2.0'}]}]}]

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.
TensorFlow has double free in Fractional(Max/Avg)Pool (GHSA-f49c-87jh-g47q)
Aliases: CVE-2023-25801
Published: 2023-03-24T21:53:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
`nn_ops.fractional_avg_pool_v2` and `nn_ops.fractional_max_pool_v2` require the first and fourth elements of their parameter `pooling_ratio` to be equal to 1.0, as pooling on batch and channel dimensions is not supported.

```python
import tensorflow as tf
import os
import numpy as np
from tensorflow.python.ops import nn_ops
try:
  arg_0_tensor = tf.random.uniform([3, 30, 50, 3], dtype=tf.float64)
  arg_0 = tf.identity(arg_0_tensor)
  arg_1_0 = 2
  arg_1_1 = 3
  arg_1_2 = 1
  arg_1_3 = 1
  arg_1 = [arg_1_0,arg_1_1,arg_1_2,arg_1_3,]
  arg_2 = True
  arg_3 = True
  seed = 341261001
  out = nn_ops.fractional_avg_pool_v2(arg_0,arg_1,arg_2,arg_3,seed=seed,)
except Exception as e:
  print("Error:"+str(e))
```

### Patches
We have patched the issue in GitHub commit [ee50d1e00f81f62a4517453f721c634bbb478307](https://github.com/tensorflow/tensorflow/commit/ee50d1e00f81f62a4517453f721c634bbb478307).

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability was reported by [dmc1778](https://github.com/dmc1778), of [nimashiri2012@gmail.com](mailto:nimashiri2012@gmail.com).
Moodle vulnerable to Stored Cross-site Scripting (GHSA-g6h6-4fp6-w33w)
Aliases: CVE-2021-36401
Published: 2023-03-07T00:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.
matrix-js-sdk Prototype Pollution vulnerability (GHSA-rfv9-x7hh-xc32)
Aliases: CVE-2022-36059
Published: 2023-03-28T18:59:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-js-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.4.0'}]}]}]

### Impact
Events sent with special strings in key places can temporarily disrupt or impede the matrix-js-sdk from functioning properly, potentially impacting the consumer's ability to process data safely. Note that the matrix-js-sdk can appear to be operating normally but be excluding or corrupting runtime data presented to the consumer.

### Patches
This is fixed in matrix-js-sdk 19.4.0.

### Workarounds
Redacting applicable events, waiting for the sync processor to store data, and restarting the client can often fix it. Alternatively, redacting the applicable events and clearing all storage will often fix most perceived issues.

In some cases, no workarounds are possible.

### References
https://learn.snyk.io/lessons/prototype-pollution/javascript/

### For more information
If you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:security@matrix.org).
Possible CSRF token fixation (GHSA-3g43-x7qr-96ph)
Aliases: CVE-2023-25170
Published: 2023-03-13T20:51:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.0.1'}]}]}]

### Impact
When authenticating users PrestaShop preserves session attributes. Because this does not clear CSRF tokens upon login, this might enables `same-site attackers` to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

### Patches
The problem is fixed in version 8.0.1