aswin1906/github-advisory-2023 huggingface dataset:
xml2js is vulnerable to prototype pollution (GHSA-776f-qx25-q3cc)
Aliases: CVE-2023-0842
Published: 2023-04-05T21:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'xml2js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0'}]}]}]

xml2js versions before 0.5.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the `__proto__` property to be edited.
Jenkins Convert To Pipeline Plugin vulnerable to cross-site request forgery (GHSA-48g9-h7g5-8pw2)
Aliases: CVE-2023-28676
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:convert-to-pipeline'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0'}]}]}]

Convert To Pipeline Plugin 1.0 and earlier does not require POST requests for the HTTP endpoint converting a Freestyle project to Pipeline, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to create a Pipeline based on a Freestyle project. Combined with [SECURITY-2966](https://www.jenkins.io/security/advisory/2023-03-21/#SECURITY-2966)/CVE-2023-28677, this can result in the execution of unsandboxed Pipeline scripts.
Starlette allows an unauthenticated and remote attacker to specify any number of form fields or files (GHSA-3qj8-93xh-pwh2)
Aliases: CVE-2023-30798
Published: 2023-04-21T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'starlette'}, 'ecosystem_specific': {'affected_functions': ['starlette.requests.Request.form']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.25.0'}]}]}]

There MultipartParser usage in Encode's Starlette python framework before versions 0.25.0 allows an unauthenticated and remote attacker to specify any number of form fields or files which can cause excessive memory usage resulting in denial of service of the HTTP service.
Open redirect vulnerability on CMSSecurity relogin screen  (GHSA-fw84-xgm8-9jmv)
Aliases: CVE-2023-22729
Published: 2023-04-26T19:46:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/framework'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.12.5'}]}]}]

An attacker can display a link to a third party website on a login screen by convincing a legitimate content author to follow a specially crafted link.

Upgrade to `silverstripe/framework` 4.12.5 or above to remedy the vulnerability.

Reporter: Matthew Dekker
CSRF token fixation in fastify-passport (GHSA-2ccf-ffrj-m4qw)
Aliases: CVE-2023-29020
Published: 2023-04-21T22:32:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@fastify/passport'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@fastify/passport'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.3.0'}]}]}]

The [CSRF](https://owasp.org/www-community/attacks/csrf) protection enforced by the `@fastify/csrf-protection` library, when combined with `@fastify/passport`, can be bypassed by network and same-site attackers.

## Details
`fastify/csrf-protection` implements the [synchronizer token pattern](https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#synchronizer-token-pattern) (using plugins `@fastify/session` and `@fastify/secure-session`) by storing a random value used for CSRF token generation in the `_csrf` attribute of a user's session.

The `@fastify/passport` library does not clear the session object upon authentication, preserving the `_csrf` attribute between pre-login and authenticated sessions. Consequently, CSRF tokens generated before authentication are still valid. Network and [same-site attackers](https://canitakeyoursubdomain.name/) can thus obtain a CSRF token for their pre-session, fixate that pre-session in the victim's browser via cookie tossing, and then perform a CSRF attack after the victim authenticates.

## Fix
As a solution, newer versions of `@fastify/passport` include the configuration options

* `clearSessionOnLogin (default: true)` and
* `clearSessionIgnoreFields (default: ['session'])`

to clear all the session attributes by default, preserving those explicitly defined in `clearSessionIgnoreFields`.

## Credits
* Pedro Adão (@pedromigueladao), [Instituto Superior Técnico, University of Lisbon](https://tecnico.ulisboa.pt/)
* Marco Squarcina (@lavish), [Security & Privacy Research Unit, TU Wien](https://secpriv.wien/)
vitess allows users to create keyspaces that can deny access to already existing keyspaces (GHSA-735r-hv67-g38f)
Aliases: CVE-2023-29194
Published: 2023-04-11T21:12:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'vitess.io/vitess'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.16.1'}]}]}]

### Impact
Users can either intentionally or inadvertently create a keyspace containing `/` characters such that from that point on, anyone who tries to view keyspaces from VTAdmin will receive an error. Trying to list all the keyspaces using `vtctldclient GetKeyspaces` will also return an error.
Note that all other keyspaces can still be administered using the CLI (vtctldclient).

### Patches
v16.0.1 (corresponding to 0.16.1 on pkg.go.dev)

### Workarounds
Delete the offending keyspace using a CLI client (vtctldclient) 
```
vtctldclient --server ... DeleteKeyspace a/b
```

Found during a security audit sponsored by the [CNCF](https://cncf.io) and facilitated by [OSTIF](https://ostif.org).
Apache Sling Engine vulnerable to cross-site scripting (XSS) that can lead to privilege escalation (GHSA-mg46-f9h5-g27x)
Aliases: CVE-2022-45064
Published: 2023-04-13T12:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.sling:org.apache.sling.engine'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.14.0'}]}]}]

The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on the Apache Sling level. The vulnerability is exploitable by an attacker that is able to include a resource with specific content-type and control the include path (i.e. writing content). The impact of a successful attack is privilege escalation to administrative power.

Please update to Apache Sling Engine version 2.14.0 or newer and enable the "Check Content-Type overrides" configuration option.
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via adminlog (GHSA-gcmq-7652-x98j)
Aliases: CVE-2023-1878
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the adminlog. This has been fixed in 3.1.12.
PowerJob Incorrect Access Control vulnerability (GHSA-mpvf-6h9g-2hq2)
Aliases: CVE-2023-29921
Published: 2023-04-19T12:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'tech.powerjob:powerjob'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.3.1'}]}]}]

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.
Pandao Editor.md vulnerable to cross-site scripting (XSS) in editor parameter (GHSA-5p84-mmh9-pxgr)
Aliases: CVE-2020-19698
Published: 2023-04-04T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'editor.md'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.0'}]}]}]

Cross-site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the `editor` parameter.
Apache Linkis DatasourceManager module has deserialization vulnerability (GHSA-rrhf-32rq-f28h)
Aliases: CVE-2023-29216
Published: 2023-04-10T09:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.linkis:linkis-datasource'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.2'}]}]}]

In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker can use the MySQL data source and malicious parameters to configure a new data source to trigger a deserialization vulnerability, eventually leading to remote code execution. Users should upgrade their version of Linkis to version 1.3.2.
Microweber vulnerable to stored cross-site scripting (XSS) via X-Forwarded-For header (GHSA-hhjm-mpmf-cxg9)
Aliases: CVE-2023-1881
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.3'}]}]}]

microweber/microweber prior to 1.3.3 is vulnerable to stored cross-site scripting (XSS) via the `X-Forwarded-For` header. This was fixed in version 1.3.3.
Jenkins OctoPerf Load Testing Plugin missing permission check allows for ID enumeration  (GHSA-mjg3-2v66-p34j)
Aliases: CVE-2023-28673
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkinsci.plugins:octoperf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.5.2'}}]

OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in OctoPerf Load Testing Plugin Plugin 4.5.3 requires the appropriate permissions.
alextselegidis/easyappointments vulnerable to Stored Cross-site Scripting (GHSA-7m8r-gmc3-3p4v)
Aliases: CVE-2023-2103
Published: 2023-04-15T15:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'alextselegidis/easyappointments'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.3'}]}]}]

alextselegidis/easyappointments is vulnerable to stored cross-site scripting in versions 1.4.3 and prior. A patch is available at commit 46a865300e94c7031cc0e315d95d3e3e56768498 and anticipated to be part of version 1.5.0.
XWiki Platform vulnerable to code injection from account/view through VFS Tree macro (GHSA-p67q-h88v-5jgr)
Aliases: CVE-2023-29521
Published: 2023-04-20T22:06:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-vfs-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.4-milestone-2'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-vfs-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-vfs-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.2'}]}]}]

### Impact
Any user with view rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of `Macro.VFSTreeMacro`. This page is not installed by default.

See https://jira.xwiki.org/browse/XWIKI-20260 for the reproduction steps.

### Patches
The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.2, 14.4.8, 13.10.11.

### Workarounds
The issue can be fixed by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1ba7a5b12) on `Macro.VFSTreeMacro`.

### References
- https://jira.xwiki.org/browse/XWIKI-20260
- https://github.com/xwiki/xwiki-platform/commit/fad02328f5ec7ab7fe5b932ffb5bc5c1ba7a5b12

### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
phpMyFAQ vulnerable to Stored Cross-site Scripting (GHSA-8595-6653-96p2)
Aliases: CVE-2023-2428
Published: 2023-04-30T03:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.13'}]}]}]

phpMyFAQ prior to version 3.1.13 has a stored cross site scripting vulnerability in `name` field in add question module. This allows an attacker to steal user cookies.
Hidden fields can be leaked on readable collections in Payload (GHSA-35jj-vqcf-f2jf)
Aliases: CVE-2023-30843
Published: 2023-04-26T19:45:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'payload'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.0'}]}]}]

### Details

If a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force.

Affected versions:  < 1.7.0

### Workarounds

If you are unable to update, you can write a `beforeOperation` hook to remove `where` queries that attempt to access hidden field data.

### Detecting Compromise

Monitor your instance for brute-force style requests against your instance using `where` queries.
Goobi viewer Core has Cross-Site Scripting Vulnerability in User Nicknames (GHSA-2r9r-8fcg-m38g)
Aliases: CVE-2023-29016
Published: 2023-04-07T19:22:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.goobi.viewer:viewer-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.03'}]}]}]

### Impact
A cross-site scripting vulnerability has been identified in Goobi viewer core when using nicknames. An attacker could create a user account and enter malicious scripts into their profile's nickname, resulting in the execution in the user's browser when displaying the nickname on certain pages.

### Patches
The vulnerability has been fixed in version 23.03

If you have any questions or comments about this advisory:
* Email us at [support@intranda.com](mailto:support@intranda.com)
Cross Site Scripting in CraftCMS (GHSA-wv7j-rc2q-9j67)
Aliases: CVE-2023-30177
Published: 2023-04-25T18:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.7.68'}]}]}]

CraftCMS prior to version 3.7.68 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.
Improper Restriction of Excessive Authentication Attempts in calibreweb (GHSA-jg8w-wgx2-g7q4)
Aliases: CVE-2022-2525
Published: 2023-04-15T15:30:15Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'calibreweb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.20'}]}]}]

Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20.
pretalx vulnerable to path traversal in HTML export (GHSA-wh3w-jcc7-mhmf)
Aliases: CVE-2023-28459
Published: 2023-04-20T21:33:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pretalx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.2'}]}]}]

pretalx before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.
Strapi leaking sensitive user information by filtering on private fields (GHSA-jjqf-j4w7-92w8)
Aliases: CVE-2023-22894
Published: 2023-04-19T21:41:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@strapi/strapi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.1'}, {'fixed': '4.8.0'}]}]}]

### Summary

Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users.

### Details

Strapi through 4.7.1 allows unauthenticated attackers to discover sensitive user details for Strapi administrators and API users. The unauthenticated attacker can filter users by columns that contain sensitive information and infer the values by the changes in the API responses. An unauthenticated attacker can exploit this vulnerability to hijack Strapi administrator accounts and gain unauthorized Strapi Super Administrator access by leaking the password reset token and changing the admin password. This can be exploited on all Strapi versions <=4.7.1.

### IoC

The exploitation of CVE-2023-22894 is easily detectable, since the payload is within the GET parameters and are normally included in request logs. The following regex pattern will extract requests that are exploiting this vulnerability to leak user's email, password and password reset token columns.

`/(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)/`

You can search log files for this IoC by using the following grep command.

`grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)' $PATH_TO_LOG_FILE`

If the above regex pattern matches any lines in your log files, take extra precaution to look out for multiple requests that include password, reset_password_token or resetPasswordToken. This would indicate that an attacker has leaked the password hashes and reset tokens on your Strapi server and you need to immediately start an incident response!

### Impact

All Strapi users below 4.8.0
org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins (GHSA-cmvg-w72j-7phx)
Aliases: CVE-2023-29206
Published: 2023-04-12T20:38:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-skin-skinx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0-milestone-1'}, {'fixed': '14.9-rc-1'}]}]}]

### Impact

There was no check in the author of a JavaScript xobject or StyleSheet xobject added in a XWiki document, so until now it was possible for a user having only Edit Right to create such object and to craft a script allowing to perform some operations when executing by a user with appropriate rights. 

### Patches

This has been patched in XWiki 14.9-rc-1 by only executing the script if the author of it has Script right. 

### Workarounds

The only known workaround consists in applying [the following patch](https://github.com/xwiki/xwiki-platform/commit/fe65bc35d5672dd2505b7ac4ec42aec57d500fbb) and rebuilding and redeploying `xwiki-platform-skin-skinx`.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform (GHSA-65g2-x53q-cmf6)
Aliases: CVE-2023-30618
Published: 2023-04-24T22:44:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'kitchen-terraform'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.1'}]}]}]

### Summary

Kitchen-Terraform v7.0.0 introduced a regression which caused all Terraform output values, including sensitive values, to be printed at the `info` logging level during the `kitchen converge` action. Prior to v7.0.0, the output values were printed at the `debug` level to avoid writing sensitive values to the terminal by default.

### Original Report

@brettcurtis:
> Hopefully, I'm not doing something stupid here, but I'm seeing sensitive outputs printed in the kitchen output. You can check this action for an example: https://github.com/osinfra-io/terraform-google-project/actions/runs/4700065515/jobs/8334277309#step:5:215
>
> It's not really a sensitive value just used it as an example.
thorsten/phpmyfaq vulnerable to authentication bypass  (GHSA-4cr4-x82x-hwm9)
Aliases: CVE-2023-1886
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to authentication bypass by capture-relay that allows unlimited comments to be sent. This has been fixed in 3.1.12.
Missing permission check of canView in GridFieldPrintButton (GHSA-jh3w-6jp2-vqqm)
Aliases: CVE-2023-22728
Published: 2023-04-26T19:47:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'silverstripe/framework'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.12.5'}]}]}]

The GridField print view incorrectly validates the permission of DataObjects potentially allowing a content author to view records they are not authorised to access. 

Upgrade to `silverstripe/framework` 4.12.5 or above to address the issue.

Reported by Stephan Bauer from [relaxt Webdienstleistungsagentur GmbH](https://www.relaxt.at/)
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via category field name parameter (GHSA-xxm6-ff3x-v4vm)
Aliases: CVE-2023-1885
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the `category field name` parameter. This has been fixed in 3.1.12.
SQL filter bypass leading to arbitrary write requests using "SQL Manager" (GHSA-p379-cxqh-q822)
Aliases: CVE-2023-30839
Published: 2023-04-25T19:45:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.4'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.8.9'}]}]}]

### Impact
SQL filtering vulnerability, a BO user can write, update and delete in the database, even without having specific rights.

### Patches
PrestaShop 8.0.4 and 1.7.8.9 will contain the patch.

### Workarounds
no

### References
no
Improper header name validation in guzzlehttp/psr7 (GHSA-wxmh-65f7-jcvw)
Aliases: CVE-2023-29197
Published: 2023-04-19T18:25:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'guzzlehttp/psr7'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'guzzlehttp/psr7'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.4.5'}]}]}]

### Impact

Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`.

### Patches

The issue is patched in 1.9.1 and 2.4.5.

### Workarounds

There are no known workarounds.

### References

* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
vm2 Sandbox Escape vulnerability (GHSA-xj72-wvfv-8985)
Aliases: CVE-2023-29199
Published: 2023-04-12T20:42:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vm2'}, 'ecosystem_specific': {'affected_functions': ['vm2.run']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.16'}]}]}]

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.

### Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches
This vulnerability was patched in the release of version `3.9.16` of `vm2`.

### Workarounds
None.

### References
Github Issue - https://github.com/patriksimek/vm2/issues/516
PoC - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.
xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability (GHSA-c5f4-p5wv-2475)
Aliases: CVE-2023-29212
Published: 2023-04-12T20:35:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-panels-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-panels-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact
Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the included documents edit panel.

A proof of concept exploit is to edit a document and add the following code before saving.

```
{{display reference="{{cache~}~}{{groovy~}~}println(~"Hello from Groovy~" + ~" in included document!~"){{/groovy~}~}{{/cache~}~}"/}}
```

**expected**
The right had side panels contain:
```
One included page: 
{{cache}}{{groovy}}println("Hello from Groovy" + " in included document!"){{/groovy}}{{/cache}}
```

**actual**
The right had side panels contain:
```
One included page:
    XWiki.Hello from Groovy in included document!
```

### Patches
The problem has been patched on XWiki 14.4.7, and 14.10.

### Workarounds
The issue can be fixed manually applying this [patch](https://github.com/xwiki/xwiki-platform/commit/22f249a0eb9f2a64214628217e812a994419b69f#diff-a51a252f0190274464027342b4e3eafc4ae32de4d9c17ef166e54fc5454c5689R214-R217).

### References
- https://github.com/xwiki/xwiki-platform/commit/22f249a0eb9f2a64214628217e812a994419b69f#diff-a51a252f0190274464027342b4e3eafc4ae32de4d9c17ef166e54fc5454c5689R214-R217
- https://jira.xwiki.org/browse/XWIKI-20293

### For more information
If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
configobj ReDoS exploitable by developer using values in a server-side configuration file (GHSA-c33w-24p9-8m24)
Aliases: CVE-2023-26112
Published: 2023-04-03T06:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'configobj'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.0.8'}]}]}]

All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\((.*)\). **Note:** This is only exploitable in the case of a developer, putting the offending value in a server side configuration file.
org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticate endpoints (GHSA-jjm5-5v9v-7hx2)
Aliases: CVE-2023-29506
Published: 2023-04-12T20:36:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-security-authentication-default'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '13.10.8'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-security-authentication-default'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.4.3'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-security-authentication-default'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.6'}, {'fixed': '14.10'}]}]}]

### Impact

It was possible to inject some code using the URL of authenticate endpoints, e.g.:

```
https://hostname/xwiki/authenticate/wiki/xwiki%22onload=%22alert(origin)%22/resetpassword
```

This vulnerability was present in recent versions of XWiki:
  - 13.10.8+
  - 14.4.3+
  - 14.6+

### Patches

This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.

### Workarounds
There is no easy workaround except to upgrade.

### References

  - https://jira.xwiki.org/browse/XWIKI-20335
  - https://github.com/xwiki/xwiki-platform/commit/1943ea26c967ef868fb5f67c487d98d97cba0380

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](https://jira.xwiki.org)
* Email us at [security mailing-list](mailto:security@xwiki.org)
safe-eval vulnerable to Sandbox Bypass due to improper input sanitization (GHSA-79xf-67r4-q2jj)
Aliases: CVE-2023-26122
Published: 2023-04-11T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'safe-eval'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.4.2'}]}]}]

All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. The vulnerability is derived from prototype pollution exploitation. Exploiting this vulnerability might result in remote code execution (RCE).

**Vulnerable functions:**

__defineGetter__, stack(), toLocaleString(), propertyIsEnumerable.call(),  valueOf().
RuoYi vulnerable to arbitrary file download (GHSA-h4c9-rr5m-32fm)
Aliases: CVE-2023-27025
Published: 2023-04-02T03:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.ruoyi:ruoyi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.7.6'}]}]}]

An arbitrary file download vulnerability in the background management module of RuoYi v4.7.6 and below allows attackers to download arbitrary files in the server.
Improper input validation in Drupal core (GHSA-g36h-4jr6-qmm9)
Aliases: CVE-2022-25273
Published: 2023-04-26T15:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '9.2.18'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.3.0'}, {'fixed': '9.3.12'}]}]}]

Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow an attacker to inject disallowed values or overwrite data. Affected forms are uncommon, but in certain cases an attacker could alter critical or sensitive data.

Drupal 7 is not affected.
sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service (GHSA-rrm6-wvj7-cwh2)
Aliases: CVE-2023-30608
Published: 2023-04-21T20:24:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'sqlparse'}, 'ecosystem_specific': {'affected_functions': ['sqlparse.keywords.SQL_REGEX', 'sqlparse.lexer.Lexer']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.1.15'}, {'fixed': '0.4.4'}]}]}]

### Impact
The SQL parser contains a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service). The vulnerability may lead to Denial of Service (DoS).

### Patches
This issues has been fixed in sqlparse 0.4.4.

### Workarounds
None. 

### References
This issue was discovered and reported by GHSL team member [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh).
- Commit that introduced the vulnerability: e75e35869473832a1eb67772b1adfee2db11b85a
Jenkins Kubernetes Plugin does not properly mask credentials (GHSA-v5hq-cqqr-6w4g)
Aliases: CVE-2023-30513
Published: 2023-04-12T18:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.csanchez.jenkins.plugins:kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3910.ve59cec5e33ea'}]}]}]

Multiple Jenkins plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met:

- The credentials are printed in build steps executing on an agent (typically inside a node block).

- Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch.

The following plugins are affected by this vulnerability:

- Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513)

- Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 / CVE-2023-30514)

- Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)

The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled:

- Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513)

- Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 / CVE-2023-30514)

As of publication of this advisory, there is no fix available for the following plugin:

- Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies (GHSA-p26g-97m4-6q7c)
Aliases: CVE-2023-26049
Published: 2023-04-18T22:19:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.4.51.v20230217'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '10.0.14'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0'}, {'fixed': '11.0.14'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.0.0alpha0'}, {'fixed': '12.0.0.beta0'}]}]}]

Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism.

If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered.

So, a cookie header such as:

`DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be parsed as one cookie, with the name `DISPLAY_LANGUAGE` and a value of `b; JSESSIONID=1337; c=d`

instead of 3 separate cookies.

### Impact
This has security implications because if, say, `JSESSIONID` is an `HttpOnly` cookie, and the `DISPLAY_LANGUAGE` cookie value is rendered on the page, an attacker can smuggle the `JSESSIONID` cookie into the `DISPLAY_LANGUAGE` cookie and thereby exfiltrate it. This is significant when an intermediary is enacting some policy based on cookies, so a smuggled cookie can bypass that policy yet still be seen by the Jetty server.

### Patches
* 9.4.51.v20230217 - via PR #9352
* 10.0.15 - via PR #9339
* 11.0.15 - via PR #9339

### Workarounds
No workarounds

### References
* https://www.rfc-editor.org/rfc/rfc2965
* https://www.rfc-editor.org/rfc/rfc6265
h2 vulnerable to denial of service (GHSA-f8vr-r385-rh5r)
Aliases: CVE-2023-26964
Published: 2023-04-11T15:30:30Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'h2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.17'}]}]}]

Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).

This issue affects users only when dealing with http2 connections.
Authenication bypass (GHSA-pj76-75cm-3552)
Aliases: CVE-2023-28473
Published: 2023-04-28T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'concrete5/concrete5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.0'}]}]}]

Concrete CMS (previously concrete5) before 9.2 is vulnerable to possible Auth bypass in the jobs section.
PowerJob vulnerable to Incorrect Access Control via the create user/save interface. (GHSA-c23v-vqw5-52c5)
Aliases: CVE-2023-29922
Published: 2023-04-19T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'tech.powerjob:powerjob'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.3.1'}]}]}]

PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.
XWiki Platform vulnerable to code injection from view right on XWiki.ClassSheet (GHSA-mjw9-3f9f-jq2w)
Aliases: CVE-2023-29522
Published: 2023-04-20T22:15:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-xclass-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-xclass-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.3'}]}]}]

### Impact

Any user with view rights can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload.

For instance: `Open <xwiki-host>/xwiki/bin/view/%22%2F%7D%7D%7B%7B%2Fhtml%7D%7D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=XWiki.ClassSheet&xpage=view`, where `<xwiki-host>` is the URL of your XWiki installation.

### Patches
This has been patched in XWiki 14.4.8, 14.10.3 and 15.0RC1.

### Workarounds
The fix is only impacting Velocity templates and page contents, so applying this [patch](https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee) is enough to fix the issue.

### References
- https://github.com/xwiki/xwiki-platform/commit/d7e56185376641ee5d66477c6b2791ca8e85cfee
- https://jira.xwiki.org/browse/XWIKI-20456

### For more information

If you have any questions or comments about this advisory:

-    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
-    Email us at [Security Mailing List](mailto:security@xwiki.org)
Jenkins Mashup Portlets Plugin vulnerable to stored cross-site scripting (GHSA-h9h3-jx58-6hqq)
Aliases: CVE-2023-28679
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'javagh.jenkins:mashup-portlets-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.2'}]}]}]

Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custom JavaScript expression.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission.
Buffer overflow in sponge queue functions (GHSA-6w4m-2xhg-2658)
Aliases: CVE-2022-37454
Published: 2023-04-26T17:39:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pysha3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'sha3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.5'}]}]}]

### Impact

The Keccak sponge function interface accepts partial inputs to be absorbed and partial outputs to be squeezed. A buffer can overflow when partial data with some specific sizes are queued, where at least one of them has a length of 2^32 - 200 bytes or more.

### Patches

Yes, see commit [fdc6fef0](https://github.com/XKCP/XKCP/commit/fdc6fef075f4e81d6b1bc38364248975e08e340a).

### Workarounds

The problem can be avoided by limiting the size of the partial input data (or partial output digest) below 2^32 - 200 bytes. Multiple calls to the queue system can be chained at a higher level to retain the original functionality. Alternatively, one can process the entire input (or produce the entire output) at once, avoiding the queuing functions altogether.

### References

See [issue #105](https://github.com/XKCP/XKCP/issues/105) for more details.
Phachon mm-wiki Cross Site Request Forgery vulnerability (GHSA-f6xp-59jq-r35c)
Aliases: CVE-2020-19278
Published: 2023-04-04T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/phachon/mm-wiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.2'}]}]}]

Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/user/save parameter.
nilsteampassnet/teampass vulnerable to stored cross-site scripting (XSS) (GHSA-4h2q-84w7-4mhx)
Aliases: CVE-2023-2021
Published: 2023-04-13T12:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nilsteampassnet/teampass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.3'}]}]}]

nilsteampassnet/teampass prior to 3.0.3 is vulnerable to stored cross-site scripting (XSS) in the description parameter of a folder.
org.xwiki.platform:xwiki-platform-attachment-ui vulnerable to Code Injection (GHSA-3hjg-cghv-22ww)
Aliases: CVE-2023-29519
Published: 2023-04-20T22:04:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-attachment-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0-rc-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-attachment-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-attachment-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.2'}]}]}]

### Impact
A registered user can perform remote code execution leading to privilege escalation by injecting the proper code in the "property" field of an attachment selector, as a gadget of their own dashboard. Note that the vulnerability does not impact comments of a wiki.

### Patches
The vulnerability has been patched in XWiki 13.10.11, 14.4.8, 14.10.2, 15.0-rc-1.

### Workarounds
The problem can be worked around by applying following changes directly in XWiki.AttachmentSelector page: https://github.com/xwiki/xwiki-platform/commit/5e8725b4272cd3e5be09d3ca84273be2da6869c1.

### References

* https://jira.xwiki.org/browse/XWIKI-20364
* https://github.com/xwiki/xwiki-platform/commit/5e8725b4272cd3e5be09d3ca84273be2da6869c1

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)