deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-45822
Published: 2023-10-19
Description: Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which a default unsafe rego built-in was allowed to be used when defining authorization policies. Artifact Hub includes a fine-grained authorization mechanism that allows organizations to define what actions can be performed by their members. It is based on customizable authorization policies that are enforced by the `Open Policy Agent`. Policies are written using `rego` and their data files are expected to be json documents. By default, `rego` allows policies to make HTTP requests, which can be abused to send requests to internal resources and forward the responses to an external entity. In the context of Artifact Hub, this capability should have been disabled. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 3.7 (LOW)
CWE: CWE-918, CWE-918
References: https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0; https://github.com/artifacthub/hub/security/advisories/GHSA-9pc8-m4vp-ggvf; https://www.openpolicyagent.org/
CVE: CVE-2023-45823
Published: 2023-10-19
Description: Artifact Hub is a web-based application that enables finding, installing, and publishing packages and configurations for CNCF projects. During a security audit of Artifact Hub's code base a security researcher identified a bug in which by using symbolic links in certain kinds of repositories loaded into Artifact Hub, it was possible to read internal files. Artifact Hub indexes content from a variety of sources, including git repositories. When processing git based repositories, Artifact Hub clones the repository and, depending on the artifact kind, reads some files from it. During this process, in some cases, no validation was done to check if the file was a symbolic link. This made possible to read arbitrary files in the system, potentially leaking sensitive information. This issue has been resolved in version `1.16.0`. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0; https://github.com/artifacthub/hub/security/advisories/GHSA-hmq4-c2r4-5q8h; https://artifacthub.io/packages/helm/artifact-hub/artifact-hub?modal=changelog&version=1.16.0
CVE: CVE-2023-43341
Published: 2023-10-19
Description: Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-; https://github.com/sromanhu/Evolution-Reflected-XSS---Installation-Connection-; https://github.com/sromanhu/CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-
CVE: CVE-2023-43342
Published: 2023-10-19
Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Languages Menu component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sromanhu/CVE-2023-43342-Quick-CMS-Stored-XSS---Languages-Frontend; https://github.com/sromanhu/Quick-CMS-Stored-XSS---Languages-Frontend; https://github.com/sromanhu/CVE-2023-43342-Quick-CMS-Stored-XSS---Languages-Frontend
CVE: CVE-2023-43344
Published: 2023-10-19
Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the SEO - Meta description parameter in the Pages Menu component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/sromanhu/CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description; https://github.com/sromanhu/CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description
CVE: CVE-2023-43359
Published: 2023-10-19
Description: Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the Page Specific Metadata and Smarty data parameters in the Content Manager Menu component.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager; https://github.com/sromanhu/CVE-2023-43359-CMSmadesimple-Stored-XSS----Content-Manager
CVE: CVE-2023-43875
Published: 2023-10-19
Description: Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation/blob/main/README.md; https://github.com/sromanhu/Subrion-CMS-Reflected-XSS---Installation/blob/main/README.md; https://github.com/sromanhu/CVE-2023-43875-Subrion-CMS-Reflected-XSS---Installation/blob/main/README.md
CVE: CVE-2023-44690
Published: 2023-10-19
Description: Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.py
CVSS Score: 7.5 (HIGH)
CWE: CWE-326
References: https://github.com/dbcli/mycli/issues/1131; https://github.com/dbcli/mycli/issues/1131
CVE: CVE-2023-45279
Published: 2023-10-19
Description: Yamcs 5.8.6 allows XSS (issue 1 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload a display referencing a malicious JavaScript file to the bucket. The user can then open the uploaded display by selecting Telemetry from the menu and navigating to the display.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7; https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies; https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7
CVE: CVE-2023-45280
Published: 2023-10-19
Description: Yamcs 5.8.6 allows XSS (issue 2 of 2). It comes with a Bucket as its primary storage mechanism. Buckets allow for the upload of any file. There's a way to upload an HTML file containing arbitrary JavaScript and then navigate to it. Once the user opens the file, the browser will execute the arbitrary JavaScript.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7; https://www.linkedin.com/pulse/yamcs-vulnerability-assessment-visionspace-technologies; https://github.com/yamcs/yamcs/compare/yamcs-5.8.6...yamcs-5.8.7
CVE: CVE-2023-45815
Published: 2023-10-19
Description: ArchiveBox is an open source self-hosted web archiving system. Any users who are using the `wget` extractor and view the content it outputs. The impact is potentially severe if you are logged in to the ArchiveBox admin site in the same browser session and view an archived malicious page designed to target your ArchiveBox instance. Malicious Javascript could potentially act using your logged-in admin credentials and add/remove/modify snapshots, add/remove/modify ArchiveBox users, and generally do anything an admin user could do. The impact is less severe for non-logged-in users, as malicious Javascript cannot *modify* any archives, but it can still *read* all the other archived content by fetching the snapshot index and iterating through it. Because all of ArchiveBox's archived content is served from the same host and port as the admin panel, when archived pages are viewed the JS executes in the same context as all the other archived pages (and the admin panel), defeating most of the browser's usual CORS/CSRF security protections and leading to this issue. A patch is being developed in https://github.com/ArchiveBox/ArchiveBox/issues/239. As a mitigation for this issue would be to disable the wget extractor by setting `archivebox config --set SAVE_WGET=False`, ensure you are always logged out, or serve only a [static HTML version](https://github.com/ArchiveBox/ArchiveBox/wiki/Publishing-Your-Archive#2-export-and-host-it-as-static-html) of your archive.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/ArchiveBox/ArchiveBox/issues/239; https://github.com/ArchiveBox/ArchiveBox/security/advisories/GHSA-cr45-98w9-gwqx; https://github.com/ArchiveBox/ArchiveBox/issues/239
CVE: CVE-2023-45818
Published: 2023-10-19
Description: TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo and redo functionality. When a carefully-crafted HTML snippet passes the XSS sanitisation layer, it is manipulated as a string by internal trimming functions before being stored in the undo stack. If the HTML snippet is restored from the undo stack, the combination of the string manipulation and reparative parsing by either the browser's native [DOMParser API](https://developer.mozilla.org/en-US/docs/Web/API/DOMParser) (TinyMCE 6) or the SaxParser API (TinyMCE 5) mutates the HTML maliciously, allowing an XSS payload to be executed. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring HTML is trimmed using node-level manipulation instead of string manipulation. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/tinymce/tinymce/security/advisories/GHSA-v65r-p3vv-jjfv; https://researchgate.net/publication/266654651_mXSS_attacks_Attacking_well-secured_web-applications_by_using_innerHTML_mutations; https://tiny.cloud/docs/release-notes/release-notes5108/#securityfixes
CVE: CVE-2023-45819
Published: 2023-10-19
Description: TinyMCE is an open source rich text editor. A cross-site scripting (XSS) vulnerability was discovered in TinyMCE’s Notification Manager API. The vulnerability exploits TinyMCE's unfiltered notification system, which is used in error handling. The conditions for this exploit requires carefully crafted malicious content to have been inserted into the editor and a notification to have been triggered. When a notification was opened, the HTML within the text argument was displayed unfiltered in the notification. The vulnerability allowed arbitrary JavaScript execution when an notification presented in the TinyMCE UI for the current user.  This issue could also be exploited by any integration which uses a TinyMCE notification to display unfiltered HTML content. This vulnerability has been patched in TinyMCE 5.10.8 and TinyMCE 6.7.1 by ensuring that the HTML displayed in the notification is sanitized, preventing the exploit. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/tinymce/tinymce/security/advisories/GHSA-hgqx-r2hp-jr38; https://github.com/tinymce/tinymce/security/advisories/GHSA-hgqx-r2hp-jr38
CVE: CVE-2023-41895
Published: 2023-10-19
Description: Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the `redirect_uri` and `client_id` parameters. Although the `redirect_uri` validation typically ensures that it matches the `client_id` and the scheme represents either `http` or `https`, Home Assistant will fetch the `client_id` and check for `<link rel="redirect_uri" href="...">` HTML tags on the page. These URLs are not subjected to the same scheme validation and thus allow for arbitrary JavaScript execution on the Home Assistant administration page via usage of `javascript:` scheme URIs. This Cross-site Scripting (XSS) vulnerability can be executed on the Home Assistant frontend domain, which may be used for a full takeover of the Home Assistant account and installation. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/home-assistant/core/security/advisories/GHSA-jvxq-x42r-f7mv; https://github.com/home-assistant/core/security/advisories/GHSA-jvxq-x42r-f7mv
CVE: CVE-2023-41896
Published: 2023-10-19
Description: Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` parameter. The state parameter contains the `hassUrl`, which is subsequently utilized to establish a WebSocket connection. This behavior permits an attacker to create a malicious Home Assistant link with a modified state parameter that forces the frontend to connect to an alternative WebSocket backend. Henceforth, the attacker can spoof any WebSocket responses and trigger cross site scripting (XSS). Since the XSS is executed on the actual Home Assistant frontend domain, it can connect to the real Home Assistant backend, which essentially represents a comprehensive takeover scenario. Permitting the site to be iframed by other origins, as discussed in GHSA-935v-rmg9-44mw, renders this exploit substantially covert since a malicious website can obfuscate the compromise strategy in the background. However, even without this, the attacker can still send the `auth_callback` link directly to the victim user. To mitigate this issue, Cure53 advises modifying the WebSocket code’s authentication flow. An optimal implementation in this regard would not trust the `hassUrl` passed in by a GET parameter. Cure53 must stipulate the significant time required of the Cure53 consultants to identify an XSS vector, despite holding full control over the WebSocket responses. In many areas, data from the WebSocket was properly sanitized, which hinders post-exploitation. The audit team eventually detected the `js_url` for custom panels, though generally, the frontend exhibited reasonable security hardening. This issue has been addressed in Home Assistant Core version 2023.8.0 and in the npm package home-assistant-js-websocket in version 8.2.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.1 (HIGH)
CWE: CWE-345, CWE-345
References: https://github.com/home-assistant/core/security/advisories/GHSA-935v-rmg9-44mw; https://github.com/home-assistant/core/security/advisories/GHSA-cr83-q7r2-7f5q; https://github.com/home-assistant/core/security/advisories/GHSA-935v-rmg9-44mw
CVE: CVE-2023-41897
Published: 2023-10-19
Description: Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers facilitates covert clickjacking attacks and alternative exploit opportunities, such as the vector described in this security advisory. This fault incurs major risk, considering the ability to trick users into installing an external and malicious add-on with minimal user interaction, which would enable Remote Code Execution (RCE) within the Home Assistant application. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-1021, CWE-1021
References: https://github.com/home-assistant/core/security/advisories/GHSA-935v-rmg9-44mw; https://github.com/home-assistant/core/security/advisories/GHSA-cr83-q7r2-7f5q; https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/
CVE: CVE-2023-41898
Published: 2023-10-19
Description: Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.
CVSS Score: 8.6 (HIGH)
CWE: CWE-94, CWE-345, CWE-94
References: https://github.com/home-assistant/core/security/advisories/GHSA-jvpm-q3hq-86rg; https://github.com/home-assistant/core/security/advisories/GHSA-jvpm-q3hq-86rg
CVE: CVE-2023-41899
Published: 2023-10-19
Description: Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke any Supervisor REST API endpoints with a POST request. An attacker able to exploit will be able to control the data dictionary, including its addon and input key/values. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-162`.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-918, CWE-918
References: https://github.com/home-assistant/core/security/advisories/GHSA-4r74-h49q-rr3h; https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp; https://github.com/home-assistant/core/security/advisories/GHSA-4r74-h49q-rr3h
CVE: CVE-2023-43340
Published: 2023-10-19
Description: Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-79
References: https://github.com/sromanhu/-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options; https://github.com/sromanhu/Evolution-Reflected-XSS---Installation-Admin-Options; https://github.com/sromanhu/-CVE-2023-43340-Evolution-Reflected-XSS---Installation-Admin-Options
CVE: CVE-2023-43345
Published: 2023-10-19
Description: Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted script to the Content - Name parameter in the Pages Menu component.
CVSS Score: 8.6 (HIGH)
CWE: CWE-79
References: https://github.com/sromanhu/CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content; https://github.com/sromanhu/CVE-2023-43345-Quick-CMS-Stored-XSS---Pages-Content
CVE: CVE-2023-44385
Published: 2023-10-19
Description: The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant installation. Combined with this security advisory, may result in full compromise and remote code execution (RCE). Version 2023.7 addresses this issue and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: GHSL-2023-161.
CVSS Score: 8.6 (HIGH)
CWE: CWE-352, CWE-352
References: https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp; https://github.com/home-assistant/core/security/advisories/GHSA-h2jp-7grc-9xpp
CVE: CVE-2023-39731
Published: 2023-10-20
Description: The leakage of the client secret in Kaibutsunosato v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messages.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284
References: https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39731.md; https://liff.line.me/[PII_REDACTED]-pwEQNzJ4; https://github.com/syz913/CVE-reports/blob/main/CVE-2023-39731.md
CVE: CVE-2023-41893
Published: 2023-10-20
Description: Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Consequently, the code parameter utilized to fetch the `access_token` post-authentication will be sent to the URL specified in the aforementioned parameters. Since an arbitrary URL is permitted and `homeassistant.local` represents the preferred, default domain likely used and trusted by many users, an attacker could leverage this weakness to manipulate a user and retrieve account access. Notably, this attack strategy is plausible if the victim has exposed their Home Assistant to the Internet, since after acquiring the victim’s `access_token` the adversary would need to utilize it directly towards the instance to achieve any pertinent malicious actions. To achieve this compromise attempt, the attacker must send a link with a `redirect_uri` that they control to the victim’s own Home Assistant instance. In the eventuality the victim authenticates via said link, the attacker would obtain code sent to the specified URL in `redirect_uri`, which can then be leveraged to fetch an `access_token`. Pertinently, an attacker could increase the efficacy of this strategy by registering a near identical domain to `homeassistant.local`, which at first glance may appear legitimate and thereby obfuscate any malicious intentions. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://github.com/home-assistant/core/security/advisories/GHSA-qhhj-7hrc-gqj5; https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/; https://github.com/home-assistant/core/security/advisories/GHSA-qhhj-7hrc-gqj5
CVE: CVE-2023-41894
Published: 2023-10-20
Description: Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local network. This issue is facilitated by the SniTun proxy, which sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-669
References: https://github.com/home-assistant/core/security/advisories/GHSA-wx3j-3v2j-rf45; https://www.home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant/; https://github.com/home-assistant/core/security/advisories/GHSA-wx3j-3v2j-rf45