aswin1906/github-advisory-2023 huggingface dataset:
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability (GHSA-f4v8-58f6-mwj4)
Aliases: CVE-2023-29509
Published: 2023-04-12T20:36:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-theme-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.2-rc-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-theme-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-theme-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact
Any user with view rights on commonly accessible documents can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the `documentTree` macro parameters in  This macro is installed by default in `FlamingoThemesCode.WebHome`. This page is installed by default.

Example of reproduction:
Open `<xwiki_host>/xwiki/bin/view/%22%20%2F%7D%7D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=FlamingoThemesCode.WebHome&xpage=view` where `<xwiki_host>` is the URL of your XWiki installation.

> The [documentTree] macro is a standalone macro and it cannot be used inline. Click on this message for details.
> Hello from groovy!.WebHome" /}}

is displayed. This shows that the Groovy macro that is passed in the URL has been executed and thus demonstrates a privilege escalation from view to programming rights.

### Patches
The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.

### Workarounds
The issue can be fixed by replacing the code of `FlamingoThemesCode.WebHome` by the [patched version](https://github.com/xwiki/xwiki-platform/commit/80d5be36f700adcd56b6c8eb3ed8b973f62ec0ae).

### References
- https://jira.xwiki.org/browse/XWIKI-20279
- https://github.com/xwiki/xwiki-platform/commit/80d5be36f700adcd56b6c8eb3ed8b973f62ec0ae

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
modoboa vulnerable to Cross-Site Request Forgery (GHSA-6pvf-cq4f-hfjp)
Aliases: CVE-2023-2228
Published: 2023-04-21T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

modoboa prior to 2.1.0 is vulnerable to cross-site request forgery. An attacker must be logged in as admin to exploit this issue.
markdown-pdf vulnerable to local file read via server side cross-site scripting (XSS) (GHSA-qghr-877h-f9jh)
Aliases: CVE-2023-0835
Published: 2023-04-05T00:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'markdown-pdf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '11.0.0'}]}]}]

markdown-pdf version 11.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the Markdown content entered by the user.
SQL Injection in Admin Search Find API (GHSA-6mhm-gcpf-5gr8)
Aliases: CVE-2023-30848
Published: 2023-04-27T17:09:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. 

In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behavior. In some situations, an attacker can escalate an SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack. It was observed that the reported API endpoint accessible by an authenticated administrator user and is vulnerable to SQL injection via the "fields[]" GET parameter. The parameter is not sanitized properly and is used in a SQL statement in an unsafe manner, resulting in SQL injection.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/25ad8674886f2b938243cbe13e33e204a2e35cc3.patch manually.

### References
https://github.com/pimcore/pimcore/pull/14972
Apache Airflow Hive Provider vulnerable to code injection (GHSA-5cvg-9pp5-mxcj)
Aliases: CVE-2023-28706
Published: 2023-04-07T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow-providers-apache-hive'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.0'}]}]}]

Apache Software Foundation's Apache Airflow Hive Provider before 6.0.0 is vulnerable to improper control of generation of code.
Remote code execution in Voyager (GHSA-2x3r-7jgm-gh8x)
Aliases: CVE-2020-36070
Published: 2023-04-26T21:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'tcg/voyager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.0'}]}]}]

Insecure Permission vulnerability found in Voyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php file to the media component.
LangChain vulnerable to code injection (GHSA-fprp-p869-w6q2)
Aliases: CVE-2023-29374
Published: 2023-04-05T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.131'}]}]}]

In LangChain through 0.0.131, the `LLMMathChain` chain allows prompt injection attacks that can execute arbitrary code via the Python `exec()` method.
Jenkins WSO2 Oauth Plugin stores WSO2 Oauth client secret unencrypted in global config.xml file on Jenkins controller (GHSA-g472-f8cm-8x5f)
Aliases: CVE-2023-30527
Published: 2023-04-12T18:30:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:wso2id-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0'}]}]}]

Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins controller as part of its configuration.

This client secret can be viewed by users with access to the Jenkins controller file system.

Additionally, the global configuration form does not mask the WSO2 Oauth client secret, increasing the potential for attackers to observe and capture it.
Apache Spark vulnerable to Improper Privilege Management (GHSA-329j-jfvr-rhr6)
Aliases: CVE-2023-22946
Published: 2023-04-17T09:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.spark:spark-core_2.12'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.3.2'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.spark:spark-core_2.13'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.3.2'}}]

In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a `proxy-user` to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.
Cross-site Scripting in Backdrop CMS (GHSA-3862-c622-v4fp)
Aliases: CVE-2023-31045
Published: 2023-04-24T09:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'backdrop/backdrop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.24.2'}]}]}]

A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via the name parameter. When a user is editing any content type (e.g., page, post, or card) as an admin, the stored XSS payload is executed upon selecting a malicious text formatting option. 

NOTE: the vendor disputes the security relevance of this finding because "any administrator that can configure a text format could easily allow Full HTML anywhere."
Flask-AppBuilder Has No Rate Limiting on Login AUTH DB (GHSA-9hcr-9hcv-x6pv)
Aliases: CVE-2023-29005
Published: 2023-04-10T16:37:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'Flask-AppBuilder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.3.0'}]}]}]

### Impact
Lack of rate limiting will allow an attacker to brute-force user credentials.

### Patches
Ability to enable rate limiting on Flask-AppBuilder >=  4.3.0. Use `AUTH_RATE_LIMITED = True` and `RATELIMIT_ENABLED = True` set the limit itself by using `AUTH_RATE_LIMIT`. Will apply only to database authentication.

### Workarounds
Implement rate limiting using a reverse proxy or other strategies.
phpMyFAQ Improper Access Control vulnerability (GHSA-r69v-q48g-3966)
Aliases: CVE-2023-2429
Published: 2023-04-30T03:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.13'}]}]}]

phpMyFAQ prior to version 3.1.13 does not properly validate email addresses when updating user profiles. This vulnerability allows an attacker to manipulate their email address and change it to another email address that is already registered in the system, including email addresses belonging to other users such as the administrator. Once the attacker has control of the other user's email address, they can request to remove the user from the system, leading to a loss of data and access.
Phachon mm-wiki vulnerable to stored cross-site scripting (XSS) (GHSA-f7rp-xx67-4pj9)
Aliases: CVE-2020-19277
Published: 2023-04-04T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/phachon/mm-wiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.2'}]}]}]

Phachon mm-wiki v.0.1.2 vulnerable to stored cross-site scripting (XSS). This could allow a remote attacker to execute arbitrary code via JavaScript code in the markdown editor. Any user browsing the document containing XSS malicious code will trigger the vulnerability.
HashiCorp Nomad vulnerable to unauthenticated client agent HTTP request privilege escalation (GHSA-f8r8-h93m-mj77)
Aliases: CVE-2023-1782
Published: 2023-04-05T21:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/nomad'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.5.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.5.2'}}]

HashiCorp Nomad and Nomad Enterprise versions 1.5.0 up to 1.5.2 allow unauthenticated users to bypass intended ACL authorizations for clusters where mTLS is not enabled. This issue is fixed in version 1.5.3.
Cross-site Scripting (XSS) in Website Settings name field (GHSA-2c67-p4xh-m34w)
Aliases: CVE-2023-2342
Published: 2023-04-27T17:13:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.21 or apply this patches manually
https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091.patch
https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564.patch

### Workarounds
Apply patches manually:
https://github.com/pimcore/pimcore/commit/07a2c95be524c7e20105cef58c5767d4ebb06091.patch
https://github.com/pimcore/pimcore/commit/42a5bbe5f16b97371fdbfdcf2bb3ee759dea8564.patch

### References
https://huntr.dev/bounties/01cd3ed5-dce8-4021-9de0-81cb14bf1829/
alextselegidis/easyappointments Session Fixation vulnerability (GHSA-4qmm-cv4r-qfr4)
Aliases: CVE-2023-2105
Published: 2023-04-15T15:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'alextselegidis/easyappointments'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.3'}]}]}]

alextselegidis/easyappointments is vulnerable to session fixation. The application does not generate a new `ea_session` cookie after the user authenticates. A malicious user may create a new session cookie value and inject it to a victim. After the victim logs in, the injected cookie becomes valid, giving the attacker access to the user's account through the active session. If an attacker conducts this attack against an admin user, the attacker may escalate their privileges with the admin user being unaware.

This issue is patched in commit 7f37350fab9d729a9350d96369ff0f453cf7b840 and anticipated to be part of version 1.5.0.
Incorrect success value returned in vyper (GHSA-w9g2-3w7p-72g9)
Aliases: CVE-2023-30629
Published: 2023-04-24T22:33:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'vyper'}, 'ecosystem_specific': {'affected_functions': ['vyper.builtins.functions.RawCall.build_IR']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.3.1'}, {'fixed': '0.3.8'}]}]}]

### Background
During the audit of [Lido's Gate Seals](https://github.com/lidofinance/gate-seals) code [statemind](https://statemind.io) team identified a weird behavior of the code that uses `raw_call`: https://github.com/lidofinance/gate-seals/blob/051593e74df01a4131c485b4fda52e691cd4b7d8/contracts/GateSeal.vy#L164 .

Construction like this:
```vyper
success = raw_call(
    sealable,
    _abi_encode(SEAL_DURATION_SECONDS, method_id=method_id("pauseFor(uint256)")),
    revert_on_failure=False
)
```
was not fully documented: https://docs.vyperlang.org/en/v0.3.7/built-in-functions.html#raw_call .

The documentation says that: if `max_outsize=0` it should return nothing and then it says that if `revert_on_failure=False` it should return a `success` flag in the tuple of response, but what if `max_outsize=0`  and `revert_on_failure=False`.

<img width="715" alt="image" src="https://user-images.githubusercontent.com/22330612/232125364-d2b3bbac-0b4f-40cb-80ff-f55d8eafef44.png">

 So the team started researching what exactly happened in that case, after some research we found that the Vyper compiler generates the wrong bytecode in that case, it generates the sequence:
```
CALL // call
MLOAD // MLOAD is wrong since the CALL result is already stored in the stack
```

### Impact
Example of buggy code:
```vyper
@external
def returnSome(calling: address, a: uint256) -> bool:
    success: bool = false
    success = raw_call(
        calling,
        _abi_encode(a, method_id=method_id("a(uint256)")),
        revert_on_failure=False
        )
```

any contract that uses the `raw_call` with `revert_on_failure=False` and `max_outsize=0` receives the wrong response from `raw_call`. Depending on the memory garbage, the result can be either `True` or `False`.

### Patches
Fix by @charles-cooper https://github.com/vyperlang/vyper/commit/851f7a1b3aa2a36fd041e3d0ed38f9355a58c8ae

### Workarounds
The simple workaround is always to put  `max_outsize>0`.
Workaround example https://github.com/lidofinance/gate-seals/pull/5/files

### References
Lido's fix: https://github.com/lidofinance/gate-seals/pull/5/files
SQL Injection in Translation Export API (GHSA-xmg8-w465-mr56)
Aliases: CVE-2023-30849
Published: 2023-04-27T17:10:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. 

In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behavior. In some situations, an attacker can escalate an SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack. It was observed that the reported API endpoint accessible by an authenticated administrator user and is vulnerable to SQL injection via the "filter" GET parameter. The parameter accepts JSON formatted data. The value of JSON key "property" inside "filter" is not sanitized properly and is used in a SQL statement in an unsafe manner, resulting in SQL injection

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/c6c80905e58c7724c776f980570a56df7016c6d1.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/c6c80905e58c7724c776f980570a56df7016c6d1.patch manually.

### References
#14968
CubeFS allows Kubernetes cluster-level privilege escalation (GHSA-9337-8c6c-c2xg)
Aliases: CVE-2023-30512
Published: 2023-04-12T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cubefs/cubefs'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.2.1'}]}]}]

CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. This occurs because DaemonSet has cfs-csi-cluster-role and can thus list all secrets, including the admin secret.
Path traversal vulnerability in gatsby-plugin-sharp (GHSA-h2pm-378c-pcxx)
Aliases: CVE-2023-30548
Published: 2023-04-20T19:05:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'gatsby-plugin-sharp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.8.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'gatsby-plugin-sharp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.25.1'}]}]}]

### Impact

The gatsby-plugin-sharp plugin prior to versions 5.8.1 and 4.25.1 contains a path traversal vulnerability exposed when running the Gatsby develop server (`gatsby develop`).

The following steps can be used to reproduce the vulnerability:

```
# Create a new Gatsby project, and install gatsby-plugin-sharp
$ npm init gatsby
$ cd my-gatsby-site
$ npm install gatsby-plugin-sharp


# Add the plugin to gatsby-config.js
module.exports = {
  plugins: [
    {
      resolve: `gatsby-plugin-sharp`,
    },
  ]
}

# Start the Gatsby develop server
$ gatsby develop

# Execute the path traversal vulnerability
$ curl "http://127.0.0.1:8000/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
```

It should be noted that by default `gatsby develop` is only accessible via the localhost `127.0.0.1`, and one would need to intentionally expose the server to other interfaces to exploit this vulnerability by using server options such as `--host 0.0.0.0`, `-H 0.0.0.0`, or the `GATSBY_HOST=0.0.0.0` environment variable.


### Patches

A patch has been introduced in `gatsby-plugin-sharp@5.8.1` and `gatsby-plugin-sharp@4.25.1` which mitigates the issue by ensuring that included paths remain within the project directory.


### Workarounds

As stated above, by default `gatsby develop` is only exposed to the localhost `127.0.0.1`.  For those using the develop server in the default configuration no risk is posed.  If other ranges are required, preventing the develop server from being exposed to untrusted interfaces or IP address ranges would mitigate the risk from this vulnerability.

We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.


### Credits

We would like to thank Patrick Rombouts and Bart Veneman [drukwerkdeal.nl] for bringing the issue to our attention.


### For more information

Email us at [security@gatsbyjs.com](mailto:security@gatsbyjs.com).
Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks (GHSA-w4g6-8xqp-g92m)
Aliases: CVE-2023-28683
Published: 2023-04-02T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:phabricator-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.1.5'}]}]}]

Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control coverage report file contents for the `Post to Phabricator` post-build action to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
XWiki Platform's async and display macro allow displaying and interacting with any document in restricted mode (GHSA-gpq5-7p34-vqx5)
Aliases: CVE-2023-29526
Published: 2023-04-20T22:24:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.11.1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-oldcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-async-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.11.1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-async-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-async-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.3'}]}]}]

### Impact

It's possible to display any page you cannot access through the combination of the async and display macro. 

Steps to reproduce:

1. Enable comments for guests by giving guests comment rights
2. As a guest, create a comment with content ```{{async}}{{display reference="Menu.WebHome" /}}{{/async}}```
3. Open the comments viewer from the menu (appends ?viewer=comments to the URL)

-> the `Menu.WebHome` is displayed while the expectation would be to have an error that the current user is not allowed to see it

### Patches

The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.3, 14.4.8, and 13.10.11.

### Workarounds

There is no known workaround.

### References

https://jira.xwiki.org/browse/XWIKI-20394
https://jira.xwiki.org/browse/XRENDERING-694

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Modoboa has Weak Password Requirements (GHSA-9gxx-32p7-ff7m)
Aliases: CVE-2023-2160
Published: 2023-04-18T18:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.5'}]}]}]

Modoboa 2.0.5 and prior allows users to set unsafe passwords, such as `1` or `HACK`. This issue is fixed in commit 130257c96a2392ada795785a91178e656e27015c and anticipated to be part of version 2.1.0.
Uncaught Exception in yaml (GHSA-f9xv-q969-pqx4)
Aliases: CVE-2023-2251
Published: 2023-04-24T15:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'yaml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0-5'}, {'fixed': '2.2.2'}]}]}]

Uncaught Exception in GitHub repository eemeli/yaml starting at version 2.0.0-5 and prior to 2.2.2.
spin-rs initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers (GHSA-2qv5-7mw5-j3cg)
Published: 2023-04-03T22:53:18Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'spin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.9.3'}, {'fixed': '0.9.8'}]}]}]

`Once::try_call_once` is unsound if invoked more than once concurrently and any call fails to initialise successfully.
Arbitrary file read via SQL injection (GHSA-8r4m-5p6p-52rp)
Aliases: CVE-2023-30545
Published: 2023-04-26T16:03:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.0.4'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'prestashop/prestashop'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.8.9'}]}]}]

### Impact
It is possible for a user having access to the SQL Manager (Advanced Options -> Database) to arbitrary read any file on the Operating system when using SQL function LOAD_FILE in a SELECT request. So It can access to critical information.

### Patches
The patch will be on PS 8.0.4 and PS 1.7.8.9
Jenkins OctoPerf Load Testing Plugin vulnerable to Cross-site Request Forgery (GHSA-x263-hp5c-p2rj)
Aliases: CVE-2023-28674
Published: 2023-04-02T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkinsci.plugins:octoperf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.3'}]}]}]

OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to a previously configured Octoperf server using attacker-specified credentials.

Additionally, these endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

OctoPerf Load Testing Plugin Plugin 4.5.3 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service (GHSA-48wp-p9qv-4j64)
Published: 2023-04-11T22:08:18Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'commonmarker'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.23.9'}]}]}]

## Impact

Several quadratic complexity bugs in commonmarker's underlying [`cmark-gfm`](https://github.com/github/cmark-gfm) library may lead to unbounded resource exhaustion and subsequent denial of service.

The following vulnerabilities were addressed:

* [CVE-2023-24824](https://github.com/github/cmark-gfm/security/advisories/GHSA-66g8-4hjf-77xh)
* [CVE-2023-26485](https://github.com/github/cmark-gfm/security/advisories/GHSA-r8vr-c48j-fcc5)

For more information, consult the release notes for version [`0.23.0.gfm.10`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.10) and [`0.23.0.gfm.11`](https://github.com/github/cmark-gfm/releases/tag/0.29.0.gfm.11).

## Mitigation

Users are advised to upgrade to commonmarker version [`0.23.9`](https://rubygems.org/gems/commonmarker/versions/0.23.9).
Spring Session session ID can be logged to the standard output stream (GHSA-r7qr-f43m-pxfr)
Aliases: CVE-2023-20866
Published: 2023-04-13T21:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.session:spring-session-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.1'}]}], 'versions': ['3.0.0']}]

In Spring Session version 3.0.0, the session id can be logged to the standard output stream. This vulnerability exposes sensitive information to those who have access to the application logs and can be used for session hijacking. Specifically, an application is vulnerable if it is using HeaderHttpSessionIdResolver.
Stored cross site scripting on saved presets (GHSA-2j26-j953-2rph)
Aliases: CVE-2023-28474
Published: 2023-04-28T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'concrete5/concrete5'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.0'}]}]}]

Concrete CMS (previously concrete5) before 9.2 is vulnerable to Stored XSS on Saved Presets on search.
org.xwiki.platform:xwiki-platform-logging-ui Eval Injection vulnerability (GHSA-4655-wh7v-3vmg)
Aliases: CVE-2023-29213
Published: 2023-04-12T20:35:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-logging-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2-milestone-3'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-logging-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-logging-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact


#### Steps to reproduce:

It is possible to trick a user with programming rights into visiting <xwiki-host>/xwiki/bin/view/XWiki/LoggingAdmin?loggeraction_set=1&logger_name=%7B%7Bcache%7D%7D%7B%7Bgroovy%7D%7Dnew+File%28%22%2Ftmp%2Fexploit.txt%22%29.withWriter+%7B+out+-%3E+out.println%28%22created+from+notification+filter+preferences%21%22%29%3B+%7D%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fcache%7D%7D&logger_level=TRACE where <xwiki-host> is the URL of your XWiki installation, e.g., by embedding an image with this URL in a document that is viewed by a user with programming rights.

#### Expected result:

No file in /tmp/exploit.txt has been created.

#### Actual result:

The file `/tmp/exploit.txt` is been created with content "created from notification filter preferences!". This demonstrates a CSRF remote code execution vulnerability that could also be used for privilege escalation or data leaks (if the XWiki installation can reach remote hosts).


### Patches
The problem has been patched on XWiki 14.4.7, and 14.10.

### Workarounds
The issue can be fixed manually applying this [patch](https://github.com/xwiki/xwiki-platform/commit/49fdfd633ddfa346c522d2fe71754dc72c9496ca).

### References
- https://jira.xwiki.org/browse/XWIKI-20291
- https://github.com/xwiki/xwiki-platform/commit/49fdfd633ddfa346c522d2fe71754dc72c9496ca

### For more information
If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability (GHSA-9pc2-x9qf-7j2q)
Aliases: CVE-2023-29209
Published: 2023-04-12T20:35:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.9'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact

Any user with view rights on commonly accessible documents including the legacy notification activity macro can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki installation. The root cause is improper escaping of the macro parameters of the [legacy notification activity macro](https://extensions.xwiki.org/xwiki/bin/view/Extension/Legacy%20Notification%20Activity%20Macro/). This macro is installed by default in XWiki.

A proof of concept exploit is

```
{{activity wikis="~" /~}~} {{async async=~"true~" cached=~"false~" context=~"doc.reference~"~}~}{{groovy~}~}println(~"Hello from Groovy!~"){{/groovy~}~}"/}}
```

If the output of this macro is
```
The [notifications] macro is a standalone macro and it cannot be used inline. Click on this message for details.
Hello from Groovy!"    displayMinorEvents="false" displayRSSLink="false" /}}
```
or similar, the XWiki installation is vulnerable. The vulnerability can be exploited via every wiki page that is editable including the user's profile, but also with just view rights using the HTMLConverter that is part of the [CKEditor integration](https://extensions.xwiki.org/xwiki/bin/view/Extension/CKEditor%20Integration/) which is bundled with XWiki.

### Patches
The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10.

### Workarounds
The issue can be fixed by replacing the code of the legacy notification activity macro by the [patched version](https://github.com/xwiki/xwiki-platform/commit/94392490884635c028199275db059a4f471e57bc). Alternatively, if the macro isn't used, the document `XWiki.Notifications.Code.Legacy.ActivityMacro` can also be completely deleted.

### References
* https://github.com/xwiki/xwiki-platform/commit/94392490884635c028199275db059a4f471e57bc
* https://jira.xwiki.org/browse/XWIKI-20258

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
Answer vulnerable to account takeover because password reset links do not expire (GHSA-j97g-77fj-9c4p)
Aliases: CVE-2023-1976
Published: 2023-04-11T12:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

answerdev/answer is an open-source knowledge-based community software. Answer prior to 1.0.6 is vulnerable to account takeover because the password reset link does not expire.
org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro (GHSA-vxf7-mx22-jr24)
Aliases: CVE-2023-29205
Published: 2023-04-12T20:38:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-rendering-xwiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '14.8-rc-1'}]}]}]

### Impact

The HTML macro does not systematically perform a proper neutralization of script-related html tags. As a result, any user able to use the html macro in XWiki, is able to introduce an XSS attack. This can be particularly dangerous since in a standard wiki, any user is able to use the html macro directly in their own user profile page. 

### Patches

The problem has been patched in XWiki 14.8RC1. The patch involve that the HTML macro are systematically cleaned up whenever the user does not have script right. 

### Workarounds

There's no workaround for this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Bypass of CSRF protection in the presence of predictable userInfo (GHSA-qrgf-9gpc-vrxw)
Aliases: CVE-2023-27495
Published: 2023-04-20T21:18:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@fastify/csrf-protection'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@fastify/csrf-protection'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '6.3.0'}]}]}]

## Description
The [CSRF](https://owasp.org/www-community/attacks/csrf) protection enforced by the `@fastify/csrf-protection` library in combination with `@fastify/cookie` can be bypassed from network and same-site attackers under certain conditions.

`@fastify/csrf-protection` supports an optional `userInfo` parameter that binds the CSRF token to the user. This parameter has been introduced to prevent cookie-tossing attacks as a fix for [CVE-2021-29624](https://www.cvedetails.com/cve/CVE-2021-29624). Whenever `userInfo` parameter is missing, or its value can be predicted for the target user account, network and [same-site](https://canitakeyoursubdomain.name/) attackers can 1. fixate a `_csrf` cookie in the victim's browser, and 2. forge CSRF tokens that are valid for the victim's session. This allows attackers to bypass the CSRF protection mechanism.

As a fix, `@fastify/csrf-protection` starting from version 6.3.0 (and v4.1.0) includes a server-defined secret `hmacKey` that cryptographically binds the CSRF token to the value of the `_csrf` cookie and the `userInfo` parameter, making tokens non-spoofable by attackers. This protection is effective as long as the `userInfo` parameter is unique for each user.

### Patches

This is patched in version 6.3.0 and v4.1.0.

### Workarounds

As a workaround, developers can use a random, non-predictable `userInfo` parameter for each user.

## Credits
* Pedro Adão (@pedromigueladao), [Instituto Superior Técnico, University of Lisbon](https://tecnico.ulisboa.pt/)
* Marco Squarcina (@lavish), [Security & Privacy Research Unit, TU Wien](https://secpriv.wien/)
Path Traversal in Asset "import from server" option (GHSA-hg77-vx9v-f49x)
Aliases: CVE-2023-2336
Published: 2023-04-27T23:09:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
An authenticated attacker can abuse import-server-files with a path traversal to download an arbitrary file from the server

An arbitrary file read vulnerability allows an attacker to read files on the server that they should not have access to, potentially including sensitive files such as configuration files, user data, and credentials. This can result in the exposure of confidential information, which can be used to launch further attacks or compromise the system.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/498cadec2292f7842fb10612068ac78496e884b4.patch manually.

### References
https://huntr.dev/bounties/af764624-7746-4f53-8480-85348dbb4f14/
Improper Input Validation in nyholm/psr7 (GHSA-wjfc-pgfp-pv9c)
Published: 2023-04-21T20:27:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'nyholm/psr7'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.1'}]}]}]

### Impact

Improper header parsing. An attacker could sneak in a newline (`\n`) into both the header names and values. While the specification states that `\r\n\r\n` is used to terminate the header list, many servers in the wild will also accept `\n\n`.

### Patches

The issue is patched in 1.6.1.

### Workarounds

There are no known workarounds.

### References

* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks (GHSA-58ch-c2jf-5g23)
Aliases: CVE-2023-28684
Published: 2023-04-02T21:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.sap.jenkinsci:remote-jobs-view-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.3'}]}]}]

Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows authenticated attackers with Overall/Read permission to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Cross-site Scripting (XSS) in DataObject Classification Store (GHSA-9q7q-r54q-3f3g)
Aliases: CVE-2023-2343
Published: 2023-04-27T17:11:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/f1d904094700b513c4756904fa2b1e19d08d890e.patch manually.

### References
https://huntr.dev/bounties/2fa17227-a717-4b66-ab5a-16bffbb4edb2/
Parsing borsh messages with ZST which are not-copy/clone is unsound (GHSA-fjx5-qpf4-xjf2)
Published: 2023-04-17T16:32:26Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'borsh'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0-alpha.1'}]}], 'database_specific': {'last_known_affected_version_range': '<= 0.10.3'}}]

Affected versions of borsh cause undefined behavior when zero-sized-types (ZST) are parsed and the Copy/Clone traits are not implemented/derived. For instance if 1000 instances of a ZST are deserialized, and the ZST is not copy (this can be achieved through a singleton), then accessing/writing to deserialized data will cause a segmentation fault.

There is currently no way for borsh to read data without also providing a Rust type. Therefore, if you are not using ZST for serialization, then you are not affected by this issue.
XWiki Platform vulnerable to page render failure due to broken translations (GHSA-9jq5-xwqw-q8j3)
Aliases: CVE-2023-29520
Published: 2023-04-20T22:05:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-localization-source-wiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3-milestone-2'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-localization-source-wiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-localization-source-wiki'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.1'}]}]}]

### Impact

It's possible to break many translations coming from wiki pages by creating a corrupted document containing a translation object.

### Patches

The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.1, 14.4.8, and 13.10.11.

### Workarounds

There is no other workaround other than fixing any way to create a document that fail to load.

### References

https://jira.xwiki.org/browse/XWIKI-20460

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
safe-eval vulnerable to Prototype Pollution via the safeEval function (GHSA-hcg3-56jf-x4vh)
Aliases: CVE-2023-26121
Published: 2023-04-11T06:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'safe-eval'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.4.2'}]}]}]

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its parameter content.
Jenkins NeuVector Vulnerability Scanner Plugin disables SSL/TLS certificate and hostname validation (GHSA-r3mm-v4x7-2phm)
Aliases: CVE-2023-30517
Published: 2023-04-12T18:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.jenkins.plugins:neuvector-vulnerability-scanner'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.22'}]}]}]

Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when connecting to a configured NeuVector Vulnerability Scanner server.