aswin1906/github-advisory-2023 huggingface dataset:
Snowflake Golang Driver vulnerable to Command Injection (GHSA-fwv2-65wh-2w8c)
Aliases: CVE-2023-34231
Published: 2023-06-09T22:53:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/snowflakedb/gosnowflake'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.19'}]}]}]

### Issue
Snowflake was informed via our bug bounty program of a command injection vulnerability in the Snowflake Golang driver via SSO browser URL authentication.

### Impacted driver package: 
gosnowflake

### Impacted version range: 
before [Version 1.6.19](https://community.snowflake.com/s/article/Go-Snowflake-Driver-Release-Notes)

### Attack Scenario
In order to exploit the potential for command injection, an attacker would need to be successful in (1) establishing a malicious resource and (2) redirecting users to utilize the resource. The attacker could set up a malicious, publicly accessible server which responds to the SSO URL with an attack payload. If the attacker then tricked a user into visiting the maliciously crafted connection URL, the user’s local machine would render the malicious payload, leading to a remote code execution. 

This attack scenario can be mitigated through URL whitelisting as well as common anti-phishing resources.  

### Solution
On March 21, 2023, Snowflake merged a patch that fixed a command injection vulnerability in the Snowflake Golang driver via SSO browser URL authentication. The vulnerability affected the Snowflake Golang driver before Version 1.6.19. We strongly recommend users upgrade to Version 1.6.19 as soon as possible via the following resources: [Go Snowflake Driver](https://docs.snowflake.com/en/developer-guide/golang/go-driver)

### Additional Information
If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).
phpMyFAQ Cross-site Scripting (GHSA-v6g2-jwrm-h5r5)
Aliases: CVE-2023-3469
Published: 2023-06-30T03:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'thorsten/phpmyfaq'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.0-beta.2'}]}]}]

phpMyFAQ prior to 3.2.0-beta.2 contains a cross-site scripting vulnerability. When an administrator restores a backup from a file, it's possible to trigger an error with a specially crafted file that can be displayed on the web page. Since the error message contains the invalid part of the file, any JavaScript code in the file is executed.
When setting EntityOptions.apiPrefilter to a function, the filter is not applied to API requests for a resource by Id (GHSA-7hh3-3x64-v2g9)
Aliases: CVE-2023-35167
Published: 2023-06-20T18:50:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'remult'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.20.6'}]}]}]

### Impact
If you used the [apiPrefilter](https://remult.dev/docs/ref_entity.html#apiprefilter) option of the `@Entity` decorator, by setting it to a function that returns a filter that prevents unauthorized access to data, an attacker who knows the `id` of an entity instance she is not authorized to access, can gain read, update and delete access to it.

### Patches
The issue is fixed in version 0.20.6

### Workarounds
Set the `apiPrefilter` option to a filter object instead of a function.

### References
If you're using a minor version < 0.20 and require a patch, please create an issue.
s2n-quic potential denial of service vulnerability when receiving empty UDP packets (GHSA-hxq4-mx37-fqvg)
Published: 2023-06-30T22:11:42Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 's2n-quic'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.22.0'}, {'fixed': '1.23.0'}]}], 'versions': ['1.22.0']}]

### Impact

An issue in s2n-quic results in the endpoint shutting down after receiving an empty UDP packet on a connection. 

No AWS services are affected by this issue and customers of AWS services do not need to take action. Applications using s2n-quic should upgrade their application to the most recent release of s2n-quic.

Impacted version: s2n-quic v1.22.0.

### Patches

The patch is included in s2n-quic [v1.23.0](https://github.com/aws/s2n-quic/releases/tag/v1.23.0).

If you have any questions or comments about this advisory we ask that you contact AWS/Amazon Security via our [vulnerability reporting page](https://aws.amazon.com/security/vulnerability-reporting) or directly via email to [aws-security@amazon.com](mailto:aws-security@amazon.com). Please do not create a public GitHub issue.
progressbar.js vulnerable to Prototype Pollution (GHSA-89qm-hm2x-mxm3)
Aliases: CVE-2023-26133
Published: 2023-06-12T06:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L
Affected: [{'package': {'ecosystem': 'npm', 'name': 'progressbar.js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.0'}]}]}]

All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.
ph-json vulnerable to stack exhaustion (GHSA-mx27-gg24-h2jc)
Aliases: CVE-2023-34612
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.helger.commons:ph-json'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '11.0.4'}]}]}]

An issue was discovered in ph-json that allows attackers to cause a denial of service or other unspecified impacts via crafted objects that have deeply nested structures.
Alluxio Cross Site Scripting vulnerability (GHSA-298m-hvgh-x9cw)
Aliases: CVE-2020-21485
Published: 2023-06-20T15:31:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.alluxio:alluxio-parent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.8.1'}]}]}]

Cross Site Scripting vulnerability in Alluxio v.1.8.1 allows a remote attacker to executea arbitrary code via the path parameter in the browse board component.
htmlcleaner vulnerable to stack exhaustion (GHSA-jv4x-j47q-6qvp)
Aliases: CVE-2023-34624
Published: 2023-06-14T15:30:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.sourceforge.htmlcleaner:htmlcleaner'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.28'}]}]}]

An issue was discovered htmlcleaner through version 2.28 allows attackers to cause a denial of service or other unspecified impacts via crafted objects that deeply nested structures.
XWiki Platform vulnerable to  Code injection through NotificationRSSService (GHSA-94pf-92hw-2hjc)
Aliases: CVE-2023-36469
Published: 2023-06-30T20:42:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-notifications-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.6-rc-1'}, {'fixed': '14.10.6'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-notifications-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.2-rc-1'}]}]}]

### Impact

Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. This can be reproduced with the following steps:

1. Login as a user without script or programming right.
2. Go to the notifications preferences in your user profile.
3. Disable the "Own Events Filter" and enable notifications in the notification menu for "Like".
4. Set your first name to `{{cache id="security" timeToLive="1"}}{{groovy}}println("Hello from groovy!"){{/groovy}}{{/cache}}`
5. Click on the like button at the bottom left of the user profile.
6. Click on the notifications bell in the top bar and then on "RSS Feed".

If the text "Profile of Hello from groovy!" and/or "liked by Hello from groovy!" is displayed, the attack succeeded. The expected result would have been that the entered first name is displayed as-is in the description of the feed.

### Patches
This has been patched in XWiki 14.10.6 and 15.2RC1.

### Workarounds
The main security fix can be manually applied by patching the affected document `XWiki.Notifications.Code.NotificationRSSService` as shown in the [patch](https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-7221a548809fa2ba34348556f4b5bd436463c559ebdf691197932ee7ce4478ca). This will break the link to the differences, though as this requires additional changes to Velocity templates as shown in the patch. While the [default](https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c#diff-b261c6eac3108c3e6e734054c28a78f59d3439ab72fe8582dadf87670a0d15a4) template is available in the instance and can be easily patched, the template for mentions is contained in a `.jar`-file and thus cannot be fixed without replacing that jar.

### References
* https://jira.xwiki.org/browse/XWIKI-20610
* https://github.com/xwiki/xwiki-platform/commit/217e5bb7a657f2991b154a16ef4d5ae9c29ad39c
Kredis JSON Possible Deserialization of Untrusted Data Vulnerability (GHSA-h2wm-p2vg-6pw4)
Aliases: CVE-2023-27531
Published: 2023-06-09T22:40:54Z
Affected: [{'package': {'ecosystem': 'RubyGems', 'name': 'kredis'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.0.1'}]}]}]

There is a deserialization of untrusted data vulnerability in
the Kredis JSON deserialization code. This vulnerability has
been assigned the CVE identifier CVE-2023-27531.

'Not affected: None.'
'Versions Affected: All.'
'Fixed Versions: 1.3.0.1'

Impact
  Carefully crafted JSON data processed by Kredis may result in
  deserialization of untrusted data, potentially leading to
  deserialization of unexpected objects in the system.

  Any applications using Kredis with JSON are affected.

Releases
  The fixed releases are available at the normal locations.

Workarounds
  There are no feasible workarounds for this issue.

Patches
  To aid users who aren’t able to upgrade immediately we have
  provided patches for the two supported release series. They
  are in git-am format and consist of a single changeset.

  * 1-3-0-1-kredis.patch - Patch for 1.3.0 series

Credits
  Thank you ooooooo_k 7 for reporting this!
cyfs-base vulnerable to misaligned pointer dereference in `ChunkId::new` (GHSA-g753-ghr7-q33w)
Published: 2023-06-22T20:01:55Z
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'cyfs-base'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.6.12'}]}]}]

The function `ChunkId::new` creates a misaligned pointer by casting mutable pointer of `u8` slice which has alignment 1 to the mutable pointer of `u32` which has alignment 4, and dereference the misaligned pointer leading UB, which should not be allowed in safe function.
Backstage Scaffolder plugin has insecure sandbox (GHSA-wg6p-jmpc-xjmr)
Aliases: CVE-2023-35926
Published: 2023-06-21T22:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': '@backstage/plugin-scaffolder-backend'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.15.0'}]}]}]

The Backstage scaffolder-backend plugin uses a templating library that requires a sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in light of several past vulnerabilities and existing vulnerabilities  that may not have a fix, the plugin has switched to using a different sandbox library.

### Impact

A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template YAML definition itself and not by user input data.

### Patches

This is vulnerability is fixed in version 1.15.0 of `@backstage/plugin-scaffolder-backend`.

### Workarounds

Note that the [Backstage Threat Model](https://backstage.io/docs/overview/threat-model) states that scaffolder templates are considered to be a sensitive area that with the recommendation that you control access and perform manual reviews of changes to the scaffolder templates. The exploit is of a nature where it is easily discoverable in manual review.
Joplin Cross-site Scripting vulnerability (GHSA-4jjv-p8x9-rrf7)
Aliases: CVE-2023-37299
Published: 2023-06-30T15:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': 'joplin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.11.5'}]}]}]

Joplin before 2.11.5 allows XSS via an AREA element of an image map.
tgstation-server cached user logins in legacy server (GHSA-42r6-p4px-qvv6)
Aliases: CVE-2018-17107
Published: 2023-06-12T20:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'TGServiceInterface'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.2.1.0'}, {'fixed': '3.2.5.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.2.4.0'}}]

Please note this advisory is for a historical preexisting issue in the legacy server from 2018. It has long since been triaged. It is being moved here for visibility. The text below is copied from the original issue #690

# You can login to the server with any username/password combination if someone else is logged in

An explanation of the bug: Back in 3.2.1.0, in order to accommodate running the Control Panel using Mono some hooks were added to the WCF communication layer. Detailed in this commit: https://github.com/tgstation/tgstation-server/commit/2894ea03d708c7f16bab47ba5020c2ad4c3d5554#diff-0ba090ea7073a3a304dfdbdfc512f733 

The bug was in this line: https://github.com/tgstation/tgstation-server/commit/2894ea03d708c7f16bab47ba5020c2ad4c3d5554#diff-0ba090ea7073a3a304dfdbdfc512f733R48
authPolicy is passed in by the framework but the documentation for what the parameter is is virtually non-existent: https://docs.microsoft.com/en-us/dotnet/api/system.servicemodel.serviceauthenticationmanager.authenticate?view=netframework-4.7.2#System_ServiceModel_ServiceAuthenticationManager_Authenticate_System_Collections_ObjectModel_ReadOnlyCollection_System_IdentityModel_Policy_IAuthorizationPolicy__System_Uri_System_ServiceModel_Channels_Message__

Turns out it is a cache of what the previously returned policy was, as Floyd thankfully found out for us. The security patch fixes the issue by creating a new empty list as the return value when password authentication fails as opposed to using the authPolicy parameter.

If you're wondering why this line: https://github.com/tgstation/tgstation-server/commit/2894ea03d708c7f16bab47ba5020c2ad4c3d5554#diff-0ba090ea7073a3a304dfdbdfc512f733R42 didn't prevent the issue. It only invalidated the actual Windows login session, but in the eyes of the server the user was still valid since we just passed that closed handle as a return result. Had access to static files been attempted with a bad login, the request would end up erroring due to trying to impersonate using a closed user token handle.

This has been fixed in 1812a9c6793c8516c138a105ccfb2108164f0eff and versions 3.2.5.0+
hawtio vulnerable to Path Traversal (GHSA-p223-c4w6-q454)
Aliases: CVE-2023-33544
Published: 2023-06-01T15:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'io.hawt:project'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '2.17.2'}]}]}]

hawtio 2.17.2 is vulnerable to Path Traversal. it is possible to input malicious zip files, which can result in the high-risk files after decompression being stored in any location, even leading to file overwrite.
Apache NiFi vulnerable to Deserialization of Untrusted Data (GHSA-65wh-g8x8-gm2h)
Aliases: CVE-2023-34212
Published: 2023-06-12T18:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-jms-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8.0'}, {'fixed': '1.22.0'}]}]}]

The JndiJmsConnectionFactoryProvider Controller Service, along with the ConsumeJMS and PublishJMS Processors, in Apache NiFi 1.8.0 through 1.21.0 allow an authenticated and authorized user to configure URL and library properties that enable deserialization of untrusted data from a remote location.

The resolution validates the JNDI URL and restricts locations to a set of allowed schemes.

You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
git-commit-info vulnerable to Command Injection (GHSA-h42j-mrmp-9369)
Aliases: CVE-2023-26134
Published: 2023-06-28T06:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'npm', 'name': 'git-commit-info'}, 'ecosystem_specific': {'affected_functions': ['git-commit-info']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.2'}]}]}]

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo() fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they control the hash content.
Dynamic Linq vulnerable to remote code execution (GHSA-w65q-jcmv-28gj)
Aliases: CVE-2023-32571
Published: 2023-06-22T21:30:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'NuGet', 'name': 'System.Linq.Dynamic.Core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.7.10'}, {'fixed': '1.3.0'}]}]}]

Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed.
Apache Struts vulnerable to memory exhaustion (GHSA-8f6x-v685-g2xc)
Aliases: CVE-2023-34149
Published: 2023-06-14T09:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.apache.struts:struts2-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.5.31'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.struts:struts2-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.0.0'}, {'fixed': '6.1.2.1'}]}]}]

Denial of service via out of memory (OOM) owing to not properly checking of list bounds. When a Multipart request has non-file normal form fields, Struts used to bring them into memory as Strings without checking their sizes. This could lead to OOM if developer has set struts.multipart.maxSize to a value equal or greater than the available memory.

Upgrade to Struts 2.5.31 or 6.1.2.1 or greater.
XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application (GHSA-6mf5-36v9-3h2w)
Aliases: CVE-2023-35150
Published: 2023-06-20T16:46:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.4-m-2'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-invitation-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.0'}]}]}]

### Impact
Any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. See the example below:
Open `<xwiki-host>/xwiki/bin/view/%5D%5D%20%7B%7Basync%20async%3D%22true%22%20cached%3D%22false%22%20context%3D%22doc.reference%22%7D%7D%7B%7Bgroovy%7D%7Dprintln(%22Hello%20%22%20%2B%20%22from%20groovy!%22)%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D?sheet=Invitation.InvitationGuestActions&xpage=view` where `<xwiki-host>` is the URL of your XWiki installation.

### Patches
The problem as been patching on XWiki 15.0, 14.10.4 and 14.4.8.

### Workarounds
It is possible to partially fix the issue by applying this [patch](https://github.com/xwiki/xwiki-platform/commit/b65220a4d86b8888791c3b643074ebca5c089a3a). Note that some additional issue can remain and can be fixed automatically by a migration. Hence, it is advised to upgrade to one of the patched version instead of patching manually.

### References
- https://jira.xwiki.org/browse/XWIKI-20285

### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)
Arbitrary file read using percent-encoded relative paths in FileMiddleware (GHSA-vcvg-xgr8-p5gq)
Aliases: CVE-2020-15230
Published: 2023-06-09T19:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/vapor/vapor'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-rc.2.5'}, {'fixed': '4.29.4'}]}]}]

### Impact

Attackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`.

### Patches

Version [4.29.4](https://github.com/vapor/vapor/releases/tag/4.29.4)

### Workarounds

Upgrade to 4.24.4 or later, or disable `FileMiddleware`.

### References

* Introduced in https://github.com/vapor/vapor/pull/2223
* Fixed by https://github.com/vapor/vapor/pull/2500

### For more information

If you have any questions or comments about this advisory:
* Open [an issue](https://github.com/vapor/vapor/issues)
* Email us at [security@vapor.codes](mailto:security@vapor.codes)
requests-xml XML External Entity Injection vulnerability (GHSA-ccrc-9x59-3vc4)
Aliases: CVE-2020-26708
Published: 2023-06-29T21:30:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'requests-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.2.3'}]}]}]

requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code via a crafted XML file.
Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability (GHSA-3x74-v64j-qc3f)
Aliases: CVE-2023-30179
Published: 2023-06-13T18:30:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'craftcms/cms'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.4.2'}]}]}]

## Withdrawn
This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references.

[According to maintainers of Craft CMS](https://github.com/github/advisory-database/pull/2443#issuecomment-1610634200), only administrators can access Settings, and those administrators may have business needs for their permissions. Additionally, the underlying issue likely has little to no real-world security impact.

## Original Description
CraftCMS is vulnerable to Server-Side Template Injection (SSTI). An authenticated attacker can inject Twig Template to User Photo Location field when setting User Photo Location in User Settings, lead to Remote Code Execution.
XWiki Platform vulnerable to cross-site scripting via xcontinue parameter in previewactions template (GHSA-q9hg-9qj2-mxf9)
Aliases: CVE-2023-35162
Published: 2023-06-20T17:42:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-skin-resources'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '6.1-rc-1'}, {'fixed': '14.10.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-flamingo-skin-resources'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '15.0-rc-1'}, {'fixed': '15.1-rc-1'}]}]}]

### Impact
Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS).
It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: 
> <hostname>/xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart&vm=previewactions.vm&xcontinue=javascript:alert(document.domain)

This vulnerability exists since XWiki 6.1-rc-1. 

### Patches

The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.

### Workarounds

It's possible to workaround the vulnerability by editing the template previewactions.vm to perform checks on it, but note that the appropriate fix involves new APIs that have been recently introduced in XWiki. See the referenced jira tickets. 

### References

  * Jira ticket about the vulnerability: https://jira.xwiki.org/browse/XWIKI-20342
  * Introduction of the macro used for fixing this type of vulnerability: https://jira.xwiki.org/browse/XWIKI-20583
  * Commit containing the actual fix in the template: https://github.com/xwiki/xwiki-platform/commit/9f01166b1a8ee9639666099eb5040302df067e4d

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
* Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been reported by René de Sain @renniepak.
urlnorm vulnerable to Regular Expression Denial of Service (GHSA-fqhp-rhm6-8rrj)
Aliases: CVE-2023-33289
Published: 2023-06-21T21:30:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'crates.io', 'name': 'urlnorm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.4'}]}]}]

The urlnorm crate through 0.1.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to lib.rs.
PlantUML Improper Access Control vulnerability (GHSA-p2mf-q26j-3xmh)
Aliases: CVE-2023-3431
Published: 2023-06-27T15:30:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.sourceforge.plantuml:plantuml-mit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2023.9'}]}]}]

Improper Access Control in GitHub repository plantuml/plantuml prior to 1.2023.9.
Shopware improper mail validation vulnerability (GHSA-gh66-fp7j-98v5)
Aliases: CVE-2023-34099
Published: 2023-06-28T22:34:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'shopware/shopware'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.4'}, {'fixed': '5.7.18'}]}], 'database_specific': {'last_known_affected_version_range': '<= 5.7.17'}}]

### Impact
The mail validation in the registration process had some flaws, so it was possible to construct different mail addresses, that in the end result in the same address, which is shared by multiple accounts. 

### Patches
We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page.
https://github.com/shopware5/shopware/releases/tag/v5.7.18

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023
Notation vulnerable to denial of service from high number of artifact signatures (GHSA-9m3v-v4r5-ppx7)
Aliases: CVE-2023-33957
Published: 2023-06-06T16:43:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/notaryproject/notation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.0-rc.6'}]}]}]

### Impact
An attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running `notation verify`.

### Patches
The problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6). Users should upgrade their notation packages to [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6) or above.

### Workarounds
User should use secure and trusted container registries.

### Credits
The `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT) for root cause analysis.
Duplicate Advisory: Starlette vulnerable to directory traversal (GHSA-qj8w-rv5x-2v9h)
Published: 2023-06-01T03:30:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'starlette'}, 'ecosystem_specific': {'affected_functions': ['starlette.staticfiles.StaticFiles.lookup_path']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.13.5'}, {'fixed': '0.27.0'}]}]}]

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-v5gw-mw7f-84px. This link is maintained to preserve external references.

## Original Description
Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to view files in a web service which was built using Starlette.
PocketMine-MP vulnerable to server crash with certain invalid JSON payloads in `LoginPacket` due to vulnerable dependency (GHSA-pqp3-8rrw-g8vm)
Published: 2023-06-06T01:50:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.20.5'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'pocketmine/pocketmine-mp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.21.0'}, {'fixed': '4.21.1'}]}]}]

### Impact
An attacker could crash the server by sending malformed JWT JSON in `LoginPacket` due to a security vulnerability in [`netresearch/jsonmapper`](https://github.com/cweiske/JsonMapper), due to improper checking for mapping JSON arrays and objects onto scalar model properties such as strings.

### Patches
The problem was fixed in a fork of JsonMapper in dktapps/JsonMapper@a31902a31f5b6fdb832f57c0e3a3f16a3b41c012. PocketMine-MP releases 4.20.5 and 4.21.1 have been released with the fix.

### Workarounds
- Users of PocketMine-MP source installations may manually install the patched version of JsonMapper by backporting commit pmmp/PocketMine-MP@09668a37d66c6023685a948b7550c918620e98f2.
- A plugin may also be able to workaround this issue by using `DataPacketReceiveEvent` to attempt detection of suspicious payloads. An `ErrorException` will be thrown in the crash case, which can be caught by plugins.

### References
cweiske/jsonmapper#210
Uncontrolled Resource Consumption in LengthPrefixedMessageReader (GHSA-rxmj-hg9v-vp3p)
Aliases: CVE-2021-36155
Published: 2023-06-09T19:32:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/grpc/grpc-swift'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.0'}]}]}]

### Impact

Affected gRPC Swift clients and servers are vulnerable to uncontrolled resource consumption attacks. Excessive memory may be allocated when parsing messages. This can lead to a denial of service.

### Patches

The problem has been fixed in 1.2.0.

### Workarounds

No workaround is available. Users must upgrade.
Microweber Cross-site Scripting vulnerability (GHSA-fqcv-rfp6-wv92)
Aliases: CVE-2023-3142
Published: 2023-06-07T15:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'microweber/microweber'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3.4'}]}]}]

Microweber 1.3.4 and prior is vulnerable to stored cross-site scripting via an alert on the `Editing` page. This issue is fixed in commit 42efa981a2239d042d910069952d6276497bdcf1.
Langchain vulnerable to arbitrary code execution (GHSA-6643-h7h5-x9wh)
Aliases: CVE-2023-34541
Published: 2023-06-20T15:31:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'langchain'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.171'}]}]}]

Langchain 0.0.171 is vulnerable to Arbitrary code execution in `load_prompt`.
PyPDF2 quadratic runtime with malformed PDF missing xref marker (GHSA-jrm6-h9cq-8gqw)
Aliases: CVE-2023-36810
Published: 2023-06-30T22:17:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'PyPI', 'name': 'PyPDF2'}, 'ecosystem_specific': {'affected_functions': ['PyPDF2.PdfFileReader.readNextEndLine']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.27.9'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.27.8'}}]

### Impact
An attacker who uses this vulnerability can craft a PDF which leads to unexpected long runtime.
This quadratic runtime blocks the current process and can utilize a single core of the CPU by 100%. It does not affect memory usage.

### Patches
https://github.com/py-pdf/pypdf/pull/808

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
* [PyPDF2 PR #808](https://github.com/py-pdf/pypdf/pull/808)
* [PyPDF2 Issue #582](https://github.com/py-pdf/pypdf/issues/582)
SwiftNIO Extras vulnerable to improper detection of complete HTTP body decompression (GHSA-773g-x274-8qmf)
Aliases: CVE-2022-3252
Published: 2023-06-07T16:05:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio-extras'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11.0'}, {'fixed': '1.14.0'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio-extras'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.10.0'}, {'fixed': '1.10.3'}]}]}, {'package': {'ecosystem': 'purl-type:swift', 'name': 'github.com/apple/swift-nio-extras'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.2'}]}]}]

SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects (`HTTPRequestDecompressor` and `HTTPResponseDecompressor`) both failed to detect when the decompressed body was considered complete. If trailing junk data was appended to the HTTP message body, the code would repeatedly attempt to decompress this data and fail. This would lead to an infinite loop making no forward progress, leading to livelock of the system and denial-of-service.

This issue can be triggered by any attacker capable of sending a compressed HTTP message. Most commonly this is HTTP servers, as compressed HTTP messages cannot be negotiated for HTTP requests, but it is possible that users have configured decompression for HTTP requests as well. The attack is low effort, and likely to be reached without requiring any privilege or system access. The impact on availability is high: the process immediately becomes unavailable but does not immediately crash, meaning that it is possible for the process to remain in this state until an administrator intervenes or an automated circuit breaker fires. If left unchecked this issue will very slowly exhaust memory resources due to repeated buffer allocation, but the buffers are not written to and so it is possible that the processes will not terminate for quite some time.

This risk can be mitigated by removing transparent HTTP message decompression. The issue is fixed by correctly detecting the termination of the compressed body as reported by zlib and refusing to decompress further data.
jFinal Server-Side Template Injection vulnerability (GHSA-cgmm-c2m9-ff7r)
Aliases: CVE-2021-31635
Published: 2023-06-26T21:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'com.jfinal:jfinal'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '4.9.08'}]}]}]

Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.
Remote Code Execution for 2.4.1 and earlier (GHSA-76f7-9v52-v2fw)
Aliases: CVE-2023-36812
Published: 2023-06-30T22:58:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'net.opentsdb:opentsdb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.2'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.4.1'}}]

### Impact
OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration.

### Patches
Patched in [07c4641471c6f5c2ab5aab615969e97211eb50d9](https://github.com/OpenTSDB/opentsdb/commit/07c4641471c6f5c2ab5aab615969e97211eb50d9) and further refined in https://github.com/OpenTSDB/opentsdb/commit/fa88d3e4b5369f9fb73da384fab0b23e246309ba

### Workarounds
Disable Gunuplot via `tsd.core.enable_ui = true` and remove the shell files https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.bat and https://github.com/OpenTSDB/opentsdb/blob/master/src/mygnuplot.sh.
@udecode/plate-link does not sanitize URLs to prevent use of the `javascript:` scheme (GHSA-4882-hxpr-hrvm)
Aliases: CVE-2023-34245
Published: 2023-06-09T22:41:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: [{'package': {'ecosystem': 'npm', 'name': '@udecode/plate-link'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '20.0.0'}]}]}]

### Impact
Affected versions of the link plugin and link UI component do not sanitize URLs to prevent use of the `javascript:` scheme. As a result, links with JavaScript URLs can be inserted into the Plate editor through various means, including opening or pasting malicious content.

### Patches
`@udecode/plate-link` 20.0.0 resolves this issue by introducing an `allowedSchemes` option to the link plugin, defaulting to `['http', 'https', 'mailto', 'tel']`. URLs using a scheme that isn't in this list will not be rendered to the DOM.

### Workarounds
If you are unable to update `@udecode/plate-link` to version 20.0.0, we recommend overriding the `LinkElement` and `PlateFloatingLink` components with implementations that explicitly check the URL scheme before rendering any anchor elements.
Hashicorp Consul vulnerable to denial of service (GHSA-c57c-7hrj-6q6v)
Aliases: CVE-2023-1297
Published: 2023-06-03T00:30:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/consul'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.14.5'}]}]}, {'package': {'ecosystem': 'Go', 'name': 'github.com/hashicorp/consul'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.15.0'}, {'fixed': '1.15.3'}]}]}]

Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
XWiki Platform vulnerable to cross-site scripting in target parameter via share page by email (GHSA-fwwj-wg89-7h4c)
Aliases: CVE-2023-35155
Published: 2023-06-20T16:48:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L
Affected: [{'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-sharepage-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6-rc-2'}, {'fixed': '14.4.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.xwiki.platform:xwiki-platform-sharepage-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.5'}, {'fixed': '14.10.4'}]}]}]

### Impact
Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS).
For instance, the following URL execute an `alter` on the browser: `<xwiki-host>/xwiki/bin/view/Main/?viewer=share&send=1&target=&target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Crenniepak%40intigriti.me%3E&includeDocument=inline&message=I+wanted+to+share+this+page+with+you.`, where `<xwiki-host>` is the URL of your XWiki installation.
See https://jira.xwiki.org/browse/XWIKI-20370 for me details.

### Patches

The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8.

### Workarounds
The fix is only impacting Velocity templates and page contents, so applying this [patch](https://github.com/xwiki/xwiki-platform/commit/ca88ebdefb2c9fa41490959cce9f9e62404799e7) is enough to fix the issue.

### References
https://jira.xwiki.org/browse/XWIKI-20370

### For more information

If you have any questions or comments about this advisory:

*    Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)
*    Email us at [Security Mailing List](mailto:security@xwiki.org)

### Attribution

This vulnerability has been reported on Intigriti by René de Sain @renniepak.
Gitpod vulnerable to Cross-site Scripting (GHSA-gqx9-h3w2-fprg)
Aliases: CVE-2023-32766
Published: 2023-06-05T15:33:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/gitpod-io/gitpod'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2022.11.3'}]}]}]

Gitpod before 2022.11.3 allows XSS because redirection can occur for some protocols outside of the trusted set of three (vscode: vscode-insiders: jetbrains-gateway:).
SQL injection when using MySQL/PostgreSQL data checking (GHSA-4c32-w6c7-77x4)
Aliases: CVE-2023-33967
Published: 2023-06-06T01:38:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected: [{'package': {'ecosystem': 'Go', 'name': 'github.com/megaease/easeprobe'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]

An SQL injection issue was discovered in EaseProbe before 2.1.0 when using MySQL/PostgreSQL data checking. This problem has been fixed in v2.1.0; users should upgrade to this version.

The vulnerability was discovered by the [Oxeye research](https://www.oxeye.io/) team.
elFinder vulnerable to path traversal in LocalVolumeDriver connector (GHSA-wm5g-p99q-66g4)
Aliases: CVE-2023-35840
Published: 2023-06-14T16:37:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'studio-42/elfinder'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.62'}]}]}]

### Impact
Path Traversal vulnerability in PHP LocalVolumeDriver connector. This vulnerability can be exploited by allowing untrusted users to write to the local file system.

This issue was caused by incomplete validity checking of the supplied request parameters. That problem has been fixed in elFinder Version 2.1.62.

### Patches
This vulnerability has been fixed in elFinder 2.1.62. Installation managers should update to the latest version as soon as possible.

### Workarounds
If you cannot update for some reason, you must stop using it or prohibit writing to untrusted users.
WPGraphQL Plugin vulnerable to Server Side Request Forgery (SSRF) (GHSA-cfh4-7wq9-6pgg)
Aliases: CVE-2023-23684
Published: 2023-06-30T20:35:37Z
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'wp-graphql/wp-graphql'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.14.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.14.5'}}]

### Impact
Users with capabilities to upload media (editors and above) are succeptible to SSRF (Server-Side Request Forgery) when executing the `createMediaItem` Mutation. 

Authenticated users making GraphQL requests that execute the `createMediaItem` could pass executable paths in the mutations `filePath` argument that could give them unwarranted access to the server. 

It's recommended to update to WPGraphQL v1.14.6 or newer. If you're unable to do so, below is a snippet you can add to your functions.php (or similar) that filters the `createMediaItem` mutation's resolver. 

### Patches

- [v1.14.6](https://github.com/wp-graphql/wp-graphql/releases/tag/v1.14.6)
- https://github.com/wp-graphql/wp-graphql/pull/2840

### Workarounds
If you're unable to upgrade to v1.14.6 or higher, you should be able to use the following snippet in your functions.php to override the vulnerable resolver. 

This snippet has been tested as far back as WPGraphQL v0.15

```php
add_filter( 'graphql_pre_resolve_field', function( $nil, $source, $args, $context, \GraphQL\Type\Definition\ResolveInfo $info, $type_name, $field_key, $field, $field_resolver ) {

	if ( $info->fieldName !== 'createMediaItem' ) {
		return $nil;
	}

	$input = $args['input'] ?? null;

        if ( ! isset( $input['filePath'] ) ) {
		return $nil;
	}

	$uploaded_file_url   = $input['filePath'];

	// Check that the filetype is allowed
	$check_file = wp_check_filetype( $uploaded_file_url );

	// if the file doesn't pass the check, throw an error
	if ( ! $check_file['ext'] || ! $check_file['type'] || ! wp_http_validate_url( $uploaded_file_url ) ) {
		throw new \GraphQL\Error\UserError( sprintf( __( 'Invalid filePath "%s"', 'wp-graphql' ), $input['filePath'] ) );
	}

	$protocol = wp_parse_url( $input['filePath'], PHP_URL_SCHEME );

	// prevent the filePath from being submitted with a non-allowed protocols
	$allowed_protocols = [ 'https', 'http', 'file' ];

	if ( ! in_array( $protocol, $allowed_protocols, true ) ) {
		throw new \GraphQL\Error\UserError( sprintf( __( 'Invalid protocol. "%1$s". Only "%2$s" allowed.', 'wp-graphql' ), $protocol, implode( '", "', $allowed_protocols ) ) );
	}

	return $nil;

}, 10, 9 );
```

### References

- https://patchstack.com/database/vulnerability/wp-graphql/wordpress-wp-graphql-plugin-1-14-5-server-side-request-forgery-ssrf-vulnerability
ipandlanguageredirect extension vulnerable to SQL Injection (GHSA-4xf2-7qfv-mgfx)
Aliases: CVE-2023-35782
Published: 2023-06-16T15:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected: [{'package': {'ecosystem': 'Packagist', 'name': 'in2code/ipandlanguageredirect'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '5.1.2'}]}]}]

The ipandlanguageredirect extension before 5.1.2 for TYPO3 allows SQL Injection.