aswin1906/github-advisory-2023 huggingface dataset:
org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability (GHSA-xwph-x6xj-wggv)
Aliases: CVE-2023-29204
Published: 2023-04-12T20:38:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0-rc-1'}, {'fixed': '13.10.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.8-rc-1'}]}]}]

### Impact

It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`.

### Patches
The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.

### Workarounds
The only way to workaround the bug is by providing a patched jar of xwiki-platform-oldcore containing the following changes: https://github.com/xwiki/xwiki-platform/commit/e4f7f68e93cb08c25632c126356d218abf192d1e#diff-c445f288d5d63424f56ef13f65514ab4e174a72e979b53b88197c2b7def267cf.

### References

  * Jira ticket of the reported vulnerability: https://jira.xwiki.org/browse/XWIKI-19994
  * Jira ticket of the original mechanism put in place to prevent open redirect: https://jira.xwiki.org/browse/XWIKI-10309
  * Original advisory about open redirect: https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-jp55-vvmf-63mv

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](https://jira.xwiki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
alextselegidis/easyappointments Improper Access Control vulnerability (GHSA-fc4g-f42p-7rhp)
Aliases: CVE-2023-2104
Published: 2023-04-15T15:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'alextselegidis/easyappointments'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.3'}]}]}]

alextselegidis/easyappointments 1.4.3 and prior allows one provider to view and edit others providers' appointment details. A patch is available at commit 75b24735767868344193fb2cc56e17ee4b9ac4be and anticipated to be part of version 1.5.0.
Spring Security logout not clearing security context (GHSA-x873-6rgc-94jc)
Aliases: CVE-2023-20862
Published: 2023-04-19T21:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.7.0'}, {'fixed': '5.7.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.8.0'}, {'fixed': '5.8.3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-core'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.3'}]}]}]

In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does not properly clean the security context if using serialized versions. Additionally, it is not possible to explicitly save an empty security context to the HttpSessionSecurityContextRepository. This vulnerability can keep users authenticated even after they performed logout. Users of affected versions should apply the following mitigation. 5.7.x users should upgrade to 5.7.8. 5.8.x users should upgrade to 5.8.3. 6.0.x users should upgrade to 6.0.3.
XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration (GHSA-jgg7-w2rj-58cj)
Aliases: CVE-2023-29525
Published: 2023-04-20T22:25:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-distribution-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.6.1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-distribution-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-distribution-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.6-rc-1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-legacy-events-hibernate-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.6-rc-1'}, {'fixed': '14.10.3'}]}]}]

### Impact

Steps to reproduce:

Open <xwiki-host>/xwiki/bin/view/XWiki/Notifications/Code/LegacyNotificationAdministration?since=%7B%7B%2Fhtml%7D%7D+%7B%7Basync+async%3D%22true%22+cached%3D%22false%22+context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln%28%22Hello+%22+%2B+%22from+groovy%21%22%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D, where <xwiki-host> is the URL of your XWiki installation.

This demonstrates an XWiki syntax injection attack via the since-parameter, allowing privilege escalation from view to programming rights.

### Patches

The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8 and 14.10.3.

### Workarounds

For versions >= 14.6-rc-1 the workaround is to modify the page `XWiki.Notifications.Code.LegacyNotificationAdministration` to add the missing escaping, as described on https://github.com/xwiki/xwiki-platform/commit/8e7c7f90f2ddaf067cb5b83b181af41513028754#diff-4e13f4ee4a42938bf1201b7ee71ca32edeacba22559daf0bcb89d534e0225949R70

For versions < 14.6-rc-1 the workaround is to modify the file `<xwikiwebapp>/templates/distribution/eventmigration.wiki` to add the missing escaping, as described on https://github.com/xwiki/xwiki-platform/commit/6d74e2e4aa03d19f0be385ab63ae9e0f0e90a766

### References

https://jira.xwiki.org/browse/XWIKI-20287

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Jenkins JaCoCo Plugin vulnerable to Stored Cross-site Scripting (GHSA-xj29-gfww-j67g)
Aliases: CVE-2023-28669
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:jacoco'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.2.1'}]}]}]

Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control input files for the 'Record JaCoCo coverage report' post-build action. Version 3.3.2.1 escapes class and method names shown on the UI.
Nunjucks autoescape bypass leads to cross site scripting (GHSA-x77j-w7wf-fjmw)
Aliases: CVE-2023-2142
Published: 2023-04-20T21:19:24Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'nunjucks'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.4'}]}]}]

### Impact
In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash `\` character.

#### Example
If the user-controlled parameters were used in the views similar to the following:
```
<script>
let testObject = { lang: '{{ lang }}', place: '{{ place }}' };
</script>
```

It is possible to inject XSS payload using the below parameters:
```
https://<application-url>/?lang=jp\&place=};alert(document.domain)//
```

### Patches
The issue was patched in version 3.2.4.

### References

- https://bugzilla.mozilla.org/show_bug.cgi?id=1825980
Ironic and ironic-inspector may expose as ConfigMaps (GHSA-9wh7-397j-722m)
Aliases: CVE-2023-30841
Published: 2023-04-26T19:46:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/metal3-io/baremetal-operator'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.0'}]}]}]

### Impact
Ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage.

### Patches
This issue is patched in [baremetal-operator PR#1241](https://github.com/metal3-io/baremetal-operator/pull/1241), and is included in BMO release 0.3.0 onwards.

### Workarounds
User may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in [baremetal-operator PR#1241](https://github.com/metal3-io/baremetal-operator/pull/1241)
kiwi TCMS has possibility for user to update email address to unverified one (GHSA-7x6q-3v3m-cwjg)
Aliases: CVE-2023-30544
Published: 2023-04-24T16:46:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'kiwitcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.2'}]}]}]

### Impact
In previous versions of Kiwi TCMS users were able to update their email addresses via the "My profile" admin page. This page allowed them to change the email address registered with their account without the ownership verification performed during account registration.

### Patches
With Kiwi TCMS v12.2 or later it is not possible to edit the email field associated with a user account!

### Workarounds
No workaround exists.

### References
Disclosed by [@novemberdad](https://huntr.dev/bounties/1714df73-e639-4d64-ab25-ced82dad9f85/).
Remote code execution in JFinal CMS (GHSA-8qhm-ch8h-xgjr)
Aliases: CVE-2023-30349
Published: 2023-04-27T15:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.jflyfox:jflyfox_jfinal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.1.0'}]}]}]

JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.
PowerJob vulnerable to Insecure Permissions (GHSA-5c86-gpvc-fp53)
Aliases: CVE-2023-29923
Published: 2023-04-19T15:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'tech.powerjob:powerjob'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.3.1'}]}]}]

PowerJob V4.3.1 is vulnerable to Insecure Permissions via the list job interface.
org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability (GHSA-m3jr-cvhj-f35j)
Aliases: CVE-2023-29201
Published: 2023-04-12T20:38:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.commons:xwiki-commons-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2-milestone-1'}, {'fixed': '14.6-rc-1'}]}]}]

### Impact
The "restricted" mode of the HTML cleaner in XWiki, introduced in version 4.2-milestone-1, only escaped `<script>` and `<style>`-tags but neither attributes that can be used to inject scripts nor other dangerous HTML tags like `<iframe>`. As a consequence, any code relying on this "restricted" mode for security is vulnerable to JavaScript injection ("cross-site scripting"/XSS). An example are anonymous comments in XWiki where the HTML macro filters HTML using restricted mode:

```javascript
{{html}}
<a href='' onclick='alert(1)'>XSS</a>
{{/html}}
```

When a privileged user with programming rights visits such a comment in XWiki, the malicious JavaScript code is executed in the context of the user session. This allows server-side code execution with programming rights, impacting the confidentiality, integrity and availability of the XWiki instance.

### Patches
This problem has been patched in XWiki 14.6 RC1 with the introduction of a filter with allowed HTML elements and attributes that is enabled in restricted mode.

### Workarounds
There are no known workarounds apart from upgrading to a version including the fix.

### References
* https://github.com/xwiki/xwiki-commons/commit/b11eae9d82cb53f32962056b5faa73f3720c6182 - the patch with the filter
* https://github.com/xwiki/xwiki-commons/commit/4a185e0594d90cd4916d60aa60bb4333dc5623b2 - the patch with the definitions what is allowed
* https://jira.xwiki.org/browse/XWIKI-9118 - the security issue with the HTML macro
* https://jira.xwiki.org/browse/XCOMMONS-1680 - the issue regarding a definition of what is allowed HTML
* https://jira.xwiki.org/browse/XCOMMONS-2426 - the issue regarding the filter that fixes the security issue

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org/)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)
Prototype Pollution in sheetJS (GHSA-4r6h-8v6p-xvw6)
Aliases: CVE-2023-30533
Published: 2023-04-24T09:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'xlsx'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.19.3'}]}]}]

All versions of SheetJS CE through 0.19.2 are vulnerable to "Prototype Pollution" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.

A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained.
Adverserial use of `make_bitflags!` macro can cause undefined behavior (GHSA-qvc4-78gw-pv8p)
Published: 2023-04-24T16:47:24Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'enumflags2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.7.0'}, {'fixed': '0.7.7'}]}]}]

The macro relied on an expression of the form `Enum::Variant` always being a
variant of the enum. However, it may also be an associated integer constant, in
which case there's no guarantee that the value of said constant consists only of
bits valid for this bitflag type.

Thus, code like this could create an invalid `BitFlags<Test>`, which would cause
iterating over it to trigger undefined behavior. As the debug formatter
internally iterates over the value, it is also affected.

```rust
use enumflags2::{bitflags, make_bitflags};

#[bitflags]
#[repr(u8)]
#[derive(Copy, Clone, Debug)]
enum Test {
    A = 1,
    B = 2,
}

impl Test {
    const C: u8 = 69;
}

fn main() {
    let x = make_bitflags!(Test::{C});
    // printing or iterating over x is UB
}
```
matrix-js-sdk vulnerable to invisible eavesdropping in group calls (GHSA-6g67-q39g-r79q)
Aliases: CVE-2023-29529
Published: 2023-04-14T16:14:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'matrix-js-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '24.1.0'}]}]}]

### Impact

An attacker present in a room where an [MSC3401](https://github.com/matrix-org/matrix-spec-proposals/pull/3401) group call is taking place can eavesdrop on the video and audio of participants using matrix-js-sdk, without their knowledge. To affected matrix-js-sdk users, the attacker will not appear to be participating in the call.

This attack is possible because matrix-js-sdk's group call implementation accepts incoming direct calls from other users, even if they have not yet declared intent to participate in the group call, as a means of resolving a race condition in call setup. Affected versions do not restrict access to the user's outbound media in this case.

Legacy 1:1 calls are unaffected.

### Workarounds

Users may hold group calls in private rooms where only the exact users who are expected to participate in the call are present.
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via FAQ News link parameter  (GHSA-jvjx-qqh7-6x6c)
Aliases: CVE-2023-1757
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the FAQ News link parameter. This has been fixed in 3.1.12.
Cross-site Scripting (XSS) in pimcore via DataObject Class date fields (GHSA-x9xj-pqmv-8jf7)
Aliases: CVE-2023-2327
Published: 2023-04-27T19:37:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/fb3056a21d439135480ee299bf1ab646867b5f4f.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/fb3056a21d439135480ee299bf1ab646867b5f4f.patch manually.

### References
https://huntr.dev/bounties/7336b71f-a36f-4ce7-a26d-c8335ac713d6/
ntru-rs has unsound FFI: Wrong API usage causes write past allocated area (GHSA-fq33-vmhv-48xh)
Published: 2023-04-07T19:23:49Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'ntru'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.4.3'}, {'last_affected': '0.5.6'}]}]}]

The following usage causes undefined behavior.
```rust
let kp: ntru::types::KeyPair = …;
kp.get_public().export(Default::default())
```

When compiled with debug assertions, the code above will trigger a `attempt to subtract with overflow` panic before UB occurs.
Other mistakes (e.g. using `EncParams` from a different key) may always trigger UB.

Likely, older versions of this crate are also affected, but have not been tested.
XXL-JOB vulnerable to Cross-site Scripting (GHSA-4j2p-x79m-jcj8)
Aliases: CVE-2023-26120
Published: 2023-04-10T06:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.xuxueli:xxl-job'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.4.0'}]}]}]

XXL-JOB (`com.xuxueli:xxl-job`) versions 2.4.0 and earlier are vulnerable to cross-site scripting (XSS). An HTML uploaded payload can be executed successfully through `/xxl-job-admin/user/add` and `/xxl-job-admin/user/update`.
Unrestricted file upload in kiwi TCMS (GHSA-fwcf-753v-fgcj)
Aliases: CVE-2023-30613
Published: 2023-04-24T22:44:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'kiwitcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '12.2'}]}]}]

### Impact
Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. In earlier versions there is no control over what kinds of files can be uploaded. Thus a malicious actor may upload an `.exe` file or a file containing embedded JavaScript and trick others into clicking on these files causing vulnerable browsers to execute malicious code on another computer or attempting XSS attacks.

Stored XSS attacks via file uploads have been fixed in earlier versions of Kiwi TCMS, see [GHSA-2wcr-87wf-cf9j](https://github.com/kiwitcms/Kiwi/security/advisories/GHSA-2wcr-87wf-cf9j). This advisory deals with prohibiting users to upload potentially compromised files in the first place.


### Patches
Kiwi TCMS v12.2 comes with functionality that allows administrators to configure additional upload validator functions which give them more control over what file types are accepted for upload. By default `.exe` are denied. Other files containing the `<script>` tag, regardless of their type are also denied b/c they are a path to XSS attacks.



### Workarounds
Upgrade to version 12.2 or later.

### References
Originally reported by [Ahmed Rabeaa Mosaa](https://huntr.dev/bounties/c30d3503-600d-4d00-9571-98826a51f12c).
Apache Airflow Spark Provider vulnerable to improper input validation (GHSA-ffj9-4crc-q7wf)
Aliases: CVE-2023-28710
Published: 2023-04-07T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-spark'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.1'}]}]}]

Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain `/` and `?` which is used to denote the end of the field.
Fluent Fluentd and Fluent-ui use default password (GHSA-wrxf-x8rm-6ggg)
Aliases: CVE-2020-21514
Published: 2023-04-04T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'fluentd'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.8.0'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'fluentd-ui'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.2'}]}]}]

An issue was discovered in Fluent Fluentd v.1.8.0 and Fluent-ui v.1.2.2 that allows attackers to gain escilated privileges and execute arbitrary code due to use of a default password.
Session fixation in fastify-passport (GHSA-4m3m-ppvx-xgw9)
Aliases: CVE-2023-29019
Published: 2023-04-21T22:33:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@fastify/passport'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@fastify/passport'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.3.0'}]}]}]

Applications using `@fastify/passport` for user authentication, in combination with `@fastify/session` as the underlying session management mechanism, are vulnerable to [session fixation attacks](https://owasp.org/www-community/attacks/Session_fixation) from network and same-site attackers.

## Details
fastify applications rely on the `@fastify/passport` library for user authentication. The login and user validation are performed by the `authenticate` function. When executing this function, the `sessionId` is preserved between the pre-login and the authenticated session. Network and [same-site attackers](https://canitakeyoursubdomain.name/) can hijack the victim's session by tossing a valid `sessionId` cookie in the victim's browser and waiting for the victim to log in on the website.

## Fix
As a solution, newer versions of `@fastify/passport` regenerate `sessionId` upon login, preventing the attacker-controlled pre-session cookie from being upgraded to an authenticated session.

## Credits
* Pedro Adão (@pedromigueladao), [Instituto Superior Técnico, University of Lisbon](https://tecnico.ulisboa.pt/)
* Marco Squarcina (@lavish), [Security & Privacy Research Unit, TU Wien](https://secpriv.wien/)
Jenkins OctoPerf Load Testing Plugin vulnerable to credential capture (GHSA-j9h4-p6p7-8652)
Aliases: CVE-2023-28672
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkinsci.plugins:octoperf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.2'}]}]}]

OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

OctoPerf Load Testing Plugin Plugin 4.5.2 properly performs a permission check when accessing the affected connection test HTTP endpoint.
Reflected cross site scripting (GHSA-vcpr-hm2m-gjjj)
Aliases: CVE-2023-28475
Published: 2023-04-28T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'concrete5/concrete5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.0'}]}]}]

Concrete CMS (previously concrete5) before 9.2 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthors (GHSA-pwfv-3cvg-9m4c)
Aliases: CVE-2023-29507
Published: 2023-04-12T20:36:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.4.1'}, {'fixed': '14.4.7'}]}]}]

### Impact

The Document script API returns directly a DocumentAuthors allowing to set any authors to the document, which in consequence can allow subsequent executions of scripts since this author is used for checking rights. 
Example of such attack:

```
{{velocity}}
$doc.setContent('{{velocity}}$xcontext.context.authorReference{{/velocity}}')
$doc.authors.setContentAuthor('xwiki:XWiki.superadmin')
$doc.getRenderedContent()
{{/velocity}}
```

### Patches
The problem has been patched in XWiki 14.10 and 14.4.7 by returning a safe script API.

### Workarounds
There no easy workaround apart of upgrading. 

### References

  * https://jira.xwiki.org/browse/XWIKI-20380
  * https://github.com/xwiki/xwiki-platform/commit/905cdd7c421dbf8c565557cdc773ab1aa9028f83

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Access bypass in Drupal core (GHSA-8849-cv9f-vccm)
Aliases: CVE-2023-31250
Published: 2023-04-26T21:30:37Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.0.0'}, {'fixed': '10.0.8'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.5.0'}, {'fixed': '9.5.8'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.4.14'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.96'}]}]}]

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.
Jenkins Role-based Authorization Strategy Plugin grants permissions even after they’ve been disabled (GHSA-436g-2f92-cvhh)
Aliases: CVE-2023-28668
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:role-strategy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '587.588.v850a_20a_30162'}]}], 'database_specific': {'last_known_affected_version_range': '< 587.588.v850a'}}]

Permissions in Jenkins can be enabled and disabled. Some permissions are disabled by default, e.g., Overall/Manage or Item/Extended Read. Disabled permissions cannot be granted directly, only through greater permissions that imply them (e.g., Overall/Administer or Item/Configure).

Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they’ve been disabled.

This allows attackers to have greater access than they’re entitled to after the following operations took place:

A permission is granted to attackers directly or through groups.

The permission is disabled, e.g., through the script console.

Role-based Authorization Strategy Plugin 587.588.v850a_20a_30162 does not grant disabled permissions.
A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation (GHSA-833c-xh79-p429)
Aliases: CVE-2023-30622
Published: 2023-04-21T19:42:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/clusternet/clusternet'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.15.2'}]}]}]

## Summary:
A potential risk in clusternet which can be leveraged to make a cluster-level privilege escalation.
## Detailed analysis:
The clusternet has a deployment called cluster-hub inside the clusternet-system Kubernetes namespace, which runs on worker nodes
randomly. The deployment has a service account called clusternet-hub, which has a cluster role called clusternet:hub via cluster role binding. The clusternet:hub cluster role has "*" verbs of "*.*" resources. Thus, if a malicious user can access the worker node which runs the clusternet, he/she can leverage the service account to do malicious actions to critical system resources. For example, he/she can leverage the service account to get ALL secrets in the entire cluster, resulting in cluster-level privilege escalation.
Cross-site Scripting in thorsten/phpmyfaq (GHSA-ch5w-2994-6h82)
Aliases: CVE-2023-1875
Published: 2023-04-22T18:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
Access bypass in Drupal Core (GHSA-cfh2-7f6h-3m85)
Aliases: CVE-2022-25278
Published: 2023-04-24T20:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '9.3.19'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4.0'}, {'fixed': '9.4.3'}]}]}]

Drupal core form API evaluates form element access incorrectly. This can lead to a user being able to alter data they should not have access to.
Missing secure cookie parameters (GHSA-f55r-8rcv-mqcf)
Aliases: CVE-2023-28472
Published: 2023-04-28T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'concrete5/concrete5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.0'}]}]}]

Concrete CMS (previously concrete5) before 9.2 does not have Secure and HTTP only attributes set for ccmPoll cookies.
vm2 vulnerable to sandbox escape (GHSA-7jxr-cg7f-gpgv)
Aliases: CVE-2023-29017
Published: 2023-04-07T20:35:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vm2'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.15'}]}]}]

vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors.

- vm2 version: ~3.9.14
- Node version: 18.15.0, 19.8.1, 17.9.1

### Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches
This vulnerability was patched in the release of version `3.9.15` of `vm2`.

### Workarounds
None.
Allegro Tech BigFlow vulnerable to Missing SSL Certificate Validation (GHSA-w6q2-48ch-fj26)
Aliases: CVE-2023-25392
Published: 2023-04-10T15:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'bigflow'}, 'ecosystem_specific': {'affected_functions': ['bigflow.build.operate._build_docker_image', 'bigflow.deploy.deploy_docker_image', 'bigflow.deploy._deploy_docker_image_from_local_repo', 'bigflow.deploy._deploy_docker_image_from_fs', 'bigflow.deploy._deploy_image_loaded_to_local_registry', 'bigflow.deploy.authenticate_to_registry', 'bigflow.deploy.check_images_exist', 'bigflow.deploy.deploy_dags_folder', 'bigflow.deploy.create_storage_client', 'bigflow.deploy.get_vault_token']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.0'}]}]}]

Allegro Tech BigFlow prior to 1.6.0 is vulnerable to Missing SSL Certificate Validation.
Improper Privilege Management in microweber (GHSA-r6xq-xcxc-fghx)
Aliases: CVE-2023-2240
Published: 2023-04-22T03:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.4'}]}]}]

Microweber prior to 1.3.4 has an Improper Privilege Management vulnerability.
Improper Authorization in modoboa (GHSA-67mg-gm8m-ph5r)
Aliases: CVE-2023-2227
Published: 2023-04-21T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

In modoboa prior to 2.1.0, sending a GET request to the endpoint `/api/v2/parameters/core/` returns sensitive information without any authentication or authorization.
org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerability (GHSA-qx9h-c5v6-ghqh)
Aliases: CVE-2023-29214
Published: 2023-04-12T20:35:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-panels-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1-M2'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-panels-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-panels-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact
Any user with edit rights can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the included pages in the IncludedDocuments panel.

**Precondition**: As an admin, add the `Panels.IncludedDocuments` panel on one column.

A proof of concept exploit is to edit a document and add the following code before saving.

```
{{display reference="{{cache~}~}{{groovy~}~}println(~"Hello from Groovy~" + ~" in included document!~"){{/groovy~}~}{{/cache~}~}"/}}
```

**expected**
The right had side panels contain:
```
One included page: 
{{cache}}{{groovy}}println("Hello from Groovy" + " in included document!"){{/groovy}}{{/cache}}
```

**actual**
The right had side panels contain:
```
One included page:
    XWiki.Hello from Groovy in included document!
```

### Patches
The problem has been patched on XWiki 14.4.7, and 14.10.

### Workarounds
The issue can be fixed manually applying this [patch](https://github.com/xwiki/xwiki-platform/commit/50b4d91418b4150933f0317eb4a94ceaf5b69f67).

### References
- https://github.com/xwiki/xwiki-platform/commit/50b4d91418b4150933f0317eb4a94ceaf5b69f67
- https://jira.xwiki.org/browse/XWIKI-20306

### For more information
If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
Firefly III insufficiently expires sessions (GHSA-h7vv-46p5-prmh)
Aliases: CVE-2023-1788
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'grumpydictator/firefly-iii'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.0'}]}]}]

Firefly III prior to 6.0.0 insufficiently expires sessions upon close.
Cross Site Scripting (XSS) in Serenity (GHSA-93h6-wx7r-mgfp)
Aliases: CVE-2023-31285
Published: 2023-04-27T03:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'Serenity.Net.Core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.7.0'}]}]}, {'package': {'ecosystem': 'NuGet', 'name': 'Serenity.Net.Services'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.7.0'}]}]}]

An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be sent to an administrator user.
Apache IoTDB Grafana Connector vulnerable to Improper Authentication (GHSA-pvjv-386f-c8wh)
Aliases: CVE-2023-24831
Published: 2023-04-17T09:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.iotdb:iotdb-grafana-connector'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.13.0'}, {'fixed': '0.13.4'}]}]}]

Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB. This issue affects Apache IoTDB Grafana Connector from 0.13.0 through 0.13.3.

Attackers could log in without authorization. This is fixed in 0.13.4.
Jenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted (GHSA-54cw-rvr3-w6cx)
Aliases: CVE-2023-30531
Published: 2023-04-12T18:30:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:consul-kv-builder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.13'}]}]}]

Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file `org.jenkinsci.plugins.consulkv.GlobalConsulConfig.xml` on the Jenkins controller as part of its configuration.

This token can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the token, increasing the potential for attackers to observe and capture it.
Lack of domain validation in Druple core (GHSA-4wfq-jc9h-vpcx)
Aliases: CVE-2022-25276
Published: 2023-04-26T15:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '9.3.19'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'drupal/core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4.0'}, {'fixed': '9.4.3'}]}]}]

The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. Under certain circumstances, this could lead to cross-site scripting, leaked cookies, or other vulnerabilities.

Drupal 7 core does not include the Media module and therefore is not affected.
Jenkins Pipeline Aggregator View Plugin vulnerable to Cross-site Scripting (GHSA-v27q-87jf-j9cr)
Aliases: CVE-2023-28670
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.paul8620.jenkins.plugins:pipeline-aggregator-view'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.14'}]}]}]

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by authenticated attackers with Overall/Read permission. Version 1.14 obtains the current URL in a way not susceptible to XSS.
thorsten/phpmyfaq vulnerable to stored cross-site scripting (XSS) via artlang parameter (GHSA-m8q9-7v2f-qjx9)
Aliases: CVE-2023-1880
Published: 2023-04-05T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

thorsten/phpmyfaq prior to 3.1.12 is vulnerable to stored cross-site scripting (XSS) because it fails to sanitize user input in the artlang parameter. This has been fixed in 3.1.12.
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin (GHSA-2h87-4q2w-v4hf)
Aliases: CVE-2023-22621
Published: 2023-04-19T21:41:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@strapi/plugin-users-permissions'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.6'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@strapi/plugin-email'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.6'}]}]}]

### Summary

Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server.

### Details

Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.

### IoC

Using just the request log files, the only IoC to search for is a `PUT` request to URL path `/users-permissions/email-templates`. This IoC only indicates that a Strapi email template was modified on your server and by itself does not indicate if your Strapi server has been compromised. If this IoC is detected, you will need to manually review your email templates on your Strapi server and backups of your database to see if any of the templates contain a `lodash` template delimiter (eg. `<%STUFF HERE%>`) that contains suspicious JavaScript code. Generally speaking these templates should look like the following, you may have minor adjustments but any unrecognized code should be considered suspicious.

Reset Password Template:

```html
<p>We heard that you lost your password. Sorry about that!</p>

<p>But don’t worry! You can use the following link to reset your password:</p>
<p><%= URL %>?code=<%= TOKEN %></p>

<p>Thanks.</p>
```

Email Confirmation Template:

```html
<p>Thank you for registering!</p>

<p>You have to confirm your email address. Please click on the link below.</p>

<p><%= URL %>?confirmation=<%= CODE %></p>

<p>Thanks.</p>
```

Specifically you should look for odd code contained within the `<%STUFF HERE%>` blocks as this is what is used to bypass the lodash templating system. If you find any code that is not a variable name, or a variable name that is not defined in the template you are most likely impacted and should take immediate steps to confirm there are no malicious applications running on your servers.

### Impact

All users on Strapi below 4.5.6 with access to the admin panel and the ability to modify the email templates
Arbitrary command injection in embano1/wip  (GHSA-rg3q-prf8-qxmp)
Aliases: CVE-2023-30623
Published: 2023-04-24T22:32:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'GitHub Actions', 'name': 'embano1/wip'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2'}]}]}]

## Summary
The  `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation.

## Details and Impact
This vulnerability can be triggered by any user on GitHub. They just need to create a pull request with a commit message containing an exploit. (Note that first-time PR requests will not be run - but the attacker can submit a valid PR before submitting an invalid PR). The commit can be genuine, but the commit message can be malicious. 

This can be used to execute code on the GitHub runners (potentially use it for crypto-mining, and waste your resources) and can be used to exfiltrate any secrets that you use in the CI pipeline (including repository tokens). [Here](https://securitylab.github.com/research/github-actions-untrusted-input/) is a set of blog posts by Github's security team explaining this issue.

## How to update existing workflows

Replace the following line in your workflow using this action with the `v2` branch name or commit pointing to this branch:

```yaml
    uses: embano1/wip@v2
```

Or using the exact commit:

```yaml
    uses: embano1/wip@c25450f77ed02c20d00b76ee3b33ff43838739a2 # v2
```
Jenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentials (GHSA-f244-f9fc-w6fq)
Aliases: CVE-2023-30515
Published: 2023-04-12T18:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:thycotic-devops-secrets-vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.0'}]}]}]

Multiple Jenkins plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met:

- The credentials are printed in build steps executing on an agent (typically inside a node block).

- Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch.

The following plugins are affected by this vulnerability:

- Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513)

- Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 / CVE-2023-30514)

- Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)

The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled:

- Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513)

- Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 / CVE-2023-30514)

As of publication of this advisory, there is no fix available for the following plugin:

- Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)