deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 8.5.6, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-cv3m-hxpc-4hvm
Package: cn.dreampie:resty (MAVEN)
Severity: LOW (CVSS 5.6)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 1.3.1.SNAPSHOT
Patched in: unpatched

Summary: Resty has a Path Traversal vulnerability

Details:
A security vulnerability has been detected in Dreampie Resty versions up to the 1.3.1.SNAPSHOT. This affects the function Request of the file /resty-httpclient/src/main/java/cn/dreampie/client/HttpClient.java of the component HttpClient Module. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
GitHub Security Advisory: GHSA-wq4c-57mh-5f7g
Package: org.apache.causeway.viewer:causeway-viewer-wicket (MAVEN)
Severity: CRITICAL (CVSS 6.3)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.5.0
Patched in: 3.5.0

Summary: Apache Causeway vulnerable to deserialization in Java

Details:
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.
GitHub Security Advisory: GHSA-wq4c-57mh-5f7g
Package: org.apache.causeway.core:causeway-core (MAVEN)
Severity: CRITICAL (CVSS 6.3)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.5.0
Patched in: 3.5.0

Summary: Apache Causeway vulnerable to deserialization in Java

Details:
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.
GitHub Security Advisory: GHSA-wq4c-57mh-5f7g
Package: org.apache.causeway.core:causeway-applib (MAVEN)
Severity: CRITICAL (CVSS 6.3)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.5.0
Patched in: 3.5.0

Summary: Apache Causeway vulnerable to deserialization in Java

Details:
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.
GitHub Security Advisory: GHSA-wq4c-57mh-5f7g
Package: org.apache.causeway.commons:causeway-commons (MAVEN)
Severity: CRITICAL (CVSS 6.3)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 3.5.0
Patched in: 3.5.0

Summary: Apache Causeway vulnerable to deserialization in Java

Details:
Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. These vulnerabilities affect all applications using Causeway's ViewModel functionality and can be exploited by authenticated attackers to execute arbitrary code with application privileges. 

This issue affects all current versions.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.
GitHub Security Advisory: GHSA-7p63-w6x9-6gr7
Package: org.glassfish.jersey.core:jersey-client (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-296: Improper Following of a Certificate's Chain of Trust, CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: = 3.1.9
Patched in: 3.1.10

Summary: Eclipse Jersey has a Race Condition

Details:
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
GitHub Security Advisory: GHSA-7p63-w6x9-6gr7
Package: org.glassfish.jersey.core:jersey-client (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-296: Improper Following of a Certificate's Chain of Trust, CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: = 3.0.16
Patched in: 3.0.17

Summary: Eclipse Jersey has a Race Condition

Details:
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
GitHub Security Advisory: GHSA-7p63-w6x9-6gr7
Package: org.glassfish.jersey.core:jersey-client (MAVEN)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-296: Improper Following of a Certificate's Chain of Trust, CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Vulnerable versions: = 2.45
Patched in: 2.46

Summary: Eclipse Jersey has a Race Condition

Details:
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and other security settings. This issue may result in SSLHandshakeException under normal circumstances, but under certain conditions, it could lead to unauthorized trust in insecure servers (see PoC)
GitHub Security Advisory: GHSA-8c52-x9w7-vc95
Package: com.xwiki.pro:xwiki-pro-macros-ui (MAVEN)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-862: Missing Authorization
Vulnerable versions: <= 1.26.20
Patched in: 1.27.0

Summary: XWiki view file macro: User can view content of office file without view rights on the attachment 

Details:
### Summary
A user with no view rights on a page may see the content of an office attachment displayed with the view file macro.

### Details
If on a public page is displayed an office attachment from a restricted page, a user with no view rights on the restricted page can view the attachment content, no matter the display type used.

### PoC
1. Install and activate the Pro Macros application
2. Create a page and limit the view rights for a test user
3. Add an attachment to the restricted page
4. Create a new public page
5. Add the view file macro and select the attachment from the restricted page using any display type
6. Login as the test user with restricted view rights
7. The user will see the content despite having no view rights

### Workarounds
None

### Impact
Private data can be leaked if a user knows the reference to an attachment and has edit rights on a page.
GitHub Security Advisory: GHSA-v7r8-8p5c-h4xw
Package: com.xwiki.admintools:application-admintools (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-276: Incorrect Default Permissions
Vulnerable versions: < 1.1
Patched in: 1.1

Summary: XWiki AdminTools application doesn't set permissions on the AdminTools space

Details:
### Impact

Users without admin rights have access to `AdminTools.SpammedPages`. 

### Details
View rights are not restricted only to admin users for `AdminTools.SpammedPages`. While no data is visible to non admin users, the page is still accessible.

### Workarounds
Set the view rights for the `AdminTools` space to be only available for the `XWikiAdminGroup`.
GitHub Security Advisory: GHSA-cg6m-9276-qpjj
Package: io.github.wwwlike:vlife-base (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 2.0.1
Patched in: unpatched

Summary: vlife-base has Path Traversal vulnerability

Details:
A security vulnerability has been detected in wwwlike vlife up to 2.0.1. This issue affects the function create of the file vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java of the component VLifeApi. Such manipulation of the argument fileName leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.
GitHub Security Advisory: GHSA-gwwr-j923-vq7r
Package: lsfusion.platform:web-client (MAVEN)
Severity: MODERATE (CVSS 7.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 6.1
Patched in: unpatched

Summary: lsFusion Platform has a Path Traversal vulnerability

Details:
A vulnerability was determined in lsfusion platform up to 6.1. Affected by this vulnerability is the function UploadFileRequestHandler of the file platform/web-client/src/main/java/lsfusion/http/controller/file/UploadFileRequestHandler.java. Executing manipulation of the argument sid can lead to path traversal. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
GitHub Security Advisory: GHSA-5jpg-2rj5-964c
Package: lsfusion.platform:web-client (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: <= 6.1
Patched in: unpatched

Summary: lsFusion Platform has a Path Traversal vulnerability

Details:
A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Performing manipulation of the argument Version results in path traversal. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
GitHub Security Advisory: GHSA-cx25-xg7c-xfm5
Package: struts:struts (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: = 1.2.9
Patched in: unpatched

Summary: Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability

Details:
** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.

This issue affects Apache Struts Extras: before 2.

When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). 

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
GitHub Security Advisory: GHSA-7m9g-pmxf-m9m8
Package: org.keycloak:keycloak-quarkus-server (MAVEN)
Severity: MODERATE (CVSS 6.8)
CWE: CWE-1327: Binding to an Unrestricted IP Address
Vulnerable versions: <= 26.4.4
Patched in: unpatched

Summary: Duplicate Advisory: Keycloak allows Binding to an Unrestricted IP Address

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references.

### Original Description
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0). This exposes the debug port to the local network, allowing an attacker on the same network segment to attach a remote debugger and achieve remote code execution within the Keycloak Java virtual machine.
GitHub Security Advisory: GHSA-7xw4-g7mm-r4hh
Package: software.amazon.jdbc:aws-advanced-jdbc-wrapper (MAVEN)
Severity: HIGH (CVSS 8.0)
CWE: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Vulnerable versions: <= 2.6.4
Patched in: 2.6.5

Summary: Amazon Web Services Advanced JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Details:
### Description of Vulnerability:
An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

AWS recommends for customers to upgrade to the following versions: AWS JDBC Wrapper to v2.6.5 or greater.


### Source of Vulnerability Report: 
Allistair Ishmael Hakim [allistair.hakim@gmail.com](mailto:allistair.hakim@gmail.com)


### Affected products & versions: 
AWS JDBC Wrapper < 2.6.5

### Platforms: 
MacOS/Windows/Linux
GitHub Security Advisory: GHSA-3cqm-mf7h-prrj
Package: com.squareup.okhttp3:okhttp (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 4.9.2
Patched in: 4.9.2

Summary: Square OkHttp can accept the wrong certificate

Details:
In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android ID: A-171980069
GitHub Security Advisory: GHSA-39hr-239p-fhqc
Package: org.openidentityplatform.openam:openam-oauth2 (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), CWE-94: Improper Control of Generation of Code ('Code Injection')
Vulnerable versions: < 16.0.3
Patched in: 16.0.3

Summary: OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed 

Details:
### Summary
If the "claims_parameter_supported" parameter is activated, it is possible through the "oidc-claims-extension.groovy" script, to inject the value of choice into a claim contained in the id_token or in the user_info.
Authorization function requests do not prevent a claims parameter containing a JSON file to be injected. This JSON file allows users to customize claims returned by the "id_token" and "user_info" files.
This allows for a very wide range of vulnerabilities depending on how clients use claims. For example, if some clients rely on an email field to identify a user, users can choose to entera any email address, and therefore assume any chosen identity.
GitHub Security Advisory: GHSA-rg35-5v25-mqvp
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 6.0)
CWE: CWE-384: Session Fixation
Vulnerable versions: < 26.0.0
Patched in: 26.0.0

Summary: Keycloak vulnerable to session takeovers due to reuse of session identifiers

Details:
A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user.
GitHub Security Advisory: GHSA-6fhj-vr9j-g45r
Package: org.cyclonedx:cyclonedx-core-java (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 2.1.0, < 11.0.1
Patched in: 11.0.1

Summary: CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection 

Details:
### Impact

The XML [`Validator`](https://docs.oracle.com/javase/8/docs/api/javax/xml/validation/Validator.html) used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection.

The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 has been incomplete in that it only fixed *parsing* of XML BOMs, but not *validation*.

### Patches

The vulnerability has been fixed in cyclonedx-core-java version 11.0.1.

### Workarounds

If feasible, applications can reject XML documents before handing them to cyclonedx-core-java for validation.
This may be an option if incoming CycloneDX BOMs are known to be in JSON format.

### References

* The issue was introduced via https://github.com/CycloneDX/cyclonedx-core-java/commit/162aa594f347b3f612fe0a45071693c3cd398ce9
* The issue was fixed via https://github.com/CycloneDX/cyclonedx-core-java/pull/737
* https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#schemafactory
GitHub Security Advisory: GHSA-j346-h5wc-rw2m
Package: org.apache.solr:solr-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 6.6.6
Patched in: 6.6.6

Summary: Incorrect Authorization in Apache Solr

Details:
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
GitHub Security Advisory: GHSA-j346-h5wc-rw2m
Package: org.apache.solr:solr-core (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.0.0, < 7.7.0
Patched in: 7.7.0

Summary: Incorrect Authorization in Apache Solr

Details:
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
GitHub Security Advisory: GHSA-j346-h5wc-rw2m
Package: org.apache.solr:solr-parent (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 6.6.6
Patched in: 6.6.6

Summary: Incorrect Authorization in Apache Solr

Details:
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
GitHub Security Advisory: GHSA-j346-h5wc-rw2m
Package: org.apache.solr:solr-parent (MAVEN)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 7.0.0, < 7.7.0
Patched in: 7.7.0

Summary: Incorrect Authorization in Apache Solr

Details:
In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 6.6.6 and 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_3 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: 2.5.13

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-rrw2-px9j-qffj
Package: co.fs2:fs2-io_2.13 (MAVEN)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: < 2.5.13
Patched in: 2.5.13

Summary: FS2 half-shutdown of socket during TLS handshake may result in spin loop on opposite side

Details:
### Impact
When establishing a TLS session using `fs2-io` on the JVM using the `fs2.io.net.tls` package, if one side of the connection shuts down write while the peer side is awaiting more data to progress the TLS handshake, the peer side will spin loop on the socket read, fully utilizing a CPU. This CPU is consumed until the overall connection is closed.

This could be used as a denial of service attack on an fs2-io powered server -- for example, by opening many connections and putting them in a half-shutdown state.

Note: this issue impacts ember backed http4s servers with HTTPS as a result of ember using fs2's TLS support.

### Patches
Fixed in fs2 3.12.2 and 3.13.0-M7.

### Workarounds
No workarounds.

### For more information

If you have any questions or comments about this advisory:

[Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).