aswin1906/github-advisory-2023 huggingface dataset:
FrameworkUserBundle Generates Error Message Containing Sensitive Information (GHSA-6m7c-45ff-3328)
Aliases: CVE-2015-10012
Published: 2023-01-03T09:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'sumocoders/framework-user-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.0'}]}]}]

A vulnerability was found in sumocoders FrameworkUserBundle up to 1.3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the file Resources/views/Security/login.html.twig. The manipulation leads to information exposure through error message. Upgrading to version 1.4.0 can address this issue. The name of the patch is abe4993390ba9bd7821ab12678270556645f94c8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217268.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
exec-local-bin vulnerable to Command Injection (GHSA-f259-h6m8-hm8m)
Aliases: CVE-2022-25923
Published: 2023-01-06T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'exec-local-bin'}, 'ecosystem_specific': {'affected_functions': ['exec-local-bin']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.0'}]}]}]

Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the `theProcess()` functionality due to improper user-input sanitization.
XSS Attack with Express API (GHSA-xrh7-m5pp-39r6)
Aliases: CVE-2023-23630
Published: 2023-01-31T22:39:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'eta'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}]

### Impact
XSS attack - anyone using the Express API is impacted

### Patches
The problem has been resolved. Users should upgrade to version 2.0.0.

### Workarounds
Don't pass user supplied data directly to `res.renderFile`. 

### References
_Are there any links users can visit to find out more?_
See https://github.com/eta-dev/eta/releases/tag/v2.0.0
xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table (GHSA-88p8-4vv5-82j7)
Aliases: CVE-2015-2179
Published: 2023-01-26T23:51:40Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'xaviershay-dm-rails'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.0'}]}]}]

xaviershay-dm-rails Gem for Ruby contains a flaw in the `execute()` function in `/datamapper/dm-rails/blob/master/lib/dm-rails/storage.rb`. The issue is due to the function exposing sensitive information via the process table. This may allow a local attack to gain access to MySQL credential information.
DataFlow upload remote code execution vulnerability (GHSA-h632-p764-pjqm)
Aliases: CVE-2021-41231
Published: 2023-01-27T00:56:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.4.22'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '20.0.0'}, {'fixed': '20.0.19'}]}]}]

### Impact
An administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile.
Cross-site Scripting in modoboa (GHSA-jm3m-wr3p-hjrq)
Aliases: CVE-2023-0519
Published: 2023-01-27T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.4'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
Tokio reject_remote_clients configuration may get dropped when creating a Windows named pipe (GHSA-7rrj-xr53-82p7)
Aliases: CVE-2023-22466
Published: 2023-01-06T21:40:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'tokio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.7.0'}, {'fixed': '1.18.4'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'tokio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.19.0'}, {'fixed': '1.20.3'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'tokio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.21.0'}, {'fixed': '1.23.1'}]}]}]

### Impact

When configuring a Windows named pipe server, setting `pipe_mode` will reset `reject_remote_clients` to `false`. If the application has previously configured `reject_remote_clients` to `true`, this effectively undoes the configuration. This also applies if `reject_remote_clients` is not explicitly set as this is the default configuration and is cleared by calling `pipe_mode`.

Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publically shared folder (SMB).

### Patches

The following versions have been patched:
* 1.23.1
* 1.20.3
* 1.18.4

The fix will also be present in all releases starting from version 1.24.0.

Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected.

### Workarounds

Ensure that `pipe_mode` is set **first** after initializing a `ServerOptions`. For example:

```rust
let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);
```

### References

https://learn.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea#pipe_reject_remote_clients
ReDoS Vulnerability in ua-parser-js version (GHSA-fhg7-m89q-25r3)
Aliases: CVE-2022-25927
Published: 2023-01-24T15:36:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'ua-parser-js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.7.33'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'ua-parser-js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.0'}, {'fixed': '1.0.33'}]}]}]

### Description:
A regular expression denial of service (ReDoS) vulnerability has been discovered in `ua-parser-js`.

### Impact:
This vulnerability bypass the library's `MAX_LENGTH` input limit prevention. By crafting a very-very-long user-agent string with specific pattern, an attacker can turn the script to get stuck processing for a very long time which results in a denial of service (DoS) condition.

### Affected Versions:
All versions of the library prior to version `0.7.33` / `1.0.33`.

### Patches:
A patch has been released to remove the vulnerable regular expression, update to version `0.7.33` / `1.0.33` or later.

### References:
[Regular expression Denial of Service - ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)

### Credits:
Thanks to @Snyk who first reported the issue.
@okta/oidc-middlewareOpen Redirect vulnerability (GHSA-58h4-9m7m-j9m4)
Aliases: CVE-2022-3145
Published: 2023-01-09T20:06:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@okta/oidc-middleware'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.0.0'}]}]}]

An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL.

**Affected products and versions**
Okta OIDC Middleware prior to version 5.0.0.

**Resolution**
The vulnerability is fixed in OIDC Middleware 5.0.0.  To remediate this vulnerability, upgrade Okta OIDC Middleware to this version or later.

**CVE details**
**CVE ID:**		[CVE-2022-3145](https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-3145)
**Published Date:**	01/05/2023
**Vulnerability Type:**	Open Redirect
**CWE:**			CWE-601
**CVSS v3.1 Score:** 4.3
**Severity:** Medium
**Vector string:** AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

**Severity Details**
To exploit this issue, an attacker would need to send a victim a malformed URL containing a target server that they control. Once a user successfully completed the login process, the victim user would then be redirected to the attacker controlled site.

**References**
https://github.com/okta/okta-oidc-middleware
Vercel ms Inefficient Regular Expression Complexity vulnerability (GHSA-w9mr-4mfr-499f)
Aliases: CVE-2017-20162
Published: 2023-01-05T12:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'ms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}]

A vulnerability, which was classified as problematic, has been found in vercel ms up to 1.x. This issue affects the function parse of the file index.js. The manipulation of the argument str leads to inefficient regular expression complexity. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is caae2988ba2a37765d055c4eee63d383320ee662. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217451.
Modoboa is vulnerable to Cross-Site Request Forgery (GHSA-v9gj-5rgp-w33r)
Aliases: CVE-2023-0398
Published: 2023-01-19T09:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.3'}]}]}]

Modoboa 2.0.3 and prior is vulnerable to Cross-Site Request Forgery. A patch is available and anticipated to be part of version 2.0.4.
webbrowser-rs allows attackers to access arbitrary files via supplying a crafted URL (GHSA-m589-mv4q-p7rj)
Aliases: CVE-2022-45299
Published: 2023-01-13T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'webbrowser'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.8.3'}]}]}]

An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.
Cross-site request forgery vulnerability in Jenkins Bitbucket OAuth Plugin  (GHSA-685j-36qx-3vp2)
Aliases: CVE-2023-24428
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:bitbucket-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.13'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into logging in to the attacker's account.
dompurify vulnerable to Cross-site Scripting (GHSA-h6p3-p4vx-wr8q)
Published: 2023-01-11T23:47:24Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'dompurify'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.3'}]}]}]

dompurify prior to version 2.2.3 is vulnerable to a cross-site scripting problem caused by nested headlines.
magento-lts Reset Password not protected against well-timed CSRF (GHSA-r3c9-9j5q-pwv4)
Aliases: CVE-2021-21395
Published: 2023-01-26T19:51:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.4.22'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '20.0.0'}, {'fixed': '20.0.19'}]}]}]

### Impact

Password reset form is vulnerable to CSRF between time reset password link is clicked and user submits new password.

### Patches

PR forthcoming

### Workarounds

None
Information Cards Module vulnerable to Cross-site Scripting (GHSA-2phw-rgr7-5pvh)
Aliases: CVE-2010-10004
Published: 2023-01-09T09:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'simplesamlphp/simplesamlphp-module-infocard'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0'}]}]}]

A vulnerability was found in Information Cards Module and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 1.0 is able to address this issue. The name of the patch is f6bfea49ae16dc6e179df8306d39c3694f1ef186. It is recommended to upgrade the affected component. The identifier VDB-217661 was assigned to this vulnerability.
github.com/openshift/apiserver-library-go Improper Input Validation vulnerability (GHSA-5465-xc2j-6p84)
Aliases: CVE-2023-0229
Published: 2023-01-26T21:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/openshift/apiserver-library-go'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20230120221150-cefee9e0162b'}]}]}]

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profile used in the restricted-v2 Security Context Constraint (SCC) is "runtime/default," allowing users to disable seccomp for pods they can create and modify.
Directory Traversal vulnerability in serve-lite (GHSA-5qq4-m6c3-xxmf)
Aliases: CVE-2022-21192
Published: 2023-01-26T21:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'serve-lite'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.0'}]}]}]

All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the req.url passed as-is to path.join().
Apiman has potential permissions bypass (GHSA-j94p-hv25-rm5g)
Aliases: CVE-2022-47551
Published: 2023-01-03T12:28:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.apiman:apiman-manager-api-rest-impl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.7'}, {'fixed': '3.0.0.Final'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.2.3.Final'}}]

### Impact

Incorrect default permissions for certain read-only resources in the Apiman 1.5.7.Final through 2.2.3.Final in the Apiman Manager REST API allows a remote authenticated attacker to access information and resources in an Apiman Organizations they are not a member of and/or do not have permissions for.

For example, an attacker may be able to craft an HTTP request to discover APIs that are private to organizations they are not members of, via fuzzing, search, and other similar mechanisms.

If the attacker has sufficient permissions in their own organization, they may also be able to sign up to the private APIs they have discovered by crafting a tailored HTTP request, thereby gaining access to an API Management protected resource that they should have access to.

* A malicious account-holder may be able to see information about APIs they do not have permission for.

* A malicious account-holder may be able to sign up to APIs they do not have permission for, and hence access API Management-protected resources they are not authorized to access.

* This does NOT relate to the Apiman Gateway.

### Patches

* Upgrade to Apiman 3.0.0.Final (or later). The issue is fixed in this version.

* If you are using an older version of Apiman, contact to your [Apiman support provider](https://www.apiman.io/support.html) for advice/long-term support.

### References

* https://www.apiman.io/blog/permissions-bypass-disclosure/
* https://github.com/advisories/GHSA-54r5-wr8x-x5v3
* https://nvd.nist.gov/vuln/detail/CVE-2022-47551
* https://github.com/orgs/apiman/discussions/2409
Path Traversal in github.com/go-sonic/sonic (GHSA-2x48-p6cq-5xcw)
Aliases: CVE-2022-46959
Published: 2023-01-23T06:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/go-sonic/sonic'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.5'}]}]}]

An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal.
XWiki CKEditor.HTMLConverter vulnerable to Remote Code Execution via Cross-Site Request Forgery (GHSA-6mjp-2rm6-9g85)
Aliases: CVE-2023-22457
Published: 2023-01-06T17:15:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.contrib:application-ckeditor-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.64.3'}]}]}]

### Impact
The `CKEditor.HTMLConverter` document lacked a protection against Cross-Site Request Forgery (CSRF), allowing to execute macros with the rights of the current user. If a privileged user with programming rights was tricked into executing a GET request to this document with certain parameters (e.g., via an image with a corresponding URL embedded in a comment or via a redirect), this would allow arbitrary remote code execution and the attacker could gain rights, access private information or impact the availability of the wiki.

The attack can be demonstrated by accessing the URL `<server>/xwiki/bin/view/Main?sheet=CKEditor.HTMLConverter&language=en&sourceSyntax=xwiki%2F2.1&stripHTMLEnvelope=true&fromHTML=false&toHTML=true&text=%7B%7Bgroovy%7D%7Dprintln%28%22Hello+from+Groovy%21%22%29%7B%7B%2Fgroovy%7D%7D` where `<server>` is the URL of the XWiki installation as a user with programming rights. If this displays the text "Hello from Groovy!", the installation is vulnerable.

### Patches
The issue has been patched in the CKEditor Integration version 1.64.3. This has also been patched in the version of the CKEditor integration that is bundled starting with XWiki 14.6 RC1.

### Workarounds
There are no known workarounds for this other than upgrading the CKEditor integration to a fixed version.

### References
* https://github.com/xwiki-contrib/application-ckeditor/commit/6b1053164386aefc526df7512bc664918aa6849b
* https://jira.xwiki.org/browse/CKEDITOR-475

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
usememos/memos vulnerable to stored Cross-site Scripting (GHSA-8686-4cr3-76wj)
Aliases: CVE-2023-0106
Published: 2023-01-07T06:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.0'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
Keycloak has lack of validation of access token on client registrations endpoint (GHSA-v436-q368-hvgg)
Aliases: CVE-2023-0091
Published: 2023-01-12T23:39:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '20.0.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 20.0.2'}}]

When a service account with the create-client or manage-clients role can use the client-registration endpoints to create/manage clients with an access token.

If the access token is leaked, there is an option to revoke the specific token. However, the check is not performed in client-registration endpoints.
phpmyadmin contains SQL Injection vulnerability (GHSA-prcg-mc23-hgjh)
Aliases: CVE-2020-22452
Published: 2023-01-26T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'phpmyadmin/phpmyadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.2'}]}]}]

SQL Injection vulnerability in function getTableCreationQuery in CreateAddField.php in phpMyAdmin 5.x before 5.0.2 via the tbl_storage_engine or tbl_collation parameters to tbl_create.php.
jSuites subect to Cross-site Scripting (GHSA-r4hg-4cpq-q57c)
Aliases: CVE-2022-25979
Published: 2023-01-31T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'jsuites'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.0.1'}]}]}]

Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function.
Cross-site Scripting in modoboa (GHSA-c467-5c2g-jp86)
Aliases: CVE-2023-0470
Published: 2023-01-27T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.4'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.
easy-scrypt Observable Timing Discrepancy vulnerability (GHSA-r894-5r7v-7rx3)
Aliases: CVE-2014-125055
Published: 2023-01-07T09:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/agnivade/easy-scrypt'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0'}]}]}]

A vulnerability, which was classified as problematic, was found in agnivade easy-scrypt. Affected is the function `VerifyPassphrase` of the file `scrypt.go`. The manipulation leads to observable timing discrepancy. Upgrading to version 1.0.0 can address this issue. The name of the patch is 477c10cf3b144ddf96526aa09f5fdea613f21812. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217596.
Improper Input Validation in pyload-ng (GHSA-x9vc-5q77-m7x4)
Aliases: CVE-2023-0434
Published: 2023-01-22T03:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyload-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0b3.dev40'}]}]}]

Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
Path Traversal in Jenkins visualexpert Plugin (GHSA-8mmh-h4jh-2g34)
Aliases: CVE-2023-24455
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:visualexpert'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3'}]}]}]

Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Item/Configure permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
CSRF vulnerability in Jenkins Orka Plugin allow capturing credentials (GHSA-9jwh-qvg7-gr59)
Aliases: CVE-2023-24432
Published: 2023-01-26T21:30:18Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:macstadium-orka'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.32'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
gosqljson SQL Injection vulnerability (GHSA-g7mw-9pf9-p2pm)
Aliases: CVE-2014-125064
Published: 2023-01-07T21:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/elgs/gosqljson'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.0-20220916234230-750f26ee23c7'}]}]}]

A vulnerability, which was classified as critical, has been found in elgs gosqljson. This issue affects the function `QueryDbToArray/QueryDbToMap/ExecDb` of the file `gosqljson.go`. The manipulation of the argument sqlStatement leads to sql injection. The name of the patch is 2740b331546cb88eb61771df4c07d389e9f0363a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217631.
Dromara hutool vulnerable to SQL Injection (GHSA-6c25-cxcc-pmc4)
Aliases: CVE-2023-24163
Published: 2023-01-31T18:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-all'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.11'}]}]}]

SQL Inection vulnerability in Dromara hutool v5.8.11 allows attacker to execute arbitrary code via the aviator template engine.
Path traversal vulnerability in Jenkins PWauth Security Realm Plugin (GHSA-5xpc-c4xv-7w62)
Aliases: CVE-2023-24449
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jvnet.hudson.plugins:pwauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.4'}]}]}]

Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
XML Entity Expansion in Jenkins TestComplete support Plugin (GHSA-g5mj-c26g-vmpm)
Aliases: CVE-2023-24443
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:TestComplete'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.8.1'}]}]}]

Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
KubePi session fixation attack allows an attacker to hijack a legitimate user session. (GHSA-v4w5-r2xc-7f8h)
Aliases: CVE-2023-22479
Published: 2023-01-09T21:57:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/KubeOperator/kubepi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.6.3'}}]

### Summary
A session fixation attack allows an attacker to hijack a legitimate user session. The attack investigates a flaw in how the online application handles the session ID, especially the susceptible web application.

### Affected Version
<= v1.6.3

### Patches
The vulnerability has been fixed in [v1.6.4](https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4).

https://github.com/KubeOperator/KubePi/commit/1e9c550356c1a425a742480efcf743d373e98dcb : A session fixation attack allows an attacker to hijack a legitimate user session.

### Workarounds
It is recommended to upgrade the version to [v1.6.4](https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4).

### For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/KubeOperator/KubePi/issues).

This vulnerability is reported by [sachinh09](https://huntr.dev/users/sachinh09/) from [huntr.dev](https://huntr.dev/).
PgHero Allows Information Disclosure Through EXPLAIN Feature (GHSA-vf99-xw26-86g5)
Aliases: CVE-2023-22626
Published: 2023-01-05T09:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'pghero'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.0'}]}]}]

PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (Depending on database user privileges, this may only be information from the database, or may be information from file contents on the database server.)
Session fixation vulnerability in Jenkins Keycloak Authentication Plugin (GHSA-9963-gmh8-vvm6)
Aliases: CVE-2023-24456
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:keycloak'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.3.0'}]}]}]

Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.
phpMyFAQ Stored Cross-site Scripting vulnerability (GHSA-w475-749h-c77m)
Aliases: CVE-2023-0308
Published: 2023-01-16T00:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.10'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.10.
globalpom-utils has Insecure Temporary File (GHSA-jjvp-wfp8-rv69)
Aliases: CVE-2018-25068
Published: 2023-01-06T21:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.anrisoftware.globalpom:globalpomutils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.1'}]}]}]

A vulnerability has been found in devent globalpom-utils up to 4.5.0 and classified as critical. This vulnerability affects the function `createTmpDir` of the file `globalpomutils-fileresources/src/main/java/com/anrisoftware/globalpom/fileresourcemanager/FileResourceManagerProvider.java`. The manipulation leads to insecure temporary file. The attack can be initiated remotely. Upgrading to version 4.5.1 can address this issue. The name of the patch is 77a820bac2f68e662ce261ecb050c643bd7ee560. It is recommended to upgrade the affected component. VDB-217570 is the identifier assigned to this vulnerability.
Issue with whitespace in JWT roles in OpenSearch (GHSA-864v-6qj7-62qj)
Aliases: CVE-2023-23612
Published: 2023-01-24T20:47:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opensearch:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.opensearch:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.5.0'}]}]}]

### Advisory title: Issue with whitespace in JWT roles

### Affected versions:
OpenSearch 1.0.0-1.3.7 and 2.0.0-2.4.1

### Patched versions:
OpenSearch 1.3.8 and 2.5.0

### Impact:
OpenSearch uses JWTs to store role claims obtained from the Identity Provider (IdP) when the authentication backend is SAML or OpenID Connect. There is an issue in how those claims are processed from the JWTs where the leading and trailing whitespace is trimmed, allowing users to potentially claim roles they are not assigned to if any role matches the whitespace-stripped version of the roles they are a member of.

This issue is only present for authenticated users, and it requires either the existence of roles that match, not considering leading/trailing whitespace, or the ability for users to create said matching roles. In addition, the Identity Provider must allow leading and trailing spaces in role names.

### Patches:
OpenSearch versions 1.3.8 and 2.5.0 contain a fix for this issue.

### For more information:
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
Luxon Inefficient Regular Expression Complexity vulnerability (GHSA-3xq5-wjfh-ppjc)
Aliases: CVE-2023-22467
Published: 2023-01-09T14:10:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'luxon'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.28.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'luxon'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.5.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'luxon'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.2.1'}]}]}]

# Impact
Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks.

This is the same bug as Moment's https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g

# Workarounds
Limit the length of the input.

# References
There is an excellent writeup of the same issue in Moment: https://github.com/moment/moment/pull/6015#issuecomment-1152961973

# Details
`DateTime.fromRFC2822("(".repeat(500000))` takes a couple minutes to complete.
Denial of service (DoS) when processing Git credentials (GHSA-8fcj-gf77-47mg)
Aliases: CVE-2022-43756
Published: 2023-01-25T19:40:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/wrangler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.7.4-security1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.7.3'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/wrangler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.0'}, {'fixed': '0.8.5-security1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.8.4'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/wrangler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.1'}]}], 'versions': ['1.0.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/wrangler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.6'}, {'fixed': '0.8.11'}]}]}]

### Impact

A denial of services (DoS) vulnerability was discovered in Wrangler Git package affecting versions up to and including `v1.0.0`.

Specially crafted Git credentials can result in a denial of service (DoS) attack on an application that uses Wrangler due to the exhaustion of the available memory and CPU resources. This is caused by a lack of input validation of Git credentials before they are used, which may lead to a denial of service in some cases. This issue can be triggered when accessing both private and public Git repositories. 

### Workarounds

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

### Patches

Patched versions include `v1.0.1` and later and the backported tags - `v0.7.4-security1`, `v0.8.5-security1` and `v0.8.11`.

### For more information

If you have any questions or comments about this advisory:

* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) or [Wrangler](https://github.com/rancher/wrangler/issues/new) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
pyLoad vulnerable to Improper Restriction of Rendered UI Layers or Frames (GHSA-h8r9-467r-vjjf)
Aliases: CVE-2023-0057
Published: 2023-01-05T03:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyload-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0b3.dev33'}]}]}]

Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.
Shopware has Improper Input Validation issue in newsletter subscription (GHSA-46h7-vj7x-fxg2)
Aliases: CVE-2023-22734
Published: 2023-01-20T23:18:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'shopware/platform'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}, {'package': {'ecosystem': 'Packagist', 'name': 'shopware/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}]

### Impact

The newsletter double opt-in validation was not checked properly, and it was possible to skip the complete double opt in process.

### Patches
The problem has been fixed with 6.4.18.1

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Or disable the newsletter registration completely.

### References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
ReDoS based DoS vulnerability in Active Support's underscore (GHSA-j6gc-792m-qgm2)
Aliases: CVE-2023-22796
Published: 2023-01-18T18:23:20Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'activesupport'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.1.7.1'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'activesupport'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.4.1'}]}]}]

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796.

Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem), 6.1.7.1, 7.0.4.1
Impact

A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

This affects String#underscore, ActiveSupport::Inflector.underscore, String#titleize, and any other methods using these.

All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.

Users on Ruby 3.2.0 or greater may be able to reduce the impact by configuring Regexp.timeout.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 6.1 series
    7-0-Avoid-regex-backtracking-in-Inflector.underscore.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Integer overflow in publify_core (GHSA-rc42-jghf-vr8f)
Aliases: CVE-2022-1812
Published: 2023-01-14T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'publify_core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.10'}]}]}]

Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10 due to an unlimited length user name field.
XML external entity vulnerability on agents in Jenkins MSTest Plugin  (GHSA-3ppr-72x5-x67q)
Aliases: CVE-2023-24441
Published: 2023-01-26T21:30:18Z
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jvnet.hudson.plugins:mstest'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.1'}]}]}]

Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
PapaParse Inefficient Regular Expression Complexity vulnerability (GHSA-798h-g4j5-5537)
Aliases: CVE-2020-36649
Published: 2023-01-11T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'papaparse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.2.0'}]}]}]

A vulnerability was found in mholt PapaParse up to 5.1.x. It has been classified as problematic. Affected is an unknown function of the file papaparse.js. The manipulation leads to inefficient regular expression complexity. Upgrading to version 5.2.0 is able to address this issue. The name of the patch is 235a12758cd77266d2e98fd715f53536b34ad621. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218004.
Cleartext Transmission of Sensitive Information in Jenkins JIRA Pipeline Steps Plugin (GHSA-3g2g-rcm6-rrq2)
Aliases: CVE-2023-24440
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:jira-steps'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.165.v8846cf59f3db'}]}]}]

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
PaginationServiceProvider SQL Injection vulnerability (GHSA-ww43-mcvh-35p4)
Aliases: CVE-2014-125029
Published: 2023-01-08T00:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'ttskch/pagination-service-provider'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0'}]}]}]

A vulnerability was found in ttskch PaginationServiceProvider up to 0.x. It has been declared as critical. This vulnerability affects unknown code of the file `demo/index.php` of the component demo. The manipulation of the argument sort/id leads to sql injection. Upgrading to version 1.0.0 can address this issue. The name of the patch is 619de478efce17ece1a3b913ab16e40651e1ea7b. It is recommended to upgrade the affected component. VDB-217150 is the identifier assigned to this vulnerability.
Missing permission checks in Jenkins Orka Plugin allow enumerating credentials IDs  (GHSA-87rh-wc85-xqvc)
Aliases: CVE-2023-24431
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:macstadium-orka'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.32'}]}]}]

A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Froxlor vulnerable to Command Injection (GHSA-cp68-42pf-6627)
Aliases: CVE-2023-0315
Published: 2023-01-16T03:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.8'}]}]}]

Command Injection in GitHub repository froxlor/froxlor prior to 2.0.8.
usememos/memos vulnerable to stored Cross-site Scripting (GHSA-h2ph-9r76-37v5)
Aliases: CVE-2023-0111
Published: 2023-01-07T06:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.10.0'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.10.0.
convict vulnerable to Prototype Pollution (GHSA-4jrm-c32x-w4jf)
Aliases: CVE-2023-0163
Published: 2023-01-10T21:50:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'convict'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.2.4'}]}]}]

### Impact

* An attacker can inject attributes that are used in other components
* An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.

The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.

### Patches
The problem is patched in `convict@6.2.4`. Users should upgrade to `convict@6.2.4`.

### Workarounds
No way for users to fix or remediate the vulnerability without upgrading

### References
https://github.com/mozilla/node-convict/issues/410
WebPA SQL Injection vulnerability (GHSA-mjgw-f2c4-f8qj)
Aliases: CVE-2021-4308
Published: 2023-01-08T12:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'webpa/webpa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.2'}]}]}]

A vulnerability was found in WebPA up to 3.1.1. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. Upgrading to version 3.1.2 can to address this issue. The name of the patch is 8836c4f549181e885a68e0e7ca561fdbcbd04bf0. It is recommended to upgrade the affected component. The identifier VDB-217637 was assigned to this vulnerability.
DBRisinajumi d2files SQL Injection vulnerability (GHSA-68hv-8926-j34c)
Aliases: CVE-2015-10018
Published: 2023-01-06T15:30:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dbrisinajumi/d2files'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0'}]}]}]

A vulnerability has been found in DBRisinajumi d2files and classified as critical. Affected by this vulnerability is the function `actionUpload/actionDownloadFile` of the file `controllers/D2filesController.php`. The manipulation leads to sql injection. Upgrading to version 1.0.0 can address this issue. The name of the patch is b5767f2ec9d0f3cbfda7f13c84740e2179c90574. It is recommended to upgrade the affected component. The identifier VDB-217561 was assigned to this vulnerability.