aswin1906/github-advisory-2023 huggingface dataset:
XWiki Platform vulnerable to data leak via Improper Restriction of XML External Entity Reference (GHSA-gx4f-976g-7g6v)
Aliases: CVE-2023-27480
Published: 2023-03-08T17:19:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-xar-model'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1-milestone-3'}, {'fixed': '13.10.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-xar-model'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0'}, {'fixed': '14.4.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-xar-model'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10-rc-1'}]}]}]

### Impact
Any user with edit rights on a document can trigger a XAR import on a forged XAR file, leading to the ability to display the content of any file on the XWiki server host.

Example to reproduce:
* Create a forget XAR file and inside it, have the following `package.xml` content:
  ```xml
  <?xml version="1.0" encoding="UTF-8"?>
  <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>

  <package>
  <infos>
  <name>&xxe;</name>
  <description> &xxe; Helper pages for creating and listing Class/Template/Sheets</description>
  <licence></licence>
  <author>XWiki.Admin</author>
  ...
  ```
* Upload it onto a wiki page (e.g. `XXE`) as an attachment (e.g. `test.xar`).
* Call the page using `http://localhost:8080/xwiki/bin/view/Main/XXE?sheet=XWiki.AdminImportSheet&file=test.xar`

You'll then notice that the displayed UI contains the content of the `/etc/passwd` file.

### Patches
The vulnerability has been patched in XWiki 13.10.11, 14.4.7 and 14.10-rc-1.

### Workarounds
You'd need to get XWiki Platform sources and apply the changes from https://github.com/xwiki/xwiki-platform/commit/e3527b98fdd8dc8179c24dc55e662b2c55199434 to the `XarPackage` java class and then copy the modified version to your `WEB-INF/classes` directory (or rebuild the `xwiki-platform-xar-model` maven module and replace the one found in `WEB-INF/lib/`).

### References
* https://github.com/xwiki/xwiki-platform/commit/e3527b98fdd8dc8179c24dc55e662b2c55199434
* https://jira.xwiki.org/browse/XWIKI-20320

### For more information
If you have any questions or comments about this advisory:
*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
imgproxy Cross-site Scripting vulnerability (GHSA-ch9g-x9j7-rcgp)
Aliases: CVE-2023-1496
Published: 2023-03-19T18:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/imgproxy/imgproxy/v3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.14.0'}]}]}]

Cross-site Scripting (XSS) - Reflected in GitHub repository imgproxy/imgproxy prior to 3.14.0.
Full authentication bypass if SASL authorization username is specified (GHSA-4g76-w3xw-2x6w)
Aliases: CVE-2023-27582
Published: 2023-03-14T18:03:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/foxcpp/maddy'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.0'}, {'fixed': '0.6.3'}]}]}]

### Impact

maddy 0.2.0 - 0.6.2 allows a full authentication bypass if SASL authorization username is specified when using the PLAIN authentication mechanisms. Instead of validating the specified authorization username, it is accepted as is after checking the credentials for the authentication username.

### Patches

maddy 0.6.3 includes the fix for the bug. 

### Workarounds

There is no way to fix the issue without upgrading.

### References

* Commit that introduced the vulnerable code: https://github.com/foxcpp/maddy/commit/55a91a37b71210f34f98f4d327c30308fe24399a
* Fix: https://github.com/foxcpp/maddy/commit/9f58cb64b39cdc01928ec463bdb198c4c2313a9c
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch (GHSA-7phw-cxx7-q9vq)
Aliases: CVE-2023-20860
Published: 2023-03-28T00:34:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework:spring'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.0.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework:spring'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.3.0'}, {'fixed': '5.3.26'}]}]}]

Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a security bypass.
Answer has Guessable CAPTCHA (GHSA-g44v-6qfm-f6ch)
Aliases: CVE-2023-1539
Published: 2023-03-21T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Guessable CAPTCHA in GitHub repository answerdev/answer prior to 1.0.6.
Froxlor is vulnerable to authentication bypass (GHSA-j83x-r9qq-9g4v)
Aliases: CVE-2023-1307
Published: 2023-03-10T03:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'froxlor/froxlor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.13'}]}]}]

Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
HashiCorp Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File (GHSA-v3hp-mcj5-pg39)
Aliases: CVE-2023-0620
Published: 2023-03-30T03:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.8.0'}, {'fixed': '1.11.9'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.12.0'}, {'fixed': '1.12.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/vault'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.13.0'}, {'fixed': '1.13.1'}]}]}]

HashiCorp Vault and Vault Enterprise versions 0.8.0 until 1.13.1 are vulnerable to an SQL injection attack when using the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin, certain parameters are required to establish a connection (schema, database, and table) are not sanitized when passed to the user-provided MSSQL database. A privileged attacker with the ability to write arbitrary data to Vault's configuration may modify these parameters to execute a malicious SQL command when the Vault configuration is applied. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9.
phpMyFAQ Code Injection vulnerability (GHSA-6cpg-gqgq-2rrr)
Aliases: CVE-2023-1761
Published: 2023-03-31T03:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.12'}]}]}]

Code Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12.
keycloak-connect contains Open redirect vulnerability in the Node.js adapter (GHSA-59fq-727j-hm3f)
Aliases: CVE-2022-2237
Published: 2023-03-02T23:21:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'keycloak-connect'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '21.0.1'}]}]}]

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using `checkSSO` with query param `prompt=none`.
Kubernetes vulnerable to validation bypass (GHSA-jh36-q97c-9928)
Aliases: CVE-2022-3294
Published: 2023-03-01T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.25.0'}, {'fixed': '1.25.4'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.24.0'}, {'fixed': '1.24.8'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.23.0'}, {'fixed': '1.23.14'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/kubernetes/kubernetes'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.22.0'}, {'fixed': '1.22.16'}]}]}]

Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.
node-static and @nubosoftware/node-static vulnerable to Directory Traversal (GHSA-5g97-whc9-8g7j)
Aliases: CVE-2023-26111
Published: 2023-03-06T06:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'node-static'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.7.11'}]}]}, {'package': {'ecosystem': 'npm', 'name': '@nubosoftware/node-static'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.7.11'}]}]}]

node-static and the fork @nubosoftware/node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.
baserCMS allows any file to be uploaded (GHSA-mfvg-qwcw-qvc8)
Aliases: CVE-2023-25655
Published: 2023-03-23T20:00:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'baserproject/basercms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.7.5'}]}]}]

There is a vulnerability that allows uploading any files to baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

### Target
baserCMS 4.7.3 and earlier versions

### Vulnerability
Malicious files may be uploaded in Upload File Management.

### Countermeasures
Update to the latest version of baserCMS

Please refer to the following page to reference for more information.
https://basercms.net/security/JVN_61105618

### Credits
- Taisei Inoue@GMO Cybersecurity by Ierae, Inc.
- Yusuke Akagi@Mitsui Bussan Secure Directions, Inc.
Moodle may allow teachers to access the names of users they could not otherwise access (GHSA-prjm-2fj2-787f)
Aliases: CVE-2023-28336
Published: 2023-03-23T21:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0'}, {'fixed': '3.11.13'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.20'}]}]}]

Insufficient filtering of grade report history made it possible for teachers to access the names of users they could not otherwise access.
Spring Vault vulnerable to insertion of sensitive information into a log file (GHSA-r47r-87p9-8jh3)
Aliases: CVE-2023-20859
Published: 2023-03-23T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.vault:spring-vault-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.vault:spring-vault-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.3'}]}]}]

In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertion of sensitive information into a log file when it attempts to revoke a Vault batch token.
SQL Injection in Funadmin (GHSA-vhrv-9f9g-rfrx)
Aliases: CVE-2023-24781
Published: 2023-03-07T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'funadmin/funadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.2.0'}]}]}]

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.
Apiman vulnerable to permissions bypass due to missing check on API key URL (GHSA-m6f8-hjrv-mw5f)
Aliases: CVE-2023-28640
Published: 2023-03-27T22:17:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.apiman:apiman-manager-api-rest-impl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.0.Final'}]}], 'database_specific': {'last_known_affected_version_range': '< 3.0.0.Final'}}]

### Impact

Due to a missing permissions check, an attacker with an authenticated Apiman Manager account may be able to gain access to API keys they do not have permission for if they correctly guess the URL. The URL includes Organisation ID, Client ID, and Client Version of the targeted non-permitted resource, and each of these can have arbitrary values.

While not trivial to exploit, it could be achieved by brute-forcing or guessing common names.

Access to the non-permitted API Keys could allow use of other users' resources without their permission (depending on the specifics of configuration, such as whether an API key is the only form of security).

### Patches

Apiman 3.1.0.Final and later resolves this issue. 

### Workarounds

Only provide Apiman Manager accounts to known users, do not allow anonymous/unknown users to create an Apiman Manager account.

Note that this does **not** affect the Apiman Gateway.

### References

* [Blog post disclosing issue](https://www.apiman.io/blog/potential-permissions-bypass-disclosure/)
Panic leading to denial of service (GHSA-hw7c-3rfg-p46j)
Aliases: CVE-2023-24535
Published: 2023-03-14T23:01:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'google.golang.org/protobuf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.29.0'}, {'fixed': '1.29.1'}]}]}]

Parsing invalid messages can panic.

Parsing a text-format message which contains a potential number consisting of a minus sign, one or more characters of whitespace, and no further input will cause a panic.
Answer vulnerable to Cross-site Scripting (GHSA-55vm-3vq3-4jpc)
Aliases: CVE-2023-1240
Published: 2023-03-07T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
SQL Injection in Funadmin (GHSA-v43v-pv95-jc55)
Aliases: CVE-2023-24775
Published: 2023-03-07T18:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'funadmin/funadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.2.0'}]}]}]

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.
Opencontainers runc Incorrect Authorization vulnerability (GHSA-vpvm-3wq2-2wvm)
Aliases: CVE-2023-27561
Published: 2023-03-03T21:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/opencontainers/runc'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0-rc95'}, {'fixed': '1.1.5'}]}]}]

runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to `libcontainer/rootfs_linux.go`. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.
XWiki Platform may allow privilege escalation to programming rights via user's first name (GHSA-8cw6-4r32-6r3h)
Aliases: CVE-2023-26055
Published: 2023-03-03T22:49:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.commons:xwiki-commons-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1-milestone-1'}, {'fixed': '13.10.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.commons:xwiki-commons-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0-rc-1'}, {'fixed': '14.4.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.commons:xwiki-commons-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.7-rc-1'}]}]}]

### Impact
Any user can edit his own profile and inject code which is going to be executed with programming right.

Steps to reproduce:

* Set your first name to

```
    {{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}
```

The first name appears as interpreted "`Hello from groovy`" instead of the expected fully escaped "`{{cache id="userProfile"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}`".

The same vulnerability can also be exploited in all other places where short text properties are displayed, e.g., in apps created using [Apps Within Minutes](https://extensions.xwiki.org/xwiki/bin/view/Extension/App%20Within%20Minutes%20Application) that use a short text field.

### Patches
The problem has been patched on versions 13.10.9, 14.4.4, 14.7RC1.

### Workarounds
There are no other workarounds than upgrading XWiki or patching the xwiki-commons-xml JAR file.

### References
* https://jira.xwiki.org/browse/XWIKI-19793
* https://jira.xwiki.org/browse/XWIKI-19794
* https://jira.xwiki.org/browse/XCOMMONS-2498

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)
kaml has potential denial of service while parsing input with anchors and aliases  (GHSA-c24f-2j3g-rg48)
Aliases: CVE-2023-28118
Published: 2023-03-20T21:26:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.charleskorn.kaml:kaml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.53.0'}]}]}]

### Impact
Applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash.

### Patches
Version 0.53.0 and later default to refusing to parse YAML documents containing anchors and aliases.

### Workarounds
None.

### References
Wikipedia has an explanation of this class of vulnerability: [billion laughs attack](https://en.wikipedia.org/wiki/Billion_laughs_attack)

### Acknowledgements
Thank you to @gdude2002 for reporting this issue.
Apache InLong vulnerable to JDBC Deserialization of Untrusted Data (GHSA-gpqq-59rp-3c3w)
Aliases: CVE-2023-27296
Published: 2023-03-27T15:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.inlong:inlong-manager'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.1.0'}, {'fixed': '1.6.0'}]}]}]

Apache InLong versions from 1.1.0 through 1.5.0 are vulnerable to Java Database Connectivity (JDBC) deserialization of untrusted data from the MySQL JDBC URL in MySQLDataNode. It could be triggered by authenticated users of InLong. This has been patched in version 1.6.0. Users are advised to upgrade to Apache InLong's latest version or cherry-pick the [patch](https://github.com/apache/inlong/pull/7422) to solve it.
Directus vulnerable to extraction of password hashes through export querying (GHSA-m5q3-8wgf-x8xf)
Aliases: CVE-2023-27481
Published: 2023-03-08T17:13:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'directus'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.16.0'}]}]}]

### Impact

Users with read access to the `password` field in `directus_users` can extract the argon2 password hashes by brute forcing the export functionality combined with a `_starts_with` filter. This allows the user to enumerate the password hashes.

### Patches

The problem has been patched by preventing any hashed/concealed field to be filtered against with the `_starts_with` or other string operator.

### Workarounds

Ensuring that no user has `read` access to the `password` field in `directus_users` is sufficient to prevent this vulnerability. 


### For more information
If you have any questions or comments about this advisory:
* Open a Discussion in [directus/directus](https://github.com/directus/directus/discussions/new)
* Email us at [security@directus.io](mailto:security@directus.io)
Moodle vulnerable to Server-Side Request Forgery (GHSA-4rmj-w58m-fvch)
Aliases: CVE-2021-36396
Published: 2023-03-06T21:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
node-bluetooth is vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation (GHSA-cxx3-36qc-m6qm)
Aliases: CVE-2023-26110
Published: 2023-03-09T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'node-bluetooth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.2.6'}]}]}]

All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.
Moodle has a Hidden Functionality vulnerability (GHSA-j9cw-5cpj-9qj5)
Aliases: CVE-2021-36403
Published: 2023-03-07T00:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.11.0-beta'}, {'fixed': '3.11.1'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0-beta'}, {'fixed': '3.10.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'moodle/moodle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.9.8'}]}]}]

In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may pose a phishing risk.
Funadmin vulnerable to SQL injection (GHSA-jx2x-fg9p-7gc7)
Aliases: CVE-2023-24774
Published: 2023-03-10T15:30:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'funadmin/funadmin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.2.0'}]}]}]

Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.
Answer vulnerable to Cross-site Scripting (GHSA-6c32-3x46-m9rh)
Aliases: CVE-2023-1245
Published: 2023-03-07T09:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
TensorFlow has Floating Point Exception in AudioSpectrogram  (GHSA-f637-vh3r-vfh2)
Aliases: CVE-2023-25666
Published: 2023-03-24T21:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
version:2.11.0 //core/ops/audio_ops.cc:70

Status SpectrogramShapeFn(InferenceContext* c) { ShapeHandle input; TF_RETURN_IF_ERROR(c->WithRank(c->input(0), 2, &input)); int32_t window_size; TF_RETURN_IF_ERROR(c->GetAttr("window_size", &window_size)); int32_t stride; TF_RETURN_IF_ERROR(c->GetAttr("stride", &stride)); .....[1]

DimensionHandle input_length = c->Dim(input, 0); DimensionHandle input_channels = c->Dim(input, 1);

DimensionHandle output_length; if (!c->ValueKnown(input_length)) { output_length = c->UnknownDim(); } else { const int64_t input_length_value = c->Value(input_length); const int64_t length_minus_window = (input_length_value - window_size); int64_t output_length_value; if (length_minus_window < 0) { output_length_value = 0; } else { output_length_value = 1 + (length_minus_window / stride); .....[2] } output_length = c->MakeDim(output_length_value); }

Get the value of stride at [1], and the used at [2]
```python
import tensorflow as tf

para = {'input': tf.constant([[14.], [24.]], dtype=tf.float32), 'window_size': 1, 'stride': 0, 'magnitude_squared': False}
func = tf.raw_ops.AudioSpectrogram

@tf.function(jit_compile=True)
def fuzz_jit():
   y = func(**para)
   return y

fuzz_jit()
```

### Patches
We have patched the issue in GitHub commit [d0d4e779da0d0f56499c6fa5ba09f0a576cc6b14](https://github.com/tensorflow/tensorflow/commit/d0d4e779da0d0f56499c6fa5ba09f0a576cc6b14).

The fix will be included in TensorFlow 2.12.0. We will also cherrypick this commit on TensorFlow 2.11.1


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx
code-server vulnerable to Missing Origin Validation in WebSockets (GHSA-frjg-g767-7363)
Aliases: CVE-2023-26114
Published: 2023-03-23T06:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'code-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.10.1'}]}]}]

Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. Exploiting this vulnerability can allow an adversary in specific scenarios to access data from and connect to the code-server instance.
sqlite vulnerable to code execution due to Object coercion (GHSA-jqv5-7xpx-qj74)
Aliases: CVE-2022-43441
Published: 2023-03-13T20:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'sqlite3'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.1.5'}]}]}]

### Impact

Due to the underlying implementation of `.ToString()`, it's possible to execute arbitrary JavaScript, or to achieve a denial-of-service, if a binding parameter is a crafted Object.

Users of `sqlite3` v5.0.0 - v5.1.4 are affected by this.

### Patches

Fixed in v5.1.5. All users are recommended to upgrade to v5.1.5 or later.

### Workarounds

* Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters.

### References

* Commit: https://github.com/TryGhost/node-sqlite3/commit/edb1934dd222ae55632e120d8f64552d5191c781

### For more information

If you have any questions or comments about this advisory:

* Email us at [security@ghost.org](mailto:security@ghost.org)

Credits: Dave McDaniel of Cisco Talos
TensorFlow has Null Pointer Error in LookupTableImportV2 (GHSA-94mm-g2mv-8p7r)
Aliases: CVE-2023-25672
Published: 2023-03-24T21:54:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.1'}]}]}]

### Impact
The function `tf.raw_ops.LookupTableImportV2` cannot handle scalars in the `values` parameter and gives an NPE.

```python
import tensorflow as tf

v = tf.Variable(1)

@tf.function(jit_compile=True)
def test():
   func = tf.raw_ops.LookupTableImportV2
   para={'table_handle': v.handle,'keys': [62.98910140991211, 94.36528015136719], 'values': -919}

   y = func(**para)
   return y

print(test())
```

### Patches
We have patched the issue in GitHub commit [980b22536abcbbe1b4a5642fc940af33d8c19b69](https://github.com/tensorflow/tensorflow/commit/980b22536abcbbe1b4a5642fc940af33d8c19b69).

The fix will be included in TensorFlow 2.12. We will also cherrypick this commit on TensorFlow 2.11.1.


### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.


### Attribution
This vulnerability has been reported by r3pwnx of 360 AIVul Team
Vega Expression Language `scale` expression function Cross Site Scripting (GHSA-4vq7-882g-wcg4)
Aliases: CVE-2023-26486
Published: 2023-03-02T23:11:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'vega-functions'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.13.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'vega'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.23.0'}]}]}]

### Summary
The Vega `scale` expression function has the ability to call arbitrary functions with a single controlled argument. This can be exploited to escape the Vega expression sandbox in order to execute arbitrary JavaScript.

### Details

The [scale](https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/functions/scale.js#L36-L37) expression function passes a user supplied argument `group` to [getScale](https://github.dev/vega/vega/blob/72b9b3bbf912212e7879b6acaccc84aff969ef1c/packages/vega-functions/src/scales.js#L6), which is then used as if it were an internal context. The `context.scales[name].value` is accessed from `group` and called as a function back in `scale`.

### PoC
The following Vega definition can be used to demonstrate this issue executing the JavaScript code `alert(1);`
```json
{
  "$schema": "https://vega.github.io/schema/vega/v5.json",
  "data": [
    {
      "name": "XSS PoC",
      "values": [1],
      "transform": [
        {
          "type": "formula",
          "as": "amount",
          "expr": "scale('func', null,  {context: {scales: {func: {value: scale('func', 'eval(atob(\"YWxlcnQoMSk7\"))', {context: {scales: {func: {value: [].constructor.constructor}}}})}}}})"
        }
      ]
    }
  ]
}
```

This can be viewed in the Vega online IDE at https://vega.github.io/editor/#/url/vega/N4IgJAzgxgFgpgWwIYgFwhgF0wBwqgegIDc4BzJAOjIEtMYBXAI0poHsDp5kTykSArJQBWENgDsQAGhAATJJhSoA2qHFIEcNCAAaAZT0ACAApsAwtJDEkAGwZwIaZQEYAujMwAnJOIgAzNk8EJ1BMAE8cLXQAoIYbFBkkR3QNNgZxTEs4AA8cT21oWzgACgByP3SoUqlDcTibGsNgKAlMHMxUJsKbB07gCvEoPus7OE7ukvLK6sNSuBHihTYmYoAdEABNAHVsmyhxAEU2AFk9AGsAdnWASmuZ5tb2von8JoGhppH7TuVXShbfF4GFBMIF-hIIECQYEAL5wmHXeEIkAw1yomFAA
weixin-python XML External Entity vulnerability (GHSA-h384-ph77-3699)
Aliases: CVE-2018-25082
Published: 2023-03-21T18:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'weixin-python'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.5'}]}]}]

A vulnerability was found in zwczou WeChat SDK Python 0.3.0 and classified as critical. This issue affects the function validate/to_xml. The manipulation leads to xml external entity reference. The attack may be initiated remotely. Upgrading to version 0.5.5 is able to address this issue. The name of the patch is e54abadc777715b6dcb545c13214d1dea63df6c9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-223403.
jeecg-boot vulnerable to SQL injection (GHSA-23xf-5535-62v5)
Aliases: CVE-2023-1741
Published: 2023-03-31T00:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jeecgframework.boot:jeecg-boot-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.5.0'}]}]}]

jeecg-boot 3.5.0 is vulnerable to SQL injection from functionality of the file `SysDictMapper.java` of the component `Sleep Command Handler`. The attack can be launched remotely and the exploit has been disclosed to the public and may be used.
cockpit-hq/cockpit is vulnerable to unrestricted file uploads  (GHSA-6x8f-x6qw-qwx3)
Aliases: CVE-2023-1313
Published: 2023-03-10T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'cockpit-hq/cockpit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.1'}]}]}]

Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
Answer vulnerable to Cross-site Scripting (GHSA-ff27-hrmr-ggpj)
Aliases: CVE-2023-1241
Published: 2023-03-07T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Company admin role gives excessive privileges in eZ Platform Ibexa (GHSA-qq2j-9pf8-g58c)
Aliases: CVE-2022-48365
Published: 2023-03-12T06:30:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezpublish-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.5.0'}, {'fixed': '7.5.30'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'ezsystems/ezplatform-kernel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.3.26'}]}]}]

Users with the Company admin role (introduced by the company account feature in v4) can assign any role to any user. This also applies to any other user that has the role / assign policy. Any subtree limitation in place does not have any effect.

The role / assign policy is typically only given to administrators, which limits the scope in most cases, but please verify who has this policy in your installaton. The fix ensures that subtree limitations are working as intended.
Answer vulnerable to Cross-site Scripting (GHSA-9v4v-9fj5-p982)
Aliases: CVE-2023-1237
Published: 2023-03-07T09:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/answerdev/answer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.6'}]}]}]

Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.6.
Crossplane-runtime contains Improper Input Validation via Compositions (GHSA-v829-x6hh-cqfq)
Aliases: CVE-2023-27484
Published: 2023-03-10T23:47:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.2'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.10.0'}, {'fixed': '1.10.3'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/crossplane/crossplane'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11.0'}, {'fixed': '1.11.2'}]}]}]

### Summary

Fuzz testing, by Ada Logics and sponsored by the CNCF, identified a [vulnerability](https://github.com/crossplane/crossplane-runtime/security/advisories/GHSA-vfvj-3m3g-m532) in the `fieldpath` package from `crossplane/crossplane-runtime` that an already highly privileged Crossplane user able to create or update Compositions could leverage to cause an out of memory panic in Crossplane.

### Details

Compositions allow users to specify patches inserting elements into arrays at an arbitrary index. When a Composition is selected for a Composite Resource, patches are evaluated and if a specified index is greater than the current size of the target slice, that slice's size will be increased to the specified index, which could lead to an excessive amount of memory usage and therefore the Pod being OOM-Killed. The index is already capped to the maximum value for a uint32 (4294967295) when parsed, but that is still an unnecessarily large value.

### Workaround

Users can restrict write privileges on Compositions to only admin users as a workaround.
Karate has vulnerable dependency on json-smart package (CVE-2023-1370) (GHSA-5x5q-8cgm-2hjq)
Published: 2023-03-31T22:44:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.intuit.karate:karate-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.1'}, {'fixed': '1.4.0'}]}], 'versions': ['1.3.1']}]

### Summary
Karate has vulnerable dependency on the package [net.minidev:json-smart](https://github.com/netplex/json-smart-v1). More information is available at https://github.com/oswaldobapvicjr/jsonmerge/security/advisories/GHSA-493p-pfq6-5258.

![image](https://user-images.githubusercontent.com/2663049/229081854-1155c041-56fa-48ca-a7ff-f2f085b845fd.png)


### How to fix it
Very simple, just upgrade json-path package to 2.8.0 (from 2.7.0) inside karate-core pom.xml ;)
Mattermost vulnerable to information disclosure (GHSA-3wq5-3f56-v5xc)
Aliases: CVE-2023-1777
Published: 2023-03-31T12:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server/v6'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.3.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 6.7.2'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.8.0'}, {'fixed': '7.8.1'}]}], 'versions': ['7.8.0']}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.7.0'}, {'fixed': '7.7.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.7.1'}}, {'package': {'ecosystem': 'Go', 'name': 'github.com/mattermost/mattermost-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.1.0'}, {'fixed': '7.1.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 7.1.5'}}]

Mattermost allows an attacker to request a preview of an existing message when creating a new message via the createPost API call, disclosing the contents of the linked message.
Goutil vulnerable to path traversal when unzipping files (GHSA-fx2v-qfhr-4chv)
Aliases: CVE-2023-27475
Published: 2023-03-07T20:37:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gookit/goutil'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.0'}]}]}]

### Impact

ZipSlip issue when use fsutil package to unzip files.
When users use fsutil.Unzip to unzip zip files from a malicious attacker, they may be vulnerable to path traversal. 

### Patches

It has been fixed in v0.6.0, Please upgrade version to v0.6.0 or above.

### Workarounds
No, users have to upgrade version.
Etcd-io Improper Authentication vulnerability (GHSA-gmph-wf7j-9gcm)
Aliases: CVE-2021-28235
Published: 2023-04-04T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'go.etcd.io/etcd/v3'}, 'versions': ['3.4.10']}]

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.

This has been fixed in v.[3.5.8](https://github.com/etcd-io/etcd/blob/main/CHANGELOG/CHANGELOG-3.5.md#etcd-server) and was also backported to [3.4](https://github.com/etcd-io/etcd/pull/15655) and [3.5](https://github.com/etcd-io/etcd/pull/15653).
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Pay (GHSA-cqf3-vpx7-rxhw)
Aliases: CVE-2023-30614
Published: 2023-04-20T21:28:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'pay'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.3.2'}]}]}]

### Impact
A payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality.

### Patches
This has been patched in version 6.3.2 and above.

Pay will now sanitize the `back` parameter and only permit relative paths.
@nuxtlabs/github-module made Use of Hard-coded Credentials (GHSA-fp2w-g92g-fgq4)
Aliases: CVE-2023-2138
Published: 2023-04-18T03:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@nuxtlabs/github-module'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.2'}]}]}]

https://nuxt.com had a hardcoded GitHub token in the source code of the page. This token had access to multiple repositories under `nuxt`, `nuxtlabs` and `nuxt-themes` GitHub organizations. A patch in version 1.6.2 fixed the issue.
Microweber vulnerable to cross-site scripting (XSS) (GHSA-f4g6-c47x-qhww)
Aliases: CVE-2023-2014
Published: 2023-04-13T03:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.3'}]}]}]

microweber/microweber prior to 1.3.3 is vulnerable to cross-site scripting (XSS) in the template selection while changing a group template.
Cross-site Scripting (XSS) in DataObject Any Getter grid operator (GHSA-6fvf-x8c6-2f6j)
Aliases: CVE-2023-2339
Published: 2023-04-27T23:09:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '10.5.21'}]}]}]

### Impact
Stored cross site scripting vulnerability in operator any getter in dataobject grid configuration.

### Patches
Update to version 10.5.21 or apply this patch manually https://github.com/pimcore/pimcore/commit/6946f8a5a0a93b516c49f17a5b45044eebd73480.patch

### Workarounds
Apply patch https://github.com/pimcore/pimcore/commit/6946f8a5a0a93b516c49f17a5b45044eebd73480.patch manually.

### References
https://huntr.dev/bounties/bb1537a5-fe7b-4c77-a582-10a82435fbc2/
Jenkins Quay.io trigger Plugin webhook endpoint can be accessed without authentication (GHSA-q2fc-9ww2-ggfj)
Aliases: CVE-2023-30519
Published: 2023-04-12T18:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.jenkins-ci.plugins:quayio-trigger'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1'}]}]}]

Jenkins Quay.io trigger Plugin provides a webhook endpoint at `/quayio-webhook/` that can be used to trigger builds of jobs configured to use a specified repository.

In Quay.io trigger Plugin 0.1 and earlier, this endpoint can be accessed without authentication.

This allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
Weak Password Requirements in calibreweb (GHSA-mhmp-m6g7-7c24)
Aliases: CVE-2023-2106
Published: 2023-04-15T15:30:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'calibreweb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.20'}]}]}]

Weak Password Requirements in GitHub repository janeczku/calibre-web prior to 0.6.20.
Ming-Soft MCMS vulnerable to SQL injection (GHSA-hx8p-9m48-g76r)
Aliases: CVE-2020-20913
Published: 2023-04-04T15:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.mingsoft:ms-mcms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.1'}]}]}]

SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via `basic_title` parameter. This issue is resolved in v5.1.