aswin1906/github-advisory-2023 huggingface dataset:
Denial of service via multipart parsing in Rack (GHSA-rqv2-275x-2jq5)
Aliases: CVE-2022-44572
Published: 2023-01-18T18:19:21Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.9.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0.0'}, {'fixed': '2.1.4.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0.0'}, {'fixed': '2.2.6.1'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0.0'}, {'fixed': '3.0.4.1'}]}]}]

There is a denial of service vulnerability in the multipart parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2022-44572.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.0.9.2, 2.1.4.2, 2.2.6.1, 3.0.0.1
Impact

Carefully crafted input can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Releases

The fixed releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    2-0-Forbid-control-characters-in-attributes.patch - Patch for 2.0 series
    2-1-Forbid-control-characters-in-attributes.patch - Patch for 2.1 series
    2-2-Forbid-control-characters-in-attributes.patch - Patch for 2.2 series
    3-0-Forbid-control-characters-in-attributes.patch - Patch for 3.0 series
Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin  (GHSA-vxmh-p52j-h33m)
Aliases: CVE-2023-24424
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:oic-auth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5'}]}]}]

Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
SQL Injection in liftkit/database (GHSA-8hcf-2m4v-f2rq)
Aliases: CVE-2016-15020
Published: 2023-01-16T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'liftkit/database'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.13.2'}]}]}]

A vulnerability was found in liftkit database up to 2.13.1. It has been classified as critical. This affects the function processOrderBy of the file src/Query/Query.php. The manipulation leads to sql injection. Upgrading to version 2.13.2 is able to address this issue. The name of the patch is 42ec8f2b22e0b0b98fb5b4444ed451c1b21d125a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218391.
Improper Authorization in grumpydictator/firefly-iii (GHSA-7mc4-jp4f-v2j2)
Aliases: CVE-2023-0298
Published: 2023-01-14T09:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'grumpydictator/firefly-iii'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.8.0'}]}]}]

Improper Authorization in GitHub repository firefly-iii/firefly-iii prior to 5.8.0.
Apache Superset's SQL Alchemy connector vulnerable to SQL Injection (GHSA-cxvp-3frm-3876)
Aliases: CVE-2022-41703
Published: 2023-01-16T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'versions': ['2.0.0']}]

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter (GHSA-579w-22j4-4749)
Aliases: CVE-2022-44566
Published: 2023-01-18T18:21:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'activerecord'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.1.7.1'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'activerecord'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.4.1'}]}]}]

There is a potential denial of service vulnerability present in ActiveRecord’s PostgreSQL adapter.

This has been assigned the CVE identifier CVE-2022-44566.

Versions Affected: All. Not affected: None. Fixed Versions: 5.2.8.15 (Rails LTS, which is a paid service and not part of the rubygem), 6.1.7.1, 7.0.4.1

Impact:
In ActiveRecord <7.0.4.1 and <6.1.7.1, when a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.
Releases

The fixed releases are available at the normal locations.
Workarounds

Ensure that user supplied input which is provided to ActiveRecord clauses do not contain integers wider than a signed 64bit representation or floats.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy 1 regarding security issues. They are in git-am format and consist of a single changeset.

    6-1-Added-integer-width-check-to-PostgreSQL-Quoting.patch - Patch for 6.1 series
    7-0-Added-integer-width-check-to-PostgreSQL-Quoting.patch - Patch for 7.0 series
Paranoidhttp Server-Side Request Forgery vulnerability (GHSA-v9mp-j8g7-2q6m)
Aliases: CVE-2023-24623
Published: 2023-01-30T06:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hakobe/paranoidhttp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.0'}]}]}]

Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addresses.
Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator (GHSA-jmj6-p2j9-68cp)
Aliases: CVE-2022-3143
Published: 2023-01-13T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.wildfly.security:wildfly-elytron'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.15.15.Final'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.wildfly.security:wildfly-elytron'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.16.0.CR1'}, {'fixed': '1.20.3.Final'}]}]}]

wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses `java.util.Arrays.equals` in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use `java.security.MessageDigest.isEqual` instead. This flaw allows an attacker to access secure information or impersonate an authed user.
KubePi may allow unauthorized access to system API (GHSA-gqx8-hxmv-c4v4)
Aliases: CVE-2023-22478
Published: 2023-01-09T21:56:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/KubeOperator/kubepi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.6.3'}}]

### Summary
Unauthorized access refers to the ability to bypass the system's preset permission settings to access some API interfaces. The attack exploits a flaw in how online applications handle routing permissions.

### Affected Version
<= v1.6.3

### Patches
The vulnerability has been fixed in v1.6.4.

https://github.com/KubeOperator/KubePi/commit/0c6774bf5d9003ae4d60257a3f207c131ff4a6d6

### Workarounds
It is recommended to upgrade the version to v1.6.4.

### For more information
If you have any questions or comments about this advisory, please open an issue.

### References
https://github.com/KubeOperator/KubePi/releases/tag/v1.6.4
SimpleSAMLphp simplesamlphp-module-openid (GHSA-ggj9-6x8j-49w9)
Aliases: CVE-2010-10002
Published: 2023-01-01T18:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'simplesamlphp/simplesamlphp-module-openid'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0'}]}]}]

A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affected is an unknown function of the file `templates/consumer.php` of the component `OpenID Handler`. The manipulation of the argument `AuthState` leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0 can address this issue. The name of the patch is d652d41ccaf8c45d5707e741c0c5d82a2365a9a3. It is recommended to upgrade the affected component. VDB-217170 is the identifier assigned to this vulnerability.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Sandbox bypass in Jenkins Script Security Plugin (GHSA-76qj-9gwh-pvv3)
Aliases: CVE-2023-24422
Published: 2023-01-26T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:script-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1229.v4880b'}]}]}]

A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.
Uniswap Universal Router Incorrect Authorization vulnerability (GHSA-7m37-cx35-qgmr)
Aliases: CVE-2022-48216
Published: 2023-01-04T18:31:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@uniswap/universal-router'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]

Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.
Cross-Site Request Forgery in modoboa (GHSA-9c64-x3cx-vgmm)
Aliases: CVE-2023-0438
Published: 2023-01-23T15:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'modoboa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.4'}]}]}]

Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.
Velociraptor vulnerable to Missing Authorization (GHSA-g5vm-525q-r66c)
Aliases: CVE-2023-0242
Published: 2023-01-18T21:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'www.velocidex.com/golang/velociraptor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.7-5'}]}]}]

Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing or modifying files on the server. The VQL copy() function applies permission checks for reading files but does not check for permission to write files. This allows a low privilege user (usually, users with the Velociraptor "investigator" role) to overwrite files on the server, including Velociraptor configuration files. To exploit this vulnerability, the attacker must already have a Velociraptor user account at a low privilege level (at least "analyst") and be able to log into the GUI and create a notebook where they can run the VQL query invoking the copy() VQL function. Typically, most users deploy Velociraptor with limited access to a trusted group (most users will be administrators within the GUI). This vulnerability is associated with program files https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go https://github.Com/Velocidex/velociraptor/blob/master/vql/filesystem/copy.go and program routines copy(). This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.
Open Redirect Vulnerability in Action Pack (GHSA-9445-4cr6-336r)
Aliases: CVE-2023-22797
Published: 2023-01-18T18:21:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'actionpack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.0.4.1'}]}]}]

There is a vulnerability in Action Controller’s redirect_to. This vulnerability has been assigned the CVE identifier CVE-2023-22797.

Versions Affected: >= 7.0.0 Not affected: < 7.0.0 Fixed Versions: 7.0.4.1
Impact 

There is a possible open redirect when using the redirect_to helper with untrusted user input.

Vulnerable code will look like this:
```
redirect_to(params[:some_param])
```

Rails 7.0 introduced protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could be bypassed by a carefully crafted URL.

All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases

The FIXED releases are available at the normal locations.
Workarounds

There are no feasible workarounds for this issue.
Patches

To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

    7-0-Fix-sec-issue-with-_url_host_allowed.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Missing permissions check in Jenkins JIRA Pipeline Steps Plugin (GHSA-6j27-3xfw-cj2w)
Aliases: CVE-2023-24438
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:jira-steps'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.165.v8846cf59f3db'}]}]}]

A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
window-control vulnerable to Command Injection due to improper input sanitization (GHSA-9mjx-wfqp-j5ph)
Aliases: CVE-2022-25926
Published: 2023-01-04T18:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'window-control'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.5'}]}]}]

window-control is an npm package that provides tools to manage window focus. Versions before 1.4.5 are vulnerable to Command Injection via the `sendKeys` function due to improper input sanitization.
PocketMine-MP has improperly handled dye colour IDs in banner NBT, leading to server crash (GHSA-wqqv-jcfr-9f5g)
Published: 2023-01-09T20:07:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.8.1'}]}]}]

### Impact
`DyeColorIdMap->fromId()` did not account for the possibility that it might be given invalid input. This means that an undefined offset error would occur whenever this happened.

This code is indirectly called during [`Banner->deserializeCompoundTag()`](https://github.com/pmmp/PocketMine-MP/blob/38d6284671e8b657ba557e765a6c29b24a7705f5/src/item/Banner.php#L104), which is invoked when deserializing any item NBT, whether from network or disk.

An attacker could use this bug to crash a server by providing NBT with invalid values for pattern colours in an inventory transaction, or by using `/give` to obtain an item with NBT like this.

### Patches
08b9495bce2d65a6d1d3eeb76e484499a00765eb

### Workarounds
This is quite difficult to work around via a plugin. Theoretically, it's possible to override the `Banner` item class from a plugin and validate the data before it reaches `deserializeCompoundTag()`.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@pmmp.io](mailto:security@pmmp.io)
terminal-kit Inefficient Regular Expression Complexity vulnerability (GHSA-wxgh-8gmr-3qh3)
Aliases: CVE-2021-4306
Published: 2023-01-07T18:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'terminal-kit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.8'}]}]}]

A vulnerability classified as problematic has been found in cronvel terminal-kit up to 2.1.7. Affected is an unknown function. The manipulation leads to inefficient regular expression complexity. Upgrading to version 2.1.8 can address this issue. The name of the patch is a2e446cc3927b559d0281683feb9b821e83b758c. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217620.
wifey vulnerable to Command Injection due to improper input sanitization (GHSA-xj9v-6q2f-vqhx)
Aliases: CVE-2022-25890
Published: 2023-01-09T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'wifey'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.0.7'}]}]}]

All versions of the package wifey are vulnerable to Command Injection via the `connect()` function due to improper input sanitization.
Missing permission check in Jenkins RabbitMQ Consumer Plugin (GHSA-qgjq-hrhg-f24h)
Aliases: CVE-2023-24448
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:rabbitmq-consumer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.8'}]}]}]

A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
Servst vulnerable to Path Traversal (GHSA-88v8-v46g-6c9w)
Aliases: CVE-2022-25936
Published: 2023-01-30T06:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'servst'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.3'}]}]}]

Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.
Publify Improper Input Validation vulnerability (GHSA-q3rm-f527-ghxj)
Aliases: CVE-2023-0299
Published: 2023-01-14T15:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'publify_core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.10'}]}]}]

Improper Input Validation in GitHub repository publify/publify prior to 9.2.10.
CakePHP allows direct access of prefixed controller actions (GHSA-6hg4-vp5q-47mw)
Published: 2023-01-20T23:34:05Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.3.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.4.0'}, {'fixed': '2.4.99'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.5.9'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.11'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.2'}]}]}]

Unconventional URL paths would allow direct access to prefixed actions without setting the correct request parameters.
Excessive Attack Surface in pyload-ng (GHSA-6jmx-pv77-wm5w)
Aliases: CVE-2023-0435
Published: 2023-01-23T00:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'pyload-ng'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.0b3.dev41'}]}]}]

Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.
Cisco Spark Notifier Jenkins Plugin contains Missing Authorization (GHSA-hcvf-pfrm-jxgf)
Aliases: CVE-2023-24451
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:cisco-spark-notifier-plugin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.1'}]}]}]

A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
nemo-appium vulnerable to OS Command Injection (GHSA-c6rx-gxqv-vr5j)
Aliases: CVE-2022-21129
Published: 2023-01-31T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'nemo-appium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.9'}]}]}]

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. 

**Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies.
golang.org/x/net/http2/h2c vulnerable to request smuggling attack (GHSA-fxg5-wq6x-vr4w)
Aliases: CVE-2022-41721
Published: 2023-01-14T00:30:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'golang.org/x/net/http2/h2c'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.0-20220524220425-1d687d428aca'}, {'fixed': '0.1.1-0.20221104162952-702349b0e862'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'golang.org/x/net'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.0-20220524220425-1d687d428aca'}, {'fixed': '0.1.1-0.20221104162952-702349b0e862'}]}]}]

A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the server attempts to read HTTP2 frames from the connection, it will instead be reading the body of the HTTP request, which could be attacker-manipulated to represent arbitrary HTTP2 requests.
Code injection in ruby git (GHSA-pphf-gfrm-v32r)
Aliases: CVE-2022-47318
Published: 2023-01-17T12:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'git'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.13.0'}]}]}]

ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
Plaintext storage of Access Token in Jenkins GitHub Pull Request Coverage Status Plugin (GHSA-4x65-4fjx-r7m6)
Aliases: CVE-2023-24442
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:github-pr-coverage-status'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.2.0'}]}]}]

Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar password unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Bloom Uncontrolled Search Path Element vulnerability (GHSA-fgwp-pwqq-g3w4)
Aliases: CVE-2023-0247
Published: 2023-01-12T18:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/bits-and-blooms/bloom'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.1'}]}]}]

Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1.
Froxlor contains Unchecked Error Condition (GHSA-3chw-8jq2-w769)
Aliases: CVE-2023-0572
Published: 2023-01-30T00:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.10'}]}]}]

Unchecked Error Condition in GitHub repository froxlor/froxlor prior to 2.0.10.
Apache Sling App CMS vulnerable to reflected Cross-site Scripting (GHSA-38m2-vr6g-8c94)
Aliases: CVE-2022-46769
Published: 2023-01-09T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.sling:org.apache.sling.cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.4'}]}]}]

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature. Upgrade to Apache Sling App CMS >= 1.1.4
Java Merge-sort Insecure Temporary File vulnerability (GHSA-qxxc-7mq4-mf79)
Aliases: CVE-2022-24913
Published: 2023-01-12T06:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.util:java-merge-sort'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]

Versions of the package `com.fasterxml.util:java-merge-sort` before 1.1.0 are vulnerable to Insecure Temporary File in the `StdTempFileProvider()` function in `StdTempFileProvider.java`, which uses the permissive `File.createTempFile()` function, exposing temporary file contents.
SUKOHI Surpass Path Traversal vulnerability (GHSA-c9pw-f4wp-22jr)
Aliases: CVE-2015-10030
Published: 2023-01-08T12:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'sukohi/surpass'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0'}]}]}]

A vulnerability has been found in SUKOHI Surpass and classified as critical. This vulnerability affects unknown code of the file `src/Sukohi/Surpass/Surpass.php`. The manipulation of the argument dir leads to pathname traversal. Upgrading to version 1.0.0 can address this issue. The name of the patch is d22337d453a2a14194cdb02bf12cdf9d9f827aa7. It is recommended to upgrade the affected component. VDB-217642 is the identifier assigned to this vulnerability.
Command injection in vagrant.js (GHSA-54jw-jqr9-6cj9)
Aliases: CVE-2022-25962
Published: 2023-01-26T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vagrant.js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.4'}]}]}]

All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.
safeurl-python contains Server-Side Request Forgery (GHSA-jgh8-vchw-q3g7)
Aliases: CVE-2023-24622
Published: 2023-01-27T01:04:27Z
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'safeurl-python'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2'}]}]}]

### Description
In SafeURL it is possible to specify a list of domains that should be matched before a request is sent out. The regex used to compare domains did not work as intended.

### Impact
The regex used was:

`re.match("(?i)^%s" % domain, value)`

This has two problems, first that only the beginning and not the end of the string is anchored. Second, that a dot in the domain matches any character as part of regex syntax.

Therefore, an allowlist of ["victim.com"] could allow the domain "victimacomattacker.com" to be requested.

This has lower impact since the usual attacker aim in an SSRF is to request internal resources such as private IP addresses rather than an attacker's own domain. But, in a case where SafeURL had specifically been used to try to limit requests to a particular allowlist, say for example a PDF renderer, the finding would be more severe.

### Patches
Fixed in https://github.com/IncludeSecurity/safeurl-python/pull/5

### References
[Server-side request forgery (SSRF)](https://portswigger.net/web-security/ssrf)
gatsby-transformer-remark has possible unsanitized JavaScript code injection (GHSA-7ch4-rr99-cqcw)
Aliases: CVE-2023-22491
Published: 2023-01-11T18:27:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'gatsby-transformer-remark'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.3.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'gatsby-transformer-remark'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.25.1'}]}]}]

### Impact
The gatsby-transformer-remark plugin prior to versions 5.25.1 and 6.3.2 passes input through to the `gray-matter` npm package, which is vulnerable to JavaScript injection in its default configuration, unless input is sanitized.  The vulnerability is present in gatsby-transformer-remark when passing input in data mode (querying MarkdownRemark nodes via GraphQL).  Injected JavaScript executes in the context of the build server.

To exploit this vulnerability untrusted/unsanitized input would need to be sourced by or added into a file processed by gatsby-transformer-remark.  The following payload demonstrates a vulnerable configuration:
```
---js
((require("child_process")).execSync("id >> /tmp/rce"))
--- 
```

### Patches
A patch has been introduced in `gatsby-transformer-remark@5.25.1` and `gatsby-transformer-remark@6.3.2` which mitigates the issue by disabling the `gray-matter` JavaScript Frontmatter engine.  The patch introduces a new option, `JSFrontmatterEngine` which is set to `false` by default.  When setting `JSFrontmatterEngine` to `true`, input passed to `gatsby-plugin-mdx` must be sanitized before processing to avoid a security risk.  Warnings are displayed when enabling `JSFrontmatterEngine` to `true` or if it appears that the MarkdownRemark input is attempting to use the Frontmatter engine.

### Workarounds
If an older version of `gatsby-transformer-remark` must be used, input passed into the plugin should be sanitized ahead of processing.

**We encourage projects to upgrade to the latest major release branch for all Gatsby plugins to ensure the latest security updates and bug fixes are received in a timely manner.**


### For more information
Email us at [security@gatsbyjs.com](mailto:security@gatsbyjs.com).
CSRF vulnerability in Jenkins TestQuality Updater Plugin  (GHSA-px2f-cqrf-f2qg)
Aliases: CVE-2023-24452
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:testquality-updater'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3'}]}]}]

A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
Passwords stored in plain text by Jenkins view-cloner Plugin  (GHSA-6hw7-x86v-wrgf)
Aliases: CVE-2023-24450
Published: 2023-01-26T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:view-cloner'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1'}]}]}]

Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Warp vulnerable to Path Traversal via Improper validation of Windows paths (GHSA-8v4j-7jgf-5rg9)
Published: 2023-01-31T23:33:47Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'warp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.3'}]}]}]

Path resolution in `warp::filters::fs::dir` didn't correctly validate Windows paths meaning paths like `/foo/bar/c:/windows/web/screen/img101.png` would be allowed and respond with the contents of `c:/windows/web/screen/img101.png`. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.
Fix for authenticated remote code execution through layout update (GHSA-5j2g-3ph4-rgvm)
Aliases: CVE-2021-41144
Published: 2023-01-27T00:56:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.4.22'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'openmage/magento-lts'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '20.0.0'}, {'fixed': '20.0.19'}]}]}]

### Impact
A layout block was able to bypass the block blacklist to execute remote code.
mechanize Regular Expression Denial of Service vulnerability (GHSA-g3pv-pj5f-3hfq)
Aliases: CVE-2021-32837
Published: 2023-01-18T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'mechanize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.4.6'}]}]}]

mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. If a web server responds in a malicious way, then mechanize could crash. Version 0.4.6 has a patch for the issue.
Path traversal in binwalk (GHSA-3cm8-v4mc-gppg)
Aliases: CVE-2022-4510
Published: 2023-01-26T21:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'binwalk'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.2b'}, {'last_affected': '2.3.3'}]}]}]

A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 inclusive. By crafting a malicious PFS filesystem file, an attacker can get binwalk's PFS extractor to extract files at arbitrary locations when binwalk is run in extraction mode (-e option). Remote code execution can be achieved by building a PFS filesystem that, upon extraction, would extract a malicious binwalk module into the folder .config/binwalk/plugins. This vulnerability is associated with program files src/binwalk/plugins/unpfs.py. This issue affects binwalk from 2.1.2b through and including 2.3.3.
Gravitee API Management contains Path Traversal (GHSA-vp62-m958-qj8c)
Aliases: CVE-2022-38723
Published: 2023-01-04T00:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.gravitee.apim:gravitee-api-management'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.15.13'}]}]}]

**This CVE addresses the partial fix for CVE-2019-25075**

Gravitee API Management before 3.15.13 allows path traversal through HTML injection. A certain HTML injection combined with path traversal in the Email service in Gravitee API Management before 3.15.13 allows anonymous users to read arbitrary files via a /management/users/register request.

A patch was published in 2019 for this vulnerability but did not appear to have solved the issue. Version 3.15.13 did remove the flaw.
OpenStack Cinder, glance, and Nova vulnerable to Path Traversal (GHSA-7h75-hwxx-qpgc)
Aliases: CVE-2022-47951
Published: 2023-01-27T00:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'cinder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.1.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'cinder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '20.0.0'}, {'fixed': '20.0.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'glance'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '23.0.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'glance'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '24.0.0'}, {'fixed': '24.1.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'nova'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '24.1.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'nova'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '25.0.0'}, {'fixed': '25.0.2'}]}]}]

An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
robots-txt-guard Inefficient Regular Expression Complexity vulnerability (GHSA-6g33-8w2q-4hxv)
Aliases: CVE-2021-4305
Published: 2023-01-05T12:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'robots-txt-guard'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.2'}]}]}]

A vulnerability was found in Woorank robots-txt-guard. It has been rated as problematic. Affected by this issue is the function makePathPattern of the file lib/patterns.js. The manipulation of the argument pattern leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. The name of the patch is c03827cd2f9933619c23894ce7c98401ea824020. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217448.
Apache Superset vulnerable to Cross-Site Request Forgery via legacy REST API endpoints (GHSA-7222-r37x-8q3m)
Aliases: CVE-2022-43719
Published: 2023-01-16T12:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'versions': ['2.0.0']}]

Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
Publify contains Weak Password Requirements (GHSA-g7gf-2rqw-5rwx)
Aliases: CVE-2023-0569
Published: 2023-01-29T18:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'publify_core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.2.10'}]}]}]

Weak Password Requirements in GitHub repository publify/publify prior to 9.2.10.
Velociraptor subject to Path Traversal (GHSA-7jf5-fvgf-48c6)
Aliases: CVE-2023-0290
Published: 2023-01-19T00:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'www.velocidex.com/golang/velociraptor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.7-5'}]}]}]

Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client. Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to "administrator" role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the "investigator" role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least "investigator" level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI. This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.
Apache Tomcat improperly escapes input from JsonErrorReportValve (GHSA-rq2w-37h9-vg94)
Aliases: CVE-2022-45143
Published: 2023-01-03T21:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.5.83'}, {'fixed': '8.5.84'}]}], 'versions': ['8.5.83']}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.40'}, {'fixed': '9.0.69'}]}], 'database_specific': {'last_known_affected_version_range': '<= 9.0.68'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.1.0'}, {'fixed': '10.1.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 10.1.1'}}]

The `JsonErrorReportValve` in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the `type`, `message` or `description` values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or manipulated the JSON output.
gry vulnerable to Command Injection (GHSA-w5mw-f2hq-5fw8)
Aliases: CVE-2020-36650
Published: 2023-01-11T18:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'gry'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.0'}]}]}]

A vulnerability, which was classified as critical, was found in IonicaBizau node-gry up to 5.x. This affects an unknown part. The manipulation leads to command injection. Upgrading to version 6.0.0 is able to address this issue. The name of the patch is 5108446c1e23960d65e8b973f1d9486f9f9dbd6c. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-218019.
Apache Superset vulnerable to Injection (GHSA-fpmr-qmgh-42x2)
Aliases: CVE-2022-43720
Published: 2023-01-16T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.5.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'apache-superset'}, 'versions': ['2.0.0']}]

An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
CakePHP Database\\Query::offset() and limit() methods are vulnerable to SQL injection (GHSA-6g8q-qfpv-57wp)
Aliases: CVE-2023-22727
Published: 2023-01-20T17:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.11'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.4.0'}, {'fixed': '4.4.10'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/database'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/database'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.11'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/database'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.4.0'}, {'fixed': '4.4.10'}]}]}]

### Impact

The `Cake\Database\Query::limit()` and `Cake\Database\Query::offset()` methods are vulnerable to SQL injection if passed un-sanitized user request data.

### Patches
This issue has been fixed in 4.2.12, 4.3.11, 4.4.10

### Workarounds

Using CakePHP's Pagination library will mitigate this issue, as will validating or casting parameters to these methods.

### References

https://bakery.cakephp.org/2023/01/06/cakephp_4211_4311_4410_released.html