deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-r38m-cgpg-qj69
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 17.0.0-rc-1, < 17.2.0-rc-1
Patched in: 17.2.0-rc-1

Summary: XWiki leaks password hashes and other accessible password properties

Details:
### Impact
Any user with edit right on a page of the wiki can create an XClass with a database list property that references a password property, for example the password hash that is stored for users. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view.

### Patches
This vulnerability has been pached in XWiki 16.4.7, 16.10.5, and 17.2.0 by disallowing the use of password properties in database list properties. Additionally, queries for email properties are disallowed, too, when email obfuscation is enabled.

### Workarounds
We're not aware of any workarounds.
GitHub Security Advisory: GHSA-r38m-cgpg-qj69
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 16.5.0-rc-1, < 16.10.5
Patched in: 16.10.5

Summary: XWiki leaks password hashes and other accessible password properties

Details:
### Impact
Any user with edit right on a page of the wiki can create an XClass with a database list property that references a password property, for example the password hash that is stored for users. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view.

### Patches
This vulnerability has been pached in XWiki 16.4.7, 16.10.5, and 17.2.0 by disallowing the use of password properties in database list properties. Additionally, queries for email properties are disallowed, too, when email obfuscation is enabled.

### Workarounds
We're not aware of any workarounds.
GitHub Security Advisory: GHSA-r38m-cgpg-qj69
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 9.8-rc-1, < 16.4.7
Patched in: 16.4.7

Summary: XWiki leaks password hashes and other accessible password properties

Details:
### Impact
Any user with edit right on a page of the wiki can create an XClass with a database list property that references a password property, for example the password hash that is stored for users. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view.

### Patches
This vulnerability has been pached in XWiki 16.4.7, 16.10.5, and 17.2.0 by disallowing the use of password properties in database list properties. Additionally, queries for email properties are disallowed, too, when email obfuscation is enabled.

### Workarounds
We're not aware of any workarounds.
GitHub Security Advisory: GHSA-m9x4-w7p9-mxhx
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 17.0.0-rc-1, < 17.3.0-rc-1
Patched in: 17.3.0-rc-1

Summary: XWiki allows Reflected XSS in two templates

Details:
### Impact
Reflected XSS vulnerabilities in two templates allow an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. PoC URLs are `/xwiki/bin/view/Main/?xpage=job_status_json&jobId=asdf&translationPrefix=<img src=1 onerror=alert(document.domain)>` and `/xwiki/bin/view/Main/?xpage=distribution&extensionId=%3Cimg src=x onerror=alert(document.domain)%3E&extensionVersionConstraint=%3Cimg src=x onerror=alert(document.domain)%3E`. This allows the attacker to perform arbitrary actions using the permissions of the victim.

### Patches
The problem has been patched in XWiki 16.4.8, 16.10.6 and 17.3.0RC1 by adding escaping in the affected templates.

### Workarounds
The affected templates can be patched manually in the WAR by applying the same changes as in [the patch](https://github.com/xwiki/xwiki-platform/commit/e5926a938cbecc8b1eaa48053d8d370cff107cb0).

### Attribution

The vulnerability involving `job_status_json` has been reported as "Unauth Reflected XSS" vulnerability by Aleksey Solovev (Positive Technologies), and the vulnerability involving `distribution` has been reported as "Auth Admin Reflected XSS" vulnerability by Evgeny Kopytin (Positive Technologies). According to our analysis, both vulnerabilities can be exploited against both unauthenticated and authenticated victims (including victims with admin privileges) which is why we publish them together in this advisory.
GitHub Security Advisory: GHSA-m9x4-w7p9-mxhx
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 16.5.0-rc-1, < 16.10.6
Patched in: 16.10.6

Summary: XWiki allows Reflected XSS in two templates

Details:
### Impact
Reflected XSS vulnerabilities in two templates allow an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. PoC URLs are `/xwiki/bin/view/Main/?xpage=job_status_json&jobId=asdf&translationPrefix=<img src=1 onerror=alert(document.domain)>` and `/xwiki/bin/view/Main/?xpage=distribution&extensionId=%3Cimg src=x onerror=alert(document.domain)%3E&extensionVersionConstraint=%3Cimg src=x onerror=alert(document.domain)%3E`. This allows the attacker to perform arbitrary actions using the permissions of the victim.

### Patches
The problem has been patched in XWiki 16.4.8, 16.10.6 and 17.3.0RC1 by adding escaping in the affected templates.

### Workarounds
The affected templates can be patched manually in the WAR by applying the same changes as in [the patch](https://github.com/xwiki/xwiki-platform/commit/e5926a938cbecc8b1eaa48053d8d370cff107cb0).

### Attribution

The vulnerability involving `job_status_json` has been reported as "Unauth Reflected XSS" vulnerability by Aleksey Solovev (Positive Technologies), and the vulnerability involving `distribution` has been reported as "Auth Admin Reflected XSS" vulnerability by Evgeny Kopytin (Positive Technologies). According to our analysis, both vulnerabilities can be exploited against both unauthenticated and authenticated victims (including victims with admin privileges) which is why we publish them together in this advisory.
GitHub Security Advisory: GHSA-m9x4-w7p9-mxhx
Package: org.xwiki.platform:xwiki-platform-web-templates (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: >= 4.2-milestone-3, < 16.4.8
Patched in: 16.4.8

Summary: XWiki allows Reflected XSS in two templates

Details:
### Impact
Reflected XSS vulnerabilities in two templates allow an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. PoC URLs are `/xwiki/bin/view/Main/?xpage=job_status_json&jobId=asdf&translationPrefix=<img src=1 onerror=alert(document.domain)>` and `/xwiki/bin/view/Main/?xpage=distribution&extensionId=%3Cimg src=x onerror=alert(document.domain)%3E&extensionVersionConstraint=%3Cimg src=x onerror=alert(document.domain)%3E`. This allows the attacker to perform arbitrary actions using the permissions of the victim.

### Patches
The problem has been patched in XWiki 16.4.8, 16.10.6 and 17.3.0RC1 by adding escaping in the affected templates.

### Workarounds
The affected templates can be patched manually in the WAR by applying the same changes as in [the patch](https://github.com/xwiki/xwiki-platform/commit/e5926a938cbecc8b1eaa48053d8d370cff107cb0).

### Attribution

The vulnerability involving `job_status_json` has been reported as "Unauth Reflected XSS" vulnerability by Aleksey Solovev (Positive Technologies), and the vulnerability involving `distribution` has been reported as "Auth Admin Reflected XSS" vulnerability by Evgeny Kopytin (Positive Technologies). According to our analysis, both vulnerabilities can be exploited against both unauthenticated and authenticated victims (including victims with admin privileges) which is why we publish them together in this advisory.
GitHub Security Advisory: GHSA-xg8j-j6vp-6h5w
Package: org.apache.zeppelin:zeppelin-shell (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-1385: Missing Origin Validation in WebSockets
Vulnerable versions: >= 0.11.1, < 0.12.0
Patched in: 0.12.0

Summary: Apache Zeppelin: Missing Origin Validation in WebSockets vulnerability

Details:
Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.

The attacker could access the Zeppelin server from another origin without any restriction, and get internal information about paragraphs. 
This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.
GitHub Security Advisory: GHSA-p288-459w-jxj6
Package: org.apache.zeppelin:zeppelin-web (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 0.12.0
Patched in: 0.12.0

Summary: Apache Zeppelin: XSS in the Helium module

Details:
Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin.

This issue affects Apache Zeppelin: before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.
GitHub Security Advisory: GHSA-jr43-q92q-5q82
Package: org.apache.zeppelin:zeppelin-jdbc (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 0.11.1, < 0.12.0
Patched in: 0.12.0

Summary: Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string

Details:
Improper Input Validation vulnerability in Apache Zeppelin. The fix for JDBC URL validation in CVE-2024-31864 did not account for URL encoded input.

This issue affects Apache Zeppelin: from 0.11.1 before 0.12.0.

Users are recommended to upgrade to version 0.12.0, which fixes the issue.
GitHub Security Advisory: GHSA-2rjv-cv85-xhgm
Package: org.opensearch.plugin:opensearch-security (MAVEN)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2.19.3.0
Patched in: 2.19.3.0

Summary: OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object

Details:
### Impact

OpenSearch versions 2.19.2 and earlier improperly apply Field Level Security (FLS) rules on fields which are not at the top level of the source document tree (i.e., which are members of a JSON object). 

If an FLS exclusion rule (like `~object`) is applied to an object valued attribute in a source document, the object is properly removed from the `_source` document in search and get results. However, any member attribute of that object remains available to search queries. This allows to reconstruct the original field contents using range queries. 

### Patches

The issue has been resolved in OpenSearch 3.0.0 and OpenSearch 2.19.3.

### Workarounds

If FLS exclusion rules are used for object valued attributes  (like `~object`), add an additional exclusion rule for the members of the object  (like `~object.*`).
GitHub Security Advisory: GHSA-rrmm-wq7q-h4v5
Package: org.opensearch.plugin:opensearch-security (MAVEN)
Severity: MODERATE (CVSS 5.7)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 2.19.3.0
Patched in: 2.19.3.0

Summary: OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape

Details:
### Impact

OpenSearch versions 2.19.2 and earlier improperly apply field masking rules on fields of the types `ip`, `geo_point`, `geo_shape`, `xy_point`, `xy_shape`. While the content of these fields is properly redacted in the `_source` document returned by search operations, the original unredacted values remain available to search queries. This allows to reconstruct the original field contents using range queries.

Additionally, the content of fields of type `geo_point`, `geo_shape`, `xy_point`, `xy_shape` is returned in an unredacted form if requested via the `fields` option of the search API.

### Patches

The issue has been resolved in OpenSearch 3.0.0 and OpenSearch 2.19.3.

### Workarounds

If you cannot upgrade immediately, you can avoid the problem by using field level security (FLS) protection on fields of the affected types instead of field masking.
GitHub Security Advisory: GHSA-72ww-4rcw-mc62
Package: org.apache.jspwiki:jspwiki-main (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.12.3
Patched in: 2.12.3

Summary: Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability in the Image Plugin

Details:
A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Apache JSPWiki users should upgrade to 2.12.3 or later.
GitHub Security Advisory: GHSA-rrff-chj9-w4c7
Package: org.apache.jspwiki:jspwiki-markdown (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.12.3
Patched in: 2.12.3

Summary: Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

Details:
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.

Apache JSPWiki users should upgrade to 2.12.3 or later.
GitHub Security Advisory: GHSA-rrff-chj9-w4c7
Package: org.apache.jspwiki:jspwiki-main (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.12.3
Patched in: 2.12.3

Summary: Apache JSPWiki Cross-Site Scripting (XSS) Vulnerability via Header Link Rendering

Details:
A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Further research by the JSPWiki team showed that the markdown parser allowed this kind of attack too.

Apache JSPWiki users should upgrade to 2.12.3 or later.
GitHub Security Advisory: GHSA-cx25-xg7c-xfm5
Package: org.apache.struts:struts-extras (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-117: Improper Output Neutralization for Logs
Vulnerable versions: <= 1.3.10
Patched in: unpatched

Summary: Apache Struts Extras Before 2 has an Improper Output Neutralization for Logs Vulnerability

Details:
** UNSUPPORTED WHEN ASSIGNED ** Improper Output Neutralization for Logs vulnerability in Apache Struts.

This issue affects Apache Struts Extras: before 2.

When using LookupDispatchAction, in some cases, Struts may print untrusted input to the logs without any filtering. Specially-crafted input may lead to log output where part of the message masquerades as a separate log line, confusing consumers of the logs (either human or automated). 

As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
GitHub Security Advisory: GHSA-27gp-8389-hm4w
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: >= 26.2.0, < 26.2.6
Patched in: 26.2.6

Summary: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)

Details:
A Privilege Escalation vulnerability was identified in the Keycloak identity and access management solution, specifically when FGAPv2 is enabled in version 26.2.x. The flaw lies in the admin permission enforcement logic, where a user with manage-users privileges can self-assign realm-admin rights. The escalation occurs due to missing privilege boundary checks in role mapping operations via the admin REST interface. A malicious administrator with limited permissions can exploit this by editing their own user roles, gaining unauthorized full access to realm configuration and user data.

This issue has been fixed in versions 26.2.6, and 26.3.0.
GitHub Security Advisory: GHSA-xhpr-465j-7p9q
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: >= 26.2.0, < 26.2.6
Patched in: 26.2.6

Summary: Keycloak phishing attack via email verification step in first login flow

Details:
There is a flaw with the first login flow where, during a IdP login, an attacker with a registered account can initiate the process to merge accounts with an existing victim's account. The attacker will subsequently be prompted to "review profile" information, which allows the the attacker to modify their email address to that of a victim's account. This triggers a verification email sent to the victim's email address. If the victim clicks the verification link, the attacker can gain access to the victim's account. While not a zero-interaction attack, the attacker's email address is not directly present in the verification email content, making it a potential phishing opportunity. 

This issue has been fixed in versions 26.0.13, 26.2.6, and 26.3.0.
GitHub Security Advisory: GHSA-xhpr-465j-7p9q
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-346: Origin Validation Error
Vulnerable versions: < 26.0.13
Patched in: 26.0.13

Summary: Keycloak phishing attack via email verification step in first login flow

Details:
There is a flaw with the first login flow where, during a IdP login, an attacker with a registered account can initiate the process to merge accounts with an existing victim's account. The attacker will subsequently be prompted to "review profile" information, which allows the the attacker to modify their email address to that of a victim's account. This triggers a verification email sent to the victim's email address. If the victim clicks the verification link, the attacker can gain access to the victim's account. While not a zero-interaction attack, the attacker's email address is not directly present in the verification email content, making it a potential phishing opportunity. 

This issue has been fixed in versions 26.0.13, 26.2.6, and 26.3.0.
GitHub Security Advisory: GHSA-chj2-4vg7-hhg3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.4.0-GA, <= 7.4.13.u92
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

Details:
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36.
GitHub Security Advisory: GHSA-chj2-4vg7-hhg3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.3.0-GA, < 7.3.10.u36
Patched in: 7.3.10.u36

Summary: Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

Details:
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36.
GitHub Security Advisory: GHSA-chj2-4vg7-hhg3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.2.0.GA, <= 7.2.10.fp20
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

Details:
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36.
GitHub Security Advisory: GHSA-chj2-4vg7-hhg3
Package: com.liferay.portal:release.dxp.bom (MAVEN)
Severity: CRITICAL (CVSS 9.6)
CWE: CWE-352: Cross-Site Request Forgery (CSRF)
Vulnerable versions: >= 7.1.0-GA, <= 7.1.10.fp28
Patched in: unpatched

Summary: Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console

Details:
The Script Console in Liferay Portal 7.0.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, 7.2 GA through fix pack 20, 7.1 GA through fix pack 28, 7.0 GA through fix pack 102 and 6.2 GA through fix pack 173 does not sufficiently protect against Cross-Site Request Forgery (CSRF) attacks, which allows remote attackers to execute arbitrary Groovy script via a crafted URL or a XSS vulnerability. This issue has been patched in Liferay Portal 7.4.3.102, Liferay DXP 2024.Q1.1, Liferay DXP 2023.Q4.0, Liferay DXP 2023.Q3.5, and Liferay DXP 7.3 Update 36.