aswin1906/github-advisory-2023 huggingface dataset:
Apache InLong vulnerable to Incorrect Permission Assignment for Critical Resource (GHSA-rf76-whgp-fp56)
Aliases: CVE-2023-31454
Published: 2023-07-06T21:14:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:manager-service'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.7.0'}]}]}]

Incorrect Permission Assignment for Critical Resource Vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong from 1.2.0 through 1.6.0. The attacker can bind any cluster, even if he is not the cluster owner. Users are advised to upgrade to Apache InLong 1.7.0 or cherry-pick https://github.com/apache/inlong/pull/7947 to solve it.
Jenkins Assembla Auth Plugin vulnerable to cross-site request forgery (GHSA-p756-66w2-35g7)
Aliases: CVE-2023-37961
Published: 2023-07-12T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:assembla-auth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.14'}]}]}]

Jenkins Assembla Auth Plugin 1.14 and earlier does not implement a state parameter in its OAuth flow, a unique and non-guessable value associated with each authentication request.

This vulnerability allows attackers to trick users into logging in to the attacker’s account.
Jenkins OpenShift Login Plugin vulnerable to Open Redirect (GHSA-35gf-xjgf-96c5)
Aliases: CVE-2023-37947
Published: 2023-07-12T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.openshift.jenkins:openshift-login'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0.230.v5d7030b'}]}]}]

Jenkins OpenShift Login Plugin 1.1.0.227.v27e08dfb_1a_20 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.

OpenShift Login Plugin 1.1.0.230.v5d7030b_f5432 only redirects to relative (Jenkins) URLs.
Apache Linkis Authentication Bypass vulnerability (GHSA-4x5h-xmv4-99wx)
Aliases: CVE-2023-27987
Published: 2023-07-06T19:24:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.linkis:linkis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.2'}]}]}]

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values.

We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization.
Apache Airflow Improper Input Validation vulnerability (GHSA-3h4m-m55v-gx4m)
Aliases: CVE-2023-36543
Published: 2023-07-12T12:31:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.3'}]}]}]

Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected
Spring Security's authorization rules can be misconfigured when using multiple servlets (GHSA-4vpr-xfrp-cj64)
Aliases: CVE-2023-34035
Published: 2023-07-18T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-config'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.8.0'}, {'fixed': '5.8.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-config'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-config'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1.0'}, {'fixed': '6.1.2'}]}]}]

Spring Security versions 5.8 prior to 5.8.5, 6.0 prior to 6.0.5, and 6.1 prior to 6.1.2 could be susceptible to authorization rule misconfiguration if the application uses requestMatchers(String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. (DispatcherServlet is a Spring MVC component that maps HTTP endpoints to methods on @Controller-annotated classes.)

Specifically, an application is vulnerable when all of the following are true:

  *  Spring MVC is on the classpath
  *  Spring Security is securing more than one servlet in a single application (one of them being Spring MVC’s DispatcherServlet)
  *  The application uses requestMatchers(String) to refer to endpoints that are not Spring MVC endpoints


An application is not vulnerable if any of the following is true:

  *  The application does not have Spring MVC on the classpath
  *  The application secures no servlets other than Spring MVC’s DispatcherServlet
  *  The application uses requestMatchers(String) only for Spring MVC endpoints
Barberry Security Advisory - regarding x/auth periodic vesting accounts (GHSA-j2cr-jc39-wpx5)
Published: 2023-07-07T18:34:27Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cosmos/cosmos-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.46.0'}, {'fixed': '0.46.13'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.46.12'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cosmos/cosmos-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.47.0'}, {'fixed': '0.47.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.47.2'}}]

### Impact

In `PeriodicVestingAccount`, defined in `x/auth`, an attacker can initialize a victim's account as a malicious vesting account, which allows deposits but does not allow withdrawals. When the user then deposits funds into their account, those funds are locked forever, and the user is not able to withdraw them.

### Patches

\>= v0.46.13 for Cosmos SDK v0.46.x
\>= v0.47.3 for Cosmos SDK v0.47.x

If a network backported periodic vesting accounts to earlier versions of the SDK, those networks are affected too.

### Workarounds

There is no workaround for this issue. Upgrade immediately.

### References

* Patched versions release notes: [v0.47.3](https://github.com/cosmos/cosmos-sdk/blob/cfc757dc5043fb2758c47c146d2912fd010c1a45/RELEASE_NOTES.md#cosmos-sdk-v0473-release-notes), [v0.46.13](https://github.com/cosmos/cosmos-sdk/blob/d4b7164de5d8391e6aa644d8ea84e07396dd9653/RELEASE_NOTES.md#cosmos-sdk-v04613-release-notes).
* [Forum Post](https://forum.cosmos.network/t/cosmos-sdk-security-advisory-barberry/10825)
Artesãos SEOTools Open Redirect vulnerability (GHSA-w745-xjqx-7wp8)
Aliases: CVE-2020-36664
Published: 2023-07-06T19:24:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'artesaos/seotools'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.2'}]}]}]

A vulnerability has been found in Artesãos SEOTools up to and including version 0.17.1. This vulnerability affects the function setTitle of the file SEOMeta.php. The manipulation of the argument title leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The name of the patch is ca27cd0edf917e0bc805227013859b8b5a1f01fb. It is recommended to upgrade the affected component.
Concrete CMS Cross-site Scripting vulnerability (GHSA-8699-h45g-7hm8)
Aliases: CVE-2022-43695
Published: 2023-07-06T19:24:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'concrete5/concrete5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.5.10'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'concrete5/concrete5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.1.3'}]}]}]

Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entities/associations because Concrete CMS allows association with an entity name that doesn’t exist or, if it does exist, contains XSS since it was not properly sanitized. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
TeamPass Cross-site Scripting vulnerability (GHSA-524r-w8fx-hqg3)
Aliases: CVE-2023-3565
Published: 2023-07-10T18:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.10'}]}]}]

Cross-site Scripting (XSS) - Generic in GitHub repository nilsteampassnet/teampass prior to 3.0.10.
aiohttp.web.Application vulnerable to HTTP request smuggling via llhttp HTTP request parser (GHSA-45c4-8wx5-qw6w)
Aliases: CVE-2023-37276
Published: 2023-07-20T14:52:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'aiohttp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.8.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.8.4'}}]

### Impact

aiohttp v3.8.4 and earlier are [bundled with llhttp v6.0.6](https://github.com/aio-libs/aiohttp/blob/v3.8.4/.gitmodules) which is vulnerable to CVE-2023-30589. The vulnerable code is used by aiohttp for its HTTP request parser when available which is the default case when installing from a wheel.

This vulnerability only affects users of aiohttp as an HTTP server (ie `aiohttp.Application`), you are not affected by this vulnerability if you are using aiohttp as an HTTP client library (ie `aiohttp.ClientSession`).

### Reproducer

```python
from aiohttp import web

async def example(request: web.Request):
    headers = dict(request.headers)
    body = await request.content.read()
    return web.Response(text=f"headers: {headers} body: {body}")

app = web.Application()
app.add_routes([web.post('/', example)])
web.run_app(app)
```

Sending a crafted HTTP request will cause the server to misinterpret one of the HTTP header values leading to HTTP request smuggling.

```console
$ printf "POST / HTTP/1.1\r\nHost: localhost:8080\r\nX-Abc: \rxTransfer-Encoding: chunked\r\n\r\n1\r\nA\r\n0\r\n\r\n" \
  | nc localhost 8080

Expected output:
  headers: {'Host': 'localhost:8080', 'X-Abc': '\rxTransfer-Encoding: chunked'} body: b''

Actual output (note that 'Transfer-Encoding: chunked' is an HTTP header now and body is treated differently)
  headers: {'Host': 'localhost:8080', 'X-Abc': '', 'Transfer-Encoding': 'chunked'} body: b'A'
```

### Patches

Upgrade to the latest version of aiohttp to resolve this vulnerability. It has been fixed in v3.8.5: [`pip install aiohttp >= 3.8.5`](https://pypi.org/project/aiohttp/3.8.5/)

### Workarounds

If you aren't able to upgrade you can reinstall aiohttp using `AIOHTTP_NO_EXTENSIONS=1` as an environment variable to disable the llhttp HTTP request parser implementation. The pure Python implementation isn't vulnerable to request smuggling:

```console
$ python -m pip uninstall --yes aiohttp
$ AIOHTTP_NO_EXTENSIONS=1 python -m pip install --no-binary=aiohttp --no-cache aiohttp
```

### References

* https://nvd.nist.gov/vuln/detail/CVE-2023-30589
* https://hackerone.com/reports/2001873
plexus-codehaus vulnerable to directory traversal (GHSA-g6ph-x5wf-g337)
Aliases: CVE-2022-4244
Published: 2023-09-25T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.codehaus.plexus:plexus-utils'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.24'}]}]}]

A flaw was found in plexus-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with dot-dot-slash (`../`) sequences and their variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on the file system, including application source code, configuration, and other critical system files.
SQL injection in jeecgboot (GHSA-rwhx-6hx7-pqc8)
Aliases: CVE-2023-40989
Published: 2023-09-22T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-common'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.5.3'}]}]}]

SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the `report/jeecgboot/jmreport/queryFieldBySql` component.
tss-lib leaks secret keys in response to incorrectly constructed Paillier moduli (GHSA-h24c-6p6p-m3vx)
Published: 2023-09-01T20:51:05Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/bnb-chain/tss-lib'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3.5'}]}]}]

### Impact

The specification of the GG18 threshold ECDSA signature protocol contains a vulnerability allowing an attacker to recover the shared secret key. If a participant generates a Paillier modulus `N` containing small factors (less than `2^100`) they can interact with other participants in the signing protocol to steal their secret key shares in as little as sixteen signing attempts. The master key can then be reconstructed from these shares.

### Patches

The implementation of GG18 in tss-lib did not prove that `N` is biprime or that it doesn't contain small factors. The fixed implementation adds the following proofs from the CGGMP21 threshold ECDSA protocol to the key generation:

- Paillier-Blum Modulus (`N` is the product of two primes)
- No Small Factor (both factors of `N` are greater than `2^256`)

These proofs apply to both the Paillier encryption modulus `N`, and the modulus `NTilde` used in MTA proofs.

To address the issue in the resharing protocol, an additional round has been added to the end so that participants can confirm that they received valid proofs.

### References

- [GG18](https://eprint.iacr.org/2019/114)
- [CGGMP21](https://eprint.iacr.org/2021/060)
Keylime registrar and (untrusted) Agent can be bypassed by an attacker (GHSA-f4r5-q63f-gcww)
Aliases: CVE-2023-38201
Published: 2023-09-06T13:49:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'keylime'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.5.0'}]}]}]

### Impact

A security issue was found in the Keylime `registrar` code which allows an attacker to effectively bypass the challenge-response protocol used to verify that an `agent` has indeed access to an AIK which in indeed related to the EK.

When an `agent` starts up, it will contact a `registrar` and provide a public EK and public AIK, in addition to the EK Certificate. This `registrar` will then challenge the `agent` to decrypt a challenge encrypted with the EK. 

When receiving the wrong "auth_tag" back from the `agent` during activation, the `registrar` answers with an error message that contains the expected correct "auth_tag" (an HMAC which is calculated within the `registrar` for checking). An attacker could simply record the correct expected "auth_tag" from the HTTP error message and perform the activate call again with the correct expected "auth_tag" for the `agent`.

The security issue allows an attacker to pass the challenge-response protocol during registration with (almost) arbitrary registration data. In particular, the attacker can provide a valid EK Certificate and EK, which passes verification by the `tenant` (or `registrar`), while using a compromised AIK, which is stored unprotected outside the TPM and is unrelated to former two. The attacker then deliberately fails the initial activation call to get to know the correct "auth_tag" and then provides it in a subsequent activation call. This results in an `agent` which is (incorrectly) registered with a valid EK Certificate, but with a compromised/unrelated AIK.

### Patches
Users should upgrade to release 7.5.0
Electron vulnerable to out-of-package code execution when launched with arbitrary cwd (GHSA-7x97-j373-85x5)
Aliases: CVE-2023-39956
Published: 2023-09-06T19:51:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '22.3.19'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '23.0.0-alpha.1'}, {'fixed': '23.3.13'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.0.0-alpha.1'}, {'fixed': '24.7.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '25.0.0-alpha.1'}, {'fixed': '25.5.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '26.0.0-alpha.1'}, {'fixed': '26.0.0-beta.13'}]}]}]

### Impact
Apps that are launched as command line executables are impacted.  E.g. if your app exposes itself in the path as `myapp --help`

Specifically this issue can only be exploited if the following conditions are met:
* Your app is launched with an attacker-controlled working directory
* The attacker has the ability to write files to that working directory

This makes the risk quite low, in fact normally issues of this kind are considered outside of our threat model as similar to Chromium we exclude [Physically Local Attacks](https://github.com/electron/electron/security/advisories/GHSA-7x97-j373-85x5#:~:text=Physically%20Local%20Attacks) but given the ability for this issue to bypass certain protections like ASAR Integrity it is being treated with higher importance.  Please bear this in mind when reporting similar issues in the future.

### Workarounds
There are no app side workarounds, you must update to a patched version of Electron.

### Fixed Versions
* `26.0.0-beta.13`
* `25.5.0`
* `24.7.1`
* `23.3.13`
* `22.3.19`

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
Croc sender may place ANSI or CSI escape sequences in filename to attach receiver's terminal device (GHSA-364c-vvqx-446c)
Aliases: CVE-2023-43620
Published: 2023-09-20T06:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/schollz/croc/v9'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '9.6.5'}]}]}]

An issue was discovered in Croc through 9.6.5. A sender may place ANSI or CSI escape sequences in a filename to attack the terminal device of a receiver.
Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script (GHSA-6773-rfjv-c54w)
Aliases: CVE-2023-38886
Published: 2023-09-20T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dolibarr/dolibarr'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '17.0.1'}]}]}]

An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
Apache Superset has incorrect authorization check (GHSA-95ch-p3gw-23qg)
Aliases: CVE-2023-32672
Published: 2023-09-06T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.0'}]}]}]

An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.
Argo CD repo-server  Denial of Service vulnerability (GHSA-g687-f2gx-6wm8)
Aliases: CVE-2023-40584
Published: 2023-09-11T12:59:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.4.0'}, {'fixed': '2.6.15'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.14'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.3'}]}]}]

### Impact
All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, the said component extracts a user-controlled tar.gz file without validating the size of its inner files. As a result, a malicious, low-privileged user can send a malicious tar.gz file that exploits this vulnerability to the repo-server, thereby harming the system's functionality and availability. Additionally, the repo-server is susceptible to another vulnerability due to the fact that it does not check the extracted file permissions before attempting to delete them. Consequently, an attacker can craft a malicious tar.gz archive in a way that prevents the deletion of its inner files when the manifest generation process is completed.


### Patches
A patch for this vulnerability has been released in the following Argo CD versions:

* v2.6.15
* v2.7.14
* v2.8.3

### Workarounds
The only way to completely resolve the issue is to upgrade.

#### Mitigations
Configure RBAC (Role-Based Access Control) and provide access for configuring applications only to a limited number of administrators. These administrators should utilize trusted and verified Helm charts.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd

### Credits
This vulnerability was found & reported by GE Vernova – Amit Laish.

The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
LibreNMS Cross-site Scripting vulnerability (GHSA-qjpw-rg56-jh8v)
Aliases: CVE-2023-4978
Published: 2023-09-15T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'librenms/librenms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.9.0'}]}]}]

Cross-site Scripting (XSS) - DOM in GitHub repository librenms/librenms prior to 23.9.0.
hutool Buffer Overflow vulnerability (GHSA-rxgf-r843-g53h)
Aliases: CVE-2023-42276
Published: 2023-09-09T00:30:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.21'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'cn.hutool:hutool-json'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.8.21'}]}]}]

hutool v5.8.21 was discovered to contain a buffer overflow via the component `jsonArray`.
OpenFGA Vulnerable to DoS from circular relationship definitions (GHSA-2hm9-h873-pgqh)
Aliases: CVE-2023-43645
Published: 2023-09-28T21:27:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/openfga/openfga'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.2'}]}]}]

## Overview
OpenFGA is vulnerable to a DoS attack when certain Check calls are executed against authorization models that contain circular relationship definitions. When the call is made, it's possible for the server to exhaust resources and die.

## Am I Affected?
Yes, if your store contains an authorization model that allows circular relationships. For example, with this model:

```
model
  schema 1.1

type user

type group
  relations
    define memberA: [user] or memberB or memberC or memberD or memberE
    define memberB: [user] or memberA or memberC or memberD or memberE
    define memberC: [user] or memberA or memberB or memberD or memberE
    define memberD: [user] or memberA or memberB or memberC or memberE
    define memberE: [user] or memberA or memberB or memberC or memberD
```

This Check: `(user:anne, memberA, group:X)` can exhaust memory in the server.

## Fix
Upgrade to v1.3.2 and update any offending models.

  **[BREAKING]** If your model contained cycles or a relation definition that has the relation itself in its evaluation path, then Checks and queries that require evaluation will no longer be evaluated on v1.3.2+ and will return errors instead. You will need to update your models to remove the cycles.
FUXA local file inclusion vulnerability (GHSA-wwfj-h843-3hrq)
Aliases: CVE-2023-31718
Published: 2023-09-22T00:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'fuxa-server'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.12'}]}]}]

FUXA <= 1.1.12 is vulnerable to Local File Inclusion via `/api/download`.
Undertow denial of service vulnerability (GHSA-m4mm-pg93-fv78)
Aliases: CVE-2023-1108
Published: 2023-09-14T15:31:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.undertow:undertow-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.3.5.Final'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'io.undertow:undertow-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.24.Final'}]}]}]

A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attack (GHSA-qqh2-wvmv-h72m)
Aliases: CVE-2023-41886
Published: 2023-09-12T13:52:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.openrefine:database'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.7.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.7.4'}}]

### Summary
An arbitrary file read vulnerability allows any unauthenticated user to read the file on the server._

### Details
Hi,Team,
i find openrefine support to import data from database,When use mysql jdbc to connect to database,It is vulnerable to jdbc url attacks,for example,unauthenticated attacker can read the file on the server.
There are some differences in utilization depending on the version of the mysql-connector dependency on the server side.  
1.  mysql-connector-java version > 8.14
The default value of `allowLoadLocalInfile` on the server side is false in this case.We need to manually set this value to true in the connection string.  
Since the way to get the databaseurl in `com/google/refine/extension/database/mysql/MySQLConnectionManager.java` is to splice the individual configurations directly, we can set the `allowLoadLocalInfile` parameter after the other parameters(for example the `databaseName` parameter ).  
![image](https://user-images.githubusercontent.com/24366795/262531956-ef8bb163-6692-4494-92f9-3b9bcffdf503.png)  
![image](https://user-images.githubusercontent.com/24366795/262531716-95e7c9a6-601d-4157-bce9-c58d17a6e3ea.png)
![image](https://user-images.githubusercontent.com/24366795/262531614-a34f891f-acd2-4354-bbbe-96447a9dcbd1.png)
2.  mysql-connector-java version <= 8.14
The default value of `allowLoadLocalInfile` on the server side is true in this case.so wo don't need do anything,Just connect to our malicious server.

### PoC
env:   
centos 7
openrefine 3.7.4 
jdk11 
mysql-connector-java version 8.30.0  

you can use the tool https://github.com/4ra1n/mysql-fake-server to running a malicious mysql server.  
![image](https://user-images.githubusercontent.com/24366795/262536594-a62dbc2c-62d2-4b21-a351-5be7f506f852.png)  
for example,to read the /etc/passwd file.
![image](https://user-images.githubusercontent.com/24366795/262539711-f274a396-9c0a-4ace-b3af-3b4e5309ab00.png)
set the `username` to `base64ZmlsZXJlYWRfL2V0Yy9wYXNzd2Q=` and `Database name` to `test?allowLoadLocalInfile=true#` (for  mysql-connector-java version <= 8.14,just setting the database name normally) and test to connect your malicious mysql server.
you can get the file in your fake-server-files directory.
![image](https://user-images.githubusercontent.com/24366795/262542538-c9f501a4-899f-4b57-89b9-b8dd42f535fb.png)


### Impact

An arbitrary file read vulnerability allows any unauthenticated user to read the file on the server._
Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input (GHSA-x4hh-vjm7-g2jv)
Aliases: CVE-2023-37279
Published: 2023-09-20T22:51:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/contribsys/faktory'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.8.0'}]}]}]

### Summary
Faktory web dashboard can suffer from denial of service by a crafted malicious url query param `days`.

### Details
The vulnerability is related to how the backend reads the `days` URL query parameter in the Faktory web dashboard. The value is used directly without any checks to create a string slice. If a very large value is provided, the backend server ends up using a significant amount of memory and causing it to crash.

### PoC
To reproduce this vulnerability, please follow these steps:

Start the Faktory Docker and limit memory usage to 512 megabytes for better demonstration:
```
$ docker run --rm -it -m 512m \
  -p 127.0.0.1:7419:7419 \
  -p 127.0.0.1:7420:7420 \
  contribsys/faktory:latest
``` 

Send the following request. The Faktory server will exit after a few seconds due to out of memory:

```
$ curl 'http://localhost:7420/?days=922337'
```

### Impact
**Server Availability**: The vulnerability can crash the Faktory server, affecting its availability.
**Denial of Service Risk**: Given that the Faktory web dashboard does not require authorization, any entity with internet access to the dashboard could potentially exploit this vulnerability. This unchecked access opens up the potential for a Denial of Service (DoS) attack, which could disrupt service availability without any conditional barriers to the attacker.
Cecil Path Traversal vulnerability (GHSA-q8hr-4w58-985p)
Aliases: CVE-2023-4914
Published: 2023-09-12T15:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cecil/cecil'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.47.1'}]}]}]

Relative Path Traversal in GitHub repository cecilapp/cecil prior to 7.47.1.
Multiple soundness issues in lexical (GHSA-c2hm-mjxv-89r4)
Published: 2023-09-04T17:02:00Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'lexical'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '6.1.1'}]}]}]

`lexical` contains multiple soundness issues:

 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102)
 1. [BytesIter::read() advances iterators out of bounds](https://github.com/Alexhuszagh/rust-lexical/issues/101)
 1. [The `BytesIter` trait has safety invariants but is public and not marked `unsafe`](https://github.com/Alexhuszagh/rust-lexical/issues/104)
 1. [`write_float()` calls `MaybeUninit::assume_init()` on uninitialized data, which is is not allowed by the Rust abstract machine](https://github.com/Alexhuszagh/rust-lexical/issues/95)

The crate also has some correctness issues and appears to be unmaintained.

## Alternatives

For quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorith by the author of `lexical` has been [merged](https://github.com/rust-lang/rust/pull/86761) into libcore.

For quickly parsing integers, consider `atoi` and `btoi` crates (100% safe code). `atoi_radix10` provides even faster parsing, but only with `-C target-cpu=native`, and at the cost of some `unsafe`.

For formatting integers in a `#[no_std]` context consider the [`numtoa`](https://crates.io/crates/numtoa) crate.

For working with big numbers consider `num-bigint` and `num-traits`.
Subrion CMS Cross-site Scripting vulnerability in /panel/languages (GHSA-4w2j-wj9q-6wpx)
Aliases: CVE-2023-43828
Published: 2023-09-27T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'intelliants/subrion'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.2.1'}]}]}]

A Cross-site scripting (XSS) vulnerability in /panel/languages/ of Subrion v4.2.1 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Title' parameter.
LibreNMS Cross-site Scripting vulnerability (GHSA-jp3c-g46v-jg2c)
Aliases: CVE-2023-4979
Published: 2023-09-15T03:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'librenms/librenms'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.9.0'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.9.0.
Spring for GraphQL may be exposed to GraphQL context with values from a different session (GHSA-frqc-f2h8-fjvf)
Aliases: CVE-2023-34047
Published: 2023-09-20T12:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.graphql:spring-graphql'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '1.1.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.graphql:spring-graphql'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.2.3'}]}]}]

A batch loader function in Spring for GraphQL versions 1.1.0 - 1.1.5 and 1.2.0 - 1.2.2 may be exposed to GraphQL context with values, including security context values, from a different session. An application is vulnerable if it provides a DataLoaderOptions instance when registering batch loader functions through DefaultBatchLoaderRegistry.
Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability (GHSA-86c6-3g63-5w64)
Aliases: CVE-2023-5077
Published: 2023-09-29T00:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.13.0'}]}]}]

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.
Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation (GHSA-fv2h-753j-9g39)
Aliases: CVE-2023-41890
Published: 2023-09-20T23:01:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'Sustainsys.Saml2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.3'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Sustainsys.Saml2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.9.2'}]}]}]

### Impact
When a response is processed, the issuer of the Identity Provider is not sufficiently validated. This could allow a malicious identity provider to craft a Saml2 response that is processed as if issued by another identity provider. It is also possible for a malicious end user to cause stored state intended for one identity provider to be used when processing the response from another provider.

An application is impacted if they rely on any of these features in their authentication/authorization logic:
* the issuer of the generated identity and claims
* items in the stored request state (AuthenticationProperties)

### Patches
Patched in version 2.9.2 and 1.0.3. All previous versions are vulnerable.

### Workarounds
The `AcsCommandResultCreated` notification can be used to add the validation required if an upgrade to patched packages is not possible.

### References
The patch is linked to https://github.com/Sustainsys/Saml2/issues/712 and https://github.com/Sustainsys/Saml2/issues/713
Cross-Site Request Forgery (CSRF) in  usememos/memos (GHSA-2g7r-9xq5-c6hv)
Aliases: CVE-2023-5036
Published: 2023-09-18T06:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.15.1'}]}]}]

Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.15.1.
libwebp: OOB write in BuildHuffmanTable (GHSA-j7hp-h8jx-5ppr)
Aliases: CVE-2023-4863
Published: 2023-09-12T15:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'libwebp-sys2'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.8'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'libwebp-sys'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.9.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '22.0.0'}, {'fixed': '22.3.24'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.0.0'}, {'fixed': '24.8.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '25.0.0'}, {'fixed': '25.8.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '26.0.0'}, {'fixed': '26.2.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'electron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '27.0.0-beta.1'}, {'fixed': '27.0.0-beta.2'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'SkiaSharp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.88.6'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/chai2010/webp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}]}]}]

Heap buffer overflow in libwebp allow a remote attacker to perform an out of bounds memory write via a crafted HTML page.
Chaijs/get-func-name vulnerable to ReDoS (GHSA-4q6p-r6v2-jvc5)
Aliases: CVE-2023-43646
Published: 2023-09-27T20:16:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'get-func-name'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.1'}]}]}]

The current regex implementation for parsing values in the module is susceptible to excessive backtracking, leading to potential DoS attacks. The regex implementation in question is as follows:

```js
const functionNameMatch = /\s*function(?:\s|\s*\/\*[^(?:*/)]+\*\/\s*)*([^\s(/]+)/;
```

This vulnerability can be exploited when there is an imbalance in parentheses, which results in excessive backtracking and subsequently increases the CPU load and processing time significantly. This vulnerability can be triggered using the following input:

```js
'\t'.repeat(54773) + '\t/function/i'
```

Here is a simple PoC code to demonstrate the issue:

```js
const protocolre = /\sfunction(?:\s|\s/*[^(?:*\/)]+*/\s*)*([^\(\/]+)/;

const startTime = Date.now();
const maliciousInput = '\t'.repeat(54773) + '\t/function/i'

protocolre.test(maliciousInput);

const endTime = Date.now();

console.log("process time: ", endTime - startTime, "ms");
```
Account TakeOver Due to Improper Handling of JWT Tokens in usememos/memos (GHSA-j2gj-g3p9-7mrr)
Aliases: CVE-2023-4696
Published: 2023-09-01T03:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.13.2'}]}]}]

Improper Access Control in GitHub repository usememos/memos prior to 0.13.2. As of commit `c9aa2eeb9` access tokens which fail validation are rejected.
Directus affected by VM2 sandbox escape vulnerability (GHSA-22rr-f3p8-5gf8)
Published: 2023-09-15T17:12:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'directus'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.6.0'}]}]}]

### Impact
In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox running code in the main nodejs context.

### Patches
Patched in v10.6.0 by replacing `vm2` with `isolated-vm`

### Workarounds
None

### References
https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
ReportLab vulnerable to remote code execution via paraparser (GHSA-pj98-2xf6-cff5)
Aliases: CVE-2019-19450
Published: 2023-09-20T15:30:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'reportlab'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.31'}]}]}]

paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in a unichar element in a crafted XML document with '<unichar code="' followed by arbitrary Python code, a similar issue to CVE-2019-17626.
sing-box vulnerable to improper authentication in the SOCKS inbound (GHSA-r5hm-mp3j-285g)
Aliases: CVE-2023-43644
Published: 2023-09-26T19:35:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/sagernet/sing-box'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/sagernet/sing-box'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0-beta.1'}, {'fixed': '1.5.0-rc.5'}]}]}]

### Impact

This vulnerability allows specially crafted requests to bypass authentication, affecting all SOCKS inbounds with user authentication.

### Patches

Update to sing-box 1.4.5 or 1.5.0-rc.5 and later versions.

### Workarounds

Don't expose the SOCKS5 inbound to insecure environments.
Searchor CLI's Search vulnerable to Arbitrary Code using Eval (GHSA-66m2-493m-crh2)
Aliases: CVE-2023-43364
Published: 2023-09-25T18:37:51Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'searchor'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.4.1'}}]

 An issue in Arjun Sharda's Searchor before version v.2.4.2 allows an attacker to
 execute arbitrary code via a crafted script to the eval() function in Searchor's src/searchor/main.py file, affecting the search feature in Searchor's CLI (Command Line Interface).

### Impact
Versions equal to, or below 2.4.1 are affected.

### Patches
Versions above, or equal to 2.4.2 have patched the vulnerability.

### References
https://github.com/nikn0laty/Exploit-for-Searchor-2.4.0-Arbitrary-CMD-Injection
https://github.com/nexis-nexis/Searchor-2.4.0-POC-Exploit-
https://github.com/jonnyzar/POC-Searchor-2.4.2
https://github.com/ArjunSharda/Searchor/pull/130
Economizzer vulnerable to Clickjacking (GHSA-gc95-5mmp-mp6j)
Aliases: CVE-2023-38873
Published: 2023-09-28T06:30:20Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'gugoan/economizzer'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9-beta1'}]}]}]

The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they were intending to click on the top-level page. Thus, the attacker is "hijacking" clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both.