deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-fjf5-xgmq-5525
Package: org.geoserver:gs-wms (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: < 2.25.6
Patched in: 2.25.6

Summary: GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Details:
## Description

An XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint ``/geoserver/wms`` operation ``GetMap``. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.

An XML External Entity attack is a type of attack that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.

By exploiting this vulnerability, an attacker can:
- Read arbitrary files from the server's file system.
- Conduct Server-Side Request Forgery (SSRF) to interact with internal systems.
- Execute Denial of Service (DoS) attacks by exhausting resources.

## Resolution

Update to GeoServer 2.25.6, GeoServer 2.26.3, or GeoServer 2.27.0.

## Impact

The XXE vulnerability can be used to retrieve arbitrary files from the server's file system.

## Reference

* https://osgeo-org.atlassian.net/browse/GEOS-11682
* XBOW-024-081

## Disclaimer

This vulnerability was detected using **[XBOW](https://xbow.com/)**, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.
GitHub Security Advisory: GHSA-fjf5-xgmq-5525
Package: org.geoserver.web:gs-web-app (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: < 2.25.6
Patched in: 2.25.6

Summary: GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Details:
## Description

An XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint ``/geoserver/wms`` operation ``GetMap``. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.

An XML External Entity attack is a type of attack that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.

By exploiting this vulnerability, an attacker can:
- Read arbitrary files from the server's file system.
- Conduct Server-Side Request Forgery (SSRF) to interact with internal systems.
- Execute Denial of Service (DoS) attacks by exhausting resources.

## Resolution

Update to GeoServer 2.25.6, GeoServer 2.26.3, or GeoServer 2.27.0.

## Impact

The XXE vulnerability can be used to retrieve arbitrary files from the server's file system.

## Reference

* https://osgeo-org.atlassian.net/browse/GEOS-11682
* XBOW-024-081

## Disclaimer

This vulnerability was detected using **[XBOW](https://xbow.com/)**, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.
GitHub Security Advisory: GHSA-fjf5-xgmq-5525
Package: org.geoserver:gs-wms (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 2.26.0, < 2.26.2
Patched in: 2.26.2

Summary: GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Details:
## Description

An XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint ``/geoserver/wms`` operation ``GetMap``. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.

An XML External Entity attack is a type of attack that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.

By exploiting this vulnerability, an attacker can:
- Read arbitrary files from the server's file system.
- Conduct Server-Side Request Forgery (SSRF) to interact with internal systems.
- Execute Denial of Service (DoS) attacks by exhausting resources.

## Resolution

Update to GeoServer 2.25.6, GeoServer 2.26.3, or GeoServer 2.27.0.

## Impact

The XXE vulnerability can be used to retrieve arbitrary files from the server's file system.

## Reference

* https://osgeo-org.atlassian.net/browse/GEOS-11682
* XBOW-024-081

## Disclaimer

This vulnerability was detected using **[XBOW](https://xbow.com/)**, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.
GitHub Security Advisory: GHSA-fjf5-xgmq-5525
Package: org.geoserver.web:gs-web-app (MAVEN)
Severity: HIGH (CVSS 8.2)
CWE: CWE-611: Improper Restriction of XML External Entity Reference
Vulnerable versions: >= 2.26.0, < 2.26.2
Patched in: 2.26.2

Summary: GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature

Details:
## Description

An XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint ``/geoserver/wms`` operation ``GetMap``. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request.

An XML External Entity attack is a type of attack that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts.

By exploiting this vulnerability, an attacker can:
- Read arbitrary files from the server's file system.
- Conduct Server-Side Request Forgery (SSRF) to interact with internal systems.
- Execute Denial of Service (DoS) attacks by exhausting resources.

## Resolution

Update to GeoServer 2.25.6, GeoServer 2.26.3, or GeoServer 2.27.0.

## Impact

The XXE vulnerability can be used to retrieve arbitrary files from the server's file system.

## Reference

* https://osgeo-org.atlassian.net/browse/GEOS-11682
* XBOW-024-081

## Disclaimer

This vulnerability was detected using **[XBOW](https://xbow.com/)**, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.
GitHub Security Advisory: GHSA-w66h-j855-qr72
Package: org.geoserver:gs-wms (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.25.0
Patched in: 2.25.0

Summary: GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format

Details:
### Summary
A reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's browser through specially crafted SLD_BODY parameters. 

### Details

The WMS service setting that controls HTML auto-escaping is either disabled by default, or completely missing, in the affected versions (see workarounds).

### Impact

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can:
1. Perform any action within the application that the user can perform.
2. View any information that the user is able to view.
3. Modify any information that the user is able to modify.
4. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

### Workarounds
Changing any of the following WMS service settings should mitigate this vulnerability in most environments:
1. Enable GetFeatureInfo HTML auto-escaping (available in GeoServer 2.21.3+ and 2.22.1+)
2. Disable dynamic styling
3. Disable GetFeatureInfo text/html MIME type

### References
https://osgeo-org.atlassian.net/browse/GEOS-11297
https://github.com/geoserver/geoserver/pull/7406
GitHub Security Advisory: GHSA-w66h-j855-qr72
Package: org.geoserver.web:gs-web-app (MAVEN)
Severity: MODERATE (CVSS 6.1)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 2.25.0
Patched in: 2.25.0

Summary: GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format

Details:
### Summary
A reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's browser through specially crafted SLD_BODY parameters. 

### Details

The WMS service setting that controls HTML auto-escaping is either disabled by default, or completely missing, in the affected versions (see workarounds).

### Impact

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can:
1. Perform any action within the application that the user can perform.
2. View any information that the user is able to view.
3. Modify any information that the user is able to modify.
4. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user.

### Workarounds
Changing any of the following WMS service settings should mitigate this vulnerability in most environments:
1. Enable GetFeatureInfo HTML auto-escaping (available in GeoServer 2.21.3+ and 2.22.1+)
2. Disable dynamic styling
3. Disable GetFeatureInfo text/html MIME type

### References
https://osgeo-org.atlassian.net/browse/GEOS-11297
https://github.com/geoserver/geoserver/pull/7406
GitHub Security Advisory: GHSA-jqg8-m35q-jh7j
Package: org.apache.syncope:syncope-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-321: Use of Hard-coded Cryptographic Key
Vulnerable versions: < 3.0.15
Patched in: 3.0.15

Summary: Apache Syncope's AES encryption stores hard-coded passwords in internal database

Details:
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option.

When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values.
This is not affecting encrypted plain attributes, whose values are also stored using AES encryption.

Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.
GitHub Security Advisory: GHSA-jqg8-m35q-jh7j
Package: org.apache.syncope:syncope-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-321: Use of Hard-coded Cryptographic Key
Vulnerable versions: >= 4.0.0, < 4.0.3
Patched in: 4.0.3

Summary: Apache Syncope's AES encryption stores hard-coded passwords in internal database

Details:
Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option.

When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values.
This is not affecting encrypted plain attributes, whose values are also stored using AES encryption.

Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.
GitHub Security Advisory: GHSA-m494-w24q-6f7w
Package: com.microsoft.sqlserver:mssql-jdbc (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 8.3.0.jre11-preview, < 10.2.4.jre11
Patched in: 10.2.4.jre11

Summary: JDBC Driver for SQL Server has improper input validation issue

Details:
Improper input validation in JDBC Driver for SQL Server allows an unauthorized attacker to perform spoofing over a network.
GitHub Security Advisory: GHSA-hgrr-935x-pq79
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 8.5.0, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

Details:
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
GitHub Security Advisory: GHSA-hgrr-935x-pq79
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 9.0.0.M1, < 9.0.110
Patched in: 9.0.110

Summary: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

Details:
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
GitHub Security Advisory: GHSA-hgrr-935x-pq79
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 8.5.0, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

Details:
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
GitHub Security Advisory: GHSA-hgrr-935x-pq79
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 9.0.0.M1, < 9.0.110
Patched in: 9.0.110

Summary: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

Details:
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
GitHub Security Advisory: GHSA-hgrr-935x-pq79
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 8.5.0, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

Details:
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
GitHub Security Advisory: GHSA-hgrr-935x-pq79
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: LOW (CVSS 0.0)
CWE: CWE-404: Improper Resource Shutdown or Release
Vulnerable versions: >= 9.0.0.M1, < 9.0.110
Patched in: 9.0.110

Summary: Apache Tomcat Vulnerable to Improper Resource Shutdown or Release

Details:
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109.

The following versions were EOL at the time the CVE was created but are 
known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected.
Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 8.5.6, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
GitHub Security Advisory: GHSA-wmwf-9ccg-fff5
Package: org.apache.tomcat:tomcat-catalina (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: >= 8.5.6, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Vulnerable to Relative Path Traversal

Details:
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI.



This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108.

The following versions were EOL at the time the CVE was created but are  known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.