aswin1906/github-advisory-2023 huggingface dataset:
Deno improperly handles resizable ArrayBuffer (GHSA-c25x-cm9x-qqgx)
Aliases: CVE-2023-28445
Published: 2023-03-23T23:13:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'Deno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.32.0'}, {'fixed': '1.32.1'}]}], 'versions': ['1.32.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'serde_v8'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.87.0'}, {'fixed': '0.88.0'}]}], 'versions': ['0.87.0']}, {'package': {'ecosystem': 'crates.io', 'name': 'deno_runtime'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.102.0'}, {'fixed': '0.103.0'}]}], 'versions': ['0.102.0']}]

### Impact

[Resizable ArrayBuffers](https://github.com/tc39/proposal-resizablearraybuffer) passed to asynchronous native functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write.

It is unlikely that this has been exploited in the wild, as the only version affected is Deno 1.32.0.

Deno Deploy users are not affected.

### Patches

The problem has been resolved by disabling resizable ArrayBuffers temporarily in Deno 1.32.1. A future version of Deno will re-enable resizable ArrayBuffers with a proper fix.

### Workarounds

Upgrade to Deno 1.32.1, or run with `--v8-flags=--no-harmony-rab-gsab` to disable resizable ArrayBuffers.
Moodle may allow authenticated users to enumerate other user's names via learning plans page (GHSA-hh52-g5c4-wprh)
Aliases: CVE-2023-28334
Published: 2023-03-23T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.13'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.20'}]}]}]

Authenticated users were able to enumerate other users' names via the learning plans page.
Moodle Improper Input Validation vulnerability (GHSA-gv8f-43pg-c5qw)
Aliases: CVE-2021-36402
Published: 2023-03-07T00:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In affected versions of Moodle, users' names require additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. This issue has been patched in versions 3.9.8, 3.10.5 and 3.11.1.
org.xwiki.platform:xwiki-platform-panels-ui vulnerable to Eval Injection (GHSA-qxjg-jhgw-qhrv)
Aliases: CVE-2023-27479
Published: 2023-03-08T17:18:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-panels-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.3-milestone-2'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-panels-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-panels-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10-rc-1'}]}]}]

### Impact
Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of UIX parameters

A proof of concept exploit is to log in, add an `XWiki.UIExtensionClass` xobject to the user profile page, with an Extension Parameters content of:

```
order=100
label={{/html}} {{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
icon=icon:pencil
target=XWiki.username
```

Then, navigating to `PanelsCode.ApplicationsPanelConfigurationSheet` (i.e., `<xwiki-host>/xwiki/bin/view/PanelsCode/ApplicationsPanelConfigurationSheet` where `<xwiki-host>` is the URL of your XWiki installation) should not execute the Groovy script. If it does, you will see `Hello from groovy!` displayed on the screen.

### Patches
The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1

### Workarounds
The issue can be fixed by editing the `PanelsCode.ApplicationsPanelConfigurationSheet` wiki page and making the same modifications  as shown in the [patch](https://github.com/xwiki/xwiki-platform/commit/6de5442f3c91c3634a66c7b458d5b142e1c2a2dc) for this issue.

### References
* https://github.com/xwiki/xwiki-platform/commit/6de5442f3c91c3634a66c7b458d5b142e1c2a2dc
* https://jira.xwiki.org/browse/XWIKI-20294

### For more information
If you have any questions or comments about this advisory:
*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints (GHSA-h828-v5pv-33qx)
Aliases: CVE-2022-2837
Published: 2023-03-03T18:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/coredns/coredns'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.9.3'}]}]}]

A flaw was found in coreDNS. This flaw allows a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.
TensorFlow vulnerable to segfault when opening multiframe gif (GHSA-fqm2-gh8w-gr68)
Aliases: CVE-2023-25667
Published: 2023-03-24T21:57:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
Integer overflow occurs when 2^31 <= num_frames * height * width * channels < 2^32, for example Full HD screencast of at least 346 frames.
```python
import urllib.request
dat = urllib.request.urlopen('https://raw.githubusercontent.com/tensorflow/tensorflow/1c38ad9b78ffe06076745a1ee00cec42f39ff726/tensorflow/core/lib/gif/testdata/3g_multiframe.gif').read()
import tensorflow as tf
tf.io.decode_gif(dat)
```

### Patches
We have patched the issue in GitHub commit [8dc723fcdd1a6127d6c970bd2ecb18b019a1a58d](https://github.com/tensorflow/tensorflow/commit/8dc723fcdd1a6127d6c970bd2ecb18b019a1a58d).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by Andrei
Pimcore Remote Code Execution vulnerability in Search function (GHSA-42c3-wvww-gcqj)
Aliases: CVE-2023-1578
Published: 2023-03-22T18:36:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
Attacker can get full DB and maybe RCE knowing the WEBROOT path

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/367b74488808d71ec3f66f4ca9e8df5217c2c8d2.patch manually.

### References
#14538
request-baskets vulnerable to Server-Side Request Forgery (GHSA-58g2-vgpg-335q)
Aliases: CVE-2023-27163
Published: 2023-03-31T21:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/darklynx/request-baskets'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.1'}]}]}]

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
`openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference (GHSA-6hcf-g6gr-hhcr)
Published: 2023-03-24T22:01:23Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.9.7'}, {'fixed': '0.10.48'}]}]}]

These functions would crash when the context argument was None with certain extension types.

Thanks to David Benjamin (Google) for reporting this issue.
Keycloak Cross-site Scripting on OpenID connect login service (GHSA-9hhc-pj4w-w5rv)
Aliases: CVE-2022-4137
Published: 2023-03-01T17:38:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-parent'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '20.0.5'}]}]}]

A reflected cross-site scripting (XSS) vulnerability was found in the `oob` OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page.
redis-py Race Condition due to incomplete fix (GHSA-8fww-64cx-x8p5)
Aliases: CVE-2023-28859
Published: 2023-03-26T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'redis'}, 'ecosystem_specific': {'affected_functions': ['redis.asyncio.client.Pipeline']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.5.0'}, {'fixed': '4.5.4'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'redis'}, 'ecosystem_specific': {'affected_functions': ['redis.asyncio.client.Pipeline']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.4.4'}]}]}]

redis-py through 4.5.3 and 4.4.3 leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a non-pipeline operation), and can send response data to the client of an unrelated request. NOTE: this issue exists because of an incomplete fix for CVE-2023-28858.
directus vulnerable to Insertion of Sensitive Information into Log File (GHSA-8vg2-wf3q-mwv7)
Aliases: CVE-2023-28443
Published: 2023-03-23T19:47:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'directus'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.23.3'}]}]}]

### Summary

CWE-532: Insertion of Sensitive Information into Log File discovered in v9.23.1. The `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. 

### Details

Using `v9.23.1`, I am seeing that the `directus_refresh_token` is not properly redacted as indicated by https://github.com/directus/directus/blob/7c479c5161639aac466c763b6b958a9524201d74/api/src/logger.ts#L13

I'm classifying this as a security vulnerability because if someone has access to the log outputs, for example with a shared Cloud account or Splunk implementation, they could exchange the refresh token using `/auth/refresh` for an access token and use the token to perform actions on behalf of an unsuspecting user. This situation creates issues with accountability and non-repudiation because we can no longer have confidence that actions taken in the application were authorized or even performed by the logged-in user. 

A couple of examples of this are:
- A disgruntled employee deletes all of the data to get even with a target team member before logging off on their last day
- Under the guise of their unsuspecting boss, a mischievous engineer uploads _questionable_ images that get displayed on internal or external facing content sites

The list could go on but I think these communicate the risk of an internal threat that has access to this information 😆 

### PoC
1. Set `LOG_STYLE="raw"` and run Directus v9.23.1
1. Log in to the application
1. Look at the shell output and see that `directus_refresh_token` is logged
    > Note: This is different from the standard `raw` output format. I intentionally ran this with `npx directus start | pino-pretty` so logs would be easier to read. It can also be reproduced by running `npx directus start` alone. 

    ![image](https://user-images.githubusercontent.com/13325146/224877190-54e12d7e-3c3e-42d3-9e21-0bd4439f4f44.png)

1. Exchange the `directus_refresh_token` for an `access_token`

     ``` shell
      curl -X POST \
        'http://0.0.0.0:8055/auth/refresh' \
        --header 'Accept: */*' \
        --header 'Cookie: directus_refresh_token=$shh'
     ```

### Impact
Because this can be used to exploit other threats related to  [CWE-284: Improper Access Control](https://cwe.mitre.org/data/definitions/284.html) I rank it with a Moderate severity. An insider with knowledge of this could do many mischievous things and get away with them for a long time without victims knowing about it.
dio vulnerable to CRLF injection with HTTP method string (GHSA-9324-jv53-9cc8)
Aliases: CVE-2021-31402
Published: 2023-03-21T22:41:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Pub', 'name': 'dio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.0.0'}]}]}]

### Impact
The dio package 4.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.

### Patches
The vulnerability has been resolved by https://github.com/cfug/dio/commit/927f79e93ba39f3c3a12c190624a55653d577984, and included since v5.0.0.

### Workarounds
Cherry-pick the commit to your own fork can resolves the vulberability too.

### References
- https://nvd.nist.gov/vuln/detail/CVE-2021-31402
- https://osv.dev/GHSA-jwpw-q68h-r678
- https://github.com/cfug/dio/issues/1130
- https://github.com/cfug/dio/issues/1752
jeecg-boot vulnerable to improper authentication  (GHSA-6rfv-h5v8-cj7g)
Aliases: CVE-2023-1784
Published: 2023-03-31T21:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.5.0'}]}]}]

A vulnerability was found in jeecg-boot 3.5.0 that affects some unknown processing of the component API Documentation. The manipulation leads to improper authentication because the software does not prove or insufficiently proves that an identity claim is correct when an actor claims to have a given identity. The attack may be initiated remotely and the exploit has been disclosed to the public and may be used.
phpMyFAQ Stored Cross-site Scripting vulnerability (GHSA-7q9c-f2v8-j8gw)
Aliases: CVE-2023-1760
Published: 2023-03-31T03:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Denial of service in Jenkins Core (GHSA-frgr-c5f2-8qhh)
Aliases: CVE-2023-27900
Published: 2023-03-10T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.388'}, {'fixed': '2.394'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.375.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.376'}, {'fixed': '2.387.1'}]}]}]

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 is affected by the Apache Commons FileUpload library’s vulnerability CVE-2023-24998. This library is used to process uploaded files via the Stapler web framework (usually through StaplerRequest#getFile) and MultipartFormDataParser in Jenkins.

This allows attackers to cause a denial of service (DoS) by sending crafted requests to HTTP endpoints processing file uploads.

Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 limits the number of request parts to be processed to 1000. Specific endpoints receiving only simple form submissions have a lower limit.
OWSLib vulnerable to XML External Entity (XXE) Injection (GHSA-8h9c-r582-mggc)
Aliases: CVE-2023-27476
Published: 2023-03-07T20:41:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'OWSLib'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.28.1'}]}]}]

### Impact

OWSLib's XML parser (which supports both `lxml` and `xml.etree`) does not disable entity resolution for `lxml`, and could lead to arbitrary file reads from an attacker-controlled XML payload. This affects all XML parsing in the codebase.

### Patches

- Use only lxml for XML handling, adding `resolve_entities=False` to `lxml`'s parser: https://github.com/geopython/OWSLib/pull/863

### Workarounds

```python
patch_well_known_namespaces(etree)
etree.set_default_parser(
    parser=etree.XMLParser(resolve_entities=False)
)
```

### References

- [`GHSL-2022-131`](https://securitylab.github.com/advisories/GHSL-2022-131_OWSLib/)
OpenShift Assisted Installer leaks image pull secrets as plaintext in installation logs (GHSA-g8xm-p2h4-v6jp)
Aliases: CVE-2021-3684
Published: 2023-03-24T21:30:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/openshift/assisted-installer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.25.1'}]}]}]

A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.
TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize (GHSA-49rq-hwc3-x77w)
Aliases: CVE-2023-25670
Published: 2023-03-24T21:55:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
NPE in QuantizedMatMulWithBiasAndDequantize with MKL enable 
```python
import tensorflow as tf

func = tf.raw_ops.QuantizedMatMulWithBiasAndDequantize
para={'a': tf.constant(138, dtype=tf.quint8), 'b': tf.constant(4, dtype=tf.qint8), 'bias': [[31.81644630432129, 47.21876525878906], [109.95201110839844, 152.07968139648438]], 'min_a': 141.5337138686371, 'max_a': [73.84139251708984, 173.15280151367188], 'min_b': [], 'max_b': [[16.128345489501953, 193.26820373535156]], 'min_freezed_output': [], 'max_freezed_output': [115.50032806396484, 156.974853515625], 'Toutput': 1.0, 'transpose_a': True, 'transpose_b': False, 'input_quant_mode': 'MIN_FIRST'}

func(**para)
```

### Patches
We have patched the issue in GitHub commit [8a47a39d9697969206d23a523c977238717e8727](https://github.com/tensorflow/tensorflow/commit/8a47a39d9697969206d23a523c977238717e8727).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx
Constellation allows Emergency shell access during initramfs boot phase (GHSA-6w5f-5wgr-qjg5)
Published: 2023-03-09T20:21:36Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/edgelesssys/constellation/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.0'}]}]}]

### Impact

An active attacker could let the boot fail on purpose in the initramfs, dropping the serial console into an emergency shell. This gives attackers with access to the serial console full control over the VM.

### Patches

The issue has been patched in [v2.6.0](https://github.com/edgelesssys/constellation/releases/tag/v2.6.0).

### Workarounds

none
Moodle vulnerable to Uncontrolled Resource Consumption (GHSA-273w-7fxj-pcp6)
Aliases: CVE-2021-36395
Published: 2023-03-06T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.
Possible XSS Security Vulnerability in SafeBuffer#bytesplice (GHSA-pj73-v5mw-pm9j)
Aliases: CVE-2023-28120
Published: 2023-03-15T21:36:01Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'activesupport'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.4.3'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'activesupport'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.1.7.3'}]}]}]

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

# Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

# Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.
Improper Authorization in nilsteampassnet/teampass (GHSA-86jq-pwgx-6vrq)
Aliases: CVE-2023-1463
Published: 2023-03-17T12:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0.23'}]}]}]

Improper Authorization in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor (GHSA-5cf8-vrr8-8hjm)
Aliases: CVE-2023-26476
Published: 2023-03-03T22:47:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livetable-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2-m3'}, {'fixed': '13.4.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2-m3'}, {'fixed': '13.4.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livetable-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '13.5.0'}, {'fixed': '13.10.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '13.5.0'}, {'fixed': '13.10.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livetable-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0.0'}, {'fixed': '14.7-rc-1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0.0'}, {'fixed': '14.7-rc-1'}]}]}]

### Impact
Users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`.

### Patches
The issue is applied on versions 14.7-rc-1, 13.4.4, and 13.10.9.

### Workarounds
The issue can be fixed by upgrading to versions 14.7-rc-1, 13.4.4, and 13.10.9 and higher, or in version >= 3.2M3 by applying the patch manually on `LiveTableResults` and `WikisLiveTableResultsMacros`.

### References
- Jira: https://jira.xwiki.org/browse/XWIKI-19949
- Patch: https://github.com/xwiki/xwiki-platform/commit/7f8825537c9523ccb5051abd78014d156f9791c8

### For more information
If you have any questions or comments about this advisory:

- Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
- Email us at [Security Mailing List](mailto:security@xwiki.org)
ONOS vulnerable to reflected cross-site scripting (GHSA-3xmp-jwrr-8f4r)
Aliases: CVE-2023-24279
Published: 2023-03-14T03:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.onosproject:onos-archetypes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.9.0'}, {'last_affected': '2.7.0'}]}]}]

A cross-site scripting (XSS) vulnerability in Open Network Operating System (ONOS) from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL parameter of the API documentation dashboard under info > contact > URL.
Yapscan Denial of Service vulnerability in report server (GHSA-wxwq-525w-hcqx)
Published: 2023-03-03T23:05:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/fkie-cad/yapscan'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.18.0'}, {'fixed': '0.19.2'}]}]}]

### Impact

If you use the report server, it may be vulnerable to a Denial of Service attack.

### Patches

Has been patched in v0.19.2.

### References

The vulnerability was inherited by the following upstream vulnerabilites

- [golang.org/x/text < v0.3.7](https://github.com/advisories/GHSA-ppp9-7jff-5vj2)
- [golang.org/x/net < 0.0.0-20220906165146-f3363e06e74c](https://github.com/advisories/GHSA-69cg-p879-7622)
Veracode Scan Jenkins Plugin vulnerable to information disclosure (GHSA-fjrv-vx9m-4jpj)
Aliases: CVE-2023-25722
Published: 2023-03-28T21:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.veracode.jenkins:veracode-scan'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.3.19.0'}]}]}]

Veracode Scan Jenkins Plugin before 23.3.19.0, when configured for remote agent jobs, invokes the Veracode Java API Wrapper in a manner that allows local users (with OS-level access of the Jenkins remote) to discover Veracode API credentials by listing the process and its arguments.
Saleor Unauthenticated Information Disclosure Vulnerability via Python Exceptions (GHSA-3hvj-3cg9-v242)
Aliases: CVE-2023-26052
Published: 2023-03-02T23:04:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '3.1.48'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.12'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0'}, {'fixed': '3.10.14'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.9.0'}, {'fixed': '3.9.27'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.8.0'}, {'fixed': '3.8.30'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'saleor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.7.0'}, {'fixed': '3.7.59'}]}]}]

### Impact
Some internal Python exceptions are not handled properly and thus are returned in API as error messages. Some messages might contain sensitive information like infrastructure details in unauthenticated requests.

Affected versions: Saleor ≥ 2.0.0

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Open a discussion at https://github.com/saleor/saleor/discussions
* Email us at [hello@saleor.io](mailto:hello@saleor.io)
uvdesk/community-skeleton vulnerable to Stored Cross-site Scripting (GHSA-hfxp-j95j-cwrp)
Aliases: CVE-2023-1197
Published: 2023-03-06T18:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'uvdesk/community-skeleton'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository uvdesk/community-skeleton prior to 1.1.0.
xwiki vulnerable to Improper Handling of Exceptional Conditions (GHSA-52vf-hvv3-98h7)
Aliases: CVE-2023-26479
Published: 2023-03-03T22:53:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-parser'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0'}, {'fixed': '13.10.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-parser'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-parser'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.9-rc-1'}]}]}]

### Impact
Users with write rights can insert well-formed content that is not handled well by the parser. For instance, with `xwiki/2.1`, inserting a deeply nested group blocks (`((( ((( ((( ((( .... ))) ))) ))) )))` (see the generator below to produce a large payload) can lead to the parser throwing a `StackOverflowError`.
As a consequence, some pages becomes unusable, including:
- the user index (if the page containing the faulty content is a user page)
- the page index

Note that on the page, the normal UI is completely missing and it is not possible to open the editor directly to revert the change as the stack overflow is already triggered while getting the title of the document. This means that it is quite difficult to remove this content once inserted.

### Patches
This has been patched on XWiki 13.10.10, 14.4.6, and 14.9-rc-1.

### Workarounds
A temporary solution to avoid Stack Overflow errors is to increase the memory allocated to the stack by using the `-Xss` JVM parameter (e.g., `-Xss32m`). This should allow the parser to pass and to fix the faulty content.
Note that we did not evaluated the consequence on other aspects of the system (e.g., performances), and should be only be used as a temporary solution.
Also, this does not prevent the issue to occur again with another content.
Consequently, it is strongly advised to upgrade to a version where the issue has been patched.

### References
- https://jira.xwiki.org/browse/XWIKI-19838

### For more information
If you have any questions or comments about this advisory:
- Open an issue in [Jira](http://jira.xwiki.org/)
- Email us at [Security ML](mailto:security@xwiki.org)

### Payload Generator

The Javascript code below produces 32768 nested group blocks, around the `Hello` text.

```javascript
let result = "(((\nHello\n)))";
for (let i = 0; i < 15; ++i) {
  result = result.replace("Hello", result);
}
console.log(result);
```
Frontier's modexp precompile is slow for even modulus (GHSA-fcmm-54jp-7vf6)
Aliases: CVE-2023-28431
Published: 2023-03-21T22:31:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'frontier'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.0'}]}]}]

### Impact

Frontier's `modexp` precompile uses `num-bigint` crate under the hood. [In the implementation](https://github.com/rust-num/num-bigint/blob/6f2b8e0fc218dbd0f49bebb8db2d1a771fe6bafa/src/biguint/power.rs#L134), the cases for modulus being even and modulus being odd are treated separately. Odd modulus uses the fast Montgomery multiplication, and even modulus uses the slow plain power algorithm. This gas cost discrepancy was not accounted for in the `modexp` precompile, leading to possible denial of service attacks.

### Patches

No fixes for `num-bigint` is currently available, and thus this advisory will be first fixed in the short term by raising the gas costs for even modulus, and in the long term fixing it in `num-bigint` or switching to another modexp implementation.

The short-term fix for Frontier is deployed at [PR 1017](https://github.com/paritytech/frontier/pull/1017).

The recommendations are as follows:

- If you anticipate malicious validators, it's recommended to issue an emergency runtime upgrade as soon as possible.
- If you do not anticipate malicious validators, it's recommended to issue a normal runtime upgrade, as Substrate has builtin timeout protection when validators are building blocks.

### Workarounds

None.

### References

A similar issue was presented in Geth's implementation and the fix can be found [here](https://go-review.googlesource.com/c/go/+/420897).
lambdaisland/uri `authority-regex` returns the wrong authority (GHSA-cp4w-6x4w-v2h5)
Aliases: CVE-2023-28628
Published: 2023-03-27T22:31:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'lambdaisland:uri'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.14.120'}]}]}]

### Summary
`authority-regex` allows an attacker to send malicious URLs to be parsed by the `lambdaisland/uri` and return the wrong authority. This issue is similar to CVE-2020-8910.

### Details

https://github.com/lambdaisland/uri/blob/d3355fcd3e235238f4dcd37be97787a84e580072/src/lambdaisland/uri.cljc#L9

This regex doesn't handle the backslash (`\`) character in the username correctly, leading to a wrong output.
**Payload:** `https://example.com\\@google.com`
The returned host is `google.com`, but the correct host should be `example.com`.

`urllib3` (Python) and `google-closure-library` (Javascript) return `example.com` as the host. Here the correct (or current) regex used by `google-closure-library`:

https://github.com/google/closure-library/blob/0e567abedb058e9b194a40cfa3ad4c507653bccf/closure/goog/uri/utils.js#L189

### PoC

```
(ns poc.core)
(require '[lambdaisland.uri :refer (uri)])

(def myurl "https://example.com\\@google.com")

(defn -main
  []
   (println myurl)
   (println (:host (uri myurl)))
)
```


### Impact

The library returns the wrong authority, and it can be abused to bypass host restrictions.

### Reference

WHATWG Living URL spec, section 4.4 URL Parsing, host state: https://url.spec.whatwg.org/#url-parsing
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile (GHSA-vwr6-qp4q-2wj7)
Aliases: CVE-2023-26472
Published: 2023-03-03T22:48:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-icon-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.2-milestone-1'}, {'fixed': '13.10.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-icon-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-icon-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.9'}]}]}]

### Impact

One can execute any wiki content with the right of IconThemeSheet author by creating an icon theme with the following content:

```
}}}
{{async async="true"}}
{{groovy}}
  println("Hello from Groovy!")
{{/groovy}}
{{/async}}
{{{
```

Can be done by creating a new page or even through the user profile for users not having edit right.

### Patches

This has been patched in XWiki 14.9, 14.4.6, and 13.10.10.

### Workarounds

An easy workaround is to actually fix the bug in the page `IconThemesCode.IconThemeSheet` by applying the following modification: https://github.com/xwiki/xwiki-platform/commit/48caf7491595238af2b531026a614221d5d61f38#diff-2ec9d716673ee049937219cdb0a92e520f81da14ea84d144504b97ab2bdae243R45

### References

https://jira.xwiki.org/browse/XWIKI-19731

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
Consul Server Panic when Ingress and API Gateways Configured with Peering Connections (GHSA-wj6x-hcc2-f32j)
Aliases: CVE-2023-0845
Published: 2023-03-09T18:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/consul'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.14.0'}, {'fixed': '1.14.5'}]}]}]

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. To exploit this vulnerability, an attacker requires access to an ACL token with service:write permissions, and there needs to be at least one running ingress or API gateway that is configured to route traffic to an upstream service.
coreDNS vulnerable to Improper Restriction of Communication Channel to Intended Endpoints (GHSA-ch7v-37xg-75ph)
Aliases: CVE-2022-2835
Published: 2023-03-03T18:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/coredns/coredns'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.9.3'}]}]}]

A flaw was found in coreDNS. This flaw allows a malicious user to reroute internal calls to some internal services that were accessed by the FQDN in a format of <service>.<namespace>.svc.
DDOS attack on graphql endpoints (GHSA-67g8-c724-8mp3)
Aliases: CVE-2023-28104
Published: 2023-03-16T17:22:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/graphql'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.1'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/graphql'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.2'}, {'fixed': '4.2.3'}]}]}]

An attacker could use a specially crafted graphql query to execute a Distributed Denial of Service attack (DDOS attack) against a website. This mostly affects websites with publicly exposed and particularly large/complex graphql schemas.

If your Silverstripe CMS project does not expose a public facing graphql schema, a user account is required to trigger the DDOS attack. If your site is hosted behind a content delivery network (CDN), such as Imperva or CloudFlare, this will likely further mitigate the risk.

Upgrade to `silverstripe/graphql` 4.2.3 or 4.1.2 or above to remedy the vulnerability.
Timing attack in eZ Platform Ibexa (GHSA-66m4-gc8h-hpjx)
Aliases: CVE-2022-48366
Published: 2023-03-12T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezplatform-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.3.19'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezpublish-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.5.0'}, {'fixed': '7.5.29'}]}]}]

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
redis-py Race Condition vulnerability (GHSA-24wv-mv5m-xv4h)
Aliases: CVE-2023-28858
Published: 2023-03-26T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'redis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.4.0'}, {'fixed': '4.4.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'redis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.5.0'}, {'fixed': '4.5.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'redis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.3.6'}]}]}]

redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connection open after canceling an async Redis command at an inopportune time (in the case of a pipeline operation), and can send response data to the client of an unrelated request in an off-by-one manner. The fixed versions for this CVE Record are 4.3.6, 4.4.3, and 4.5.3, but [are believed to be incomplete](https://github.com/redis/redis-py/issues/2665). CVE-2023-28859 has been assigned the issues caused by the incomplete fixes.
SQL Injection in Funadmin (GHSA-qhq8-2f3m-gxvp)
Aliases: CVE-2023-24782
Published: 2023-03-08T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'funadmin/funadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.2.0'}]}]}]

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.
Remote file existence check vulnerability in `mlflow server` and `mlflow ui` CLIs (GHSA-wp72-7hj9-5265)
Aliases: CVE-2023-1176
Published: 2023-03-24T22:01:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mlflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.2.0'}}]

### Impact

Users of the MLflow Open Source Project who are hosting the MLflow Model Registry using the `mlflow server` or `mlflow ui` commands using an MLflow version older than MLflow 2.2.1 may be vulnerable to a remote file existence check exploit if they are not limiting who can query their server (for example, by using a cloud VPC, an IP allowlist for inbound requests, or authentication / authorization middleware).

This issue only affects users and integrations that run the `mlflow server` and `mlflow ui` commands. Integrations that do not make use of `mlflow server` or `mlflow ui` are unaffected; for example, the Databricks Managed MLflow product and MLflow on Azure Machine Learning do not make use of these commands and are not impacted by these vulnerabilities in any way.

The vulnerability detailed in https://nvd.nist.gov/vuln/detail/CVE-2023-1176 enables an actor to check the existence of arbitrary files unrelated to MLflow from the host server, including any files stored in remote locations to which the host server has access.

### Patches
This vulnerability has been patched in MLflow 2.2.1, which was released to PyPI on March 2nd, 2023. If you are using `mlflow server` or `mlflow ui` with the MLflow Model Registry, we recommend upgrading to MLflow 2.2.1 as soon as possible.

### Workarounds
If you are using the MLflow open source `mlflow server` or `mlflow ui` commands, we strongly recommend limiting who can access your MLflow Model Registry and MLflow Tracking servers using a cloud VPC, an IP allowlist for inbound requests, authentication / authorization middleware, or another access restriction mechanism of your choosing.

If you are using the MLflow open source `mlflow server` or `mlflow ui` commands, we also strongly recommend limiting the remote files to which your MLflow Model Registry and MLflow Tracking servers have access. For example, if your MLflow Model Registry or MLflow Tracking server uses cloud-hosted blob storage for MLflow artifacts, make sure to restrict the scope of your server's cloud credentials such that it can only access files and directories related to MLflow.

### References
More information about the vulnerability is available at https://nvd.nist.gov/vuln/detail/CVE-2023-1176.
SketchSVG Arbitrary Code Injection vulnerability (GHSA-6722-xvq8-3254)
Aliases: CVE-2023-26107
Published: 2023-03-06T06:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'sketchsvg'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.1'}]}]}]

All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking `shell.exec` without sanitization nor parametrization while concatenating the current directory as part of the command string.
jeecg-boot SQL Injection vulnerability (GHSA-j72f-4hgp-3mwc)
Aliases: CVE-2023-1454
Published: 2023-03-17T09:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-common'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.5.0'}]}]}]

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.