aswin1906/github-advisory-2023 huggingface dataset:
Froxlor contains Business Logic Errors (GHSA-vqqm-c9gx-773q)
Aliases: CVE-2023-0565
Published: 2023-01-30T00:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.10'}]}]}]

Business Logic Errors in GitHub repository froxlor/froxlor prior to 2.0.10.
ReDoS based DoS vulnerability in Action Dispatch (GHSA-p84v-45xj-wwqj)
Aliases: CVE-2023-22792
Published: 2023-01-18T18:23:34Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'actionpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '5.2.8.15'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'actionpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.1.7.1'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'actionpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.4.1'}]}]}]

There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.

Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact

Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious X_FORWARDED_HOST headers before they reach the application.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
    7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
ReDoS based DoS vulnerability in GlobalID (GHSA-23c2-gwp5-pxw9)
Aliases: CVE-2023-22799
Published: 2023-01-18T18:13:19Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'globalid'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.1'}, {'fixed': '1.0.1'}]}]}]

There is a ReDoS based DoS vulnerability in the GlobalID gem. This vulnerability has been assigned the CVE identifier CVE-2023-22799.

Versions Affected: >= 0.2.1 Not affected: NOTAFFECTED Fixed Versions: 1.0.1
Impact

There is a possible DoS vulnerability in the model name parsing section of the GlobalID gem. Carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    1-0-model-name-redos.patch - Patch for 1.0 series
Directory Traversal in onnx (GHSA-ffxj-547x-5j7c)
Aliases: CVE-2022-25882
Published: 2023-01-26T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'onnx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.13.0'}]}]}]

Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file which is outside the model current directory or user-provided directory, for example "../../../etc/passwd"
Improper neutralization of `noscript` element content may allow XSS in Sanitize (GHSA-fw3g-2h3j-qmm7)
Aliases: CVE-2023-23627
Published: 2023-01-28T01:17:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'sanitize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '6.0.1'}]}]}]

### Impact

Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize `>= 5.0.0, < 6.0.1` when Sanitize is configured with a custom allowlist that allows `noscript` elements. This could result in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.

Sanitize's default configs don't allow `noscript` elements and are not vulnerable. This issue only affects users who are using a custom config that adds `noscript` to the element allowlist.

### Patches

Sanitize `>= 6.0.1` always removes `noscript` elements and their contents, even when `noscript` is in the allowlist.

### Workarounds

Users who are unable to upgrade can prevent this issue by using one of Sanitize's default configs or by ensuring that their custom config does not include `noscript` in the element allowlist.

### Details

The root cause of this issue is that HTML parsing rules treat the contents of a `noscript` element differently depending on whether scripting is enabled in the user agent. Nokogiri (the HTML parser Sanitize uses) doesn't support scripting so it follows the "scripting disabled" rules, but a web browser with scripting enabled will follow the "scripting enabled" rules. This means that Sanitize can't reliably make the contents of a `noscript` element safe for scripting enabled browsers. The safest thing to do is to remove the element and its contents entirely, which is now what Sanitize does in version 6.0.1 and later.

### References

- [Release Notes](https://github.com/rgrove/sanitize/releases/tag/v6.0.1)

### Credit

Thanks to David Klein from [TU Braunschweig](https://www.tu-braunschweig.de/en/ias) (@leeN) for reporting this issue.
bonita-connector-webservice XML External Entity vulnerability (GHSA-wg99-5vrx-j2gg)
Aliases: CVE-2020-36640
Published: 2023-01-05T12:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.bonitasoft.connectors:bonita-connector-webservice'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.1'}]}]}]

A vulnerability, which was classified as problematic, was found in bonitasoft bonita-connector-webservice up to 1.3.0. This affects the function `TransformerConfigurationException` of the file `src/main/java/org/bonitasoft/connectors/ws/SecureWSConnector.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.3.1 can address this issue. The name of the patch is a12ad691c05af19e9061d7949b6b828ce48815d5. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217443.
go-ipld-prime/codec/json may panic if asked to encode bytes (GHSA-c653-6hhg-9x92)
Aliases: CVE-2023-22460
Published: 2023-01-05T12:04:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ipld/go-ipld-prime'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.19.0'}]}]}]

`go-ipld-prime` is a series of Go interfaces for manipulating IPLD data and a Go module that contains the `go-ipld-prime/codec/json` codec.

### Impact

Encoding data which contains a `Bytes` kind Node will pass a `Bytes` token to the JSON encoder which will panic as it doesn't expect to receive `Bytes` tokens. Such an encoding should be treated as an error, as plain JSON should not be able to encode Bytes.

**This only impacts uses of the "json" codec, "dag-json" is not impacted.** Use of "json" as a decoder is not impacted.

### Patches

Fixed in v0.19.0.

### Workarounds

Prefer the "dag-json" codec which has the ability to [encode bytes](https://ipld.io/specs/codecs/dag-json/spec/#bytes).

### References

See fix in [#472](https://github.com/ipld/go-ipld-prime/pull/472)
Command injection in Git package in Wrangler (GHSA-qrg7-hfx7-95c5)
Aliases: CVE-2022-31249
Published: 2023-01-25T19:40:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/wrangler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.7.4-security1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/wrangler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.0'}, {'fixed': '0.8.5-security1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/wrangler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.1'}]}], 'versions': ['1.0.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/wrangler'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.6'}, {'fixed': '0.8.11'}]}]}]

### Impact

A command injection vulnerability was discovered in Wrangler's Git package affecting versions up to and including `v1.0.0`.

Wrangler's Git package uses the underlying Git binary present in the host OS or container image to execute Git operations. Specially crafted commands can be passed to Wrangler that will change their behavior and cause confusion when executed through Git, resulting in command injection in the underlying host.

### Workarounds

A workaround is to sanitize input passed to the Git package to remove potential unsafe and ambiguous characters. Otherwise, the best course of action is to update to a patched Wrangler version.

### Patches

Patched versions include `v1.0.1` and later and the backported tags - `v0.7.4-security1`, `v0.8.5-security1` and `v0.8.11`.

### For more information

If you have any questions or comments about this advisory:

* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) or [Wrangler](https://github.com/rancher/wrangler/issues/new) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
pgAdmin 4 Open Redirect vulnerability (GHSA-894c-rg7f-3c62)
Aliases: CVE-2023-22298
Published: 2023-01-17T12:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pgadmin4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.14'}]}]}]

Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
Cross-site Scripting (XSS) in serve-lite (GHSA-j8x7-qcw4-xx85)
Aliases: CVE-2022-25847
Published: 2023-01-26T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'serve-lite'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.0'}]}]}]

All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding.
bumpalo has use-after-free due to a lifetime error in `Vec::into_iter()` (GHSA-f85w-wvc7-crwc)
Published: 2023-01-20T21:54:22Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'bumpalo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '3.11.1'}]}]}]

In affected versions of this crate, the lifetime of the iterator produced by `Vec::into_iter()` is not constrained to the lifetime of the `Bump` that allocated the vector's memory. Using the iterator after the `Bump` is dropped causes use-after-free accesses.

The following example demonstrates memory corruption arising from a misuse of this unsoundness.

```rust
use bumpalo::{collections::Vec, Bump};

fn main() {
    let bump = Bump::new();
    let mut vec = Vec::new_in(&bump);
    vec.extend([0x01u8; 32]);
    let into_iter = vec.into_iter();
    drop(bump);

    for _ in 0..100 {
        let reuse_bump = Bump::new();
        let _reuse_alloc = reuse_bump.alloc([0x41u8; 10]);
    }

    for x in into_iter {
        print!("0x{:02x} ", x);
    }
    println!();
}
```

The issue was corrected in version 3.11.1 by adding a lifetime to the `IntoIter` type, and updating the signature of `Vec::into_iter()` to constrain this lifetime.
CakePHP vulnerable to Denial of Service attack through XML payloads (GHSA-q79m-c546-2g63)
Published: 2023-01-20T23:23:26Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.3.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.4.0'}, {'fixed': '2.4.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.5.90'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.6'}]}]}]

RequestHandlerComponent had a vulnerability that would allow well crafted requests to create a denial of service attack. RequestHandlerComponent leverages `Xml::build()` which allows reading local files. We recommend that all applications using RequestHandlerComponent upgrade, or disable parsing XML payloads.
debug Inefficient Regular Expression Complexity vulnerability (GHSA-9vvw-cc9w-f27h)
Aliases: CVE-2017-20165
Published: 2023-01-09T12:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'debug'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.1.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'debug'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.9'}]}]}]

A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The name of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability. The patch has been backported to the 2.6.x branch in version 2.6.9.
aXMLRPC XML External Entity vulnerability (GHSA-g4r8-28fp-f255)
Aliases: CVE-2020-36641
Published: 2023-01-05T12:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'fr.turri:aXMLRPC'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.12.1'}]}]}]

A vulnerability classified as problematic was found in gturri aXMLRPC up to 1.12.0. This vulnerability affects the function `ResponseParser` of the file `src/main/java/de/timroes/axmlrpc/ResponseParser.java`. The manipulation leads to xml external entity reference. Upgrading to version 1.12.1 is able to address this issue. The name of the patch is ad6615b3ec41353e614f6ea5fdd5b046442a832b. It is recommended to upgrade the affected component. VDB-217450 is the identifier assigned to this vulnerability.
KubeOperator allows unauthorized access to system API (GHSA-jxgp-jgh3-8jc8)
Aliases: CVE-2023-22480
Published: 2023-01-09T21:57:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/KubeOperator/KubeOperator'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.16.3'}]}]}]

### Summary

Unauthorized access refers to the ability to bypass the system's preset permission settings to access some API interfaces. The attack exploits a flaw in how online applications handle routing permissions.

### Affected Version

<= v3.16.3

### Patches

The vulnerability has been fixed in v3.16.3.

https://github.com/KubeOperator/KubeOperator/commit/7ef42bf1c16900d13e6376f8be5ecdbfdfb44aaf

### Workarounds

It is recommended to upgrade the version to v3.16.4.

### For more information

If you have any questions or comments about this advisory, please open an issue.

### References

https://github.com/KubeOperator/KubeOperator/releases/tag/v3.16.4
Dromara Hutool Deserialization of Untrusted Data vulnerability (GHSA-77h8-5j3h-jcjf)
Aliases: CVE-2023-24162
Published: 2023-01-31T18:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-all'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.11'}]}]}]

Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parameter.
Flarum post mentions can be used to read any post on the forum without access control (GHSA-22m9-m3ww-53h3)
Aliases: CVE-2023-22487
Published: 2023-01-10T22:19:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'flarum/mentions'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.3'}]}]}]

Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax.

The following behavior never changes no matter if the actor should be able to read the mentioned post or not:

A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number.

The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions.

An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post content afterward.

### Impact
The attack allows the leaking of all posts in the forum database, including posts awaiting approval, posts in tags the user has no access to, and private discussions created by other extensions like FriendsOfFlarum Byobu. This also includes non-comment posts like tag changes or renaming events. 

The discussion payload is not leaked but using the mention HTML payload it's possible to extract the discussion ID of all posts and combine all posts back together into their original discussions even if the discussion title remains unknown.

All Flarum versions prior to `v1.6.3` are affected.

### Patches
The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum have to upgrade as soon as possible to v1.6.3 using:

```
composer update --prefer-dist --no-dev -a -W
```
You can then confirm you run the latest version using:

```
composer show flarum/core
```

### Workarounds
Disable the mentions extension.

### For more information
For any questions or comments on this vulnerability please visit https://discuss.flarum.org/

For support questions create a discussion at https://discuss.flarum.org/t/support.

A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.
Missing permission check in Jenkins TestQuality Updater Plugin  (GHSA-xr8h-wj4v-rx7f)
Aliases: CVE-2023-24453
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:testquality-updater'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3'}]}]}]

A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Missing permission check in Jenkins GitHub Pull Request Builder Plugin allows enumerating credentials IDs (GHSA-ccf4-9hjc-xxc4)
Aliases: CVE-2023-24436
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:ghprb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.42.2'}]}]}]

A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Barzahlen Payment Module PHP SDK vulnerable to Observable Timing Discrepancy (GHSA-vg5x-6q66-rvgx)
Aliases: CVE-2016-15015
Published: 2023-01-08T18:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'barzahlen/barzahlen-php'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.1'}]}]}]

A vulnerability, which was classified as problematic, was found in viafintech Barzahlen Payment Module PHP SDK up to 2.0.0. Affected is the function `verify` of the file `src/Webhook.php`. The manipulation leads to observable timing discrepancy. Upgrading to version 2.0.1 is able to address this issue. The name of the patch is 3e7d29dc0ca6c054a6d6e211f32dae89078594c1. It is recommended to upgrade the affected component. VDB-217650 is the identifier assigned to this vulnerability.
bzip2 allows attackers to cause a denial of service via a large file that triggers an integer overflow (GHSA-96jv-r488-c2rj)
Aliases: CVE-2023-22895
Published: 2023-01-10T03:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'bzip2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.4'}]}]}]

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in `mem.rs`. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.
Path traversal in ubi-reader (GHSA-vp2x-3mc3-3cj4)
Aliases: CVE-2023-0591
Published: 2023-01-31T12:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'ubi-reader'}, 'ecosystem_specific': {'affected_functions': ['ubireader.ubifs.output.extract_dents']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.8.5'}]}]}]

ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the process has write access to that file or directory). This is due to the fact that a node name (dent_node.name) is considered trusted and joined to the extraction directory path during processing, then the node content is written to that joined path. By crafting a malicious UBIFS file with node names holding path traversal payloads (e.g. ../../tmp/outside.txt), it's possible to force ubi_reader to write outside of the extraction directory. This issue affects ubi-reader before 0.8.5.
Apache James MIME4J vulnerable to information disclosure to local users (GHSA-q84x-3476-8ff2)
Aliases: CVE-2022-45787
Published: 2023-01-06T12:31:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.james:apache-mime4j'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.8.9'}]}]}]

Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue affects Apache James MIME4J version 0.8.8 and prior versions. We recommend users to upgrade to MIME4j version 0.8.9 or later.
Shopware has Insufficient Session Expiration in Administration (GHSA-59qg-93jg-236f)
Aliases: CVE-2023-22732
Published: 2023-01-20T23:18:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'shopware/platform'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}, {'package': {'ecosystem': 'Packagist', 'name': 'shopware/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}]

### Impact
The Administration session expiration was set to one week, when an attacker has stolen the session cookie they could use it for a long period of time. 

### Patches
We added an automatic logout into the Administration, so the user will be logged out when they are inactive.

### References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
flash_tool Gem for Ruby File Download Handling Arbitrary Command Execution (GHSA-6325-6g32-7p35)
Aliases: CVE-2013-2513
Published: 2023-01-26T23:57:52Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'flash_tool'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.6.0'}]}]}]

flash_tool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands.
Session fixation vulnerability in Jenkins Bitbucket OAuth Plugin  (GHSA-x9q4-qwfh-9gjq)
Aliases: CVE-2023-24427
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:bitbucket-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.13'}]}]}]

Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.
Eta vulnerable to Code Injection via templates rendered with user-defined data (GHSA-mf6x-hrgr-658f)
Aliases: CVE-2022-25967
Published: 2023-01-30T06:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'eta'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}]

Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options received from The Express render API. **Note:** This is exploitable only for users who are rendering templates with user-defined data.
Plaintext Storage of a Password in Jenkins JIRA Pipeline Steps Plugin (GHSA-g29v-5pwh-wxx4)
Aliases: CVE-2023-24439
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:jira-steps'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.165.v8846cf59f3db'}]}]}]

Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Zip4j Origin Validation Error (GHSA-2pj2-gchf-wmw7)
Aliases: CVE-2023-22899
Published: 2023-01-10T03:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.lingala.zip4j:zip4j'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.11.2'}}]

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. This issue has been fixed in version 2.11.3.
Cross-site request forgery vulnerability in Jenkins RabbitMQ Consumer Plugin (GHSA-wj79-9fxj-j86p)
Aliases: CVE-2023-24447
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:rabbitmq-consumer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.8'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
Shopware vulnerable to Improper Input Validation of Clearance sale in cart (GHSA-8r6h-m72v-38fg)
Aliases: CVE-2023-22730
Published: 2023-01-17T23:57:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'shopware/platform'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}, {'package': {'ecosystem': 'Packagist', 'name': 'shopware/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}]

### Impact
It is possible to put the same line item multiple one in the cart using API, the Cart Validators checked the line item's individuality and the user was able to skip the clearance sale in cart

### Patches
The problem has been fixed with 6.4.18.1

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version. Or disable the newsletter registration completely.

### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
Command injection in yiisoft/yii2-gii (GHSA-3mpg-q26j-83j5)
Aliases: CVE-2020-36655
Published: 2023-01-21T03:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'yiisoft/yii2-gii'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.2'}]}]}]

Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. The attacker can embed arbitrary PHP code into the model file.
Any Flarum user including unactivated can reply in public discussions whose first post was permanently deleted (GHSA-hph3-hv3c-7725)
Aliases: CVE-2023-22489
Published: 2023-01-10T22:28:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'flarum/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.6.3'}]}]}]

If the first post of a discussion is permanently deleted but the discussion stays visible, any actor who can view the discussion is able to create a new reply via the REST API, no matter the reply permission or lock status.

This includes users that don't have a validated email.

Guests cannot successfully create a reply because the API will fail with a 500 error when the user ID 0 is inserted into the database. This should also be fixed to return the expected 401/403 status.

This happens because when the first post of a discussion is permanently deleted, the `first_post_id` attribute of the discussion becomes `null` which causes access control to be skipped for all new replies.

Flarum automatically makes discussions with zero comments invisible so an additional condition for this vulnerability is that the discussion must have at least one approved reply so that `discussions.comment_count` is still above zero after the post deletion.

### Impact
This can open the discussion to uncontrolled spam or just unintentional replies if users still had their tab open before the vulnerable discussion was locked and then post a reply when they shouldn't be able to.

In combination with the email notification settings, this could also be used as a way to send unsolicited emails.

Versions between `v1.3.0` and `v1.6.3` are impacted.

### Patches
The vulnerability has been fixed and published as flarum/core v1.6.3. All communities running Flarum should upgrade as soon as possible to v1.6.3 using:

```
composer update --prefer-dist --no-dev -a -W
```
You can then confirm you run the latest version using:

```
composer show flarum/core
```

### Workarounds
If you don't delete the first posts you are not affected. A workaround can be to delete the discussion itself, or amend the database to manually set a `first_post_id`.

### For more information
For any questions or comments on this vulnerability please visit https://discuss.flarum.org/

For support questions create a discussion at https://discuss.flarum.org/t/support.

A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing [security@flarum.org](mailto:security@flarum.org), and we will address it promptly.
Command Injection in puppet-facter (GHSA-g5qr-xgg7-8q2w)
Aliases: CVE-2022-25350
Published: 2023-01-26T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'puppet-facter'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.2'}]}]}]

All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.
PocketMine-MP vulnerable to denial-of-service by sending large modal form responses (GHSA-7m9r-rq9j-wmmh)
Published: 2023-01-10T00:41:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.12.5'}]}]}]

### Impact
Due to a workaround for an old client bug (which has since been fixed), very large JSON payloads in `ModalFormResponsePacket` were able to cause the server to spend a significant amount of time processing the packet. Large numbers of these packets were able to hog CPU time so as to prevent the server from processing other connections in a timely manner.

### Patches
The problem has been addressed in 3baa5ab71214f96e6e7ab12cb9beef08118473b5 by removing the workaround code.

### Workarounds
Plugins could cancel `DataPacketReceiveEvent` for this packet, decode the data their way, and then call `Player->onFormSubmit()` directly, bypassing the vulnerable code.
HTML injections in BTCPayServer (GHSA-33gv-rvgq-gpxp)
Aliases: CVE-2023-0493
Published: 2023-01-27T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'BTCPayServer.Client'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.5'}]}]}]

Improper Neutralization of Equivalent Special Elements in GitHub repository btcpayserver/btcpayserver prior to 1.7.5.
Cross-site request forgery vulnerability in Jenkins BearyChat Plugin (GHSA-5xhh-6xfv-7q42)
Aliases: CVE-2023-24458
Published: 2023-01-26T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:bearychat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.0.2'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL.
cookiejar Regular Expression Denial of Service via Cookie.parse function (GHSA-h452-7996-h45h)
Aliases: CVE-2022-25901
Published: 2023-01-18T06:31:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'cookiejar'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.webjars.npm:cookiejar'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.3'}]}]}]

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `Cookie.parse` function and other aspects of the API, which use an insecure regular expression for parsing cookie values. Applications could be stalled for extended periods of time if untrusted input is passed to cookie values or attempted to parse from request headers.

Proof of concept:

```
ts\nconst { CookieJar } = require("cookiejar");

const jar = new CookieJar();

const start = performance.now();

const attack = "a" + "t".repeat(50_000);
jar.setCookie(attack);

console.log(`CookieJar.setCookie(): ${performance.now() - start}ms`);

```

```
CookieJar.setCookie(): 2963.214399999939ms
```
mel-spintax has Inefficient Regular Expression Complexity (GHSA-qjm7-55vv-3c5f)
Aliases: CVE-2018-25077
Published: 2023-01-18T03:31:17Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'mel-spintax'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.3'}]}]}]

A vulnerability was found in melnaron mel-spintax. It has been rated as problematic. Affected by this issue is some unknown functionality of the file `lib/spintax.js`. The manipulation of the argument text leads to inefficient regular expression complexity. The name of the patch is 37767617846e27b87b63004e30216e8f919637d3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-218456.
XML external entity reference vulnerability on agents in Jenkins Semantic Versioning Plugin  (GHSA-h8p8-6378-649p)
Aliases: CVE-2023-24430
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:semantic-versioning-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.15'}]}]}]

Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Path Traversal in web-node-server (GHSA-3fwq-qv5v-2wxf)
Aliases: CVE-2020-36651
Published: 2023-01-18T03:31:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'web-node-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.11'}]}]}]

A vulnerability has been found in youngerheart nodeserver and classified as critical. Affected by this vulnerability is an unknown functionality of the file nodeserver.js. The manipulation leads to path traversal. The name of the patch is c4c0f0138ab5afbac58e03915d446680421bde28. It is recommended to apply a patch to fix this issue. The identifier VDB-218461 was assigned to this vulnerability.
Jeecg-boot is vulnerable to SQL injection  (GHSA-6w89-c65w-jx2c)
Aliases: CVE-2022-47105
Published: 2023-01-19T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-base-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.4.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-module-system'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.4.4'}]}]}]

Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component `/sys/dict/queryTableData`. A patch was released in commit 0fc374.
Initial debug-host handler implementation could leak information and facilitate denial of service (GHSA-x477-fq37-q5wr)
Published: 2023-01-27T00:55:27Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'fortio.org/proxy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.6.1'}]}]}]

### Impact
version 1.5.0 and 1.6.0 when using the new `debug-host` feature could expose unnecessary information about the host

### Patches
Use 1.6.1 or newer

### Workarounds
Downgrade to 1.4.0 or set `debug-host` to empty

### References
https://github.com/fortio/proxy/pull/38

Q&A https://github.com/fortio/proxy/discussions
JSZip contains Path Traversal via loadAsync (GHSA-36fh-84j7-cv5h)
Aliases: CVE-2022-48285
Published: 2023-01-29T06:30:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'jszip'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.8.0'}]}]}]

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
phoenix_html allows Cross-site Scripting in HEEx class attributes (GHSA-5g2h-9x5v-5h3x)
Aliases: CVE-2021-46871
Published: 2023-01-10T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'phoenix_html'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.4'}]}]}, {'package': {'ecosystem': 'Hex', 'name': 'phoenix_html'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.4'}]}]}]

tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes
Insufficient Session Expiration in Jenkins Azure AD Plugin (GHSA-939x-6mwj-96r2)
Aliases: CVE-2023-24426
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:azure-ad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '303.va'}]}]}]

Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
Shopware vulnerable to Improper Control of Generation of Code in Twig rendered views (GHSA-93cw-f5jj-x85w)
Aliases: CVE-2023-22731
Published: 2023-01-17T23:58:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'shopware/platform'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}, {'package': {'ecosystem': 'Packagist', 'name': 'shopware/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.4.18.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.4.18.0'}}]

### Impact
In Twig environment **without the Sandbox extension**, it is possible to refer to PHP functions in twig filters like `map`, `filter`, `sort`. This allows in the template to call any global PHP function. 

### Patches
The problem has been fixed with 6.4.18.1 with an override of the specified filters until the integration of the Sandbox extension has been finished.

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

### References

https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-01-2023?category=security-updates
kelvinmo simplexrd vulnerable to Improper Restriction of XML External Entity Reference (GHSA-rh3m-pr36-xh2f)
Aliases: CVE-2015-10029
Published: 2023-01-07T21:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'kelvinmo/simplexrd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.1'}]}]}]

A vulnerability classified as problematic was found in kelvinmo simplexrd up to 3.1.0. This vulnerability affects unknown code of the file `simplexrd/simplexrd.class.php`. The manipulation leads to xml external entity reference. Upgrading to version 3.1.1 is able to address this issue. The name of the patch is 4c9f2e028523ed705b555eca2c18c64e71f1a35d. It is recommended to upgrade the affected component. VDB-217630 is the identifier assigned to this vulnerability.
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie (GHSA-746g-3gfp-hfhw)
Aliases: CVE-2015-8314
Published: 2023-01-26T23:54:07Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'devise'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.4'}]}]}]

Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.
Missing permission checks in Jenkins Orka Plugin allow capturing credentials (GHSA-gmhf-37fx-c4q8)
Aliases: CVE-2023-24433
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:macstadium-orka'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.32'}]}]}]

Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Plaintext Storage of a Password in Jenkins TestQuality Updater Plugin (GHSA-98qc-v8vg-mcx4)
Aliases: CVE-2023-24454
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:testquality-updater'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3'}]}]}]

Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.