aswin1906/github-advisory-2023 huggingface dataset:
DataEase API interface has IDOR vulnerability (GHSA-7hv6-gv38-78wj)
Aliases: CVE-2023-32310
Published: 2023-06-02T17:09:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.dataease:dataease-plugin-common'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.18.7'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.18.6'}}]

### Impact
The api interface for DataEase delete dashboard and delete system messages is vulnerable to IDOR.

The interface to delete the dashboard:
1. Create two users: user1 and user2
2. User1 creates a dashboard named pan1
3. User2 creates a dashboard named pan2
4. Both user1 and user2 share their dashboards with the demo user
5. User1 wants to delete his dashboard. We hijack the request with burpsuite. The request will probably look like this: POST /api/share/removePanelShares/440efa7f-efd8-11ed-bec7-1144724bc08c HTTP/1.1. 440efa7f-efd8-11ed-bec7-1144724bc08c is the ID of pan1
6. We replace this ID with the ID of pan2 and continue the execution (i.e. we delete the shares of others)
7. Successfully remove the shared link
![image](https://user-images.githubusercontent.com/985347/238271028-d23a9ca3-cd77-42a2-9199-a28ef03f5bf0.png)

The interface to delete system messages:
1. Our request to delete a message is shown below
![image](https://user-images.githubusercontent.com/985347/238271474-1bf6be85-7a39-436d-b209-ac88bf52b591.png)
2. We can delete all messages by simply enumerating the message ID, regardless of whether the message belongs to the requester or not.
3. The interface for marking read messages is also affected

Affected versions: <= 1.18.6

### Patches
The vulnerability has been fixed in v1.18.7.

### Workarounds
It is recommended to upgrade the version to v1.18.7.

### References
If you have any questions or comments about this advisory:

Open an issue in https://github.com/dataease/dataease
Email us at [wei@fit2cloud.com](mailto:wei@fit2cloud.com)
Grafana vulnerable to Authentication Bypass by Spoofing (GHSA-mpv3-g8m3-3fjc)
Aliases: CVE-2023-3128
Published: 2023-06-22T21:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4.0'}, {'fixed': '9.4.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.3.0'}, {'fixed': '9.3.16'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.2.20'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.5.27'}]}]}]

Grafana is validating Azure AD accounts based on the email claim. 

On Azure AD, the profile email field is not unique and can be easily modified. 

This leads to account takeover and authentication bypass when Azure AD OAuth is configured with a multi-tenant app.
fief-server Server-Side Template Injection vulnerability (GHSA-hj8m-9fhf-v7jp)
Published: 2023-06-23T21:46:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'fief-server'}, 'ecosystem_specific': {'affected_functions': ['fief.apps.dashboard.routers.email_templates.update_email_template', 'fief.services.email_template.renderers.EmailTemplateRenderer._get_jinja_environment', 'fief.services.email_template.renderers.EmailSubjectRenderer._get_jinja_environment']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.19.0'}, {'fixed': '0.25.3'}]}]}]

# Server-Side Template Injection

## Overview of the Vulnerability

Server-Side Template Injection (SSTI) is a vulnerability within application templating engines where user input is improperly handled and is embedded into the template, possibly leading code being executed.

An attacker can use SSTI to execute code on the underlying system by manipulating values within the embedded template. When code is executed within the underlying system, it can allow an attacker to run permissioned commands under the exploited process, or exploit Cross-Site Scripting (XSS) to run code within the user's browser.

## Business Impact

SSTI can lead to reputational damage for the business due to a loss in confidence and trust by users. If an attacker successfully executes code within the underlying system, it can result in data theft and indirect financial losses.

## Steps to Reproduce

1. [Sign up](https://fief.fief.dev/register) and login to your account
1. Use a browser to navigate to: email-templates {{[URL](https://test.fief.dev/admin/customization/email-templates/)}}
1. put your payload in Edit Base template `{{ cycler.__init__.__globals__.os.popen('id').read() }}` and you will se it will execute.

Payload:
`{{ cycler.__init__.__globals__.os.popen('id').read() }}`

## Proof of Concept (PoC)

The screenshot(s) below demonstrates the SSTI:

![SSTI](https://user-images.githubusercontent.com/42150485/248214990-854c2272-4f34-4c49-9759-d49ce8ce3d12.png)
XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanel (GHSA-h7cw-44vp-jq7h)
Aliases: CVE-2023-35166
Published: 2023-06-20T19:55:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-help-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.1-milestone-1'}, {'fixed': '14.10.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-help-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1-rc-1'}]}]}]

### Impact

It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension.

To reproduce:
* Add an object of type UIExtensionClass
* Set "Extension Point ID" to org.xwiki.platform.help.tipsPanel
* Set "Extension ID" to org.xwiki.platform.user.test (needs to be unique but otherwise doesn't matter)
* Set "Extension Parameters" to
    ```
    tip={{async async="true" cached="false" context="doc.reference"}}{{groovy}}println("Hello " + "from groovy!"){{/groovy}}{{/async}}
    ```
* Set "Extension Scope" to "Current User".
* Click "Save & View"
* Open the "Help.TipsPanel" document at <xwiki-host>/xwiki/bin/view/Help/TipsPanel where <xwiki-host> is the URL of your XWiki installation and press refresh repeatedly.

The groovy macro is executed, after the fix you get an error instead.

### Patches

This has been patched in XWiki 15.1-rc-1 and 14.10.5.

### Workarounds

There are no known workarounds for it.

### References

* https://jira.xwiki.org/browse/XWIKI-20281
* https://github.com/xwiki/xwiki-platform/commit/98208c5bb1e8cdf3ff1ac35d8b3d1cb3c28b3263#diff-4e3467d2ef3871a68b2f910e67cf84531751b32e0126321be83c0f1ed5d90b29L176-R178

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
@apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces (GHSA-68jh-rf6x-836f)
Published: 2023-06-16T19:40:53Z
Affected: [{'package': {'ecosystem': 'npm', 'name': '@apollo/server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.7.1'}, {'fixed': '4.7.4'}]}]}]

### Context
Content Security Policies (CSP) are a defense-in-depth strategy against XSS attacks. Improper application of CSP isn't itself a vulnerability, but it does fail to prevent XSS in the event that there is a viable attack vector for an XSS attack.

### Impact
There aren't any XSS attack vectors via the Apollo Server landing pages _known to Apollo_, so to our knowledge there is no impact. However, if there are existing XSS vectors that haven't been reported and patched, then all users of Apollo Server's landing pages have a vulnerability which won't be prevented by the current CSP implemented by the landing pages.

Prior to version 4.7.1, there was no CSP implemented at all. However, the initial CSP implementation (4.7.1+) reused nonces. While this sufficiently resolved the issue w.r.t. scripts not running in Safari, it did not implement CSP in a safe or conventional way.

### Patches
The issue is patched in the latest version of Apollo Server, v4.7.4. The changes can be reviewed in [the merge commit](https://github.com/apollographql/apollo-server/commit/0adaf80d1ee51d8c7e5fd863c04478536d15eb8c).

### Workarounds
The landing page can be disabled completely until the patch can be upgraded to.
https://www.apollographql.com/docs/apollo-server/api/plugin/landing-pages/#disabling-the-landing-page

### References
https://content-security-policy.com/nonce/
XWiki Platform may show email addresses in clear in REST results (GHSA-8g9c-c9cm-9c56)
Aliases: CVE-2023-35151
Published: 2023-06-20T16:46:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rest-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.3-milestone-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rest-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rest-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1'}]}]}]

### Impact
Any user can call a REST endpoint and obtain the obfuscated passwords (even when the mail obfuscation is activated).

For instance, by calling http://localhost:8080/xwiki/rest/wikis/xwiki/spaces/XWiki/pages/U1/objects/XWiki.XWikiUsers/0 when user `U1` exists on wiki `xwiki`.

### Patches
The issue has been patched on XWiki 14.4.8, 14.10.6, and 15.1 

### Workarounds
There is no known workaround. It is advised to upgrade to one of the patched versions.

### References
- https://jira.xwiki.org/browse/XWIKI-16138
- https://github.com/xwiki/xwiki-platform/commit/824cd742ecf5439971247da11bfe7e0ad2b10ede

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
XWiki Platform's tags on non-viewable pages can be revealed to users (GHSA-7f2f-pcv3-j2r7)
Aliases: CVE-2023-34466
Published: 2023-06-20T16:45:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-tag-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0-milestone-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-tag-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.4'}]}]}]

### Impact
Tags from pages not viewable to the current user are leaked by the tags API. 
This information can also be exploited to infer the document reference of non-viewable pages.

### Patches
This vulnerability has been patched in XWiki 14.4.8, 14.10.4, and 15.0 RC1.

### Workarounds
There is no workaround apart from upgrading to a fixed version.

### References
- https://jira.xwiki.org/browse/XWIKI-20002

### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
Vaadin vulnerable to possible information disclosure in non visible components. (GHSA-5f9v-mv5g-jh5q)
Aliases: CVE-2023-25499
Published: 2023-06-22T20:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '10.0.23'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '14.10.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '23.0.0'}, {'fixed': '23.3.13'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.0.0'}, {'fixed': '24.0.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:vaadin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.1.0.alpha1'}, {'fixed': '24.1.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.20'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '2.8.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '9.1.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '23.0.0'}, {'fixed': '23.3.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.0.0'}, {'fixed': '24.0.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.vaadin:flow-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.1.0.alpha1'}, {'fixed': '24.1.0'}]}]}]

### Description
When adding non-visible components to the UI in server side, content is sent to the browser in Vaadin 10.0.0 through 10.0.22, 11.0.0 through 14.10.0, 15.0.0 through 22.0.28, 23.0.0 through 23.3.12, 24.0.0 through 24.0.5 and 24.1.0.alpha1 to 24.1.0.beta1, resulting in potential information disclosure.

* https://vaadin.com/security/cve-2023-25499
Rancher users retain access after moving namespaces into projects they don't have access to (GHSA-8vhc-hwhc-cpj4)
Aliases: CVE-2020-10676
Published: 2023-06-06T01:59:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.4'}]}]}]

### Impact
A vulnerability was identified in which users with update privileges on a namespace, can move that namespace into a project they don't have access to. After the namespace transfer is completed, their previous permissions are still preserved, which enables them to gain access to project-specific resources (such as [project secrets](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/kubernetes-resources-setup/secrets#creating-secrets-in-projects)). In addition, resources in the namespace will now count toward the [quota limit](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/manage-projects/manage-project-resource-quotas/about-project-resource-quotas) of the new project, potentially causing availability issues.

User with roles `Project Owner` and `Project Member` on the source project can exploit this vulnerability; however, this would also apply to custom roles with similar privileges. 

The patched version include an improved RBAC mechanism, which checks if the user has the correct permissions before the namespace move takes place.

### Patches
Patched versions include releases `2.6.13`, `2.7.4` and later versions.

### Workarounds
There is no direct mitigation besides updating Rancher to a patched version.

### For more information
If you have any questions or comments about this advisory:

- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Synapse has improper checks for deactivated users during login (GHSA-26c5-ppr8-f33p)
Aliases: CVE-2023-32682
Published: 2023-06-06T16:40:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'matrix-synapse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.85.0'}]}]}]

### Impact
It may be possible for a deactivated user to login when using uncommon configurations.

This only applies if any of the following are true:

* [JSON Web Tokens are enabled for login](https://matrix-org.github.io/synapse/latest/jwt.html) via the `jwt_config.enabled` configuration setting
* The [local password database is enabled](https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#password_config) via the `password_config.enabled` and `password_config.localdb_enabled` configuration settings *and* a user's password is [updated via an admin API](https://matrix-org.github.io/synapse/latest/admin_api/user_admin_api.html#create-or-modify-account) after a user is deactivated.

**Note that the local password database is enabled by default**, but it is uncommon to set a user's password after they've been deactivated.

Installations that are configured to only allow login via Single Sign-On (SSO) via CAS, SAML or OpenID Connect (OIDC); or via an external password provider (e.g. LDAP) are not affected.

### Patches

* If using JSON Web Token logins: #15624
* For other users: #15634

### Workarounds

If not using JSON Web Tokens, ensure that deactivated users do not have a password set. This list of users can be queried from PostgreSQL:

```sql
SELECT name FROM users WHERE password_hash IS NOT NULL AND deactivated = 1;
```
Upgrading doesn't prevent exploiting vulnerable XWiki documents (GHSA-8q9q-r9v2-644m)
Aliases: CVE-2023-36468
Published: 2023-06-30T20:42:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0'}, {'fixed': '14.10.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.2-rc-1'}]}]}]

### Impact

When an XWiki installation is upgraded and that upgrade contains a fix for a bug in a document, just a new version of that document is added. In some cases, it's still possible to exploit the vulnerability that was fixed in the new version. The severity of this depends on the fixed vulnerability, for the purpose of this advisory take [CVE-2022-36100](https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-2g5c-228j-p52x) as example - it is easily exploitable with just view rights and critical. When XWiki is upgraded from a version before the fix for it (e.g., 14.3) to a version including the fix (e.g., 14.4), the vulnerability can still be reproduced by adding `rev=1.1` to the URL used in the reproduction steps so remote code execution is possible even after upgrading. Therefore, this affects the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability also affects manually added script macros that contained security vulnerabilities that were later fixed by changing the script macro without deleting the versions with the security vulnerability from the history.

This vulnerability doesn't affect freshly installed versions of XWiki. Further, this vulnerability doesn't affect content that is only loaded from the current version of a document like the code of wiki macros or UI extensions.

### Patches

This vulnerability has been patched in XWiki 14.10.7 and 15.2RC1 by forcing old revisions to be executed in a restricted mode that disables all script macros.

### Workarounds

As a workaround, admins can manually delete old revisions of affected documents. A script could be used to identify all installed documents and delete the history for them. However, also manually added and later corrected code may be affected by this vulnerability so it is easy to miss documents.

### References

* https://jira.xwiki.org/browse/XWIKI-20594
* https://github.com/xwiki/xwiki-platform/commit/15a6f845d8206b0ae97f37aa092ca43d4f9d6e59
Pimcore Privilege Defined With Unsafe Actions vulnerability (GHSA-m4mv-rmr7-h5f5)
Aliases: CVE-2023-2983
Published: 2023-06-06T01:39:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.23'}]}]}]

### Impact
A new user can privilege escalation to admin role which least config

### Patches
Update to version 10.5.23 or apply this patches manually
https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a.patch

### Workarounds
Apply patches manually: https://github.com/pimcore/pimcore/commit/c8f37b19c99cd82e4e558857d3e4d5476ea7228a.patch

### References
https://huntr.dev/bounties/6b2f33d3-2fd0-4d2d-ad7b-2c1e2417eeb1/
Teampass Cross-site Scripting vulnerability (GHSA-p7xm-g427-jxfc)
Aliases: CVE-2023-3190
Published: 2023-06-10T09:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting (XSS) vectors in the application.
easy-parse XML External Entity Injection vulnerability (GHSA-vv6q-6hwp-vrgp)
Aliases: CVE-2020-26710
Published: 2023-06-29T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'easy-parse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.1'}]}]}]

easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
atty potential unaligned read (GHSA-g98v-hv3f-hcfr)
Published: 2023-06-30T20:21:59Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'atty'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.2.14'}]}]}]

On windows, `atty` dereferences a potentially unaligned pointer.

In practice however, the pointer won't be unaligned unless a custom global allocator is used.

In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.

# atty is Unmaintained

A Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.

Last release of `atty` was almost 3 years ago.

## Possible Alternative(s)

The below list has not been vetted in any way and may or may not contain alternatives;

- [std::io::IsTerminal](https://doc.rust-lang.org/stable/std/io/trait.IsTerminal.html) - Stable since Rust 1.70.0\n 
- [is-terminal](https://crates.io/crates/is-terminal) - Standalone crate supporting Rust older than 1.70.0"
pbjson vulnerable to stack exhaustion (GHSA-p4c9-x742-qh8c)
Aliases: CVE-2023-34616
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.progsbase.libraries:JSON'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.4.0'}]}]}]

An issue was discovered pbjson through 0.4.0 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.
Rancher vulnerable to Privilege Escalation via manipulation of Secrets (GHSA-p976-h52c-26p6)
Aliases: CVE-2023-22647
Published: 2023-06-06T02:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'rancher/rancher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.4'}]}]}]

### Impact

A vulnerability has been identified which enables [Standard users](https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/manage-role-based-access-control-rbac/global-permissions) or above to elevate their permissions to Administrator in the `local` cluster.

The `local` cluster means the cluster where Rancher is installed. It is named `local` inside the list of clusters in the Rancher UI.

Standard users could leverage their existing permissions to manipulate Kubernetes secrets in the `local` cluster, resulting in the secret being deleted, but their read-level permissions to the secret being preserved. When this operation was followed-up by other specially crafted commands, it could result in the user gaining access to tokens belonging to service accounts in the `local` cluster.

Users that have custom global roles which grant `create` and `delete` permissions on `secrets` would also be able to exploit this vulnerability.

Users with [audit logs enabled](https://ranchermanager.docs.rancher.com/how-to-guides/advanced-user-guides/enable-api-audit-log#enabling-api-audit-log) in Rancher can try to identify possible abuses of this issue by going through the logs. To sieve through the data filter by `kind: Secret` with `type: provisioning.cattle.io/cloud-credential`, then investigate all log entries that affect that specific resource. A secondary check would be to filter by all operations with `Opaque` Secrets within the `cattle-global-data` namespace.

After patching, it is recommended that users review access methods to Rancher (including RBAC policies, tokens, and host-level node access), to ensure that no changes were made to persist access to users who have leveraged this vulnerability.

### Patches

Patched versions include releases `2.6.13`, `2.7.4` and later versions. 

### Workarounds

There is no direct mitigation besides updating Rancher to a patched version.

### For more information

If you have any questions or comments about this advisory:

- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Broadleaf vulnerable to Cross-site Scripting (GHSA-3862-fmr3-4f3h)
Aliases: CVE-2023-33725
Published: 2023-06-21T18:31:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.broadleafcommerce:broadleaf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0-GA'}, {'fixed': '6.2.7-GA'}]}]}]

Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.7-GA.
Admidio Improper Neutralization of Formula Elements in a CSV File vulnerability (GHSA-hm75-8w6h-4f8f)
Aliases: CVE-2023-3302
Published: 2023-06-23T15:30:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'admidio/admidio'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.9'}]}]}]

Admidio prior to 4.2.9 is vulnerable toImproper Neutralization of Formula Elements in a CSV File.
mx-chain-go does not treat invalid transaction with wrong username correctly (GHSA-7xpv-4pm9-xch2)
Aliases: CVE-2023-33964
Published: 2023-06-02T19:41:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/multiversx/mx-chain-go'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.16'}]}]}]

### Impact
Metachain cannot process a cross-shard miniblock.
An invalid transaction with the wrong username on metachain is not treated correctly on the metachain transaction processor. This is strictly a processing issue that could have happened on MultiversX chain. If an error like this had occurred, the metachain would have stopped notarizing blocks from the shard chains. The resuming of notarization is possible only after applying a patched binary version. 
 
### Patches
Introduce processIfTxErrorCrossShard for metachain transaction processor. 

### Workarounds
No

### References
No
SpiceDB's LookupResources may return partial results (GHSA-m54h-5x5f-5m6r)
Aliases: CVE-2023-35930
Published: 2023-06-28T22:48:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/authzed/spicedb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.22.0'}, {'fixed': '1.22.2'}]}], 'versions': ['1.22.0']}]

### Impact
Any user making a negative authorization decision based on the results of a LookupResources request with 1.22.0 is affected.

For example, using `LookupResources` to find a list of resources to allow access to be okay: some subjects that should have access to a resource may not. But if using `LookupResources` to find a list of banned resources instead, then some users that shouldn't have access may.

Generally, `LookupResources` is not and should not be used to gate access in this way - that's what the `Check` API is for. Additionally, version 1.22.0 has included a warning about this bug since its initial release.

### Workarounds
Avoid using `LookupResources` for negative authorization decisions if using `1.22.0`. 

### Patches
The only affected release is [v1.22.0](https://github.com/authzed/spicedb/releases/tag/v1.22.0), and it is patched in [v1.22.2](https://github.com/authzed/spicedb/releases/tag/v1.22.2) (there is no v1.22.1 release, though there is a git tag).

### References
- https://github.com/authzed/spicedb/pull/1397

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [SpiceDB](https://github.com/authzed/spicedb)
* Ask a question in the [SpiceDB Discord](https://authzed.com/discord)
genson vulnerable to stack exhaustion (GHSA-fj64-qprx-q7vq)
Aliases: CVE-2023-34617
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.owlike:genson'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.6'}]}]}]

An issue was discovered genson through 1.6 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.
Duplicate Advisory: Grafana Improper Access Control vulnerability (GHSA-wm7r-3qxj-5xgq)
Published: 2023-06-06T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '8.5.26'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.2.19'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.3.0'}, {'fixed': '9.3.15'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4.0'}, {'fixed': '9.4.12'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/grafana/grafana'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.5.0'}, {'fixed': '9.5.3'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references.

## Original Description
Grafana is an open-source platform for monitoring and observability. 

The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function.

This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server.

Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.
YiiCMS Cross Site Scripting vulnerability (GHSA-gqr4-cvf4-3957)
Aliases: CVE-2020-21246
Published: 2023-06-20T15:31:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'sheng/yiicms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.0'}]}]}]

Cross Site Scripting vulnerability in YiiCMS v.1.2.0 and prior allows a remote attacker to execute arbitrary code via the news function. A fix is available at commit 4a9d68564eb78d9f64e3f5dd77186a154093615b.
XWiki Platform vulnerable to reflected cross-site scripting via delattachment action (GHSA-phwm-87rg-27qq)
Aliases: CVE-2023-35157
Published: 2023-06-22T19:59:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2-milestone-3'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-0'}, {'fixed': '15.1-rc-1'}]}]}]

### Impact
It's possible to perform an XSS by forging a request to a delete attachment action with a specific attachment name. 
Now this XSS can be exploited only if the attacker knows the CSRF token of the user, or if the user ignores the warning about the missing CSRF token. 

### Patches

The vulnerability has been patched in XWiki 15.1-rc-1 and XWiki 14.10.6.


### Workarounds

There's no workaround for this other than upgrading XWiki. 

### References

  * Jira ticket: https://jira.xwiki.org/browse/XWIKI-20339
  * Commit containing the fix: https://github.com/xwiki/xwiki-platform/commit/35e9073ffec567861e0abeea072bd97921a3decf

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability (GHSA-q57w-826p-46jr)
Aliases: CVE-2023-35798
Published: 2023-06-27T12:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-odbc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.0'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-microsoft-mssql'}, 'ecosystem_specific': {'affected_functions': ['airflow.providers.microsoft.mssql.hooks.mssql.MsSqlHook.get_sqlalchemy_connection']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.1'}]}]}]

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected
Hashicorp Vault vulnerable to Cross-site Scripting (GHSA-gq98-53rq-qr5h)
Aliases: CVE-2023-2121
Published: 2023-06-09T18:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.11'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.7'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.3'}]}]}]

Vault and Vault Enterprise's (Vault) key-value v2 (kv-v2) diff viewer allowed HTML injection into the Vault web UI through key values. This vulnerability, CVE-2023-2121, is fixed in Vault 1.14.0, 1.13.3, 1.12.7, and 1.11.11.
jeecg-boot SQL injection vulnerability (GHSA-934g-fvcc-4833)
Aliases: CVE-2023-34659
Published: 2023-06-16T18:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.5.0'}, {'last_affected': '3.5.1'}]}]}]

jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the `id` parameter of the `/jeecg-boot/jmreport/show` interface.
buffered-reader vulnerable to out-of-bounds array access leading to panic (GHSA-29mf-62xx-28jq)
Published: 2023-06-06T01:58:41Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'buffered-reader'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.2'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'buffered-reader'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '1.1.5'}]}]}]

Affected versions of the crate have a bug where attacker-controlled input can result in the use of an out-of-bound array index. Rust
detects the use of the out-of-bound index and causes the application to panic.  An attacker may be able to use this to cause a denial-of-service.  However, it is not possible for an attacker to read from or write to the application's address space.
hjson stack exhaustion vulnerability (GHSA-5wfc-hjrc-gq87)
Aliases: CVE-2023-34620
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.hjson:hjson'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.0.0'}]}]}]

An issue was discovered hjson through 3.0.0 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.
fast-xml-parser regex vulnerability patch could be improved from a safety perspective (GHSA-gpv5-7x3g-ghjv)
Published: 2023-06-15T19:05:13Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'fast-xml-parser'}, 'ecosystem_specific': {'affected_functions': ['fast-xml-parser.XMLParser']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.4'}, {'fixed': '4.2.5'}]}], 'versions': ['4.2.4']}]

### Summary
This is a comment on https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-6w63-h3fj-q4vw and the patches fixing it.

### Details
The code which validates a name calls the validator:
https://github.com/NaturalIntelligence/fast-xml-parser/blob/ecf6016f9b48aec1a921e673158be0773d07283e/src/xmlparser/DocTypeReader.js#L145-L153
This checks for the presence of an invalid character.  Such an approach is always risky, as it is so easy to forget to include an invalid character in the list.  A safer approach is to validate entity names against the XML specification: https://www.w3.org/TR/xml11/#sec-common-syn - an ENTITY name is a Name:

```
[4]   NameStartChar ::= ":" | [A-Z] | "_" | [a-z] | [#xC0-#xD6] | [#xD8-#xF6] | [#xF8-#x2FF] | [#x370-#x37D] |
                        [#x37F-#x1FFF] | [#x200C-#x200D] | [#x2070-#x218F] | [#x2C00-#x2FEF] | [#x3001-#xD7FF] |
                        [#xF900-#xFDCF] | [#xFDF0-#xFFFD] | [#x10000-#xEFFFF]
[4a]  NameChar ::= NameStartChar | "-" | "." | [0-9] | #xB7 | [#x0300-#x036F] | [#x203F-#x2040]
[5]   Name ::= NameStartChar (NameChar)*
```

so the safest way to validate an entity name is to build a regex to represent this expression and check whether the name given matches the regex.  (Something along the lines of `/^[name start char class][name char class]*$/`.)  There's probably a nice way to simplify the explicit list rather than typing it out verbatim using Unicode character properties, but I don't know enough to do so.
Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows (GHSA-564w-97r7-c6p9)
Aliases: CVE-2023-35174
Published: 2023-06-21T22:07:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Hex', 'name': 'livebook'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.0'}, {'fixed': '0.8.2'}]}]}, {'package': {'ecosystem': 'Hex', 'name': 'livebook'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.9.0'}, {'fixed': '0.9.3'}]}]}]

On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine.

Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser.
github.com/cosmos/cosmos-sdk's x/crisis does not charge ConstantFee (GHSA-w5w5-2882-47pc)
Published: 2023-06-30T22:13:02Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cosmos/cosmos-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.50.0-alpha.1'}]}]}]

# x/crisis does not charge ConstantFee
### Impact
If a transaction is sent to the `x/crisis` module to check an invariant, the ConstantFee parameter of the chain is NOT charged. All versions of the `x/crisis` module are affected on all versions of the Cosmos SDK.

### Details
The `x/crisis` module is supposed to allow anyone to halt a chain in the event of a violated invariant by sending a `MsgVerifyInvariant` with the name of the invariant. Processing this message takes extra processing power hence a `ConstantFee` was introduced on the chain that is charged as extra from the reporter for the extra computational work. This is supposed to avert spammers on the chain making nodes do extra computations using this transaction. By not charging the `ConstantFee`, the transactions related to invariant checking are relatively cheaper compared to the computational need and other transactions.

That said, the submitter still has to pay the transaction fee to put the transaction on the network, hence using this weakness for spamming is limited by the usual mechanisms.

Synthetic testing showed up to a 20% increase in CPU usage on a validator node that is spammed by hundreds of `MsgVerifyInvariant` messages which still makes this an expensive operation to carry out on a live blockchain network.

### Patches
The `ConstantFee` charge of the `x/crisis` module will either be fixed or disabled in an upcoming regular release of the Cosmos SDK.

The `x/crisis` module was originally intended to allow chains to halt rather than continue with some unknown behavior in the case of an invariant violation (safety over liveness). However, as chains mature, and especially as the potential [cost of halting increases](https://github.com/osmosis-labs/osmosis/issues/570), chains should consider carefully what invariants they really want to halt for, and what invariants are just sort of helpful sanity checks.

The SDK team is working on new modules that allow chain developers to fine-tune the chain invariants and the necessary actions.

Hence, the decision was made that the `x/crisis` module will be deprecated when new modules take over its responsibilities.

### Workarounds
There is no workaround posted. Validators are advised to leave some extra computing room on their servers for possible spamming scenarios. (This is a good measure in any case.)

### References
SDK developer epic about invariant checking: https://github.com/cosmos/cosmos-sdk/issues/15706
Cosmos "Barberry" vulnerability in github.com/cosmos/cosmos-sdk (GHSA-w44m-8mv2-v78h)
Published: 2023-06-22T20:01:48Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cosmos/cosmos-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.46.0'}, {'fixed': '0.46.13'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cosmos/cosmos-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.47.0'}, {'fixed': '0.47.3'}]}]}]

The cosmos-sdk module is affected by the vulnerability codenamed "Barberry".
passport-wsfed-saml2 vulnerable to Signature Bypass in SAML2 token (GHSA-77fw-rf4v-vfp9)
Aliases: CVE-2017-16897
Published: 2023-06-21T22:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'passport-wsfed-saml2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.5'}]}]}]

## Information
Please note that this is not a new disclosure, and is previously reported in our [SECURITY-NOTICE.md](https://github.com/auth0/passport-wsfed-saml2/commit/520b9fc0bb4249ce83bec47e30153419f086ab70
) which we removed in favor of github advisory. 

# Overview 
 This vulnerability allows an attacker to impersonate another user and potentially elevate their privileges if the SAML identity provider:

- signs SAML response and signs assertion

- does not sign SAML response and signs assertion

# Am I affected?

You may be affected if you use SAML2 protocol with passport-wsfed-saml2 versions below 3.0.5 and your SAML identity Provider: 
1. signs SAML response and signs assertion; or 
2. does not sign SAML response and signs assertion

# How do I fix it?

You may fix this vulnerability by upgrading your library to version 3.0.5 or above. 

# Will the fix impact my users?
This fix patches the library that your application runs, but will not impact your users, their current state, or any existing sessions.
HashiCorp Consul Incorrect Access Control vulnerability (GHSA-h65h-v7fw-4p38)
Aliases: CVE-2019-12291
Published: 2023-06-09T23:23:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/consul'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.5.1'}]}]}]

HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by a token using that policy even with default deny settings configured.

### Specific Go Packages Affected
github.com/hashicorp/consul/acl
fuadmin vulnerable to insecure file upload (GHSA-5m3m-q8cq-77g4)
Aliases: CVE-2023-36097
Published: 2023-06-22T15:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'funadmin/funadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.3.2'}, {'last_affected': '3.3.3'}]}]}]

funadmin v3.3.2 and v3.3.3 are vulnerable to insecure file upload via the plugins install.