aswin1906/github-advisory-2023 huggingface dataset:
Answer has Observable Timing Discrepancy (GHSA-rvjp-8qj4-8p29)
Aliases: CVE-2023-1538
Published: 2023-03-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Observable Timing Discrepancy in GitHub repository answerdev/answer prior to 1.0.6.
OpenNMS Meridian and Horizon vulnerable to Cross-Site Request Forgery (GHSA-jxr6-7qg5-8wv6)
Aliases: CVE-2023-0870
Published: 2023-03-22T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms-webapp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '31.0.6'}]}]}]

A form can be manipulated with cross-site request forgery in multiple versions of OpenNMS Meridian and Horizon. This can potentially allow an attacker to gain access to confidential information and compromise integrity. The solution is to upgrade to Meridian 2023.1.1 or Horizon 31.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Moodle SQL Injection vulnerability (GHSA-qc86-vgf2-6fq6)
Aliases: CVE-2021-36392
Published: 2023-03-06T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.
Podman Time-of-check Time-of-use (TOCTOU) Race Condition (GHSA-qwqv-rqgf-8qh8)
Aliases: CVE-2023-0778
Published: 2023-03-27T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/containers/podman/v4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.4.2'}]}]}]

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.
Password Shucking Vulnerability (GHSA-c5vj-f36q-p9vg)
Aliases: CVE-2023-27580
Published: 2023-03-13T20:51:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'codeigniter4/shield'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0-beta.4'}]}]}]

### Impact
An improper implementation was found in the password storage process.

All hashed passwords stored in Shield v1.0.0-beta.3 or earlier are easier to crack than expected due to the vulnerability. Therefore, they should be removed as soon as possible.

If an attacker gets (1) the user's hashed password by Shield, and (2) the hashed password (SHA-384 hash without salt) from somewhere, the attacker may easily crack the user's password.

### Patches
Upgrade to Shield v1.0.0-beta.4 or later.

After upgrading, all users’ hashed passwords should be updated (saved to the database).
See https://github.com/codeigniter4/shield/blob/develop/UPGRADING.md for details.

### Workarounds
None.

### References
- https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#pre-hashing-passwords
- https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html
- https://www.scottbrady91.com/authentication/beware-of-password-shucking

### For more information
If you have any questions or comments about this advisory:
* Open an issue or discussion in [codeigniter4/shield](https://github.com/codeigniter4/shield)
* Email us at [security@codeigniter.com](mailto:security@codeigniter.com)
Moodle arbitrary file read vulnerability (GHSA-56r9-72vx-q989)
Aliases: CVE-2023-28330
Published: 2023-03-23T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.13'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.20'}]}]}]

Insufficient sanitizing in backup resulted in an arbitrary file read risk. The capability to access this feature is only available to teachers, managers and admins by default.
@nestjs/core vulnerable to Information Exposure via StreamableFile pipe (GHSA-4jpv-8r57-pv7j)
Aliases: CVE-2023-26108
Published: 2023-03-06T06:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@nestjs/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.0.5'}]}]}]

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.
Code Injection in alextselegidis/easyappointments (GHSA-9qvw-fhj2-xqmv)
Aliases: CVE-2023-1367
Published: 2023-03-13T09:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'alextselegidis/easyappointments'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.0'}]}]}]

Code Injection in GitHub repository alextselegidis/easyappointments prior to 1.5.0 due to unescaped output.
builderio/qwik is vulnerable to code injection (GHSA-9wf9-qvvp-2929)
Aliases: CVE-2023-1283
Published: 2023-03-09T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@builder.io/qwik'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.21.0'}]}]}]

Code Injection in GitHub repository builderio/qwik prior to 0.21.0. The Function deserializer can be accessed using the pureServerFunction feature. This allows any Javascript code to be run by node.js.
Duplicate Advisory: Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings (GHSA-6mmf-qm37-pmgg)
Published: 2023-03-29T18:30:29Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.20'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-7r35-chv4-xr3r](https://github.com/advisories/GHSA-7r35-chv4-xr3r). This link is maintained ot preserve external references.

## Original Description
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.
Comrak vulnerable to quadratic runtime issues when parsing Markdown (GHSL-2023-047) (GHSA-8hqf-xjwp-p67v)
Aliases: CVE-2023-28626
Published: 2023-03-28T14:40:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'comrak'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.0'}]}]}]

### Impact
A range of quadratic parsing issues from `cmark`/`cmark-gfm` are also present in Comrak. These can be used to craft denial-of-service attacks on services that use Comrak to parse Markdown.

### Patches
0.17.0 contains fixes to known quadratic parsing issues.

### Workarounds

n/a

### References

* https://github.com/commonmark/cmark/issues/255
* https://github.com/commonmark/cmark/issues/389
* https://github.com/commonmark/cmark/issues/373
* https://github.com/commonmark/cmark/issues/299
* https://github.com/commonmark/cmark/issues/388
* https://github.com/commonmark/cmark/issues/284
* https://github.com/commonmark/cmark/issues/218
* https://github.com/commonmark/cmark/pull/232
* https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py#L63-L65
* https://github.com/github/cmark-gfm/blob/c32ef78bae851cb83b7ad52d0fbff880acdcd44a/test/pathological_tests.py#L87-L89
GraphQL Java vulnerable to stack consumption (GHSA-p4qx-6w5p-4rj2)
Aliases: CVE-2023-28867
Published: 2023-03-27T03:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.graphql-java:graphql-java'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-2023-03-20T01-49-44-80e3135'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.graphql-java:graphql-java'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2'}, {'fixed': '17.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.graphql-java:graphql-java'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '18.0'}, {'fixed': '18.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.graphql-java:graphql-java'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '19.0'}, {'fixed': '19.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.graphql-java:graphql-java'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '20.0'}, {'fixed': '20.1'}]}], 'versions': ['20.0']}]

In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. The fixed versions are 20.1, 19.4, 18.4, 17.5, and 0.0.0-2023-03-20T01-49-44-80e3135.
jeecg-boot contains SQL Injection vulnerability (GHSA-qxpm-5ghc-6gc2)
Aliases: CVE-2023-24789
Published: 2023-03-06T18:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.4.4'}]}]}]

jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.
Payara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed (GHSA-xc93-587g-mxm7)
Aliases: CVE-2023-28462
Published: 2023-03-30T21:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'fish.payara.server:payara-aggregator'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.2020.1'}, {'fixed': '6.2022.1.Alpha3'}]}]}]

A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.
SQL Injection in Funadmin (GHSA-m8wf-wmwh-jw2m)
Aliases: CVE-2023-24773
Published: 2023-03-08T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'funadmin/funadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.2.0'}]}]}]

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.
Remote code execution in Funadmin (GHSA-7g53-jj25-jhgr)
Aliases: CVE-2023-24776
Published: 2023-03-06T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'funadmin/funadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.2.0'}]}]}]

Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.
Grafana vulnerable to Cross-site Scripting (GHSA-xw5p-hw8j-xg4q)
Aliases: CVE-2023-0594
Published: 2023-03-01T18:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '8.5.21'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.2.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.3.0'}, {'fixed': '9.3.8'}]}]}]

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.
TensorFlow has Floating Point Exception in TensorListSplit with XLA  (GHSA-647v-r7qq-24fh)
Aliases: CVE-2023-25673
Published: 2023-03-24T21:54:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
FPE in TensorListSplit with XLA 
```python
import tensorflow as tf

func = tf.raw_ops.TensorListSplit
para = {'tensor': [1], 'element_shape': -1, 'lengths': [0]}

@tf.function(jit_compile=True)
def fuzz_jit():
 y = func(**para)
 return y

print(fuzz_jit())
```

### Patches
We have patched the issue in GitHub commit [728113a3be690facad6ce436660a0bc1858017fa](https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx
OpenSearch has time discrepancy in authentication responses (GHSA-c6wg-cm5x-rqvj)
Aliases: CVE-2023-25806
Published: 2023-03-07T17:38:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opensearch.plugin:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.opensearch.plugin:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.6.0'}]}]}]

### Impact
There is an observable discrepancy in the authentication response time between calls where the user provided exists and calls where it does not. This issue only affects calls using the internal basic identity provider (IdP), and not other externally configured IdPs.

### Patches
OpenSearch 1.3.9 and 2.6.0

### Workarounds
None.

### References
If you have any questions or comments about this advisory, please contact AWS/Amazon Security using our issue reporting page [1] or directly via email [2]. Please do not create a public GitHub issue.

[1] AWS Security issue reporting page: https://aws.amazon.com/security/vulnerability-reporting/
[2] AWS Security email: [aws-security@amazon.com](mailto:aws-security@amazon.com)
Apache OpenMeetings missing authentication and can allow user impersonation  (GHSA-3r48-3m8r-4r9w)
Aliases: CVE-2023-28326
Published: 2023-03-28T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.openmeetings:openmeetings-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '7.0.0'}]}]}]

The Apache Software Foundation's OpenMeetings from 2.0.0 before 7.0.0 is missing authentication on meeting invitation URLs. An invitation URL contains a hash that automatically logs in as the invited user. An unauthorized user could obtain this URL and log in to the meeting as an invited user, in effect elevating their privileges in the meeting room. OpenMeetings 7.0.0 disables this option if a contact is not selected.
Mattermost fails to properly authentication inviter's permissions to private channel (GHSA-9hj7-v56g-rhf6)
Aliases: CVE-2023-1774
Published: 2023-03-31T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.3.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.10.10'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.7.0'}, {'fixed': '7.7.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.7.1'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.1.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.1.5'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.39.3'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.7.2'}}]

When processing an email invite to a private channel on a team, Mattermost fails to validate the inviter's permission to that channel, allowing an attacker to invite themselves to a private channel.

[Issue Identifier](https://mattermost.com/security-updates/): MMSA-2023-00137
Pimcore vulnerable to Cross Site Scripting in image/video thumbnail config (GHSA-qxcw-rf4v-hp26)
Aliases: CVE-2023-1117
Published: 2023-03-01T23:03:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.18'}]}]}]

### Impact
An attacker can use XSS to send a malicious script to any user through Image/Video thumbnail config

### Patches
Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/pull/14472.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14472.patch manually.

### References
https://huntr.dev/bounties/e8c0044d-a31b-4347-b2d5-59fbf492da39/
angular vulnerable to regular expression denial of service via the <input type="url"> element (GHSA-qwqh-hm9m-p5hr)
Aliases: CVE-2023-26118
Published: 2023-03-30T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'angular'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.8.3'}]}]}]

All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> element due to the usage of an insecure regular expression in the input[url] functionality. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files (GHSA-vhm8-wwrf-3gcw)
Aliases: CVE-2023-27577
Published: 2023-03-13T20:52:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'flarum/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.0'}]}]}]

### Impact
If an admin account has already been compromised by an attacker, the `LESS` parser can be exploited to read sensitive files on the server through the use of path traversal techniques.

An attacker can achieve this by providing an absolute path to a sensitive file in the custom `LESS` setting, which the `LESS` parser will then read. For example, an attacker could use the following code to read the contents of the `/etc/passwd` file:

```less
@import (inline) '/etc/passwd';

.test {
  content: data-uri('/etc/passwd');
}
```

### Patches
The vulnerability has been addressed in version `1.7`. Users should upgrade to this version to mitigate the vulnerability.

### Workarounds
Users can mitigate the vulnerability by ensuring that their admin accounts are secured with strong passwords and other best practices for account security. Additionally, users can limit the exposure of sensitive files on the server by implementing appropriate file permissions and access controls.
Craft CMS Stored Cross-site Scripting Injection Vulnerability (GHSA-qcrj-6ffc-v7hq)
Aliases: CVE-2023-23927
Published: 2023-03-03T22:45:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-RC1'}, {'fixed': '4.3.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.7.24'}, {'fixed': '3.7.64'}]}]}]

### Summary
_When you insert a payload inside a label name or instruction of an entry type, an XSS happens in the quick post widget on the 
admin dashboard._



### PoC
[_Complete instructions, including specific configuration details, to reproduce the vulnerability._](https://user-images.githubusercontent.com/53917092/215604129-d5b75608-5a24-4eb3-906f-55b192310298.mp4)

### Impact
Tested with the free version of Craft CMS 4.3.6.1
Argo CD authenticated but unauthorized users may enumerate Application names via the API (GHSA-2q5c-qw9c-fmvq)
Aliases: CVE-2022-41354
Published: 2023-03-23T19:49:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.5.0'}, {'last_affected': '1.8.7'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.5.16'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.7'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.28'}]}]}]

### Impact

All versions of Argo CD starting with v0.5.0 are vulnerable to an information disclosure bug allowing unauthorized users to enumerate application names by inspecting API error messages. An attacker could use the discovered application names as the starting point of another attack. For example, the attacker might use their knowledge of an application name to convince an administrator to grant higher privileges (social engineering).

Many Argo CD API endpoints accept an application name as the only parameter. Since Argo CD RBAC requires both the application name and its configured project name (and, if apps-in-any-namespace is enabled, the application's namespace), Argo CD fetches the requested application before performing the RBAC check. If the application does not exist, the API returns a "not found". If the application does exist, and the user does not have access, the API returns an "unauthorized" error. By trial and error, an attacker can infer which applications exist and which do not.

Note that application resources are not fetched for API calls from _unauthenticated_ users. If your Argo CD instance is accessible from the public internet, unauthenticated users will not be able to cause Argo CD to make Kubernetes API calls.

The patch changes API behavior to return "unauthorized" both when the application is missing and when the user is not authorized to access it. **This change in API behavior may impact API clients.** Check your code to make sure it will handle the new API behavior properly.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.6.7
* v2.5.16
* v2.4.28

### Workarounds

There are no workarounds besides upgrading.

### Credits

Thank you to bean.zhang of HIT-IDS ChunkL Team who discovered the issue and reported it confidentially according to our [guidelines](https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability).

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
node-bluetooth-serial-port is vulnerable to Buffer Overflow via the findSerialPortChannel  (GHSA-9jh3-4pc9-hq29)
Aliases: CVE-2023-26109
Published: 2023-03-09T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'node-bluetooth-serial-port'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.7'}]}]}]

All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.
Moodle SQL Injection vulnerability (GHSA-f46j-r7q3-6cm2)
Aliases: CVE-2021-36393
Published: 2023-03-06T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.
Pimcore vulnerable to improper quoting of filters in Custom Reports (GHSA-vf7q-g2pv-jxvx)
Aliases: CVE-2023-28438
Published: 2023-03-22T21:23:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
Since a user with 'report' permission can already write arbitrary SQL queries and given the fact that this endpoint is using the GET method (no CSRF protection), an attacker can inject an arbitrary query by manipulating a user to click on a link.

The impact of this path traversal and arbitrary extension is limited (creation of arbitrary files and
appending data to existing files) but when combined with the SQL Injection, the exported data can be controlled and a webshell can be uploaded. Attackers can use that to execute arbitrary PHP code on the server with the permissions of the webserver.

### Patches
Update to version 10.5.19 or apply these patch manually https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch
https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch

### Workarounds
Apply patches manually:
https://github.com/pimcore/pimcore/commit/d1abadb181c88ebaa4bce1916f9077469d4ea2bc.patch
https://github.com/pimcore/pimcore/commit/7f788fa44bc18bc1c9182c25e26b770a1d30b62f.patch

### References
#14526
#14498
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc (GHSA-m8cg-xc2p-r3fc)
Aliases: CVE-2023-25809
Published: 2023-03-30T20:17:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/opencontainers/runc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.5'}]}]}]

### Impact
It was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons:
1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl)
2. or, when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare)

A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host .
Other users's cgroup hierarchies are not affected.

### Patches
v1.1.5 (planned)

### Workarounds
- Condition 1: Unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts.
- Condition 2 (very rare): add `/sys/fs/cgroup` to `maskedPaths`
Answer vulnerable to Authentication Bypass by Capture-replay (GHSA-hwj7-frgj-7829)
Aliases: CVE-2023-1537
Published: 2023-03-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6.
Pimcore vulnerable to Cross Site Scripting in Email Blacklist (GHSA-96hp-38wx-j3wc)
Aliases: CVE-2023-1116
Published: 2023-03-01T23:04:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.18'}]}]}]

### Impact
The attacker can execute arbitrary JavaScript and steal Cookies information and use them to hijack the user's session.

### Patches
Update to version 10.5.18 or apply this patch manually https://github.com/pimcore/pimcore/pull/14467.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14467.patch manually.

### References
https://huntr.dev/bounties/3245ff99-9adf-4db9-af94-f995747e09d1/
User account enumeration in eZ Publish Ibexa Kernel (GHSA-89p3-9j8c-fqh4)
Aliases: CVE-2021-46876
Published: 2023-03-12T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezpublish-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.13.0'}, {'fixed': '6.13.8.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezpublish-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.5.0'}, {'fixed': '7.5.15.1'}]}]}]

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.
HashiCorp Vault's PKI mount vulnerable to denial of service (GHSA-hwc3-3qh6-r4gg)
Aliases: CVE-2023-0665
Published: 2023-03-30T03:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.9'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.1'}]}]}]

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Ansible Semaphore mishandles authentication (GHSA-pmhg-cmjc-3875)
Aliases: CVE-2023-28609
Published: 2023-03-18T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ansible-semaphore/semaphore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.89'}]}]}]

api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication.
cloudflared's Installer has Local Privilege Escalation Vulnerability (GHSA-7mjv-x3jf-545x)
Aliases: CVE-2023-1314
Published: 2023-03-21T22:32:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cloudflare/cloudflared'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20230313153246-f686da832f85'}]}]}]

### Impact

A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied on a world-writable directory.

An attacker with local access to the device (without Administrator rights) can use symbolic links to trick the MSI installer into deleting files in locations that the attacker would otherwise have no access to. By creating a symlink from the world-writable directory to the target file, the attacker can manipulate the MSI installer's repair functionality to delete the target file during the repair process.

Exploitation of this vulnerability could allow an attacker to delete important system files or replace them with malicious files, potentially leading to the affected device being compromised.

**The cloudflared client itself is not affected by this vulnerability, only the installer for 32-bit Windows devices.**

### Patches
A new installer was released as part of version 2023.3.1, corresponding to pseudoversion 0.0.0-20230313153246-f686da832f85 on pkg.go.dev. Users are encouraged to remove old installers from their systems.

### References
[Cloudflared Releases](https://github.com/cloudflare/cloudflared/releases)
Cockpit Uses Platform-Dependent Third Party Components (GHSA-p8cq-pv6w-6rwx)
Aliases: CVE-2023-1160
Published: 2023-03-03T03:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.3.9'}]}]}]

Use of Platform-Dependent Third Party Components in GitHub repository cockpit-hq/cockpit 2.3.9 and prior. A patch is available and anticipated to be part of version 2.4.0.
Answer vulnerable to Stored Cross-site Scripting (GHSA-xvfj-84vc-hrmf)
Aliases: CVE-2023-1536
Published: 2023-03-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.7'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
stoqey/gnuplot is vulnerable to command injection (GHSA-795w-7426-m94j)
Aliases: CVE-2021-33360
Published: 2023-03-10T18:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@stoqey/gnuplot'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.3'}]}]}]

An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_process, and/or filePath parameter(s).
Answer vulnerable to Insufficient Session Expiration (GHSA-79hx-g43v-xfmr)
Aliases: CVE-2023-1543
Published: 2023-03-21T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6.
Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings (GHSA-6qjm-39vh-729w)
Aliases: CVE-2023-1702
Published: 2023-03-31T17:11:48Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.20'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14721.patch

### Workarounds
Apply patch manually https://github.com/pimcore/pimcore/pull/14721.patch

### References
https://huntr.dev/bounties/d8a47f29-3297-4fce-b534-e1d95a2b3e19
Pimcore vulnerable to Reflected XSS in Predefined Properties module in Settings (GHSA-7r35-chv4-xr3r)
Aliases: CVE-2023-1701
Published: 2023-03-31T17:17:04Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.20'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14721.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14721.patch manually.

### References
https://huntr.dev/bounties/64f943c4-68e5-4ef8-82f6-9c4abe928256/
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability (GHSA-x2qm-r4wx-8gpg)
Aliases: CVE-2023-26477
Published: 2023-03-03T22:51:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-theme-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.2.4'}, {'fixed': '13.10.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-theme-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-theme-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.9-rc-1'}]}]}]

### Impact
It's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters `form_token=1&action=create`.

For instance: [http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?newThemeName=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&form_token=1&action=create](http://127.0.0.1:8080/xwiki/bin/view/FlamingoThemesCode/WebHomeSheet?**newThemeName**=foo%22%2F%7D%7D%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22hello%20from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D&form_token=1&action=create) will execute the following groovy code: `println("hello from groovy!")` on the server.

### Patches
This has been patched in the supported versions 13.10.10, 14.9-rc-1, and 14.4.6.

### Workarounds
It is possible to edit `FlamingoThemesCode.WebHomeSheet` and manually perform the changes from [the patch fixing the issue](https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284).

### References
- https://github.com/xwiki/xwiki-platform/commit/ea2e615f50a918802fd60b09ec87aa04bc6ea8e2#diff-e2153fa59f9d92ef67b0afbf27984bd17170921a3b558fac227160003d0dfd2aR283-R284
- https://jira.xwiki.org/browse/XWIKI-19757

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Apache HTTP Server via mod_proxy_uwsgi HTTP response smuggling (GHSA-vcph-37mh-fqrh)
Aliases: CVE-2023-27522
Published: 2023-03-07T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'uWSGI'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.22'}]}]}]

HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server from 2.4.30 through 2.4.55 and the uWSGI PyPI package prior to version 2.0.22. Special characters in the origin response header can truncate/split the response forwarded to the client.
angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backend (GHSA-gwvm-vrp4-4pp5)
Aliases: CVE-2023-28444
Published: 2023-03-24T22:04:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'angular-server-side-configuration'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0.0'}, {'fixed': '15.1.0'}]}]}]

### Impact
angular-server-side-configuration detects used environment variables in TypeScript (.ts) files during build time of an Angular CLI project. The detected environment variables are written to a ngssc.json file in the output directory.
During deployment of an Angular based app, the environment variables based on the variables from ngssc.json are inserted into the apps index.html (or defined index file).

With version 15 the environment variable detection was widened to the entire project, relative to the angular.json file from the Angular CLI. In a monorepo setup, this could lead to environment variables intended for a backend/service to be detected and written to the ngssc.json, which would then be populated and exposed via index.html.

This has NO IMPACT, in a plain Angular project that has no backend component.

### Patches
Vulnerability has been mitigated in 15.1.0, by adding an option `searchPattern` which restricts the detection file range by default.

```bash
# Update via npm
npm update angular-server-side-configuration
## Or more specific
npm install angular-server-side-configuration@15.1.0

# Update via pnpm
pnpm update angular-server-side-configuration
## Or more specific
pnpm add angular-server-side-configuration@15.1.0

# Update via yarn
yarn update angular-server-side-configuration
## Or more specific
yarn add angular-server-side-configuration@15.1.0
```

### Workarounds
Manually edit or create ngssc.json or run a script after ngssc.json generation

### References
Rack has possible DoS Vulnerability in Multipart MIME parsing (GHSA-3h57-hmj3-gj3p)
Aliases: CVE-2023-27530
Published: 2023-03-08T17:20:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.9.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.4.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.6.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.4.2'}]}]}]

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

# Impact
The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

# Workarounds
A proxy can be configured to limit the POST body size which will mitigate this issue.
Apache Log4j 1.x (EOL) allows Denial of Service (DoS) (GHSA-vp98-w2p3-mv35)
Aliases: CVE-2023-26464
Published: 2023-03-10T15:30:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.logging.log4j:log4j-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.4'}, {'fixed': '2.0.0'}]}]}]

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.