deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-r93j-3mmp-px57
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: < 3.1.1
Patched in: 3.1.1

Summary: Mattermost Server: initial_load API exposes unnecessary information

Details:
An issue was discovered in Mattermost Server before 3.1.1. The initial_load API disclosed unnecessary personal information.
GitHub Security Advisory: GHSA-cffj-7w5c-jqjh
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 3.5.1
Patched in: 3.5.1

Summary: Mattermost Server vulnerable to Cross-site Scripting through file preview feature

Details:
An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.
GitHub Security Advisory: GHSA-h773-7gf7-9m2x
Package: github.com/neuvector/neuvector (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-321: Use of Hard-coded Cryptographic Key
Vulnerable versions: >= 0.0.0[PII_REDACTED]3453-1c4957d53911, < 0.0.0[PII_REDACTED]3207-084a437033b4
Patched in: 0.0.0[PII_REDACTED]3207-084a437033b4

Summary: NeuVector is shipping cryptographic material into its binary

Details:
### Impact
NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations  when NeuVector stores the data.

In the patched version, NeuVector leverages the Kubernetes secret `neuvector-store-secret` in `neuvector` namespace to dynamically generate cryptographically secure random keys. This approach removes the reliance on static key values and ensures that encryption keys are managed securely within Kubernetes.

During rolling upgrade or restoring from persistent storage, the NeuVector controller checks each encrypted configured field. If a sensitive field in the configuration is found to be encrypted by the default encryption key, it’s decrypted with the default encryption key and then re-encrypted with the new dynamic encryption key.

If the NeuVector controller does not have the correct RBAC for accessing the new secret, it writes this error log : 
`Required Kubernetes RBAC for secrets are not found` and exits.

The device encryption key is rotated every 3 months. For details, please refer to this [Rotating Self-Signed Certificate](https://open-docs.neuvector.com/configuration/console/certrotate) documentation.

### Patches
Patched versions include release **v5.4.7** and above.

### Workarounds
There is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.

### References
If you have any questions or comments about this advisory:
- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
GitHub Security Advisory: GHSA-h773-7gf7-9m2x
Package: github.com/neuvector/neuvector (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-321: Use of Hard-coded Cryptographic Key
Vulnerable versions: >= 5.3.0, <= 5.4.6
Patched in: 5.4.7

Summary: NeuVector is shipping cryptographic material into its binary

Details:
### Impact
NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations  when NeuVector stores the data.

In the patched version, NeuVector leverages the Kubernetes secret `neuvector-store-secret` in `neuvector` namespace to dynamically generate cryptographically secure random keys. This approach removes the reliance on static key values and ensures that encryption keys are managed securely within Kubernetes.

During rolling upgrade or restoring from persistent storage, the NeuVector controller checks each encrypted configured field. If a sensitive field in the configuration is found to be encrypted by the default encryption key, it’s decrypted with the default encryption key and then re-encrypted with the new dynamic encryption key.

If the NeuVector controller does not have the correct RBAC for accessing the new secret, it writes this error log : 
`Required Kubernetes RBAC for secrets are not found` and exits.

The device encryption key is rotated every 3 months. For details, please refer to this [Rotating Self-Signed Certificate](https://open-docs.neuvector.com/configuration/console/certrotate) documentation.

### Patches
Patched versions include release **v5.4.7** and above.

### Workarounds
There is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.

### References
If you have any questions or comments about this advisory:
- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
GitHub Security Advisory: GHSA-c8g6-qrwh-m3vp
Package: github.com/neuvector/neuvector (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vulnerable versions: >= 0.0.0[PII_REDACTED]3453-1c4957d53911, < 0.0.0[PII_REDACTED]3207-084a437033b4
Patched in: 0.0.0[PII_REDACTED]3207-084a437033b4

Summary: NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

Details:
### Impact
A vulnerability was identified in NeuVector, where the enforcer used environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to generate a command to be executed via `popen`, without first sanitising their values.

The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the `popen` function to execute a shell command that determines whether the ports used by the consul subprocess are still active.

The values of environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` are used directly to compose shell commands via popen without validation or sanitization.  This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.

In the patched version, the monitor process validates the values of `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to ensure they contain only valid port numbers before invoking the `popen` command.

If validation fails, the monitor process exits immediately, causing the enforcer container to terminate. This prevents the execution of any injected or malicious commands.


### Patches
Patched versions include release `v5.4.7` and above.

### Workarounds
There is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.

### References
If you have any questions or comments about this advisory:
- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
GitHub Security Advisory: GHSA-c8g6-qrwh-m3vp
Package: github.com/neuvector/neuvector (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vulnerable versions: >= 5.4.0, <= 5.4.6
Patched in: 5.4.7

Summary: NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

Details:
### Impact
A vulnerability was identified in NeuVector, where the enforcer used environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to generate a command to be executed via `popen`, without first sanitising their values.

The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the `popen` function to execute a shell command that determines whether the ports used by the consul subprocess are still active.

The values of environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` are used directly to compose shell commands via popen without validation or sanitization.  This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.

In the patched version, the monitor process validates the values of `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to ensure they contain only valid port numbers before invoking the `popen` command.

If validation fails, the monitor process exits immediately, causing the enforcer container to terminate. This prevents the execution of any injected or malicious commands.


### Patches
Patched versions include release `v5.4.7` and above.

### Workarounds
There is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.

### References
If you have any questions or comments about this advisory:
- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
GitHub Security Advisory: GHSA-c8g6-qrwh-m3vp
Package: github.com/neuvector/neuvector (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Vulnerable versions: >= 5.3.0, < 5.3.5
Patched in: 5.3.5

Summary: NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

Details:
### Impact
A vulnerability was identified in NeuVector, where the enforcer used environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to generate a command to be executed via `popen`, without first sanitising their values.

The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the `popen` function to execute a shell command that determines whether the ports used by the consul subprocess are still active.

The values of environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` are used directly to compose shell commands via popen without validation or sanitization.  This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.

In the patched version, the monitor process validates the values of `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to ensure they contain only valid port numbers before invoking the `popen` command.

If validation fails, the monitor process exits immediately, causing the enforcer container to terminate. This prevents the execution of any injected or malicious commands.


### Patches
Patched versions include release `v5.4.7` and above.

### Workarounds
There is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.

### References
If you have any questions or comments about this advisory:
- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.
- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).
GitHub Security Advisory: GHSA-8pfh-j44r-f654
Package: github.com/cosmos/evm (GO)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: >= 0.4.0, < 0.4.2
Patched in: 0.4.2

Summary: Cosmos EVM Vulnerability

Details:
## Patches
Patched in versions `v0.3.1`, `v0.4.2`, and in the `v0.5.0` release. More information will be disclosed at a later point to ensure chains have time to safely upgrade.

## Workarounds
No workarounds for chains that make use of static or dynamic precompiles. Upgrading is strongly recommended.

## Testing
Tests are introduced in every affected version.

## Credits
Special thanks to @yihuang for the help on this issue.
GitHub Security Advisory: GHSA-8pfh-j44r-f654
Package: github.com/cosmos/evm (GO)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: >= 0.3.0, < 0.3.2
Patched in: 0.3.2

Summary: Cosmos EVM Vulnerability

Details:
## Patches
Patched in versions `v0.3.1`, `v0.4.2`, and in the `v0.5.0` release. More information will be disclosed at a later point to ensure chains have time to safely upgrade.

## Workarounds
No workarounds for chains that make use of static or dynamic precompiles. Upgrading is strongly recommended.

## Testing
Tests are introduced in every affected version.

## Credits
Special thanks to @yihuang for the help on this issue.
GitHub Security Advisory: GHSA-g3j4-58mp-3x25
Package: github.com/netbirdio/netbird (GO)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-1392: Use of Default Credentials
Vulnerable versions: < 0.57.0
Patched in: 0.57.0

Summary: NetBird VPN does not remove the default password of an admin account

Details:
NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL.
This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed.

This issue has been fixed in version 0.57.0.
GitHub Security Advisory: GHSA-g46h-2rq9-gw5m
Package: github.com/openbao/openbao (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: <= 2.4.0
Patched in: 2.4.1

Summary: OpenBao has potential Denial of Service vulnerability when processing malicious unauthenticated JSON requests

Details:
### Summary

JSON objects after decoding might use more memory than their serialized version. It is possible to tune a JSON to maximize the factor between serialized memory usage and deserialized memory usage (similar to a zip bomb). While reproducing the issue, we could reach a factor of about 35. This can be used to circumvent the [`max_request_size` (https://openbao.org/docs/configuration/listener/tcp/) configuration parameter, which is meant to protect against Denial of Service attacks, and also makes Denial of Service attacks easier in general, as the attacker needs much less resources.

### Details

The request body is parsed into a `map[string]interface{}` https://github.com/openbao/openbao/blob/788536bd3e10818a7b4fb00aac6affc23388e5a9/http/logical.go#L50 very early in the request handling chain (before authentication), which means an attacker can send a specifically crafted JSON object and cause an OOM crash. Additionally, for simpler requests with large numbers of strings, the audit subsystem can consume large quantities of CPU. 

To remediate, set `max_request_json_memory` and `max_request_json_strings`.

### Impact

- Unauthenticated Denial of Service

### Resources

This issue was disclosed directly to HashiCorp and is the OpenBao equivalent of the following tickets:

- https://discuss.hashicorp.com/t/hcsec-2025-24-vault-denial-of-service-though-complex-json-payloads/76393
- https://nvd.nist.gov/vuln/detail/CVE-2025-6203

HashiCorp attributes the problem to the audit subsystem. For OpenBao, it was noted the problem was additionally in the requests handling logic.
GitHub Security Advisory: GHSA-6pvw-g552-53c5
Package: github.com/git-lfs/git-lfs (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-59: Improper Link Resolution Before File Access ('Link Following')
Vulnerable versions: >= 0.5.2, <= 3.7.0
Patched in: 3.7.1

Summary: Git LFS may write to arbitrary files via crafted symlinks

Details:
### Impact

When populating a Git repository's working tree with the contents of Git LFS objects, certain Git LFS commands may write to files visible outside the current Git working tree if symbolic or hard links exist which collide with the paths of files tracked by Git LFS.

Git LFS has resolved this problem by revising the `git lfs checkout` and `git lfs pull` commands so that they check for symbolic links in the same manner as performed by Git before writing to files in the working tree.  These commands now also remove existing files in the working tree before writing new files in their place.

As well, Git LFS has resolved a problem whereby the `git lfs checkout` and `git lfs pull` commands, when run in a bare repository, could write to files visible outside the repository.  While a specific and relatively unlikely set of conditions were required for this to occur, it is no longer possible under any circumstances.

### Patches

This problem exists in all versions since 0.5.2 and is patched in v3.7.1.  All users should upgrade to v3.7.1.

### Workarounds

Support for symlinks in Git may be disabled by setting the `core.symlinks` configuration option to `false`, after which further clones and fetches will not create symbolic links.  However, any symbolic or hard links in existing repositories will still provide the opportunity for Git LFS to write to their targets.

### References

- https://github.com/git-lfs/git-lfs/security/advisories/GHSA-6pvw-g552-53c5
- https://nvd.nist.gov/vuln/detail/CVE-2025-26625
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26625
- https://github.com/git-lfs/git-lfs/releases/tag/v3.7.1
- [git-lfs/git-lfs@5c11ffce9a](https://github.com/git-lfs/git-lfs/commit/5c11ffce9a4f095ff356bc781e2a031abb46c1a8)
- [git-lfs/git-lfs@0cffe93176](https://github.com/git-lfs/git-lfs/commit/0cffe93176b870055c9dadbb3cc9a4a440e98396)
- [git-lfs/git-lfs@d02bd13f02](https://github.com/git-lfs/git-lfs/commit/d02bd13f02ef76f6807581cd6b34709069cb3615)

### For more information

If there are any questions or comments about this advisory:
* For general questions, start a discussion in the Git LFS [discussion forum](https://github.com/git-lfs/git-lfs/discussions).
* For reports of additional vulnerabilities, please follow the Git LFS [security reporting policy](https://github.com/git-lfs/git-lfs/blob/main/SECURITY.md).
GitHub Security Advisory: GHSA-jjjj-jwhf-8rgr
Package: github.com/minio/minio (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 0.0.0[PII_REDACTED]0045-c1a49490c78e
Patched in: 0.0.0[PII_REDACTED]0045-c1a49490c78e

Summary: MinIO is Vulnerable to Privilege Escalation via Session Policy Bypass in Service Accounts and STS

Details:
### Summary
A privilege escalation vulnerability allows service accounts and STS (Security Token Service) accounts with restricted session policies to bypass their inline policy restrictions when performing "own" account operations, specifically when creating new service accounts for the same user.

### Details
The vulnerability exists in the IAM policy validation logic in `cmd/iam.go`. When validating session policies for restricted accounts performing operations on their own account (such as creating service accounts), the code incorrectly relied on the `DenyOnly` argument.

The `DenyOnly` flag is used to allow accounts to perform actions related to their own account by only checking if the action is explicitly denied. However, when a session policy (sub-policy) is present, the system should validate that the action is actually **allowed** by the session policy, not just that it isn't denied.

### Attack Scenario
  1. An administrator creates a service account or STS account with a restricted inline policy (e.g., access only to bucket1 and bucket2)
  2. The restricted account attempts to create a new service account for itself without specifying any policy restrictions
  3. Due to the bypass, the new service account is created with full parent privileges instead of being restricted by the inline policy
  4. The attacker now has escalated privileges beyond the intended restrictions

### Impact

  **Attack Complexity**: LOW - Exploitation requires only valid credentials for a restricted service/STS account

  **Confidentiality**: HIGH - Attackers can access buckets and objects beyond their intended restrictions

  **Integrity**: HIGH - Attackers can modify, delete, or create objects outside their authorized scope

  **Availability**: NONE - Does not directly impact service availability

### Patches
Fixed in PR https://github.com/minio/minio/pull/21642
Commit: c1a49490c78e9c3ebcad86ba[PII_REDACTED]ace190

Install the release
```
go install -v github.com/minio/minio@RELEASE.2025-10-15T17-29-55Z
```

### Workarounds
No workarounds available. You can upgrade to the latest version immediately.

### Mitigation Steps

1. **Upgrade MinIO**: Update to the latest version containing the fix
2. **Audit Service Accounts**: Review all service accounts created by non-admin accounts
3. **Revoke Suspicious Accounts**: Delete any service accounts that may have been created through exploitation
4. **Review Access Logs**: Check for unauthorized access to sensitive buckets

### Resources

- Fix PR: https://github.com/minio/minio/pull/21642
- Affected code: cmd/iam.go (functions: isAllowedBySessionPolicyForServiceAccount, isAllowedBySessionPolicy)
GitHub Security Advisory: GHSA-9m49-p2j3-c6xm
Package: github.com/apache/trafficcontrol/v8 (GO)
Severity: LOW (CVSS 0.0)
CWE: CWE-1333: Inefficient Regular Expression Complexity
Vulnerable versions: <= 8.0.2
Patched in: unpatched

Summary: Apache Traffic Control has an Inefficient Regular Expression Complexity vulnerability

Details:
*** UNSUPPORTED WHEN ASSIGNED ***
Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.

This issue affects Apache Traffic Control: all versions.

People with access to the management interface of the Traffic Router component could specify malicious patterns and cause unavailability.

As this project is retired, it is not planned to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.