deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-r6qj-894f-5hr2
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.5.0, < 10.5.11
Patched in: 10.5.11

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState.
GitHub Security Advisory: GHSA-r6qj-894f-5hr2
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.10.0, < 10.10.3
Patched in: 10.10.3

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState.
GitHub Security Advisory: GHSA-r6qj-894f-5hr2
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.11.0, < 10.11.2
Patched in: 10.11.2

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState.
GitHub Security Advisory: GHSA-r6qj-894f-5hr2
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]0400-2d5cdc6e217e
Patched in: 8.0.0[PII_REDACTED]0400-2d5cdc6e217e

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the RelayState.
GitHub Security Advisory: GHSA-6q7m-p8cc-998r
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.5.0, < 10.5.11
Patched in: 10.5.11

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
GitHub Security Advisory: GHSA-6q7m-p8cc-998r
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.10.0, < 10.10.3
Patched in: 10.10.3

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
GitHub Security Advisory: GHSA-6q7m-p8cc-998r
Package: github.com/mattermost/mattermost-server (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.11.0, < 10.11.2
Patched in: 10.11.2

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
GitHub Security Advisory: GHSA-6q7m-p8cc-998r
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]4701-e14175eb6539
Patched in: 8.0.0[PII_REDACTED]4701-e14175eb6539

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which allows any attacked to join any team on a Mattermost server regardless of restrictions via manipulating the OAuth state.
GitHub Security Advisory: GHSA-xr3w-rmvj-f6m7
Package: github.com/mattermost/mattermost-server (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 10.11.0, < 10.11.3
Patched in: 10.11.3

Summary: Mattermost has an Observable Timing Discrepancy vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets.
GitHub Security Advisory: GHSA-xr3w-rmvj-f6m7
Package: github.com/mattermost/mattermost-server (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: >= 10.5.0, < 10.5.11
Patched in: 10.5.11

Summary: Mattermost has an Observable Timing Discrepancy vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets.
GitHub Security Advisory: GHSA-xr3w-rmvj-f6m7
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-208: Observable Timing Discrepancy
Vulnerable versions: < 8.0.0[PII_REDACTED]3359-38208b8f065f
Patched in: 8.0.0[PII_REDACTED]3359-38208b8f065f

Summary: Mattermost has an Observable Timing Discrepancy vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets.
GitHub Security Advisory: GHSA-3q4q-wqm6-hvf3
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.11.0, < 10.11.3
Patched in: 10.11.3

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions.
GitHub Security Advisory: GHSA-3q4q-wqm6-hvf3
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.5.0, < 10.5.11
Patched in: 10.5.11

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions.
GitHub Security Advisory: GHSA-3q4q-wqm6-hvf3
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.10.0, < 10.10.3
Patched in: 10.10.3

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions.
GitHub Security Advisory: GHSA-3q4q-wqm6-hvf3
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]3415-01b95392a450
Patched in: 8.0.0[PII_REDACTED]3415-01b95392a450

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verified user accounts with arbitrary email domains via malicious Slack import data to bypass email-based team access restrictions.
GitHub Security Advisory: GHSA-424h-xj87-m937
Package: github.com/mattermost/mattermost-server (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.11.0, < 10.11.3
Patched in: 10.11.3

Summary: Mattermost has an Incorrect Authorization vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint
GitHub Security Advisory: GHSA-424h-xj87-m937
Package: github.com/mattermost/mattermost-server (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 10.5.0, < 10.5.11
Patched in: 10.5.11

Summary: Mattermost has an Incorrect Authorization vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint
GitHub Security Advisory: GHSA-424h-xj87-m937
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]5038-ff30b84049f0
Patched in: 8.0.0[PII_REDACTED]5038-ff30b84049f0

Summary: Mattermost has an Incorrect Authorization vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team members to their private channels via the `/api/v4/channels/{channel_id}/members` endpoint
GitHub Security Advisory: GHSA-7cr3-38jm-6p45
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.11.0, < 10.11.3
Patched in: 10.11.3

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
GitHub Security Advisory: GHSA-7cr3-38jm-6p45
Package: github.com/mattermost/mattermost-server (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: >= 10.5.0, < 10.5.11
Patched in: 10.5.11

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
GitHub Security Advisory: GHSA-7cr3-38jm-6p45
Package: github.com/mattermost/mattermost/server/v8 (GO)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-862: Missing Authorization
Vulnerable versions: < 8.0.0[PII_REDACTED]0405-e8c7e7d0252b
Patched in: 8.0.0[PII_REDACTED]0405-e8c7e7d0252b

Summary: Mattermost has a Missing Authorization vulnerability

Details:
Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when accessing channel information which allows guest users to discover active public channels and their metadata via the `/api/v4/teams/{team_id}/channels/ids` endpoint
GitHub Security Advisory: GHSA-72c7-4g63-hpw5
Package: github.com/in-toto/go-witness (GO)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-295: Improper Certificate Validation
Vulnerable versions: < 0.9.1
Patched in: 0.9.1

Summary: go-witness is Vulnerable to Improper Verification of AWS EC2 Identity Documents

Details:
### Impact
This vulnerability only affects users of the AWS attestor.

Users of the AWS attestor could have unknowingly received a forged identity document. While this may seem unlikely, AWS recently issued a security bulletin about IMDS (Instance Metadata Service) impersonation.[^1]

There are multiple locations where the verification of the identity document will mistakenly report a successful verification.

- If a signature is not present or is empty
https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L161-L163

- If the RSA verification of the document fails for any reason
https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L192-L196

### Workarounds
The contents of the AWS attestation contain the identity document, signature, and public key that was used to verify the document. These attestations and their could be identity documents could be manually verified with the `openssl` command line as documented in the below reference from AWS.[^2]

However, the certificate containing the public key was hard-coded into the attestor. 
https://github.com/in-toto/go-witness/blob/0c8bb30c143951d88b1d4b32f260c5f67d30137b/attestation/aws-iid/aws-iid.go#L46-L66

Since the original authoring of the attestor, AWS has moved to region specific public certificates. The currently valid certificates were issued around April of 2024, making the identification of attestations with forged content difficult without additional trusted data proving the AWS region in which the attestation was created.

### Patches
This vulnerability is addressed in `go-witness` 0.9.1 and `witness` 0.10.1.

### Resources
[^1]: [AWS Security Bulletin on IMDS Impersonation](https://aws.amazon.com/security/security-bulletins/rss/aws-2025-021/)
[^2]: [Verification of instance identity documents](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/verify-iid.html#verify-signature)
GitHub Security Advisory: GHSA-fr8m-434r-g3xp
Package: github.com/consensys/gnark-crypto (GO)
Severity: MODERATE (CVSS 5.1)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 0.12.0
Patched in: 0.12.0

Summary: gnark-crypto doesn't range check input values during ECDSA and EdDSA signature deserialization

Details:
### Impact

During deserialization of ECDSA and EdDSA signatures gnark-crypto did not check that the values are in the range `[1, n-1]` with `n` being the corresponding modulus (either base field modulus in case of `R` in EdDSA, and scalar field modulus in case of `s,r` in ECDSA and `s` in EdDSA). As this also allowed zero inputs, then it was possible to craft a signature which lead to null pointer dereference, leading to denial-of-service of an application. This also enabled weak signature malleability when the users assumed uniqueness of the serialized signatures (but not the underlying modulo reduced values).

We are not aware of any users impacted by the bug. The implemented signature schemes in gnark-crypto complement the in-circuit versions in gnark, allowing to have end-to-end tests.

### Patches

The issue was patched in PR #449. The fix returns an error during deserialization if the values do not belong to the ranges `[1, n-1]`.

The fix is included in release v0.12.0 and upwards.

### Workarounds

Users can manually validate the inputs to be in corresponding ranges when using serialized signatures (or digests of them) as unique keys.

To address the denial-of-service, the users can install hook to recover panics and recover 

### Resources

* [Verichains advisory](https://github.com/advisories/GHSA-9xfq-8j3r-xp5g) for signature malleability.
* Fix https://github.com/Consensys/gnark-crypto/pull/449
* [Go blog post "Defer, Panic, and Recover"](https://go.dev/blog/defer-panic-and-recover)
* [gnark v0.12.0](https://github.com/Consensys/gnark-crypto/releases/tag/v0.12.0)


### Acknowledgement

Lack of range checks leading to signature malleability was reported by [Verichains](https://www.verichains.io/).
GitHub Security Advisory: GHSA-5m9m-j5p7-m7f9
Package: github.com/casdoor/casdoor (GO)
Severity: HIGH (CVSS 7.2)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 2.63.0
Patched in: 2.63.0

Summary: Casdoor is vulnerable to Improper Authorization

Details:
An issue in the permission verification module and organization/application editing interface in Casdoor before 2.63.0 allows remote authenticated administrators of any organization within the system to bypass the system's permission verification mechanism by directly concatenating URLs after login.
GitHub Security Advisory: GHSA-hrhf-2vcr-ghch
Package: github.com/cometbft/cometbft (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-228: Improper Handling of Syntactically Invalid Structure
Vulnerable versions: >= 0.38.0-alpha.1, <= 0.38.18
Patched in: 0.38.19

Summary: CometBFT's invalid BitArray handling can lead to network halt

Details:
Name: ASA-2025-003: Invalid BitArray handling can lead to network halt
Criticality: High (Considerable Impact; Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))
Affected versions: `<= v0.38.18`, `<= v0.37.15`, and `main` development branches
Affected users: Validators, Full nodes, Users

### Description

A bug was discovered in CometBFT's handling of `BitArray`'s that have a mismatch between the `BitArray`'s expected number of `Elems` for the specified number of `Bits`. Additional validation was added to prevent processing `BitArray`'s in this invalid state, as well as guards to prevent panics on `BitArray` methods if one of these invalid states is processed.

### Impact
`BitArray`'s are present in a number of messages received from peers. When handling these messages, insufficient validation was applied to prevent processing messages the aforementioned invalid state. In the worst case, nodes will gossip messages to peers in an invalid state before processing them themselves, leading to a network halt (instead of only the node receiving the malicious message crashing). 

### Patches

The new CometBFT releases [v0.38.19](https://github.com/cometbft/cometbft/releases/tag/v0.38.19) and [v0.37.16](https://github.com/cometbft/cometbft/releases/tag/v0.37.16) fix this issue.

Unreleased code in the main branch is patched as well.

### Workarounds

If a node is able to identify a malicious peer sending these payloads, they can ban the ip address using common tools like `iptables`.

### Timeline

* October 3, 2025, 11:26am EST: Issue reported to Cosmos Labs via an external team (via their Bug Bounty Program).
* October 3, 2025, 11:59am EST: Issue triaged by core team and core team completes validation of issue.
* October 6, 2025, 11:14pm EST: Issue reported to the Cosmos Bug Bounty Program (by original white hat reporter).
* October 9, 2025, 11:15am EST: Pre-notification delivered.
* October 10, 2025, 11:37am EST: Core team completes patch for the issue.
* October 14, 2025, 11:00am EST: Patch made available.

This issue was reported by @whoismxuse to the Cosmos Bug Bounty Program on HackerOne on October 6, 2025. If you believe you have found a bug in the Cosmos Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

If there are questions about Cosmos security efforts, please reach out to our official communication channel at [security@cosmoslabs.io](mailto:security@cosmoslabs.io).

A Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-hrhf-2vcr-ghch). For more information about CometBFT, see https://docs.cometbft.com/.
GitHub Security Advisory: GHSA-hrhf-2vcr-ghch
Package: github.com/cometbft/cometbft (GO)
Severity: HIGH (CVSS 0.0)
CWE: CWE-228: Improper Handling of Syntactically Invalid Structure
Vulnerable versions: <= 0.37.15
Patched in: 0.37.16

Summary: CometBFT's invalid BitArray handling can lead to network halt

Details:
Name: ASA-2025-003: Invalid BitArray handling can lead to network halt
Criticality: High (Considerable Impact; Possible Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))
Affected versions: `<= v0.38.18`, `<= v0.37.15`, and `main` development branches
Affected users: Validators, Full nodes, Users

### Description

A bug was discovered in CometBFT's handling of `BitArray`'s that have a mismatch between the `BitArray`'s expected number of `Elems` for the specified number of `Bits`. Additional validation was added to prevent processing `BitArray`'s in this invalid state, as well as guards to prevent panics on `BitArray` methods if one of these invalid states is processed.

### Impact
`BitArray`'s are present in a number of messages received from peers. When handling these messages, insufficient validation was applied to prevent processing messages the aforementioned invalid state. In the worst case, nodes will gossip messages to peers in an invalid state before processing them themselves, leading to a network halt (instead of only the node receiving the malicious message crashing). 

### Patches

The new CometBFT releases [v0.38.19](https://github.com/cometbft/cometbft/releases/tag/v0.38.19) and [v0.37.16](https://github.com/cometbft/cometbft/releases/tag/v0.37.16) fix this issue.

Unreleased code in the main branch is patched as well.

### Workarounds

If a node is able to identify a malicious peer sending these payloads, they can ban the ip address using common tools like `iptables`.

### Timeline

* October 3, 2025, 11:26am EST: Issue reported to Cosmos Labs via an external team (via their Bug Bounty Program).
* October 3, 2025, 11:59am EST: Issue triaged by core team and core team completes validation of issue.
* October 6, 2025, 11:14pm EST: Issue reported to the Cosmos Bug Bounty Program (by original white hat reporter).
* October 9, 2025, 11:15am EST: Pre-notification delivered.
* October 10, 2025, 11:37am EST: Core team completes patch for the issue.
* October 14, 2025, 11:00am EST: Patch made available.

This issue was reported by @whoismxuse to the Cosmos Bug Bounty Program on HackerOne on October 6, 2025. If you believe you have found a bug in the Cosmos Stack or would like to contribute to the program by reporting a bug, please see https://hackerone.com/cosmos.

If there are questions about Cosmos security efforts, please reach out to our official communication channel at [security@cosmoslabs.io](mailto:security@cosmoslabs.io).

A Github Security Advisory for this issue is available in the CometBFT [repository](https://github.com/cometbft/cometbft/security/advisories/GHSA-hrhf-2vcr-ghch). For more information about CometBFT, see https://docs.cometbft.com/.