aswin1906/github-advisory-2023 huggingface dataset:
Pomerium vulnerable to Incorrect Authorization with specially crafted requests (GHSA-pvrc-wvj2-f59p)
Aliases: CVE-2023-33189
Published: 2023-05-26T22:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/pomerium/pomerium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.22.0'}, {'fixed': '0.22.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pomerium/pomerium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.21.0'}, {'fixed': '0.21.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pomerium/pomerium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.20.0'}, {'fixed': '0.20.1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pomerium/pomerium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.19.0'}, {'fixed': '0.19.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pomerium/pomerium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.18.0'}, {'fixed': '0.18.1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pomerium/pomerium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.17.4'}]}]}]

### Impact

With specially crafted requests, incorrect authorization decisions may be made by Pomerium.

### Patches

We are releasing patch fixes to address this vulnerability going back to `v0.17.X`. Please upgrade to:

- v0.22.2
- v0.21.4
- v0.20.1
- v0.19.2
- v0.18.1
- v0.17.4


### For more information

If you have any questions or comments about this advisory:

- Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
- Email us at [security@pomerium.com](mailto:security@pomerium.com)
Open redirect in Tornado (GHSA-hj3f-6gcp-jg8j)
Aliases: CVE-2023-28370
Published: 2023-05-25T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tornado'}, 'ecosystem_specific': {'affected_functions': ['tornado.web.StaticFileHandler.validate_absolute_path']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.3.2'}]}]}]

Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.
Planet's secret file is created with excessive permissions (GHSA-j5fj-rfh6-qj85)
Aliases: CVE-2023-32303
Published: 2023-05-12T20:55:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'planet'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.1'}]}]}]

### Impact
The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but its permissions allowed the user's group and non-group to read the file as well. 

### Validation
Check the permissions on the secret file with `ls -l ~/.planet.json` and ensure that they read as `-rw-------`

### Patches
[d71415a8](https://github.com/planetlabs/planet-client-python/commit/d71415a83119c5e89d7b80d5f940d162376ee3b7)

### Workarounds
Set the secret file permissions to only user read/write by hand:
```
chmod 600 ~/.planet.json
```
editor.md vulnerable to Cross-site Scripting (GHSA-847g-34c5-vvm8)
Aliases: CVE-2023-29641
Published: 2023-05-01T18:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'editor.md'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.0'}]}]}]

Cross Site Scripting (XSS) vulnerability in pandao editor.md thru 1.5.0 allows attackers to inject arbitrary web script or HTML via crafted markdown text.
Apache Spark UI vulnerable to Command Injection (GHSA-59hw-j9g6-mfg3)
Aliases: CVE-2023-32007
Published: 2023-05-02T09:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.spark:spark-parent_2.12'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.1'}, {'fixed': '3.2.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'pyspark'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.1'}, {'fixed': '3.2.2'}]}]}]

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Users are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.
swift-nio-http2 vulnerable to denial of service via invalid HTTP/2 HEADERS frame length (GHSA-ccw9-q5h2-8c2w)
Aliases: CVE-2022-24666
Published: 2023-05-18T17:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio-http2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.19.2'}]}]}]

A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This attack affects all swift-nio-http2 versions from 1.0.0 to 1.19.1. It is fixed in 1.19.2 and later releases.

This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS frame where the frame contains priority information without any other data. This logical error caused confusion about the size of the frame, leading to a parsing error. This parsing error immediately crashes the entire process.

Sending a HEADERS frame with HTTP/2 priority information does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack.

The attack is low-effort: it takes very little resources to send an appropriately crafted frame. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted frames, so attackers require very few resources to achieve a substantial denial of service.

The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the frame in memory-safe code, so the crash is safe. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks.

The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services.

The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.
imgproxy is vulnerable to Server-Side Request Forgery (GHSA-9x7h-ggc3-xg47)
Aliases: CVE-2023-30019
Published: 2023-05-08T15:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/imgproxy/imgproxy/v3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.15.0'}]}]}]

imgproxy prior to version 3.15.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.
Improper random reading in CIRCL (GHSA-2q89-485c-9j2x)
Aliases: CVE-2023-1732
Published: 2023-05-11T20:40:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cloudflare/circl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.3'}]}]}]

### Impact
When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether `crypto/rand.Read()` returns an error. In rare deployment cases (error thrown by the `Read()` function), this could lead to a predictable shared secret.

The tkn20 and blindrsa components did not check whether enough randomness was returned from the user provided randomness source. Typically the user provides `crypto/rand.Reader`, which in the vast majority of cases will always return the right number random bytes. In the cases where it does not, or the user provides a source that does not, the blinding for blindrsa is weak and integrity of the plaintext is not ensured in tkn20.


### Patches
The fix was introduced in CIRCL v. 1.3.3
Jenkins SAML Single Sign On(SSO) Plugin missing permission checks (GHSA-w88f-j9rc-h7v3)
Aliases: CVE-2023-32996
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:miniorange-saml-sp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.1'}]}]}]

Jenkins SAML Single Sign On(SSO) Plugin 2.0.0 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to send an HTTP POST request with JSON body containing attacker-specified content, to miniOrange’s API for sending emails.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

SAML Single Sign On(SSO) Plugin 2.0.1 removes the affected HTTP endpoint.
Improper input validation in github.com/gin-gonic/gin (GHSA-3vp4-m3rf-835h)
Aliases: CVE-2023-26125
Published: 2023-05-04T06:30:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gin-gonic/gin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.0'}]}]}]

Versions of the package github.com/gin-gonic/gin before version 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning.

**Note:** Although this issue does not pose a significant threat on its own it can serve as an input vector for other more impactful vulnerabilities. However, successful exploitation may depend on the server configuration and whether the header is used in the application logic.
Django bypasses validation when using one form field to upload multiple files (GHSA-r3xc-prgr-mg9p)
Aliases: CVE-2023-31047
Published: 2023-05-07T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ecosystem_specific': {'affected_functions': ['django.forms.widgets.FileInput']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.0'}, {'fixed': '3.2.19'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ecosystem_specific': {'affected_functions': ['django.forms.widgets.FileInput']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.1.9'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'Django'}, 'ecosystem_specific': {'affected_functions': ['django.forms.widgets.FileInput']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.1'}]}]}]

In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to upload multiple files. This multiple upload has never been supported by forms.FileField or forms.ImageField (only the last uploaded file was validated). However, Django's "Uploading multiple files" documentation suggested otherwise.
Duplicate Advisory: Cross-site Scripting (XSS) in name field of Custom Reports (GHSA-6gp6-xj27-g89q)
Published: 2023-05-10T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m6m9-gr85-79vm. This link is maintained to preserve external references.

## Original Description
Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.
Cross-site Scripting (XSS) in pimcore (GHSA-9xg6-75mh-7x3f)
Aliases: CVE-2023-2361
Published: 2023-05-01T13:43:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
An attacker can use XSS to send a malicious script to any user.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/6970649f5d3790a1db9ef4324bece0d4cb95366a.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/6970649f5d3790a1db9ef4324bece0d4cb95366a.patch manually.

### References
https://huntr.dev/bounties/24d91b83-c3df-48f5-a713-9def733f2de7/
thorsten/phpmyfaq vulnerable to cross-site scripting (GHSA-974q-4vvr-vg9c)
Aliases: CVE-2023-2998
Published: 2023-05-31T03:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.14'}]}]}]

In thorsten/phpmyfaq prior to 3.1.14, when admins create a FAQ News, they can pass xss to the "text of the record" section.
Buffer under-read in workerd (GHSA-8vx6-69vg-c46f)
Aliases: CVE-2023-2512
Published: 2023-05-12T20:16:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'workerd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.20230419.0'}]}]}]

### Impact
Prior to version v1.20230419.0, the FormData API implementation was subject to an integer overflow. If a FormData instance contained more than 2^31 elements, the `forEach()` method could end up reading from the wrong location in memory while iterating over elements. This would most likely lead to a segmentation fault, but could theoretically allow arbitrary undefined behavior.

In order for the bug to be exploitable, the process would need to be able to allocate 160GB of RAM. Due to this, the bug was never exploitable on the Cloudflare Workers platform, but could theoretically be exploitable on deployments of workerd running on machines with a huge amount of memory. Moreover, in order to be remotely exploited, an attacker would have to upload a single form-encoded HTTP request of at least tens of gigabytes in size. The application code would then have to use `request.formData()` to parse the request and `formData.forEach()` to iterate over this data. Due to these limitations, the exploitation likelihood was considered Low.

### Patches
A fix that addresses this vulnerability has been released in version v1.20230419.0 and users are encouraged to update to the latest version available.

### References
Release - https://github.com/cloudflare/workerd/releases/tag/v1.20230419.0
Mage-ai missing user authentication (GHSA-c6mm-2g84-v4m7)
Aliases: CVE-2023-31143
Published: 2023-05-05T23:10:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mage-ai'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.34'}, {'fixed': '0.8.72'}]}]}]

### Impact

You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions.

### Patches

The vulnerability has been resolved in Mage version 0.8.72.
Improper Neutralization of Invalid Characters in Data Attribute Names in org.xwiki.commons:xwiki-commons-xml (GHSA-pv7v-ph6g-3gxv)
Aliases: CVE-2023-31126
Published: 2023-05-09T19:59:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.commons:xwiki-commons-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.6-rc-1'}, {'fixed': '14.10.4'}]}]}]

### Impact
The HTML sanitizer, introduced in version 14.6-rc-1, allowed the injection of arbitrary HTML code and thus cross-site scripting via invalid data attributes. This can be exploited, e.g., via the link syntax in any content that supports XWiki syntax like comments in XWiki: 

```
[[Link1>>https://XWiki.example.com||data-x/onmouseover="alert('XSS1')"]].
```

When a user moves the mouse over this link, the malicious JavaScript code is executed in the context of the user session. When this user is a privileged user who has programming rights, this allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance.

Note that this vulnerability does not affect restricted cleaning in HTMLCleaner as there attributes are cleaned and thus characters like `/` and `>` are removed in all attribute names.

### Patches
This problem has been patched in XWiki 14.10.4 and 15.0 RC1 by making sure that data attributes only contain allowed characters.

### Workarounds
There are no known workarounds apart from upgrading to a version including the fix.

### References
* https://jira.xwiki.org/browse/XCOMMONS-2606
* https://github.com/xwiki/xwiki-commons/commit/0b8e9c45b7e7457043938f35265b2aa5adc76a68

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org/)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)
@mittwald/kubernetes's secret contents leaked via debug logging (GHSA-g35x-j6jj-8g7j)
Published: 2023-05-02T16:51:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@mittwald/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.0'}]}]}]

### Impact

When debug logging is enabled (via `DEBUG` environment variable), the Kubernetes client may log all response bodies into the debug log -- including sensitive data from `Secret` resources.

When running in a Kubernetes cluster, this might expose sensitive information to users who are _not_ authorised to access secrets, but have access to Pod logs (either directly using kubectl, or by Pod logs being shipped elsewhere).

### Patches
Upgrade to 3.5.0 or newer.

### Workarounds
Disable debug logging entirely, or exclude the `kubernetes:client` debug item (for example, using `DEBUG=*,-kubernetes:client`).

### References

- https://cwe.mitre.org/data/definitions/532.html
Code injection in nilsteampassnet/teampass (GHSA-h6jh-cf83-qcq5)
Aliases: CVE-2023-2859
Published: 2023-05-24T09:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}]

nilsteampassnet/teampass prior to 3.0.9 is vulnerable to code injection. A malicious user could potentially rename a folder with a payload containing malicious code. This could result in an attack on an admin who edits the folder, as the payload could execute upon the admin's interaction with the folder. This attack could potentially allow the attacker to gain unauthorized access to the admin's system or steal sensitive information, or it could force admin to get redirected to a website controlled by the attacker.
alkacon-OpenCMS vulnerable to stored Cross-site Scripting (GHSA-m44f-9jhg-59cr)
Aliases: CVE-2023-31544
Published: 2023-05-16T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opencms:opencms-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '11.0.1'}]}]}]

A stored cross-site scripting (XSS) vulnerability in alkacon-OpenCMS v11.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module.
git-url-parse Regular Expression Denial of Service (GHSA-4xqq-73wg-5mjp)
Aliases: CVE-2023-32758
Published: 2023-05-15T06:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'git-url-parse'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.2'}]}]}]

giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial of Service) if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package (for example, to check whether it accesses any Git repository at an http:// URL), and that package's author placed a ReDoS attack payload in a URL used by the package.
Cross Site Scripting in nilsteampassnet/teampass (GHSA-2ffp-w665-9mgx)
Aliases: CVE-2023-2516
Published: 2023-05-05T21:31:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.7'}]}]}]

nilsteampassnet/teampass prior to version 3.0.7 is vulnerable to cross site scripting (XSS) from item names within a folder.
Pimcore Cross-site Scripting (XSS) in Predefined Properties delete (GHSA-q7cc-m6jw-m262)
Aliases: CVE-2023-2615
Published: 2023-05-10T21:26:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.


### Patches
Update to version 10.5.21 or apply this patches manually
https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f.patch

### Workarounds
Apply patches manually:
https://github.com/pimcore/pimcore/commit/7a799399e6843cd049e85da27ceb75b78505317f.patch

### References
https://huntr.dev/bounties/af9c360a-87f8-4e97-a24b-6db675ee942a/
Incorrect signature verification in django-ses (GHSA-qg36-9jxh-fj25)
Aliases: CVE-2023-33185
Published: 2023-05-22T19:41:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'django-ses'}, 'ecosystem_specific': {'affected_functions': ['django_ses.utils.EventMessageVerifier._get_cert_url']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.0'}]}]}]

The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests are signed by AWS and are verified by django_ses, however the verification of this signature was found to be flawed as it allowed users to specify arbitrary public certificates.
Jenkins Azure VM Agents Plugin Cross-site Request Forgery vulnerability (GHSA-26j3-4m55-j6r7)
Aliases: CVE-2023-32989
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:azure-vm-agents'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '853.v4a'}]}]}]

Jenkins Azure VM Agents Plugin 852.v8d35f0960a_43 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified Azure Cloud server using attacker-specified credentials IDs obtained through another method.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Azure VM Agents Plugin 853.v4a_1a_dd947520 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
RosarioSIS vulnerable to CSV Injection (GHSA-f8hp-grmr-pp7j)
Aliases: CVE-2023-29918
Published: 2023-05-02T18:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'francoisjacquet/rosariosis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '10.8.4'}]}]}]

RosarioSIS 10.8.4 is vulnerable to CSV injection via the Periods Module.
MindSpore vulnerable to memory corruption (GHSA-x67g-47p3-rc7f)
Aliases: CVE-2023-2970
Published: 2023-05-30T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mindspore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.0-rc1'}]}]}]

A vulnerability classified as problematic was found in MindSpore 2.0.0-alpha/2.0.0-rc1. This vulnerability affects the function `JsonHelper::UpdateArray` of the file `mindspore/ccsrc/minddata/dataset/util/json_helper.cc`. The manipulation leads to memory corruption. The name of the patch is 30f4729ea2c01e1ed437ba92a81e2fc098d608a9. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-230176.
Go package pydio/cells vulnerable to authorization bypass (GHSA-mv7x-27pc-8c96)
Aliases: CVE-2023-2978
Published: 2023-05-30T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/pydio/cells'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.1'}]}]}]

A vulnerability was found in Abstrium Pydio Cells 4.2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Change Subscription Handler. The manipulation leads to authorization bypass. Upgrading to version 4.2.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-230210 is the identifier assigned to this vulnerability.
Cross-site scripting in TotalJS (GHSA-jj45-24rw-v6jw)
Aliases: CVE-2023-30094
Published: 2023-05-04T21:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'total4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.81'}]}]}]

A stored cross-site scripting (XSS) vulnerability in TotalJS allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module.
glazedlists XML Deserialization vulnerability (GHSA-p6m6-9j36-vfjx)
Aliases: CVE-2023-31890
Published: 2023-05-16T18:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.glazedlists:glazedlists'}, 'versions': ['1.11.0']}]

An XML Deserialization vulnerability in glazedlists v1.11.0 allows an attacker to execute arbitrary code via the BeanXMLByteCoder.decode() parameter.
Craft CMS XSS in RSS widget feed (GHSA-qpgm-gjgf-8c2x)
Aliases: CVE-2023-33195
Published: 2023-05-26T13:55:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.4.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.4.5'}}]

### Summary
A malformed RSS feed can deliver an XSS payload

### PoC
Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss
The XSS payload will be triggered by the title in tag `<item>`

Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f
Jenkins Sidebar Link Plugin vulnerable to Path Traversal (GHSA-pp8m-prr7-wr8w)
Aliases: CVE-2023-32985
Published: 2023-05-16T18:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:sidebar-link'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.2'}]}]}]

Jenkins Sidebar Link Plugin allows specifying files in the `userContent/` directory for use as link icons.

Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.

Sidebar Link Plugin 2.2.2 ensures that only files located within the expected `userContent/` directory can be accessed.
Duplicate Advisory: PrestaShop Cross-site Scripting vulnerability (GHSA-6mhc-hqr3-w466)
Aliases: CVE-2023-31508
Published: 2023-05-12T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.7.7.4'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-95hx-62rh-gg96. This link is maintained to preserve external references.

## Original Description
A cross-site scripting (XSS) vulnerability in PrestaShop v1.7.7.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the message parameter in /contactform/contactform.php.
Kyverno vulnerable due to usage of insecure cipher (GHSA-hgv6-w7r3-w4qw)
Published: 2023-05-30T20:07:06Z
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kyverno/kyverno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.5'}]}]}]

### Summary
Insecure 3DES ciphers are used which may lead to exploitation of the [Sweet32 vulnerability](https://sweet32.info/). Specifically, the ciphers TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp256r1) and TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) are allowed. See CVE-2016-2183. This is fixed in Kyverno v1.9.5 and v1.10.0 and no known users have been affected.

### Details

The ciphers in affected versions can be read using the following command which uses `nmap`:

```sh
$ kubectl exec -it mypod -n kyverno sh 
kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead.
**nmap -sV --script ssl-enum-ciphers -p 443 kyverno-cleanup-controller** or  
**nmap -sV --script ssl-enum-ciphers -p 443 kyverno-svc**
Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-26 10:55 UTC
Nmap scan report for kyverno-cleanup-controller (10.103.199.233)
Host is up (0.000058s latency).
rDNS record for 10.103.199.233: kyverno-cleanup-controller.kyverno.svc.cluster.local

PORT    STATE SERVICE  VERSION
443/tcp open  ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
| ssl-enum-ciphers: 
|   TLSv1.2: 
|     ciphers: 
**|       TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp256r1) - C**
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
**|       TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) - C**
|       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_CBC_SHA (rsa 2048) - A
|       TLS_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|     compressors: 
|       NULL
|     cipher preference: client
|     warnings: 
|       64-bit block cipher 3DES vulnerable to SWEET32 attack
|   TLSv1.3: 
|     ciphers: 
|       TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
|       TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
|       TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
|     cipher preference: server
|_  least strength: C

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.72 seconds
```
Unwanted access to the entire file system vulnerability due to a missing check in `staticFiles` HTTP handler (GHSA-j2wh-wrv3-4x4g)
Published: 2023-02-16T18:41:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': '@graphql-mesh/cli'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.78.0'}, {'fixed': '0.82.22'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@graphql-mesh/http'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.19'}]}]}]

### Summary
Missing check vulnerability in the static file handler allows any client to access the files in the server's file system

### Details
When `staticFiles` is set in the `serve` settings in the configuration file, the following handler doesn't check if `absolutePath` is still under the directory provided as `staticFiles`;

```ts
  if (staticFiles) {
    router.get('/:relativePath+', async request => {
      let { relativePath } = request.params;
      if (!relativePath) {
        relativePath = 'index.html';
      }
      const absolutePath = path.join(baseDir, staticFiles, relativePath);
      if (absolutePath.includes(staticFiles) && (await pathExists(absolutePath))) {
        const readStream = fs.createReadStream(absolutePath);
        return new Response(readStream as any, {
          status: 200,
        });
      }
      return undefined;
    });
 ```

### Example scenario
To reproduce it, set `staticFiles` to the relative path of a directory in `.meshrc.yml`;

```yml
serve:
   staticFiles: ./public
```

Then start the server with `mesh dev`, and browse to `/..%2fpackage.json` then you will see the content of `package.json`. You can even go deeper to see sensitive data; `/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd`

### Impact and solution
If `staticFiles` is set under `serve` in the configuration file. you have two options to fix vulnerability;

- Update `@graphql-mesh/cli` to a version higher than `0.82.21`, and if you use `@graphql-mesh/http`, update it to a version higher than `0.3.18`
- Remove `staticFiles` option from the configuration, and use other solutions to serve static files.

### Credits
Thanks [alanwillms@gmail.com](mailto:alanwillms@gmail.com) for reporting this vulnerability with details
Moodle Improper Access Control vulnerability (GHSA-32jc-9p58-p82x)
Aliases: CVE-2023-23923
Published: 2023-02-17T21:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.19'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0'}, {'fixed': '3.11.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-beta'}, {'fixed': '4.0.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0-beta'}, {'fixed': '4.1.1'}]}]}]

The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
Dompdf vulnerable to URI validation failure on SVG parsing (GHSA-3cw5-7cxw-v5qg)
Aliases: CVE-2023-23924
Published: 2023-02-01T01:37:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'dompdf/dompdf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.2'}]}]}]

### Summary
The URI validation on dompdf 2.0.1 can be bypassed on SVG parsing by passing `<image>` tags with uppercase letters. This might leads to arbitrary object unserialize on PHP < 8, through the `phar` URL wrapper.

### Details
The bug occurs during SVG parsing of `<image>` tags, in src/Image/Cache.php : 

```
if ($type === "svg") {
    $parser = xml_parser_create("utf-8");
    xml_parser_set_option($parser, XML_OPTION_CASE_FOLDING, false);
    xml_set_element_handler(
        $parser,
        function ($parser, $name, $attributes) use ($options, $parsed_url, $full_url) {
            if ($name === "image") {
                $attributes = array_change_key_case($attributes, CASE_LOWER);
```
This part will try to detect `<image>` tags in SVG, and will take the href to validate it against the protocolAllowed whitelist. However, the `$name comparison with "image" is case sensitive, which means that such a tag in the SVG will pass : 

```
<svg>
    <Image xlink:href="phar:///foo"></Image>
</svg>
```

As the tag is named "Image" and not "image", it will not pass the condition to trigger the check.

A correct solution would be to strtolower the `$name` before the check : 

```
if (strtolower($name) === "image") {
```

### PoC
Parsing the following SVG file is sufficient to reproduce the vulnerability :

```
<svg>
    <Image xlink:href="phar:///foo"></Image>
</svg>
```

### Impact
An attacker might be able to exploit the vulnerability to call arbitrary URL with arbitrary protocols, if they can provide a SVG file to dompdf. In PHP versions before 8.0.0, it leads to arbitrary unserialize, that will leads at the very least to an arbitrary file deletion, and might leads to remote code execution, depending on classes that are available.
privilege chaining in cockpit-hq/cockpit (GHSA-86rf-38v8-9c4x)
Aliases: CVE-2023-0759
Published: 2023-02-09T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.8'}]}]}]

Privilege Chaining in GitHub repository cockpit-hq/cockpit prior to 2.3.8.
Cross-site Scripting in jspreadsheet (GHSA-q82h-q47j-f492)
Aliases: CVE-2022-48115
Published: 2023-02-18T00:31:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'jspreadsheet-ce'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.6.0'}]}]}]

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).
Microweber contains Cross-site Scripting (GHSA-pj97-r83v-vj7f)
Aliases: CVE-2023-0608
Published: 2023-02-01T06:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.2'}]}]}]

Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2.
Answer contains Cross-site Scripting vulnerability (GHSA-rmw8-7823-wp7f)
Aliases: CVE-2023-0742
Published: 2023-02-08T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.4'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4.
Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug (GHSA-76r7-h46w-463r)
Published: 2023-02-15T18:17:22Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.17'}]}]}]

### Impact
An attacker can use XSS to send a malicious script to an unsuspecting user.

### Patches
Update to version 10.5.17 or apply this patch manually https://github.com/pimcore/pimcore/pull/14301.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14301.patch manually.

### References
https://huntr.dev/bounties/75bc7d07-46a7-4ed9-a405-af4fc47fb422/
Duplicate advisory: Sequelize - Unsafe fall-through in getWhereConditions (GHSA-r3vq-92c6-3mqf)
Published: 2023-02-16T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@sequelize/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.0.0-alpha.20'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-vqfx-gj96-3w95](https://github.com/advisories/GHSA-vqfx-gj96-3w95). This link is maintained to preserve external references.

## Original Description
Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.
Apache InLong contains Out-of-bounds Read vulnerability (GHSA-q9p5-w2v9-6wxf)
Aliases: CVE-2023-24977
Published: 2023-02-01T12:32:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:inlong'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'last_affected': '1.5.0'}]}]}]

Out-of-bounds Read vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7214 to solve it.
Cross-site Scripting in MobileDetect (GHSA-r77c-qv68-j3pp)
Aliases: CVE-2018-25080
Published: 2023-02-04T09:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'mobiledetect/mobiledetectlib'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.32'}]}]}]

A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.8.32 is able to address this issue. The name of the patch is 31818a441b095bdc4838602dbb17b8377d1e5cce. It is recommended to upgrade the affected component. The identifier VDB-220061 was assigned to this vulnerability.
Duplicate advisory: Deno vulnerable to Regular Expression Denial of Service (GHSA-xr9w-x6gw-c9mj)
Published: 2023-02-25T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'deno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.31.0'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-jc97-h3h9-7xh6](https://github.com/advisories/GHSA-jc97-h3h9-7xh6). This link is maintained to preserve external references.

## Original Description
Versions of the package deno before 1.31.0 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the upgradeWebSocket function, which contains regexes in the form of /s*,s*/, used for splitting the Connection/Upgrade header. A specially crafted Connection/Upgrade header can be used to significantly slow down a web socket server. This issue has been patched in version 1.31.0.
Denial of service via HAMT Decoding Panics (GHSA-q264-w97q-q778)
Aliases: CVE-2023-23625
Published: 2023-02-10T23:08:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/ipfs/go-unixfs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.3'}]}]}]

### Impact
Trying to read malformed HAMT sharded directories can cause panics and virtual memory leaks.
If you are reading untrusted user input, an attacker can then trigger a panic.

This is caused by bogus `fanout` parameter in the HAMT directory nodes.
This include checks returned in [ipfs/go-bitfield GHSA-2h6c-j3gf-xp9r](https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r), as well as limiting the `fanout` to `<= 1024` (to avoid attempts of arbitrary sized allocations).

### Patches
- https://github.com/ipfs/go-unixfs/commit/dbcc43ec3e2db0d01e8d80c55040bba3cf22cb4b

### Workarounds
Do not feed untrusted user data to the decoding functions.

### References
- https://github.com/ipfs/go-bitfield/security/advisories/GHSA-2h6c-j3gf-xp9r
textAngular Cross-site Scripting vulnerability (GHSA-7h4w-6p98-r3wx)
Aliases: CVE-2021-32854
Published: 2023-02-21T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'textangular'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.16'}]}]}]

textAngular is a text editor for Angular.js. Version 1.5.16 and prior are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. There are no known patches.
Insecure Temporary File in RESTEasy (GHSA-jrmh-v64j-mjm9)
Aliases: CVE-2023-0482
Published: 2023-02-18T00:31:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jboss.resteasy:resteasy-undertow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '6.2.2.Final'}]}]}]

In RESTEasy the insecure File.createTempFile() is used in the DataSourceProvider, FileProvider and Mime4JWorkaround classes which creates temp files with insecure permissions that could be read by a local user.
StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route (GHSA-53jx-vvf9-4x38)
Aliases: CVE-2023-24815
Published: 2023-02-10T03:27:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.vertx:vertx-web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.3.8'}]}]}]

### Summary

When running vertx web applications that serve files using `StaticHandler` on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (`*`) then an attacker can exfiltrate any class path resource.


### Details
When computing the relative path to locate the resource, in case of wildcards, the code:

https://github.com/vert-x3/vertx-web/blob/62c0d66fa1c179ae6a4d57344631679a2b97e60f/vertx-web/src/main/java/io/vertx/ext/web/impl/Utils.java#L83

returns the user input (without validation) as the segment to lookup. Even though checks are performed to avoid escaping the sandbox, given that the input was not sanitized `\` are not properly handled and an attacker can build a path that is valid within the classpath.

### PoC

https://github.com/adrien-aubert-drovio/vertx-statichandler-windows-traversal-path-vulnerability