deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-735f-pc8j-v9w8
Package: com.google.protobuf:protobuf-kotlin (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 4.28.0-RC1, < 4.28.2
Patched in: 4.28.2

Summary: protobuf-java has potential Denial of Service issue

Details:
### Summary
When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team <ecosystem@trailofbits.com>

Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

### Severity
[CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)
This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

### Proof of Concept
For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.

### Remediation and Mitigation
We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:
* protobuf-java (3.25.5, 4.27.5, 4.28.2)
* protobuf-javalite (3.25.5, 4.27.5, 4.28.2)
* protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)
* protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)
* com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)
GitHub Security Advisory: GHSA-735f-pc8j-v9w8
Package: com.google.protobuf:protobuf-kotlin (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 4.0.0-RC1, < 4.27.5
Patched in: 4.27.5

Summary: protobuf-java has potential Denial of Service issue

Details:
### Summary
When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team <ecosystem@trailofbits.com>

Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

### Severity
[CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)
This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

### Proof of Concept
For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.

### Remediation and Mitigation
We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:
* protobuf-java (3.25.5, 4.27.5, 4.28.2)
* protobuf-javalite (3.25.5, 4.27.5, 4.28.2)
* protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)
* protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)
* com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)
GitHub Security Advisory: GHSA-735f-pc8j-v9w8
Package: com.google.protobuf:protobuf-kotlin-lite (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 4.28.0-RC1, < 4.28.2
Patched in: 4.28.2

Summary: protobuf-java has potential Denial of Service issue

Details:
### Summary
When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team <ecosystem@trailofbits.com>

Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

### Severity
[CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)
This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

### Proof of Concept
For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.

### Remediation and Mitigation
We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:
* protobuf-java (3.25.5, 4.27.5, 4.28.2)
* protobuf-javalite (3.25.5, 4.27.5, 4.28.2)
* protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)
* protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)
* com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)
GitHub Security Advisory: GHSA-735f-pc8j-v9w8
Package: com.google.protobuf:protobuf-kotlin-lite (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation, CWE-400: Uncontrolled Resource Consumption, CWE-787: Out-of-bounds Write
Vulnerable versions: >= 4.0.0-RC1, < 4.27.5
Patched in: 4.27.5

Summary: protobuf-java has potential Denial of Service issue

Details:
### Summary
When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team <ecosystem@trailofbits.com>

Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.

### Severity
[CVE-2024-7254](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254) **High** CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)
This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.

### Proof of Concept
For reproduction details, please refer to the unit tests (Protobuf Java [LiteTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java) and [CodedInputStreamTest](https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java)) that identify the specific inputs that exercise this parsing weakness.

### Remediation and Mitigation
We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:
* protobuf-java (3.25.5, 4.27.5, 4.28.2)
* protobuf-javalite (3.25.5, 4.27.5, 4.28.2)
* protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)
* protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)
* com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)
GitHub Security Advisory: GHSA-876g-49r6-33qj
Package: com.liferay:com.liferay.portal.workflow.kaleo.runtime.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 6.0.93
Patched in: 6.0.93

Summary: Liferay Portal allows improper access through the expandoTableLocalService

Details:
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService.
GitHub Security Advisory: GHSA-mpww-r37c-vxjw
Package: ccom.liferay:com.liferay.dynamic.data.mapping.web (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 5.0.122
Patched in: 5.0.122

Summary: Liferay Portal Vulnerable to Cross-Site Scripting in Dynamic Data Mapping

Details:
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 allows a remote authenticated attacker to inject JavaScript code via _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_portletNamespace and _com_liferay_dynamic_data_mapping_web_portlet_DDMPortlet_namespace parameter.
GitHub Security Advisory: GHSA-hq8m-v68g-8cf8
Package: org.opencastproject:opencast-user-interface-configuration (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: = 18.0
Patched in: 18.1

Summary: Opencast has a partial path traversal vulnerability in UI config

Details:
The protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases.

The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. For example, the default UI config directory is placed at `/etc/opencast/ui-config`. Without this patch, an attacker can get access to files in a folder `/etc/opencast/ui-config-hidden` if those files are readable by Opencast.

General path traversal is not possible. For example, an attacker **cannot** exploit this to access files in `/etc/opencast/encoding` or even in `/etc/opencast/` directly.

### How dangerous is this?

Theoretically, this vulnerability may be exploited to get access to some non-public files. However, given the default structure of Opencast's configuration, this is extremely unlikely to hit any users. There can be but one `ui-config` folders. This makes it quite unlikely for any user to have created an additional folder starting with `ui-config`. Users could also rename this folder, but since there is no real reason for anyone to do this, this, again is extremely unlikely to trigger this issue.

### How to fix the issue

- To mitigate this, check if you have folders which start with the same path as your `ui-config` folder
- A fix is available in https://github.com/opencast/opencast/pull/6979
- Updating to Opencast 17.7 or 18.1 will fix the issue
GitHub Security Advisory: GHSA-hq8m-v68g-8cf8
Package: org.opencastproject:opencast-user-interface-configuration (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: < 17.7
Patched in: 17.7

Summary: Opencast has a partial path traversal vulnerability in UI config

Details:
The protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases.

The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. For example, the default UI config directory is placed at `/etc/opencast/ui-config`. Without this patch, an attacker can get access to files in a folder `/etc/opencast/ui-config-hidden` if those files are readable by Opencast.

General path traversal is not possible. For example, an attacker **cannot** exploit this to access files in `/etc/opencast/encoding` or even in `/etc/opencast/` directly.

### How dangerous is this?

Theoretically, this vulnerability may be exploited to get access to some non-public files. However, given the default structure of Opencast's configuration, this is extremely unlikely to hit any users. There can be but one `ui-config` folders. This makes it quite unlikely for any user to have created an additional folder starting with `ui-config`. Users could also rename this folder, but since there is no real reason for anyone to do this, this, again is extremely unlikely to trigger this issue.

### How to fix the issue

- To mitigate this, check if you have folders which start with the same path as your `ui-config` folder
- A fix is available in https://github.com/opencast/opencast/pull/6979
- Updating to Opencast 17.7 or 18.1 will fix the issue
GitHub Security Advisory: GHSA-6qr6-x7jm-x2q6
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 8.0.0-RC1, <= 8.0.26
Patched in: 8.0.27

Summary: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Details:
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
GitHub Security Advisory: GHSA-rh8q-vjgf-gf74
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 8.0.0-RC1, < 8.0.30
Patched in: 8.0.30

Summary: Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Details:
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
GitHub Security Advisory: GHSA-w48j-pp7j-fj55
Package: com.ritense.valtimo:core (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 13.0.0.RELEASE, < 13.1.2.RELEASE
Patched in: 13.1.2.RELEASE

Summary: Valtimo scripting engine can be used to gain access to sensitive data or resources

Details:
### Impact
Any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources.

This includes but is not limited to:
- Running executables on the application host
- Inspecting and extracting data from the host environment or application properties
- Spring beans (application context, database pooling)

### Attack requirements
The following conditions have to be met in order to perform this attack:
- The user must be logged in
- The user must have the admin role (ROLE_ADMIN), which is required to change process definitions
- The user must have some knowledge about running scripts via a the Camunda/Operator engine

### Patches
Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade.

### Workarounds
If no scripting is needed in any of the processes, it could be possible to disable it altogether via the `ProcessEngineConfiguration`:
```
@Component
class NoScriptEnginePlugin : ProcessEnginePlugin {
    override fun preInit(processEngineConfiguration: ProcessEngineConfigurationImpl) {}

    override fun postInit(processEngineConfiguration: ProcessEngineConfigurationImpl) {
        processEngineConfiguration.scriptEngineResolver = null
    }

    override fun postProcessEngineBuild(processEngine: ProcessEngine) {}
}
```
Warning: this workaround could lead to unexpected side-effects. Please test thoroughly.

### References
- Valtimo 12 and lower: [Camunda Scripting](https://docs.camunda.org/manual/latest/user-guide/process-engine/scripting/#custom-scriptengineresolver)
- Valtimo 13 and higher: [Operaton Scripting](https://docs.operaton.org/docs/documentation/user-guide/process-engine/scripting)
GitHub Security Advisory: GHSA-w48j-pp7j-fj55
Package: com.ritense.valtimo:core (MAVEN)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 12.16.0.RELEASE
Patched in: 12.16.0.RELEASE

Summary: Valtimo scripting engine can be used to gain access to sensitive data or resources

Details:
### Impact
Any admin that can create or modify and execute process-definitions could gain access to sensitive data or resources.

This includes but is not limited to:
- Running executables on the application host
- Inspecting and extracting data from the host environment or application properties
- Spring beans (application context, database pooling)

### Attack requirements
The following conditions have to be met in order to perform this attack:
- The user must be logged in
- The user must have the admin role (ROLE_ADMIN), which is required to change process definitions
- The user must have some knowledge about running scripts via a the Camunda/Operator engine

### Patches
Version 12.16.0 and 13.1.2 have been patched. It is strongly advised to upgrade.

### Workarounds
If no scripting is needed in any of the processes, it could be possible to disable it altogether via the `ProcessEngineConfiguration`:
```
@Component
class NoScriptEnginePlugin : ProcessEnginePlugin {
    override fun preInit(processEngineConfiguration: ProcessEngineConfigurationImpl) {}

    override fun postInit(processEngineConfiguration: ProcessEngineConfigurationImpl) {
        processEngineConfiguration.scriptEngineResolver = null
    }

    override fun postProcessEngineBuild(processEngine: ProcessEngine) {}
}
```
Warning: this workaround could lead to unexpected side-effects. Please test thoroughly.

### References
- Valtimo 12 and lower: [Camunda Scripting](https://docs.camunda.org/manual/latest/user-guide/process-engine/scripting/#custom-scriptengineresolver)
- Valtimo 13 and higher: [Operaton Scripting](https://docs.operaton.org/docs/documentation/user-guide/process-engine/scripting)
GitHub Security Advisory: GHSA-9m7c-m33f-3429
Package: org.xwiki.platform:xwiki-platform-export-pdf-api (MAVEN)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer, CWE-257: Storing Passwords in a Recoverable Format
Vulnerable versions: >= 17.0.0-rc-1, < 17.4.0-rc-1
Patched in: 17.4.0-rc-1

Summary: XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

Details:
### Impact

The PDF export uses a background job that runs on the server-side. Jobs like this have a status that is serialized in the permanent directory when the job is finished. The job status includes the job request. The PDF export job request is initialized, before the job starts, with some context information that is needed to replicate the HTTP request (used to trigger the export) in the background thread used to run the export job. This context information includes the cookies from the HTTP request that triggered the export. As a result, the user cookies (including the encrypted username and password) are stored in the permanent directory after the PDF export is finished. As the encryption key is stored in the same data directory (by default it is generated in ``data/configuration.properties``), this means that this job status contains the equivalent of the plain text password of the user who requested the PDF export.

XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory.

### Patches

This vulnerability has been patched in XWiki 16.4.8, 16.10.7 and 17.4.0RC1.

### Workarounds

We're not aware of any workarounds except for upgrading.
GitHub Security Advisory: GHSA-9m7c-m33f-3429
Package: org.xwiki.platform:xwiki-platform-export-pdf-api (MAVEN)
Severity: MODERATE (CVSS 5.8)
CWE: CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer, CWE-257: Storing Passwords in a Recoverable Format
Vulnerable versions: >= 16.5.0-rc-1, < 16.10.7
Patched in: 16.10.7

Summary: XWiki PDF export jobs store sensitive cookies unencrypted in job statuses

Details:
### Impact

The PDF export uses a background job that runs on the server-side. Jobs like this have a status that is serialized in the permanent directory when the job is finished. The job status includes the job request. The PDF export job request is initialized, before the job starts, with some context information that is needed to replicate the HTTP request (used to trigger the export) in the background thread used to run the export job. This context information includes the cookies from the HTTP request that triggered the export. As a result, the user cookies (including the encrypted username and password) are stored in the permanent directory after the PDF export is finished. As the encryption key is stored in the same data directory (by default it is generated in ``data/configuration.properties``), this means that this job status contains the equivalent of the plain text password of the user who requested the PDF export.

XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passwords by gaining access to, e.g., a backup of the data directory.

### Patches

This vulnerability has been patched in XWiki 16.4.8, 16.10.7 and 17.4.0RC1.

### Workarounds

We're not aware of any workarounds except for upgrading.