aswin1906/github-advisory-2023 huggingface dataset:
dot-lens vulnerable to Prototype Pollution (GHSA-rmhg-2cvv-q7vx)
Aliases: CVE-2023-26106
Published: 2023-03-06T06:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'dot-lens'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.3'}]}]}]

All versions of the package dot-lens are vulnerable to Prototype Pollution via the `set()` function in `index.js` file.
NotrinosERP vulnerable to SQL Injection (GHSA-4pqp-69m3-f8pp)
Aliases: CVE-2023-24788
Published: 2023-03-23T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'notrinos/notrinos-erp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.7'}]}]}]

NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at `/NotrinosERP/sales/customer_delivery.php`.
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author (GHSA-3738-p9x3-mv9r)
Aliases: CVE-2023-26474
Published: 2023-03-03T22:48:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '13.10'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-legacy-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '13.10'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-legacy-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-legacy-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact

It's possible to use the right of an existing document content author to execute a text area property.

To reproduce:

* As an admin with programming rights, create a new user without script or programming right.
* Login with the freshly created user.
* Insert the following text in source mode in the about section:
```
    {{groovy}}println("hello from groovy!"){{/groovy}}
```
* Click "Save & View"

### Patches

This has been patched in XWiki 14.10, 14.4.7, and 13.10.11.

### Workarounds

No known workaround.

### References
https://jira.xwiki.org/browse/XWIKI-20373

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [Jira](http://jira.xwiki.org/)
* Email us at [Security ML](mailto:security@xwiki.org)
TensorFlow has Floating Point Exception in AvgPoolGrad with XLA (GHSA-rcf8-g8jv-vg6p)
Aliases: CVE-2023-25669
Published: 2023-03-24T21:56:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
If the stride and window size are not positive for `tf.raw_ops.AvgPoolGrad`, it can give an FPE.

```python
import tensorflow as tf
import numpy as np

@tf.function(jit_compile=True)
def test():
   y = tf.raw_ops.AvgPoolGrad(orig_input_shape=[1,0,0,0], grad=[[[[0.39117979]]]], ksize=[1,0,0,0], strides=[1,0,0,0], padding="SAME", data_format="NCHW")
   return y

print(test())
```

### Patches
We have patched the issue in GitHub commit [1295ae4dbb52fe06b19733b0257e2340d7b63b8d](https://github.com/tensorflow/tensorflow/commit/1295ae4dbb52fe06b19733b0257e2340d7b63b8d).

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx of 360 AIVul Team
Grafana vulnerable to Stored Cross-site Scripting in Text plugin (GHSA-7rqg-hjwc-6mjf)
Aliases: CVE-2023-22462
Published: 2023-03-01T20:56:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.2.0'}, {'fixed': '9.2.10'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.3.0'}, {'fixed': '9.3.4'}]}]}]

### Description 
On 2023-01-01 during an internal audit of Grafana, a member of the security team found a stored XSS vulnerability affecting the core plugin "Text".

The stored XSS vulnerability requires several user interactions in order to be fully exploited. The vulnerability was possible due to  React's render cycle that will pass though the unsanitized HTML code, but in the next cycle the HTML is cleaned up and saved in Grafana's database.

### Impact
An attacker needs to have the Editor role in order to change a Text panel to include JavaScript. later, an another user needs to edit the same Text panel, and click on "Markdown" or "HTML" for the code to be executed. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.   

### Impacted versions
Grafana versions between 9.2.0 and 9.2.10. and between 9.3.0 and 9.3.4

### Solutions and mitigations
Update your Grafana instance.


## Reporting security issues

If you think you have found a security vulnerability, please send a report to security@grafana.com. This address can be used for all of Grafana Labs' open source and commercial products (including, but not limited to Grafana, Grafana Cloud, Grafana Enterprise, and grafana.com). We can accept only vulnerability reports at this address. We would prefer that you encrypt your message to us by using our PGP key. The key fingerprint is

F988 7BEA 027A 049F AE8E 5CAA D125 8932 BE24 C5CA

The key is available from keyserver.ubuntu.com.

## Security announcements

We maintain a [security category](https://community.grafana.com/c/support/security-announcements) on our blog, where we will always post a summary, remediation, and mitigation details for any patch containing security fixes.

You can also subscribe to our [RSS feed](https://grafana.com/tags/security/index.xml).
Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting (GHSA-8648-h559-8h42)
Aliases: CVE-2023-28604
Published: 2023-03-27T21:48:40Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'sitegeist/fluid-components'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.0'}]}]}]

All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup.
TensorFlow has null dereference on ParallelConcat with XLA (GHSA-6wfh-89q8-44jq)
Aliases: CVE-2023-25676
Published: 2023-03-24T21:54:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
When running with XLA, `tf.raw_ops.ParallelConcat` segfaults with a nullptr dereference when given a parameter `shape` with rank that is not greater than zero.

```python
import tensorflow as tf

func = tf.raw_ops.ParallelConcat
para = {'shape':  0, 'values': [1]}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()
```

### Patches
We have patched the issue in GitHub commit [da66bc6d5ff466aee084f9e7397980a24890cd15](https://github.com/tensorflow/tensorflow/commit/da66bc6d5ff466aee084f9e7397980a24890cd15).

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx of 360 AIVul Team
async-nats vulnerable to TLS certificate common name validation bypass (GHSA-f5v5-ccqc-6w36)
Published: 2023-03-24T21:59:53Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'async-nats'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.29.0'}]}]}]

The NATS official Rust clients are vulnerable to MitM when using TLS.

The common name of the server's TLS certificate is validated against the `host`name provided by the server's plaintext `INFO` message during the initial connection setup phase. A MitM proxy can tamper with the `host` field's value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it.

## Reproduction steps

1. The NATS Rust client tries to establish a new connection
2. The connection is intercepted by a MitM proxy
3. The proxy makes a separate connection to the NATS server
4. The NATS server replies with an `INFO` message
5. The proxy reads the `INFO`, alters the `host` JSON field and passes the tampered `INFO` back to the client
6. The proxy upgrades the client connection to TLS, presenting a certificate issued by a certificate authority present in the client's keychain. In the previous step the `host` was set to the common name of said certificate
7. `rustls` accepts the certificate, having verified that the common name matches the attacker-controlled value it was given
8. The client has been fooled by the MitM proxy into accepting the attacker-controlled certificate
jackson-databind possible Denial of Service if using JDK serialization to serialize JsonNode (GHSA-3x8x-79m2-3w2w)
Aliases: CVE-2021-46877
Published: 2023-03-19T00:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.10.0'}, {'fixed': '2.12.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.13.0'}, {'fixed': '2.13.1'}]}]}]

jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving JsonNode JDK serialization.
Moodle vulnerable to Cross-site Scripting when algebra filter enabled but not functional (GHSA-9f45-9qrw-pp4v)
Aliases: CVE-2023-28332
Published: 2023-03-23T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.13'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.20'}]}]}]

If the algebra filter was enabled but not functional (eg the necessary binaries were missing from the server), it presented an XSS risk.
Improper Input Validation In Eclipse BIRT (GHSA-4grc-q4fj-45p8)
Aliases: CVE-2023-0100
Published: 2023-03-15T15:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.birt:org.eclipse.birt.report.viewer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.2'}, {'fixed': '4.13'}]}]}]

In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTTP path for the report parameter (e.g. __report=http://xyz.com/report.rptdesign). If the host indicated in the __report parameter matched the HTTP Host header value, the report would be retrieved. However, the Host header can be tampered with on some configurations where no virtual hosts are put in place (e.g. in the default configuration of Apache Tomcat) or when the default host points to the BIRT server. This vulnerability was patched on Eclipse BIRT 4.13.
Complianz WordPress plugin vulnerable to cross-site scripting (GHSA-7j4m-f87g-5r9r)
Aliases: CVE-2023-1069
Published: 2023-03-27T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'really-simple-plugins/complianz-gdpr'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.2'}]}]}]

The Complianz Premium WordPress plugin before 6.4.2 did not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Information disclosure through error stack traces related to agents  (GHSA-rrgp-c2w8-6vg6)
Aliases: CVE-2023-27904
Published: 2023-03-10T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.376'}, {'fixed': '2.387.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.375.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.388'}, {'fixed': '2.394'}]}]}]

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 prints an error stack trace on agent-related pages when agent connections are broken, potentially revealing information about Jenkins configuration that is otherwise inaccessible to attackers.

Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 does not display error stack traces when agent connections are broken.
json-logic-js Command Injection vulnerability (GHSA-67j4-2mh6-8627)
Aliases: CVE-2021-4329
Published: 2023-03-05T21:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'json-logic-js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.1'}]}]}]

A vulnerability, which was classified as critical, has been found in json-logic-js 2.0.0. Affected by this issue is some unknown functionality of the file logic.js. The manipulation leads to command injection. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is c1dd82f5b15d8a553bb7a0cfa841ab8a11a9c227. It is recommended to upgrade the affected component. VDB-222266 is the identifier assigned to this vulnerability.
OpenAPI Generator vulnerable to Server-Side Request Forgery (GHSA-wg4w-5m5r-w3p8)
Aliases: CVE-2023-27162
Published: 2023-03-31T21:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.openapitools:openapi-generator-project'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '6.4.0'}]}]}]

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component `/api/gen/clients/{language}`. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
NULL pointer derefernce in `stb_image` (GHSA-ppjr-267j-5p9x)
Published: 2023-03-20T21:11:58Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'stb_image'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.5'}]}]}]

A bug in error handling in the `stb_image` C library could cause a NULL pointer dereference when attempting to load an invalid or unsupported image file.  This is fixed in version 0.2.5 and later of the `stb_image` Rust crate, by patching the C code to correctly handle NULL pointers.
Authorization Bypass Through User-Controlled Key play-with-docker (GHSA-vq59-5x26-h639)
Aliases: CVE-2023-28109
Published: 2023-03-17T14:43:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/play-with-docker/play-with-docker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.2'}]}]}]

Impact
Give that CORS configuration was not correct, an attacker could use [play-with-docker.com](http://play-with-docker.com/) as an example, set origin header in http request as  [evil-play-with-docker.com](http://evil-play-with-docker.com/), it will be echo in response header, which successfully bypass the CORS policy and retrieves basic user information.

Patches
It has been fixed in lastest version, Please upgrade to latest version

Workarounds
No, users have to upgrade version.
Server-Side Request Forgery in Request (GHSA-p8p7-x288-28g6)
Aliases: CVE-2023-28155
Published: 2023-03-16T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'request'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.88.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@cypress/request'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.88.12'}}]

The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).

NOTE: The `request` package is no longer supported by the maintainer.
phpMyFAQ Cross-site Scripting vulnerability (GHSA-hp8m-g55r-9cfq)
Aliases: CVE-2023-1755
Published: 2023-03-31T03:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
json-smart Uncontrolled Recursion vulnerabilty (GHSA-493p-pfq6-5258)
Aliases: CVE-2023-1370
Published: 2023-03-23T20:32:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.minidev:json-smart'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.9'}]}]}]

### Impact
Affected versions of [net.minidev:json-smart](https://github.com/netplex/json-smart-v1) are vulnerable to Denial of Service (DoS) due to a StackOverflowError when parsing a deeply nested JSON array or object.

When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the 3PP does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause stack exhaustion (stack overflow) and crash the software.

### Patches
This vulnerability was fixed in json-smart version 2.4.9, but the maintainer recommends upgrading to 2.4.10, due to a remaining bug.

### Workarounds
N/A

### References
- https://www.cve.org/CVERecord?id=CVE-2023-1370
- https://nvd.nist.gov/vuln/detail/CVE-2023-1370
- https://security.snyk.io/vuln/SNYK-JAVA-NETMINIDEV-3369748
Gophish vulnerable to Denial of Service via crafted payload involving autofocus (GHSA-8gg8-wr4j-v2wr)
Aliases: CVE-2022-45003
Published: 2023-03-22T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gophish/gophish'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.12.1'}]}]}]

Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
russh may use insecure Diffie-Hellman keys (GHSA-cqvm-j2r2-hwpg)
Aliases: CVE-2023-28113
Published: 2023-03-17T14:42:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'russh'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.36.2'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'russh'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.37.0'}, {'fixed': '0.37.1'}]}]}]

### Summary

Diffie-Hellman key validation is insufficient, which can lead to insecure shared secrets and therefore breaks confidentiality.

### Details

Russh does not validate Diffie-Hellman keys.

It accepts received DH public keys $e$ where $e<0$, $e=1$, or $e \geq p-1$ from a misbehaving peer annd successfully performs key exchange.

This is a violation of [RFC 4253, section 8](https://www.rfc-editor.org/rfc/rfc4253#section-8) and [RFC 8268, section 4](https://www.rfc-editor.org/rfc/rfc8268#section-4), which state that:

>DH Public Key values MUST be checked and both conditions:
>
> - $1 < e < p-1$
> - $1 < f < p-1$
>
> MUST be true.  Values not within these bounds MUST NOT be sent or
> accepted by either side.  If either one of these conditions is
> violated, then the key exchange fails.

For example, a DH client public key $e=1$ would mean that the shared secret that the server calculates is always $K = e^y \mod{p} = 1^y \mod{p} = 1$.
In other cases, an insecure order-2 subgroup may be used.

Also, the code does not look like it ensures that the generated secret key $y$ is in the valid interval $0 < y < q$ (or, if russh is the client, that the secret key $x$ satisfies $1 < x < q$):
https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L72-L76
For example, `rng.gen_biguint()` might return a number consisting of zeroes, so that $y = 0$.

The public key is not validated either:
https://github.com/warp-tech/russh/blob/master/russh/src/kex/dh/groups.rs#L78-L81

### Impact

Due to the issues in the DH key generation, I think any connection that uses Diffie-Hellman key exchange is affected.
Connections between a russh client and server or those of a russh peer with some other misbehaving peer are most likely to be problematic. These may vulnerable to eavesdropping.

Most other implementations reject such keys, so this is mainly an interoperability issue in such a case.
Apache Dubbo vulnerable to Deserialization of Untrusted Data (GHSA-933g-v89r-x8pf)
Aliases: CVE-2023-23638
Published: 2023-03-08T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.dubbo:dubbo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.7.22'}]}], 'database_specific': {'last_known_affected_version_range': '< 2.7.21'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.dubbo:dubbo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.13'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.dubbo:dubbo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.1.5'}]}]}]

A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x version 3.1.5 and prior versions.
Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process (GHSA-vfgq-g5x8-g595)
Aliases: CVE-2023-28436
Published: 2023-03-23T19:58:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'tailscale.com'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.34.0'}, {'fixed': '1.38.2'}]}]}]

A vulnerability identified in the implementation of Tailscale SSH in FreeBSD allowed commands to be run with a higher privilege group ID than that specified by Tailscale SSH access rules.

**Affected platforms**: FreeBSD

**Patched Tailscale client versions**: v1.38.2 or later

### What happened?
A difference in the behavior of the FreeBSD `setgroups` system call from POSIX meant that the Tailscale client running on a FreeBSD-based operating system did not appropriately restrict groups on the host when using Tailscale SSH. When accessing a FreeBSD host over Tailscale SSH, the egid of the tailscaled process was used instead of that of the user specified in Tailscale SSH access rules.

### Who is affected?
9 tailnets with 22 FreeBSD nodes running Tailscale SSH since Tailscale v1.34 (released on 2022-12-04) may have had Tailscale SSH sessions with a higher privilege group ID than that specified in Tailscale SSH access rules.

We have notified the affected organizations where we have [security contacts](https://tailscale.com/kb/1224/contact-preferences/#setting-the-security-issues-email).

### What is the impact?
Tailscale SSH commands may have been run with a higher privilege group ID than that specified in Tailscale SSH access rules if they met all of the following criteria:
* The destination node was a FreeBSD device with Tailscale SSH enabled;
* Tailscale SSH access rules permitted access for non-root users; and
* A non-interactive SSH session was used.

### What do I need to do?
If you are running Tailscale on FreeBSD, upgrade to v1.38.2 or later to remediate the issue. Admins of a tailnet can view [FreeBSD nodes with unpatched versions](https://login.tailscale.com/admin/machines?q=version%3A%3C1.38.2+freebsd) in the admin console.

To update the local ports tree in advance of what's available upstream, you can:

1. `cd /usr/ports/security/tailscale`
2. edit the Makefile to set `PORTVERSION` to `1.38.2`
3. `make makesum`
4. `make install`

Tailscale SSH on other platforms is not affected.

### Credits
We would like to thank [Ryan Belgrave](https://www.linkedin.com/in/rbelgrave/) for reporting this issue.

### References
* [TS-2023-003](https://tailscale.com/security-bulletins/#ts-2023-003)
Answer vulnerable to Business Logic Errors (GHSA-h2wg-83fc-xvm9)
Aliases: CVE-2023-1541
Published: 2023-03-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Business Logic Errors in GitHub repository answerdev/answer prior to 1.0.6.
TensorFlow has Null Pointer Error in RandomShuffle with XLA enable  (GHSA-gf97-q72m-7579)
Aliases: CVE-2023-25674
Published: 2023-03-24T21:54:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
NPE in RandomShuffle with XLA enable 
```python
import tensorflow as tf

func = tf.raw_ops.RandomShuffle
para = {'value': 1e+20, 'seed': -4294967297, 'seed2': -2147483649}

@tf.function(jit_compile=True)
def test():
   y = func(**para)
   return y

test()
```

### Patches
We have patched the issue in GitHub commit [728113a3be690facad6ce436660a0bc1858017fa](https://github.com/tensorflow/tensorflow/commit/728113a3be690facad6ce436660a0bc1858017fa).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx
TensorFlow Denial of Service vulnerability (GHSA-fxgc-95xx-grvq)
Aliases: CVE-2023-25661
Published: 2023-03-27T21:05:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
A malicious invalid input crashes a tensorflow model (Check Failed) and can be used to trigger a denial of service attack.
To minimize the bug, we built a simple single-layer TensorFlow model containing a Convolution3DTranspose layer, which works well with expected inputs and can be deployed in real-world systems. However, if we call the model with a malicious input which has a zero dimension, it gives Check Failed failure and crashes. 
```python
import tensorflow as tf

class MyModel(tf.keras.Model):
    def __init__(self):
        super().__init__()
        self.conv = tf.keras.layers.Convolution3DTranspose(2, [3,3,3], padding="same")
        
    def call(self, input):
        return self.conv(input)
model = MyModel() # Defines a valid model.

x = tf.random.uniform([1, 32, 32, 32, 3], minval=0, maxval=0, dtype=tf.float32) # This is a valid input.
output = model.predict(x)
print(output.shape) # (1, 32, 32, 32, 2)

x = tf.random.uniform([1, 32, 32, 0, 3], dtype=tf.float32) # This is an invalid input.
output = model(x) # crash
```
This Convolution3DTranspose layer is a very common API in modern neural networks. The ML models containing such vulnerable components could be deployed in ML applications or as cloud services. This failure could be potentially used to trigger a denial of service attack on ML cloud services.

### Patches
We have patched the issue in
- GitHub commit [948fe6369a5711d4b4568ea9bbf6015c6dfb77e2](https://github.com/tensorflow/tensorflow/commit/948fe6369a5711d4b4568ea9bbf6015c6dfb77e2)
- GitHub commit [85db5d07db54b853484bfd358c3894d948c36baf](https://github.com/keras-team/keras/commit/85db5d07db54b853484bfd358c3894d948c36baf).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
xwiki contains Incorrect Authorization (GHSA-859x-p6jp-rc2w)
Aliases: CVE-2023-26056
Published: 2023-03-03T22:54:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-macro-context'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0-milestone-1'}, {'fixed': '13.10.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-macro-context'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-macro-context'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.8-rc-1'}]}]}]

### Impact

It's possible to execute a script with the right of another user (provided the target user does not have programming right).

For example, the following:

```
{{context document="xwiki:XWiki.userwithscriptright" transformationContext="document"}}{{velocity}}Hello from Velocity!{{/velocity}}{{/context}}
```

written by a user not having script right (for example in the user's profile) should produce an error (the user is not allowed to write scripts). However, because of the vulnerability, if the author of the document "xwiki:XWiki.userwithscriptright" has script right (but not programming right) the script will be executed with as if it was written by the target user.

### Patches

The problem has been patched in XWiki 14.8RC1, 14.4.5 and 13.10.10.

### Workarounds

There's no workaround for this issue.

### References

https://jira.xwiki.org/browse/XWIKI-19856

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Cross-realm object access in Webpack 5 (GHSA-hc6q-2mpp-qw7j)
Aliases: CVE-2023-28154
Published: 2023-03-13T03:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'webpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.76.0'}]}]}]

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.
Collection.js vulnerable to Prototype Pollution (GHSA-47pj-q2vm-46xc)
Aliases: CVE-2023-26113
Published: 2023-03-18T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'collection.js'}, 'ecosystem_specific': {'affected_functions': ['collection.js.extend']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.8.1'}]}]}]

Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the `extend` function in `Collection.js/dist/node/iterators/extend.js`.
Duplicate Advisory: Pimcore Cross-site scripting in Predefined Asset Metadata module in Settings (GHSA-69fc-v223-6rjw)
Published: 2023-03-29T18:30:29Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.20'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-6qjm-39vh-729w](https://github.com/advisories/GHSA-6qjm-39vh-729w). This link is maintained ot preserve external references.

## Original Description
Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.
Kiwi TCMS Stored Cross-site Scripting via SVG file (GHSA-2wcr-87wf-cf9j)
Aliases: CVE-2023-27489
Published: 2023-03-30T20:18:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'kiwitcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.1'}]}]}]

### Impact
Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. 

### Patches
This vulnerability has been fixed by configuring Kiwi TCMS to serve with the Content-Security-Policy HTTP header which blocks inline JavaScript in all modern browsers.

### Workarounds
Configure Content-Security-Policy header, see [commit 6617cee0](https://github.com/kiwitcms/Kiwi/commit/6617cee0fb70cc394b7be6bbc86ef84e6e9de077).

### References
You can visit https://digi.ninja/blog/svg_xss.php for more technical details.

Independently disclosed by [Antonio Spataro](https://huntr.dev/bounties/bf99001b-a0a2-4f7d-98cd-983bc7f14a69/) and [@1d8](https://huntr.dev/bounties/f8c73bcc-02f3-4c65-a92b-1caa4d67c2fd/).
Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower (GHSA-p756-rfxh-x63h)
Aliases: CVE-2023-23939
Published: 2023-03-07T20:07:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'GitHub Actions', 'name': 'Azure/setup-kubectl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3'}]}]}]

### Impact

This vulnerability only impacts versions `v2` and lower. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action because it is world writable. This Kubectl tool installer runs `fs.chmodSync(kubectlPath, 777)` to set permissions on the Kubectl binary, however, this allows any local user to replace the Kubectl binary. This allows privilege escalation to the user that can also run kubectl, most likely root. This attack is only possible if an attacker somehow breached the GitHub actions runner or if a user is utilizing an Action that maliciously executes this attack.

No impacted customers have been reported.

### Patches

This has been fixed and released in all versions `v3` and later. 755 permissions are used instead.

### Workarounds

If users absolutely cannot upgrade to `v3` or higher than they should be extra diligent of the other GitHub actions they are using in a workflow and ensure that their GitHub actions runner is secure.
crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb (GHSA-5mqj-xc49-246p)
Aliases: CVE-2023-28119
Published: 2023-03-22T21:23:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/crewjam/saml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.13'}]}]}]

Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.
Prototype pollution in matrix-react-sdk  (GHSA-6g43-88cp-w5gv)
Aliases: CVE-2023-28103
Published: 2023-03-29T19:34:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-react-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.69.0'}]}]}]

### Impact
In certain configurations, data sent by remote servers containing special strings in key locations could cause modifications of the `Object.prototype`, disrupting matrix-react-sdk functionality, causing denial of service and potentially affecting program logic.

(This is part 2, where [CVE-2022-36060](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36060) / [GHSA-2x9c-qwgf-94xr](https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr) is part 1. Part 2 covers remaining vectors not covered by part 1, found in a codebase audit scheduled after part 1.)

### Patches
This is fixed in matrix-react-sdk 3.69.0

### Workarounds
None.

### References

- [Release blog post](https://matrix.org/blog/2023/03/28/security-releases-matrix-js-sdk-24-0-0-and-matrix-react-sdk-3-69-0)
- The advisory [GHSA-2x9c-qwgf-94xr](https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-2x9c-qwgf-94xr) ([CVE-2022-36060](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36060)) refers to an initial set of vulnerable locations discovered and patched in matrix-react-sdk 3.53.0. We opted not to disclose that advisory while we performed an audit of the codebase and are now disclosing it jointly with this one.

### For more information
If you have any questions or comments about this advisory please email us at [security at matrix.org](mailto:security@matrix.org).
Saleor has Staff-Authenticated Error Message Information Disclosure Vulnerability via Python Exceptions (GHSA-r8qr-wwg3-2r85)
Aliases: CVE-2023-26051
Published: 2023-03-03T22:46:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '3.1.48'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.12'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0'}, {'fixed': '3.10.14'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.9.0'}, {'fixed': '3.9.27'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.8.0'}, {'fixed': '3.8.30'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.7.0'}, {'fixed': '3.7.59'}]}]}]

### Impact
Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like user email address in staff-authenticated requests.

This issue has been patched in versions 3.1.48, 3.7.59, 3.8.30, 3.9.27, 3.10.14 and 3.11.12.

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Open a discussion at https://github.com/saleor/saleor/discussions
* Email us at [hello@saleor.io](mailto:hello@saleor.io)
Moodle has Incorrect Default Permissions (GHSA-35wf-3wq2-r3hx)
Aliases: CVE-2021-36400
Published: 2023-03-07T00:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.
Wallabag Improper Authorization vulnerability (GHSA-8ccw-f83g-v7g3)
Aliases: CVE-2023-0734
Published: 2023-03-05T21:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.4'}]}]}]

Improper Authorization in GitHub repository wallabag/wallabag prior to 2.5.4.
Improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Model (GHSA-xc9p-r5qj-8xm9)
Aliases: CVE-2023-28108
Published: 2023-03-17T14:44:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact

The quoting is not done properly in UUID DAO model, so there's the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and so relies on the auto-quoting being done by the DAO class.

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/commit/08e7ba56ae983c3c67ec563b6989b16ef8f35275.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/commit/08e7ba56ae983c3c67ec563b6989b16ef8f35275.patch manually.

### References
#14633
gosaml2 vulnerable to Denial Of Service Via Deflate Decompression Bomb (GHSA-6gc3-crp7-25w5)
Aliases: CVE-2023-26483
Published: 2023-03-02T23:12:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/russellhaering/gosaml2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.9.0'}]}]}]

### Impact
SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed.

### Mitigation
The maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go's garbage collector "keep up".

Implementors are encouraged not to rely on this.

### Patches
This issue is addressed in v0.9.0
`rmp-serde` `Raw` and `RawRef` may crash when receiving invalid UTF-8 (GHSA-255r-3prx-mf99)
Published: 2023-03-22T22:21:49Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'rmp-serde'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.1'}]}]}]

It was found that `Raw::from_utf8` expects valid UTF-8. If invalid UTF-8 is received it can cause the process to crash.
Xuxueli xxl-job allows attacker to obtain sensitive information via the pageList parameter (GHSA-jhjm-5xjg-mpqp)
Aliases: CVE-2023-27087
Published: 2023-03-21T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.xuxueli:xxl-job'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'last_affected': '2.3.1'}]}]}]

Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageList parameter.