aswin1906/github-advisory-2023 huggingface dataset:
Cross-site Scripting in thorsten/phpmyfaq (GHSA-jfpg-jggf-rpph)
Aliases: CVE-2023-0786
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
Sandbox escape in Jenkins Email Extension Plugin (GHSA-c9c2-wcxh-3w5j)
Aliases: CVE-2023-25765
Published: 2023-02-15T15:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:email-ext'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.93'}]}]}]

In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowing attackers able to define email templates in folders to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Exposure of Sensitive Information in EVE-SRP (GHSA-fxqx-xgqq-gf42)
Aliases: CVE-2020-36660
Published: 2023-02-06T18:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'EVE-SRP'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.12.12'}]}]}]

A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The name of the patch is 9e03f68e46e85ca9c9694a6971859b3ee66f0240. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220211.
Froxlor Cross-Site Request Forgery vulnerability (GHSA-p7qq-rrvw-x55x)
Aliases: CVE-2023-1033
Published: 2023-02-25T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.11'}]}]}]

Froxlor prior to version 2.0.11 has a Cross-Site Request Forgery vulnerability.
Improper Privilege Management in Apache Sling (GHSA-mrpv-5pmr-p92h)
Aliases: CVE-2023-25621
Published: 2023-02-23T09:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.sling:org.apache.sling.i18n'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.6.2'}]}]}]

Privilege Escalation vulnerability in Apache Software Foundation Apache Sling. Any content author is able to create i18n dictionaries in the repository in a location the author has write access to. As these translations are used across the whole product, it allows an author to change any text or dialog in the product. For example an attacker might fool someone by changing the text on a delete button to "Info". This issue affects the i18n module of Apache Sling versions before 2.6.2. Version 2.6.2 and higher limit by default i18m dictionaries to certain paths in the repository (/libs and /apps). Users of the module are advised to update to version 2.6.2 or higher, check the configuration for resource loading and then adjust the access permissions for the configured path accordingly.
openssl-src vulnerable to Use-after-free following `BIO_new_NDEF` (GHSA-r7jw-wp68-3xch)
Aliases: CVE-2023-0215
Published: 2023-02-08T22:28:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '111.25.0'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '300.0.0'}, {'fixed': '300.0.12'}]}]}]

The public API function `BIO_new_NDEF` is a helper function used for streaming ASN.1 data via a `BIO`. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.

The function receives a `BIO` from the caller, prepends a new `BIO_f_asn1` filter `BIO` onto the front of it to form a `BIO` chain, and then returns the new head of the `BIO` chain to the caller. Under certain conditions, for example if a CMS recipient public key is invalid, the new filter `BIO` is freed and the function returns a `NULL` result indicating a failure. However, in this case, the `BIO` chain is not properly cleaned up and the `BIO` passed by the caller still retains internal pointers to the previously freed filter `BIO`. If the caller then goes on to call `BIO_pop()` on the `BIO` then a use-after-free will occur. This will most likely result in a crash.

This scenario occurs directly in the internal function `B64_write_ASN1()` which may cause `BIO_new_NDEF()` to be called and will subsequently call `BIO_pop()` on the `BIO`. This internal function is in turn called by the public API functions `PEM_write_bio_ASN1_stream`, `PEM_write_bio_CMS_stream`, `PEM_write_bio_PKCS7_stream`, `SMIME_write_ASN1`, `SMIME_write_CMS` and `SMIME_write_PKCS7`.

Other public API functions that may be impacted by this include `i2d_ASN1_bio_stream`, `BIO_new_CMS`, `BIO_new_PKCS7`, `i2d_CMS_bio_stream` and `i2d_PKCS7_bio_stream`.
Duplicate advisory: Sequelize vulnerable to Improper Filtering of Special Elements (GHSA-8mwq-mj73-qv68)
Published: 2023-02-16T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@sequelize/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.0.0-alpha.20'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'sequelize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.29.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.28.2'}}]

## Duplicate advisory
This advisory has been withdrawn because it is a duplicate of [GHSA-f598-mfpv-gmfx](https://github.com/advisories/GHSA-f598-mfpv-gmfx). This link is maintained to preserve external references.

## Original Description
Due to improper attribute filtering in the sequelize js library, an attacker can peform SQL injections. This issue can be mitigated by not accepting untrusted input.
Improper Restriction of Rendered UI Layers or Frames in cockpit-hq/cockpit (GHSA-gm7m-rqf8-jx4m)
Aliases: CVE-2023-0780
Published: 2023-02-11T03:32:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.9'}]}]}]

Improper Restriction of Rendered UI Layers or Frames in GitHub repository cockpit-hq/cockpit prior to 2.3.9.
Cross-site Scripting in thorsten/phpmyfaq (GHSA-gf34-hh5r-f74h)
Aliases: CVE-2023-0794
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
Cross-site Scripting in Jenkins Email Extension Plugin (GHSA-p2fr-mq9m-6w6p)
Aliases: CVE-2023-25764
Published: 2023-02-15T15:30:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:email-ext'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.93'}]}]}]

Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated during template rendering, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create or change custom email templates.
Vditor Cross-site Scripting vulnerability (GHSA-vfmp-9999-6wqj)
Aliases: CVE-2021-32855
Published: 2023-02-21T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vditor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.8.7'}]}]}]

Vditor is a browser-side Markdown editor. Versions prior to 3.8.7 are vulnerable to copy-paste cross-site scripting (XSS). For this particular type of XSS, the victim needs to be fooled into copying a malicious payload into the text editor. Version 3.8.7 contains a patch for this issue.
Apache Commons FileUpload denial of service vulnerability (GHSA-hfrx-6qgj-fp6c)
Aliases: CVE-2023-24998
Published: 2023-02-20T18:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'commons-fileupload:commons-fileupload'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5'}]}]}]

Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
openssl-src subject to Invalid pointer dereference in `d2i_PKCS7` functions (GHSA-29xx-hcv2-c4cp)
Aliases: CVE-2023-0216
Published: 2023-02-08T22:23:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '300.0.0'}, {'fixed': '300.0.12'}]}]}]

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the `d2i_PKCS7()`, `d2i_PKCS7_bio()` or `d2i_PKCS7_fp()` functions.

The result of the dereference is an application crash which could lead to a denial of service attack. The TLS implementation in OpenSSL does not call this function however third party applications might call these functions on untrusted data.
openssl-src subject to Timing Oracle in RSA Decryption (GHSA-p52g-cm5j-mjv4)
Aliases: CVE-2022-4304
Published: 2023-02-08T22:31:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '111.25.0'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '300.0.0'}, {'fixed': '300.0.12'}]}]}]

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection.
vantage6 refresh tokens do not expire (GHSA-4w59-c3gc-rrhp)
Aliases: CVE-2023-23929
Published: 2023-02-28T23:20:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vantage6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.8.0'}]}]}]

From issue: 

Problem description
Currently, the refresh token is valid indefinitely. This is bad security practice.

Desired solution
The refresh token should get a validity of 24-48 hours.

Additional context

When implementing this, also check that the refresh token returns a new refresh token
When implementing this, also adapt the UI so that it logs out if refresh token is no longer valid.
When implementing this, ensure that nodes refresh their token periodically so that they do not have to be restarted manually.


### Impact
### Patches
None available 

### Workarounds
None available
Argo CD leaks repository credentials in user-facing error messages and in logs (GHSA-mv6w-j4xc-qpfw)
Aliases: CVE-2023-25163
Published: 2023-02-08T22:37:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0-rc1'}, {'fixed': '2.6.1'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/argoproj/argo-cd/v2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0-rc1'}, {'fixed': '2.6.1'}]}]}]

### Impact
All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have `applications, create` or `applications, update` RBAC access to reach the code which may produce the error.

The user is not guaranteed to be able to trigger the error message. They may attempt to spam the API with requests to trigger a rate limit error from the upstream repository. 

If the user has `repositories, update` access, they may edit an existing repository to introduce a URL typo or otherwise force an error message. But if they have that level of access, they are probably intended to have access to the credentials anyway.

### Patches

A patch for this vulnerability has been released in the following Argo CD version:

* v2.6.1

### Workarounds

The only way to completely resolve the issue is to upgrade.

#### Mitigations

To mitigate the issue, make sure that your repo credentials have only least necessary privileges. For example, the credentials should not have push access, and they should not have access to more resources than what Argo CD actually needs (for example, a whole GitHub org when only one repo is needed).

To further mitigate the impact of a leaked write-capable repo credential, you could [enable commit signature verification](https://argo-cd.readthedocs.io/en/stable/user-guide/gpg-verification/#enforcing-signature-verification). Even if someone could push a malicious commit, the commit would not by synced.

You should also enforce least privileges in Argo CD RBAC. Make sure users only have `repositories, update`, `applications, update`, or `applications, create` access if they absolutely need it.

### References

* The problem was initially reported in a [GitHub issue](https://github.com/argoproj/argo-cd/issues/12309)
* [Argo CD RBAC configuration documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/)

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Uncontrolled Resource Consumption in Hashicorp Nomad (GHSA-w479-w22g-cffh)
Aliases: CVE-2023-0821
Published: 2023-02-17T00:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/nomad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.15'}, {'fixed': '1.2.16'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/nomad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.3.9'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/nomad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.4.4'}]}]}]

HashiCorp Nomad and Nomad Enterprise 1.2.15 up to 1.3.8, and 1.4.3 jobs using a maliciously compressed artifact stanza source can cause excessive disk usage. Fixed in 1.2.16, 1.3.9, and 1.4.4.
OpenZeppelin Contracts contains Improper Verification of Cryptographic Signature (GHSA-626q-v9j4-mcp4)
Aliases: CVE-2023-23940
Published: 2023-02-02T16:59:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'openzeppelin-cairo-contracts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.0'}, {'fixed': '0.6.1'}]}]}]

### Cause
`is_valid_eth_signature` is missing a call to `finalize_keccak` after calling `verify_eth_signature`. 

### Impact
As a result, any contract using `is_valid_eth_signature` from the account library (such as the `EthAccount` preset) is vulnerable to a malicious sequencer. Specifically, the malicious sequencer would be able to bypass signature validation to impersonate an instance of these accounts.

### Risk
In order to exploit this vulnerability, it is required to control a sequencer or prover since they're the ones executing the hints, being able to inject incorrect keccak results.

Today StarkWare is the only party running both a prover or a sequencer, greatly reducing the risk of exploit.

### Patches
The issue has been patched in 0.6.1.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Contracts for Cairo repository](https://github.com/OpenZeppelin/cairo-contracts/issues/new/choose)
* Email us at [security@openzeppelin.com](mailto:security@openzeppelin.com)
Apache Kafka Connect vulnerable to Deserialization of Untrusted Data (GHSA-26f8-x7cc-wqpc)
Aliases: CVE-2023-25194
Published: 2023-02-07T21:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.kafka:connect'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '3.4.0'}]}]}]

A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath. Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector client override policy that permits them. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally, in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.
Withdrawn: cacheable-request depends on http-cache-semantics, which is vulnerable to Regular Expression Denial of Service (GHSA-8x6c-cv3v-vp6g)
Published: 2023-02-11T00:13:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'cacheable-request'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.2.7'}]}]}]

## This advisory is withdawn.

cacheable-request depends on http-cache-semanttics, which contains an Inefficient Regular Expression Complexity in versions prior to 4.1.1 of that package. cacheable-request has been updated to rely on the fixed version in 10.2.7. 

### Summary of http-cache-semantics vulnerability
http-cache semantics contains an Inefficient Regular Expression Complexity , leading to Denial of Service. This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

### Details
https://github.com/advisories/GHSA-rc47-6667-2j5j
Sequelize information disclosure vulnerability (GHSA-8c25-f3mj-v6h8)
Aliases: CVE-2023-22580
Published: 2023-02-16T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'sequelize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.28.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@sequelize/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.0.0-alpha.20'}]}]}]

Due to improper input filtering in the sequelize js library, can malicious queries lead to sensitive information disclosure.
Answer vulnerable to Race Condition (GHSA-qx34-47fc-vv79)
Aliases: CVE-2023-0739
Published: 2023-02-08T06:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.4'}]}]}]

Race Condition in Switch in GitHub repository answerdev/answer prior to 1.0.4.
Insecure Permissions issue in jeecg-boot (GHSA-rwhw-6c6r-2823)
Aliases: CVE-2021-37304
Published: 2023-02-03T18:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-base'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4.5'}]}]}]

An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.
Cross Site Scripting in usememos/memos (GHSA-9w8x-5hv5-r6gw)
Aliases: CVE-2022-25978
Published: 2023-02-15T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/usememos/memos'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.11.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.10.3'}}]

All versions of the package github.com/usememos/memos/server prior to 0.11.0 are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on external resources, which allows malicious actors to introduce links starting with a javascript: scheme.
AVideo contains Command injection when embedding a video link (GHSA-pgvh-p3g4-86jw)
Aliases: CVE-2023-25313
Published: 2023-02-02T01:32:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wwbn/avideo'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.4'}]}]}]

Impact:

An attacker could execute remote code on a system running wwbn/avideo

Step to Reproduce:

1. Go to the `My Videos` tab

https://demo.avideo.com/mvideos

2. Click "Embed a video link"

Append a command to the url as a query string. eg. `?whoami`


then click Save

This issue has been resolved in commit `236228f15`
RosarioSIS Improper Access Control vulnerability (GHSA-prjg-28jg-m3p5)
Aliases: CVE-2023-0994
Published: 2023-02-24T03:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'francoisjacquet/rosariosis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.8.2'}]}]}]

Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.8.2.
Unsafe fall-through in getWhereConditions (GHSA-vqfx-gj96-3w95)
Aliases: CVE-2023-22579
Published: 2023-02-23T16:58:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'sequelize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.28.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@sequelize/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.0.0-alpha.20'}]}]}]

### Impact

Providing an invalid value to the `where` option of a query caused Sequelize to ignore that option instead of throwing an error. 

A finder call like the following did not throw an error:

```ts
User.findAll({
  where: new Date(),
});
```

As this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option.

### Patches

This issue has been patched in [`sequelize@6.28.1`](https://github.com/sequelize/sequelize/pull/15699) & [`@sequelize/core@7.0.0.alpha-20`](https://github.com/sequelize/sequelize/pull/15375)

### References

A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15698

CVE:  CVE-2023-22579
Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090
Synopsys Jenkins Coverity Plugin has Incorrect Default Permissions (GHSA-jwr6-75xh-jh5j)
Aliases: CVE-2023-23850
Published: 2023-02-15T21:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:synopsys-coverity'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.3'}]}]}]

Synopsys Coverity Plugin 3.0.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Synopsys Coverity Plugin 3.0.3 requires the appropriate permissions.
Code Injection in thorsten/phpmyfaq (GHSA-wjrj-jc3w-ppfw)
Aliases: CVE-2023-0792
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
java-xmlbuilder vulnerable to XML External Entity Reference (GHSA-3vrc-rrpw-r5pw)
Aliases: CVE-2014-125087
Published: 2023-02-19T18:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.jamesmurty.utils:java-xmlbuilder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2'}]}]}]

A vulnerability was found in java-xmlbuilder up to 1.1. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to xml external entity reference. Upgrading to version 1.2 is able to address this issue. The name of the patch is e6fddca201790abab4f2c274341c0bb8835c3e73. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-221480.
Apache InLong vulnerable to Deserialization of Untrusted Data vulnerability (GHSA-22j4-qc48-j8f8)
Aliases: CVE-2023-24997
Published: 2023-02-01T15:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:inlong'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'last_affected': '1.5.0'}]}]}]

Deserialization of Untrusted Data vulnerability in Apache Software Foundation Apache InLong. This issue affects Apache InLong: from 1.1.0 through 1.5.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick https://github.com/apache/inlong/pull/7223 to solve it.
Cross-site Scripting in pimcore (GHSA-3w96-p6vh-c298)
Aliases: CVE-2023-0827
Published: 2023-02-14T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.5.17'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 1.5.17.
Answer subject to Cross-site Scripting vulnerability (GHSA-hjmr-xm25-36mh)
Aliases: CVE-2023-0743
Published: 2023-02-08T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.4'}]}]}]

Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4.
Sensitive Information leak via Script File in TinaCMS (GHSA-pc2q-jcxq-rjrr)
Aliases: CVE-2023-25164
Published: 2023-02-08T18:18:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@tinacms/cli'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.9'}]}]}]

### Impact

Sensitive Information leaked via script File in TinaCMS. Sites building with @tinacms/cli >= 1.0.0 && < 1.0.9 that store sensitive values in process.env var are impacted. If you're on a version prior to 1.0.0 this vulnerability does not affect you.

If your Tina-enabled website has sensitive credentials stored as environment variables (eg. Algolia API keys) you should rotate those keys immediately.

### Patches

This issue has been patched in @tinacms/cli@1.0.9

### Workarounds

Upgrading, and rotating secure & exposed keys is required for the proper fix.

### References

https://github.com/tinacms/tinacms/pull/3584
Cross-site Scripting in kimai/kimai (GHSA-r58m-v5pr-jhhq)
Aliases: CVE-2020-19825
Published: 2023-02-16T00:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'kimai/kimai'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1'}]}]}]

Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain escalated privileges.
Cross-site Scripting in Quarkus (GHSA-c57v-hc7m-8px2)
Aliases: CVE-2023-0044
Published: 2023-02-23T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.quarkus:quarkus-vertx-http'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.13.7.Final'}]}]}]

If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Nervos CKB vulnerable to low-resource flood DDoS attacks through network message (GHSA-p2gm-ffr3-w2xw)
Published: 2023-02-08T18:17:06Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ckb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.101.4'}]}]}]

### Workarounds
* forbid request genesis through network request
* forbid requesting duplicate data  through network request
Nervos CKB calculation of program load cycles may be missed when executing in resume mode (GHSA-fjj4-2q73-jvgc)
Published: 2023-02-08T18:15:28Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ckb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.100.0'}]}]}]

### Impact
The calculation of program load cycles may be missed when executing in resume mode. Since the script execution order is now determined, this issue does not cause network splitting.
is-http2 vulnerable to Improper Input Validation (GHSA-2275-rpf5-xv8h)
Aliases: CVE-2022-25906
Published: 2023-02-01T06:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'is-http2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.0'}]}]}]

All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function.
Code Injection in thorsten/phpmyfaq (GHSA-r6cw-356h-mvwg)
Aliases: CVE-2023-0788
Published: 2023-02-12T15:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.11'}]}]}]

Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
create-choo-app3 is vulnerable to Command Injection via the devInstall function (GHSA-rj7m-2p3g-fjxg)
Aliases: CVE-2022-25855
Published: 2023-02-06T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'create-choo-app3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.12.3'}]}]}]

All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
Vulnerable OpenSSL included in cryptography wheels (GHSA-x4qr-2fvf-3mr5)
Aliases: CVE-2023-0286
Published: 2023-02-08T22:17:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'cryptography'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.1'}, {'fixed': '39.0.1'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '111.25.0'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '300.0.0'}, {'fixed': '300.0.12'}]}]}]

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 0.8.1-39.0.0  are vulnerable to a security issue. More details about the vulnerabilities themselves can be found in https://www.openssl.org/news/secadv/20221213.txt and https://www.openssl.org/news/secadv/20230207.txt.

If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
Pterodactyl Wings contains UNIX Symbolic Link (Symlink) Following (GHSA-p8r3-83r8-jwj5)
Aliases: CVE-2023-25152
Published: 2023-02-08T18:19:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/pterodactyl/wings'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.3'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/pterodactyl/wings'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11.0'}, {'fixed': '1.11.3'}]}]}]

### Impact

This vulnerability impacts anyone running the affected versions of Wings.  The vulnerability can be used to create new files and on the host system that previously did not exist, potentially allowing attackers to change their resource allocations, promote their containers to privileged mode, or potentially add ssh authorized keys to allow the attacker access to a remote shell on the target machine.

In order to use this exploit, an attacker must have an existing "server" allocated and controlled by Wings.  Information on how the exploitation of this vulnerability works will be released on February 24th, 2023 in North America.

### Patches

This vulnerability has been resolved in version `v1.11.3` of Wings, and has been back-ported to the 1.7 release series in `v1.7.3`.

Anyone running `v1.11.x` should upgrade to `v1.11.3` and anyone running `v1.7.x` should upgrade to `v1.7.3`.

### Workarounds

None at this time.
CRLF Injection in Nodejs ‘undici’ via host (GHSA-5r9g-qh6m-jxff)
Aliases: CVE-2023-23936
Published: 2023-02-16T20:46:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'undici'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '5.19.1'}]}]}]

### Impact

undici library does not protect `host` HTTP header from CRLF injection vulnerabilities.

### Patches

This issue was patched in Undici v5.19.1.

### Workarounds

Sanitize the `headers.host` string before passing to undici.

### References

Reported at https://hackerone.com/reports/1820955.

### Credits

Thank you to Zhipeng Zhang ([@timon8](https://hackerone.com/timon8)) for reporting this vulnerability.
mt7688-wiscan is vulnerable to Command Injection due to improper input sanitization (GHSA-5h8c-8ccp-8gmh)
Aliases: CVE-2022-25916
Published: 2023-02-01T06:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'mt7688-wiscan'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.8.3'}]}]}]

Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.
XML External Entity (XXE) vulnerability in apoc.import.graphml (GHSA-6wxg-wh7f-rqpr)
Aliases: CVE-2023-23926
Published: 2023-02-16T20:46:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.neo4j.procedure:apoc-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.5.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.neo4j.procedure:apoc-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.4.0.14'}]}]}]

### Impact
A XML External Entity (XXE) vulnerability found in the apoc.import.graphml procedure of APOC core plugin in Neo4j graph database. XML External Entity (XXE) injection occurs when the XML parser allows external entities to be resolved. The XML parser used by the apoc.import.graphml procedure was not configured in a secure way and therefore allowed this. 

External entities can be used to read local files, send HTTP requests, and perform denial-of-service attacks on the application.

Abusing the XXE vulnerability enabled assessors to read local files remotely. Although with the level of privileges assessors had this was limited to one-line files. With the ability to write to the database, any file could have been read. Additionally, assessors noted, with local testing, the server could be crashed by passing in improperly formatted XML. 

### Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability is 5.5.0. 

### Workarounds
If you cannot upgrade the library, you can control the [allowlist](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist)  of the  procedures that can be used in your system.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [neo4j-apoc](https://github.com/neo4j/apoc)
* Email us at [security@neo4j.com](mailto:security@neo4j.com)

### Credits
We want to publicly recognise the contribution of Christopher Schneider – State Farm.
Codiad information disclosure vulnerability (GHSA-2q79-56rq-8v3c)
Aliases: CVE-2017-20178
Published: 2023-02-21T18:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'codiad/codiad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.8.1'}]}]}]

A vulnerability was found in Codiad 2.8.0. It has been rated as problematic. Affected by this issue is the function saveJSON of the file components/install/process.php. The manipulation of the argument data leads to information disclosure. The attack may be launched remotely. Upgrading to version 2.8.1 is able to address this issue. The name of the patch is 517119de673e62547ee472a730be0604f44342b5. It is recommended to upgrade the affected component. VDB-221498 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Symfony vulnerable to Session Fixation of CSRF tokens (GHSA-3gv2-29qc-v67m)
Aliases: CVE-2022-24895
Published: 2023-02-01T18:48:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'symfony/security-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '4.4.50'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/security-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.4.20'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/security-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.20'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/security-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1.0'}, {'fixed': '6.1.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/security-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.2.0'}, {'fixed': '6.2.6'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '4.4.50'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.4.20'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.20'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1.0'}, {'fixed': '6.1.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.2.0'}, {'fixed': '6.2.6'}]}]}]

Description
-----------

When authenticating users Symfony by default regenerates the session ID upon login, but preserves the rest of session attributes. Because this does not clear CSRF tokens upon login, this might enables [same-site attackers](https://canitakeyoursubdomain.name/) to bypass the CSRF protection mechanism by performing an attack similar to a session-fixation.

Resolution
----------

Symfony removes all CSRF tokens from the session on successful login.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4) for branch 4.4.

Credits
-------

We would like to thank Marco Squarcina for reporting the issue and Nicolas Grekas for fixing it.
mde utilities contains Prototype Pollution (GHSA-wxfj-84xf-7gxv)
Aliases: CVE-2023-26105
Published: 2023-02-28T06:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'utilities'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.6'}]}]}]

All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.
OpenNMS Horizon and Meridian vulnerable to Cross-site Scripting (GHSA-79jr-8fhm-8wv3)
Aliases: CVE-2023-0846
Published: 2023-02-22T21:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opennms:opennms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '31.0.3'}]}]}]

Unauthenticated, stored cross-site scripting in the display of alarm reduction keys in multiple versions of OpenNMS Horizon and Meridian could allow an attacker access to confidential session information.
openssl-src subject to NULL dereference validating DSA public key (GHSA-vxrh-cpg7-8vjr)
Aliases: CVE-2023-0217
Published: 2023-02-08T22:22:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl-src'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '300.0.0'}, {'fixed': '300.0.12'}]}]}]

An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the `EVP_PKEY_public_check()` function. This will most likely lead to an application crash. This function can be called on public keys supplied from untrusted sources which could allow an attacker to cause a denial of service attack.

The TLS implementation in OpenSSL does not call this function but applications might call the function if there are additional security requirements imposed by standards such as FIPS 140-3.
markdown-it-py Denial of Service vulnerability in the command line interface (GHSA-jrwr-5x3p-hvc3)
Aliases: CVE-2023-26302
Published: 2023-02-23T00:30:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'markdown-it-py'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.0'}]}]}]

Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid UTF-8 characters as input.
iziModal Cross-site Scripting vulnerability (GHSA-h685-83w4-3ph3)
Aliases: CVE-2021-32860
Published: 2023-02-21T15:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'izimodal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.1'}]}]}]

iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting (XSS) when handling untrusted modal titles. An attacker who is able to influence the field `title` when creating a `iziModal` instance is able to supply arbitrary `html` or `javascript` code that will be rendered in the context of a user, potentially leading to `XSS`. Version 1.6.1 contains a patch for this issue