aswin1906/github-advisory-2023 huggingface dataset:
Argo CD web terminal session doesn't expire (GHSA-c8xw-vjgf-94hr)
Aliases: CVE-2023-40025
Published: 2023-08-23T17:50:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.14'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.12'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.1'}]}], 'versions': ['2.8.0']}]

### Impact
All versions of Argo CD starting from v2.6.0 have a bug where open web terminal sessions do not expire. This bug allows users to send any websocket messages even if the token has already expired. The most straightforward scenario is when a user opens the terminal view and leaves it open for an extended period. This allows the user to view sensitive information even when they should have been logged out already.

### Patches
A patch for this vulnerability has been released in the following Argo CD version:

* v2.6.14
* v2.7.12
* v2.8.1

### Workarounds
The only way to completely resolve the issue is to upgrade.

#### Mitigations
Disable web-based terminal or define RBAC rules to it
[https://argo-cd.readthedocs.io/en/latest/operator-manual/web_based_terminal/](https://argo-cd.readthedocs.io/en/latest/operator-manual/web_based_terminal/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd

### Credits

Thank you to bean.zhang (@zhlu32 ) of HIT-IDS ChunkL Team who discovered the issue and reported it confidentially according to our [guidelines](https://github.com/argoproj/argo-cd/blob/master/SECURITY.md#reporting-a-vulnerability).
Moq v4.20.0-rc to 4.20.1 share hashed user data (GHSA-6r78-m64m-qwcf)
Published: 2023-08-10T19:25:23Z
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'moq'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.20.0-rc'}, {'fixed': '4.20.2'}]}]}]

Moq v4.20.0-rc to 4.20.1 include support for [SponsorLink](https://github.com/devlooped/SponsorLink), which runs an obfuscated DLL at build time that scans local `git config` data and shares the user's hashed email address with SponsorLink's remote servers. There is no option to disable this.

Moq v4.20.2 has removed this functionality.
Jenkins Favorite View Plugin cross-site request forgery vulnerability (GHSA-jrj6-qx48-3cpq)
Aliases: CVE-2023-40351
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:favorite-view'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.v77a'}]}]}]

Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to add or remove views from another user’s favorite views tab bar.

As of publication of this advisory, there is no fix.
wger Workout Manager Cross-site Scripting vulnerability (GHSA-8m9p-3926-gffr)
Aliases: CVE-2023-38758
Published: 2023-08-08T18:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'wger'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.0a3'}]}]}]

Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the `license_author `field in the add-ingredient function in the `templates/ingredients/view.html`, `models/ingredients.py`, and `views/ingredients.py` components.
Cockpit Cross-site Scripting vulnerability (GHSA-5cv4-48h7-7782)
Aliases: CVE-2023-4395
Published: 2023-08-17T06:30:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6.3'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit 2.6.3 and prior. A patch is available at commit 36d1d4d256cbbab028342ba10cc493e5c119172c and anticipated to be part of version 2.6.4.
@excalidraw/excalidraw Cross-site Scripting vulnerability (GHSA-v7v8-gjv7-ffmr)
Aliases: CVE-2023-26140
Published: 2023-08-16T21:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@excalidraw/excalidraw'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.15.3'}]}]}]

### Impact

XSS vulnerability due to improperly sanitizing URLs of links that can be attached on canvas elements. This affects users of the npm package `@excalidraw/excalidraw` provided it was deployed in environments where untrusted user input in drawings that are then shared with third parties is a concern. If you only hosted the editor in trusted environments, or sharing didn't take place, the impact is minimized.

### Patches

Patch is available on version 0.15.3 and up (stable), or latest `@excalidraw/excalidraw@next` (unstable releases).

### Workarounds

No workaround without upgrading unless deployed in environments without untrusted user input.

### References

https://security.snyk.io/vuln/SNYK-JS-EXCALIDRAWEXCALIDRAW-5841658
https://github.com/excalidraw/excalidraw/pull/6728
Prevent logging invalid header values (GHSA-j5g3-5c8r-7qfx)
Published: 2023-08-30T21:24:57Z
Affected: [{'package': {'ecosystem': 'npm', 'name': '@apollo/server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.9.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'apollo-server-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.12.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'apollo-server-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.26.1'}]}]}]

## Impact
### What kind of vulnerability is it?
Apollo Server can log sensitive information (Studio API keys) if they are passed incorrectly (with leading/trailing whitespace) or if they have any characters that are invalid as part of a header value.

### Who is impacted?
Users who (all of the below):
* use either the schema reporting or usage reporting feature
* use an Apollo Studio API key which has invalid header values
* use the default fetcher (`node-fetch`) or configured their own `node-fetch` fetcher

The following node snippet can test whether your API key has invalid header values. This code is taken directly from `node-fetch@2`'s header value validation code.
```js
const invalidHeaderCharRegex = /[^\t\x20-\x7e\x80-\xff]/;
if (invalidHeaderCharRegex.test('<YOUR_API_KEY>')) {
  console.log('potentially affected');
}
console.log('unaffected');
```

If the provided API key is not a valid header value, whenever Apollo Server uses that API key in a request (to Studio, for example), `node-fetch` will throw an error _which contains the header value_. This error is logged in various ways depending on the user's configuration, but most likely the console or some configured logging service.

### Patches
This problem is patched in the latest version of Apollo Server as soon as this advisory is published.

### Workarounds
* Try retrieving a new API key from Studio. Note: this may not work if the invalid character is not part of the secret (it may be derived from identifiers like graph name, user name).
* Override the `fetcher` 
* Disable schema reporting and/or usage reporting

### Solution
* Apollo Server will now call `.trim()` on incoming API keys in order to eliminate leading/trailing whitespace and log a warning when it does so.
* Apollo Server will now perform the same validation of API keys as `node-fetch@2` performs on header values on startup. Apollo Server will throw an error on startup (i.e., fail to start completely) and notify the user their API key is invalid along with the offending characters.
LibreNMS Cross-site Scripting vulnerability (GHSA-m6pf-cm3f-7876)
Aliases: CVE-2023-4347
Published: 2023-08-15T03:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'librenms/librenms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.8.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 23.7.0'}}]

Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms 23.7.0 and prior. A patch is available at commit 91c57a1ee54631e071b6b0c952d99c8ee892e824 and anticiapted to be part of version 23.8.0.
OpenNMS vulnerable to remote code execution (GHSA-5m5f-qg8r-p9qf)
Aliases: CVE-2023-40313
Published: 2023-08-17T21:30:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms-base-assembly'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '32.0.2'}]}]}]

A BeanShell interpreter in remote server mode runs in OpenNMS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
Cockpit Cross-site Scripting vulnerability (GHSA-ff45-2jp9-69jc)
Aliases: CVE-2023-4433
Published: 2023-08-19T03:32:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.6.3'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit version 2.6.3 and prior. A patch is available at commit 36d1d4d256cbbab028342ba10cc493e5c119172c and anticipated to be part of version 2.6.4.
Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin vulnerable to exposure of system-scoped credentials (GHSA-97mg-9jhf-r7rm)
Aliases: CVE-2023-40347
Published: 2023-08-16T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:maven-artifact-choicelistprovider'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.14'}]}]}]

Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowing the use of System-scoped credentials otherwise reserved for the global configuration.

This allows attackers with Item/Configure permission to access and capture credentials they are not entitled to.

As of publication of this advisory, there is no fix.
Duplicate Advisory: Wallabag user can delete own API client unintentionally (GHSA-gvvx-fc6p-2h9x)
Published: 2023-08-21T12:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wallabag/wallabag'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-alpha.1'}, {'fixed': '2.6.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.6.2'}}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-gjvc-55fw-v6vq. This link is maintained to preserve external references.

## Original Description
Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.
cryptography mishandles SSH certificates (GHSA-cf7p-gm2m-833m)
Aliases: CVE-2023-38325
Published: 2023-07-14T21:31:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'cryptography'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '40.0.0'}, {'fixed': '41.0.2'}]}]}]

The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.
RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escape (GHSA-wqc8-x2pr-7jqh)
Aliases: CVE-2023-37271
Published: 2023-07-10T21:53:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'RestrictedPython'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'RestrictedPython'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0a1.dev0'}, {'fixed': '6.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'restrictedpython'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.3'}]}]}]

### Impact

RestrictedPython does not check access to stack frames and their attributes. Stack frames are accessible within at least generators and generator expressions, which are allowed inside RestrictedPython. An attacker with access to a RestrictedPython environment can write code that gets the current stack frame in a generator and then walk the stack all the way beyond the RestrictedPython invocation boundary, thus breaking out of the restricted scope allowing the call of unrestricted Python code and therefore potentially allowing arbitrary code execution in the Python interpreter.

All RestrictedPython deployments that allow untrusted users to write Python code in the RestrictedPython environment are at risk. In terms of Zope and Plone, this would mean deployments where the administrator allows untrusted users to create and/or edit objects of type `Script (Python)`, `DTML Method`, `DTML Document` or `Zope Page Template`. This is a non-default configuration and likely to be extremely rare.

### Patches

The problem has been fixed in releases 5.3 and 6.1.

### Workarounds

There is no workaround available. If you cannot upgrade to the latest release you should ensure the RestrictedPython environment is only available for trusted users.

### References

- [RestrictedPython security advisory GHSA-wqc8-x2pr-7jqh](https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-wqc8-x2pr-7jqh)

## For more information

If you have any questions or comments about this advisory:

- Open an issue in the [RestrictedPython issue tracker](https://github.com/zopefoundation/RestrictedPython/issues)
- Email us at [security@plone.org](mailto:security@plone.org)

## Credits

Thanks for analysing and reporting the go to:
- Nakul Choudhary (Quasar0147 on GitHub)
- despawningbone on GitHub
- Robert Xiao (nneonneo on GitHub)
Apache Kylin vulnerable to remote code execution (GHSA-ppxx-m926-g569)
Aliases: CVE-2022-24697
Published: 2023-07-06T19:24:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.kylin:kylin-core-common'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.kylin:kylin-spark-project'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.kylin:kylin-server-base'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.2'}]}]}]

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
Unsafe plugins can be installed via pack import by tenant admins (GHSA-wxf3-4fvj-vqqx)
Published: 2023-07-27T19:28:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@saltcorn/cli'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0'}]}]}]

### Summary
Unsafe plugins (for instance `sql-list`) can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables

### Details
I have an example
https://bot20230704.saltcorn.com/view/all_plugins
It's publicly accessible (but has not so secure values except list of tenants).
But using this mech one can read **any** data from other tenants.

### Impact
All tenants of installation (i.e. `saltcorn.com`), can be compromised from tenant user has admin access. If an untrusted user has admin rights to a tenant instance, they will be able to install a plug-in that can access information from other tenants

### Revived after 0.8.7
After patch in 0.8.7 this is not fixed completely.

Here are steps to reproduce:
1. Publish to NPM plugin that was not approved by admin (in case of saltcorn.com) by @glutamate. I've just published this one: https://www.npmjs.com/package/saltcorn-qrcode
2. Publish somewhere plugin store that includes plugin from previous step: https://gist.github.com/pyhedgehog/f1fd7cb13f4d0a7ccf6a965748d19bd2
3. Add plugin store link to tenant store.
4. Install plugin.
5. Use it in tenant: https://bot20230704.saltcorn.com/view/testqr_show/1

Here are logic:
Unsafe plugins checked against this list:
https://github.com/saltcorn/saltcorn/blob/99fe277e497fd193bb070acd8c663aa254a9907c/packages/server/load_plugins.js#L191
But it's under control of tenant admin, not server admin.
Proposed login:
```javascript
const safes = getRootState().getConfig("available_plugins",[]).filter(p=>!p.unsafe).map(p=>p.location);
```
Apache Airflow Path Traversal vulnerability (GHSA-ggwr-4vr8-g7wv)
Aliases: CVE-2023-22887
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected
Leaking sensitive user information still possible by filtering on private with prefix fields (GHSA-9xg4-3qfm-9w8f)
Aliases: CVE-2023-34235
Published: 2023-07-25T17:17:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@strapi/database'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.10.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.10.7'}}, {'package': {'ecosystem': 'npm', 'name': '@strapi/utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.10.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.10.7'}}]

### Summary
Still able to leak private fields if using the t(number) prefix 

### Details
Knex query allows you to change there default prefix 
```SqliteError: select distinct `t0`.* from `pages` as `t0` left join `admin_users` as `t1` on `t0`.`updated_by_id` = `t1`.`id` where (`t1`.`password` = 1)```
so if you change the prefix to the same as it was before or to an other table you want to query you query changes from password to t1.password password is protected by filtering protections but t1.password is not protected
### PoC
1 Create a contentType
2 add to its options "populateCreatorFields"
3 create 1 entity in your new content type
4 in settings enable the find route in settings for the content type you created for public
5 /api/(Your contenttype)?filters%5BupdatedBy%5D%5Bt1.password%5D%5B%24startsWith%5D=a%24
And now the api returns noting if you were to do
/api/(Your contenttype)?filters%5BupdatedBy%5D%5Bt1.password%5D%5B%24startsWith%5D=%24 it would return your entity

### Impact
You can do filtering attacks on everything related to the object again including admin passwords and reset-tokens.
Jenkins Orka by MacStadium Plugin missing permission check (GHSA-4hm4-94g6-f23f)
Aliases: CVE-2023-37949
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:macstadium-orka'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.34'}]}]}]

Jenkins Orka by MacStadium Plugin 1.33 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Orka by MacStadium Plugin 1.34 requires Overall/Administer permission to access the affected HTTP endpoint.
org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability (GHSA-h4vp-69r8-gvjg)
Aliases: CVE-2023-37462
Published: 2023-07-14T21:53:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-skin-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-skin-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.4'}]}]}]

### Impact

Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to a possible privilege escalation from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents.

The attack works by opening a non-existing page with a name crafted to contain a dangerous payload.

It is possible to check if an existing installation is vulnerable by opening `<xwiki-host>/xwiki/bin/view/%22%5D%5D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=SkinsCode.XWikiSkinsSheet&xpage=view` where <xwiki-host is the URL of the XWiki installation. The expected result are two list items with "Edit this skin" and "Test this skin" without any further text. If the installation is vulnerable, the second list item is "Test this skin Hello from groovy!.WebHome"]]". This shows that the Groovy macro has been executed.

### Patches

This has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1.

### Workarounds

The [fix](https://github.com/xwiki/xwiki-platform/commit/d9c88ddc4c0c78fa534bd33237e95dea66003d29) can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet`.

### References

* https://jira.xwiki.org/browse/XWIKI-20457
* https://github.com/xwiki/xwiki-platform/commit/d9c88ddc4c0c78fa534bd33237e95dea66003d29

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
SQL injection in audit endpoint (GHSA-r5pv-7g89-cxmc)
Aliases: CVE-2023-35088
Published: 2023-07-25T09:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.8.0'}]}]}]

Improper Neutralization of Special Elements Used in an SQL Command ('SQL Injection') vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 through 1.7.0. 
In the toAuditCkSql method, the groupId, streamId, auditId, and dt are directly concatenated into the SQL query statement, which may lead to SQL injection attacks.
Users are advised to upgrade to Apache InLong's 1.8.0 or cherry-pick [1] to solve it.

[1]  https://github.com/apache/inlong/pull/8198
Duplicate Advisory: Keylime's registrar vulnerable to Denial-of-service attack via a single open connection (GHSA-9gjg-834p-5gvv)
Published: 2023-07-24T18:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'keylime'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.4.0'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-pg75-v6fp-8q59. This link is maintained to preserve external references.

## Original Description
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
TeamPass Cross-site Scripting vulnerability (GHSA-pwrw-g29q-3mp8)
Aliases: CVE-2023-3531
Published: 2023-07-06T21:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.10'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
Unintentional leakage of private information via cross-origin websocket session hijacking (GHSA-4qcv-qf38-5j3j)
Aliases: CVE-2023-2850
Published: 2023-07-25T18:04:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'nodebb'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.1.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'nodebb'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.13'}]}]}]

### Impact

Private messages or posts might be leaked to third parties if victim opens the attackers site while browsing nodebb.

### Patches

* Patched in v3.1.3
* Backported to v2.x line via v2.8.13

### Workarounds

Users can cherry-pick https://github.com/NodeBB/NodeBB/commit/51096ad2345fb1d1380bec0a447113489ef6c359 if they are on v3.x

If you are running v2.x of NodeBB, you can cherry-pick a5d92da9ddac5607ab7f737520a66eaed6d3ddee followed by 62e162cf1e735e42462be1db9b4954b5a69accdf
Cross-site Scripting in Mingsoft MCMS (GHSA-rxvj-5mv6-j5mc)
Aliases: CVE-2023-3990
Published: 2023-07-28T09:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.mingsoft:ms-mcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.3.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.3.1'}}]

A Cross-site Scripting vulnerability has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.
Apache Airflow Incorrect Authorization vulnerability (GHSA-2h84-3crq-vgfj)
Aliases: CVE-2023-35908
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['airflow.www.auth.has_access']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected
Jenkins ElasticBox CI Plugin vulnerable to cross-site request forgery (GHSA-5v46-54vj-4mjq)
Aliases: CVE-2023-37964
Published: 2023-07-12T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:elasticbox'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.0.3'}]}]}]

Jenkins ElasticBox CI Plugin 5.0.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
OpenAM vulnerable to user impersonation using SAMLv1.x SSO process (GHSA-4mh8-9wq6-rjxg)
Aliases: CVE-2023-37471
Published: 2023-07-20T18:54:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.openidentityplatform.openam:openam-federation-library'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.7.3'}]}]}]

### Impact
OpenAM up to version 14.7.2 does not properly validate the signature of SAML responses received as part of the SAMLv1.x Single Sign-On process. Attackers can use this fact to impersonate any OpenAM user, including the administrator, by sending a specially crafted SAML response to the SAMLPOSTProfileServlet servlet.

### Patches
This problem has been patched in  OpenAM 14.7.3-SNAPSHOT and later

### Workarounds
One should comment servlet `SAMLPOSTProfileServlet` in web.xml or disable SAML in OpenAM
```xml
<servlet>
    <description>SAMLPOSTProfileServlet</description>
    <servlet-name>SAMLPOSTProfileServlet</servlet-name>
    <servlet-class>com.sun.identity.saml.servlet.SAMLPOSTProfileServlet</servlet-class>
</servlet>
...
<servlet-mapping>
    <servlet-name>SAMLSOAPReceiver</servlet-name>
    <url-pattern>/SAMLSOAPReceiver</url-pattern>
</servlet-mapping>
```

### References
#624
Admidio vulnerable to Unrestricted Upload of File with Dangerous Type (GHSA-q347-jrx8-5pw9)
Aliases: CVE-2023-3692
Published: 2023-07-16T03:30:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'admidio/admidio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.10'}]}]}]

Unrestricted Upload of File with Dangerous Type in GitHub repository admidio/admidio prior to 4.2.10.
By-passing Cross-Site Scripting Protection in HTML Sanitizer (GHSA-59jf-3q9v-rh6g)
Aliases: CVE-2023-38500
Published: 2023-07-25T18:27:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'typo3/html-sanitizer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.5.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'typo3/html-sanitizer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.1.2'}]}]}]

> ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.4)

### Problem
Due to an encoding issue in the serialization layer, malicious markup nested in a `noscript` element was not encoded correctly. `noscript` is disabled in the default configuration, but might have been enabled in custom scenarios. This allows bypassing the cross-site scripting mechanism of [`typo3/html-sanitizer`](https://packagist.org/packages/typo3/html-sanitizer).

### Solution
Update to `typo3/html-sanitizer` versions 1.5.1 or 2.1.2 that fix the problem described.

### Credits
Thanks to David Klein and Yaniv Nizry who reported this issue, and to TYPO3 security team members Oliver Hader and Benjamin Franzke who fixed the issue.

### References
* [TYPO3-CORE-SA-2023-002](https://typo3.org/security/advisory/typo3-core-sa-2023-002)
Weave GitOps Terraform Controller Information Disclosure Vulnerability (GHSA-6hvv-j432-23cv)
Aliases: CVE-2023-34236
Published: 2023-07-14T21:52:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/weaveworks/tf-controller'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.14.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/weaveworks/tf-controller'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.15.0-rc.1'}, {'fixed': '0.15.0-rc.5'}]}]}]

### Impact

A vulnerability has been identified in Weave GitOps Terraform Controller which could allow an authenticated remote attacker to view sensitive information. This vulnerability stems from Weave GitOps Terraform Runners (`tf-runner`), where sensitive data is inadvertently printed - potentially revealing sensitive user data in their pod logs. In particular, functions `tfexec.ShowPlan`, `tfexec.ShowPlanRaw`, and `tfexec.Output` are implicated when the `tfexec` object set its `Stdout` and `Stderr` to be `os.Stdout` and `os.Stderr`.

An unauthorized remote attacker could exploit this vulnerability by accessing these prints of sensitive information, which may contain configurations or tokens that could be used to gain unauthorized control or access to resources managed by the Terraform controller.

A successful exploit could allow the attacker to utilize this sensitive data, potentially leading to unauthorized access or control of the system.

### Patches

This vulnerability has been addressed in Weave GitOps Terraform Controller versions `v0.14.4` and `v0.15.0-rc.5`. Users are urged to upgrade to one of these versions to mitigate the vulnerability.

The patches for this vulnerability are found in:
- this commit: 9708fda28ccd0466cb0a8fd409854ab4d92f7dca
- this commit: 6323b355bd7f5d2ce85d0244fe0883af3881df4e
- this commit: 28282bc644054e157c3b9a3d38f1f9551ce09074
- and this commit: 98a0688036e9dbcf43fa84960d9a1ef3e09a69cf

### Workarounds

As a temporary measure until the patch can be applied, users can add the environment variable `DISABLE_TF_LOGS` to the tf-runners via the runner pod template of the Terraform Custom Resource. This will prevent the logging of sensitive information and mitigate the risk of this vulnerability.

### References

- The first issue: https://github.com/weaveworks/tf-controller/issues/637
- The second issue: https://github.com/weaveworks/tf-controller/issues/649

### For More Information

If you have any further questions or comments about this advisory:

Open an issue in the Weave GitOps Terraform Controller repository
Email us at [security@weave.works](mailto:security@weave.works)
RocketMQ NameServer component Code Injection vulnerability (GHSA-gpq8-963w-8qc9)
Aliases: CVE-2023-37582
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.rocketmq:rocketmq-namesrv'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.9.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.rocketmq:rocketmq-namesrv'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.1.2'}]}]}]

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. 

When NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. 

It is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.
Jenkins MathWorks Polyspace Plugin vulnerable to arbitrary file read (GHSA-q6cq-8r4j-6rj5)
Aliases: CVE-2023-37960
Published: 2023-07-12T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.mathworks.polyspace.jenkins:mathworks-polyspace'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.5'}]}]}]

Jenkins MathWorks Polyspace Plugin 1.0.5 and earlier does not restrict the path of the attached files in Polyspace Notification post-build step.

This allows attackers with Item/Configure permission to send emails with arbitrary files from the Jenkins controller file system.
Apache OpenMeetings insufficient authorization vulnerability (GHSA-v93h-rwj8-78qh)
Aliases: CVE-2023-28936
Published: 2023-07-06T21:14:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.openmeetings:openmeetings-db'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '7.1.0'}]}]}]

Attacker can access arbitrary recording/room

Vendor: The Apache Software Foundation

Versions Affected: Apache OpenMeetings from 2.0.0 before 7.1.0
Apache Ambari Expression Language Injection vulnerability (GHSA-p7w2-784m-qpq9)
Aliases: CVE-2022-45855
Published: 2023-07-12T12:31:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.ambari:ambari'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.7'}]}]}]

SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
Apache Pulsar Function Worker Incorrect Authorization vulnerability (GHSA-74mc-g2xv-pch2)
Aliases: CVE-2023-37579
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.pulsar:pulsar-functions-worker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.10.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.pulsar:pulsar-functions-worker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.11.0'}, {'fixed': '2.11.1'}]}], 'versions': ['2.11.0']}]

Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker.

This issue affects Apache Pulsar: before 2.10.4, and 2.11.0.

Any authenticated user can retrieve a source's configuration or a sink's configuration without authorization. Many sources and sinks contain credentials in the configuration, which could lead to leaked credentials. This vulnerability is mitigated by the fact that there is not a known way for an authenticated user to enumerate another tenant's sources or sinks, meaning the source or sink name would need to be guessed in order to exploit this vulnerability.

The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version.

2.10 Pulsar Function Worker users should upgrade to at least 2.10.4.
2.11 Pulsar Function Worker users should upgrade to at least 2.11.1.
3.0 Pulsar Function Worker users are unaffected.
Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.
OpenRefine vulnerable to zip slip in project import (GHSA-m88m-crr9-jvqq)
Aliases: CVE-2023-37476
Published: 2023-07-18T18:47:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.openrefine:main'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.7.4'}]}]}]

### Impact

A carefully crafted malicious OpenRefine project tar file can be used to trigger arbitrary code execution if a user can be convinced to import it.

### Patches

The vulnerability exists in all versions of OpenRefine up to and including 3.7.3. Users should update to OpenRefine 3.7.4 as soon as possible.

### Workarounds

Only import OpenRefine projects from trusted sources.

### References

A similar [issue](https://github.com/OpenRefine/OpenRefine/issues/1840) existed in the Create Project feature ([CVE-2018-19859](https://nvd.nist.gov/vuln/detail/CVE-2018-19859)), which was fixed by PR [#1901](https://github.com/OpenRefine/OpenRefine/pull/1901).
A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries (GHSA-2w8w-qhg4-f78j)
Published: 2023-07-11T22:45:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/jaegertracing/jaeger'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.47.0'}]}]}]

Related UI vulnerability advisory: https://github.com/jaegertracing/jaeger-ui/security/advisories/GHSA-vv24-rm95-q56r

### Summary
Jaeger UI is using the `json-markup` dependency to display span attributes and resources. This dependency is not sanitising keys of an object though, thus the `KeyValuesTable` is vulnerable to XSS. 

### Details
The vulnerable line is here: https://github.com/jaegertracing/jaeger-ui/blob/main/packages/jaeger-ui/src/components/TracePage/TraceTimelineViewer/SpanDetail/KeyValuesTable.tsx#L49

### PoC

1. Start a Jaeger UI
2. Save the following trace as a file:
```json
{
    "data": [
        {
            "traceID": "076ef819cc06c45a",
            "spans": [
                {
                    "traceID": "076ef819cc06c45a",
                    "spanID": "076ef819cc06c45a",
                    "flags": 1,
                    "operationName": "and open 'attributes'",
                    "references": [],
                    "startTime": 1678196149232010,
                    "duration": 13485,
                    "tags": [
                        {
                            "key": "sampler.type",
                            "type": "string",
                            "value": "{\"<img src=x onerror=alert(1)>\":\"test\"}"
                        }
                    ],
                    "logs": [],
                    "processID": "p1",
                    "warnings": null
                }
            ],
            "processes": {
                "p1": {
                    "serviceName": "click here",
                    "tags": [
                    ]
                }
            },
            "warnings": null
        }
    ],
    "total": 0,
    "limit": 0,
    "offset": 0,
    "errors": null
}
```
3. Upload that trace to Jaeger UI in order to visualise it.
4. Open the trace, open it's span's attributes.
5. XSS should be fired.

### Impact

This is a XSS on Jaeger UI. XSS can be used to run JavaScript.
Command injection in PaddlePaddle (GHSA-9q9v-qgwx-84mr)
Aliases: CVE-2023-38673
Published: 2023-07-26T12:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'paddlepaddle'}, 'ecosystem_specific': {'affected_functions': ['paddle.distributed.fleet.utils.LocalFS']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.0'}]}]}]

PaddlePaddle before 2.5.0 has a command injection in fs.py. This resulted in the ability to execute arbitrary commands on the operating system.
Apache InLong Improper Privilege Management vulnerability (GHSA-q5p5-xg93-2jqc)
Aliases: CVE-2023-31062
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-pojo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-dao'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.7.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.7.0'}]}]}]

Improper Privilege Management Vulnerabilities in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.2.0 through 1.6.0.  When the attacker has access to a valid (but unprivileged) account, the exploit can be executed using Burp Suite by sending a login request and following it with a subsequent HTTP request using the returned cookie.

Users are advised to upgrade to Apache InLong's 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7836 to solve it.
Hazelcast Executor Services don't check client permissions properly (GHSA-c5vj-wp4v-mmvx)
Aliases: CVE-2023-33265
Published: 2023-07-19T22:08:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.hazelcast:hazelcast'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.2.0'}, {'fixed': '5.2.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.2.3'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.hazelcast:hazelcast'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '5.1.7'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.1.6'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.hazelcast:hazelcast'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.0.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.0.4'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.hazelcast:hazelcast-enterprise'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.2.0'}, {'fixed': '5.2.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.2.3'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.hazelcast:hazelcast-enterprise'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '5.1.7'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.1.6'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.hazelcast:hazelcast-enterprise'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.0.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.0.4'}}]

### Impact
In Hazelcast Platform, 5.0 through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, and Hazelcast IMDG (all versions up to 4.2.z), Executor Services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.

### Patches
Fix versions: 5.3.0, 5.2.4, 5.1.7, 5.0.5

### Workarounds
Users are only affected when they already use executor services (i.e., an instance exists as a distributed data structure).