deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-7jqf-v358-p8g7
Package: org.apache.tomcat:tomcat-util (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 7.0.92, <= 7.0.109
Patched in: unpatched

Summary: Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability

Details:
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.

Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
GitHub Security Advisory: GHSA-7jqf-v358-p8g7
Package: org.apache.tomcat:tomcat-util (MAVEN)
Severity: HIGH (CVSS 8.6)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 8.5.35, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Allocation of Resources Without Limits or Throttling vulnerability

Details:
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.13 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.35 through 8.5.100 and 7.0.92 through 7.0.109.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25, or 9.0.90, which fixes the issue.

Apache Tomcat, under certain configurations on any platform, allows an attacker to cause an OutOfMemoryError by abusing the TLS handshake process.
GitHub Security Advisory: GHSA-wm9w-rjj3-j356
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-755: Improper Handling of Exceptional Conditions
Vulnerable versions: >= 8.5.0, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat - Denial of Service

Details:
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. 

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.
GitHub Security Advisory: GHSA-wm9w-rjj3-j356
Package: org.apache.tomcat:tomcat-coyote (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-755: Improper Handling of Exceptional Conditions
Vulnerable versions: >= 8.5.0, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat - Denial of Service

Details:
Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn led to the use of an incorrect infinite timeout which allowed connections to remain open which should have been closed. 

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M20, from 10.1.0-M1 through 10.1.24, from 9.0.0-M1 through 9.0.89. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100.

Users are recommended to upgrade to version 11.0.0-M21, 10.1.25 or 9.0.90, which fixes the issue.
GitHub Security Advisory: GHSA-g358-g2pq-c46j
Package: org.apache.seata:seata-serializer-fury (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: = 2.4.0
Patched in: 2.5.0

Summary: Apache Seata: Deserialization of untrusted Data in Apache Seata Server

Details:
Deserialization of Untrusted Data vulnerability in Apache Seata (incubating).

This issue affects Apache Seata (incubating): 2.4.0.

Users are recommended to upgrade to version 2.5.0, which fixes the issue.
GitHub Security Advisory: GHSA-g4px-6qhm-hqjm
Package: org.apache.cxf:cxf-rt-transports-jms (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 4.1.0, < 4.1.3
Patched in: 4.1.3

Summary: Apache CXF: Untrusted JMS configuration can lead to RCE

Details:
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.  This interface is now restricted to reject those protocols, removing this possibility.

Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
GitHub Security Advisory: GHSA-g4px-6qhm-hqjm
Package: org.apache.cxf:cxf-rt-transports-jms (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 4.0.0, < 4.0.9
Patched in: 4.0.9

Summary: Apache CXF: Untrusted JMS configuration can lead to RCE

Details:
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.  This interface is now restricted to reject those protocols, removing this possibility.

Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
GitHub Security Advisory: GHSA-g4px-6qhm-hqjm
Package: org.apache.cxf:cxf-rt-transports-jms (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 3.6.8
Patched in: 3.6.8

Summary: Apache CXF: Untrusted JMS configuration can lead to RCE

Details:
If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities.  This interface is now restricted to reject those protocols, removing this possibility.

Users are recommended to upgrade to versions 3.6.8, 4.0.9 or 4.1.3, which fix this issue.
GitHub Security Advisory: GHSA-94g7-hpv8-h9qm
Package: com.splunk.logging:splunk-library-javalogging (MAVEN)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: < 1.6.2-0-0
Patched in: 1.6.2-0-0

Summary: Remote code injection in Log4j

Details:
### Impact
Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input.

More Details:
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

### Patches
Version 1.11.1 of the Splunk Logging for Java library.

There is also a backport to version 1.6.2 released as a patch: 1.6.2-0-0.

### Workarounds
If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components.

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/splunk/splunk-library-javalogging/issues
* Email us at [devinfo@splunk.com](mailto:devinfo@splunk.com)
GitHub Security Advisory: GHSA-94g7-hpv8-h9qm
Package: com.splunk.logging:splunk-library-javalogging (MAVEN)
Severity: CRITICAL (CVSS 0.0)
Vulnerable versions: >= 1.7.0, < 1.11.1
Patched in: 1.11.1

Summary: Remote code injection in Log4j

Details:
### Impact
Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input.

More Details:
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

### Patches
Version 1.11.1 of the Splunk Logging for Java library.

There is also a backport to version 1.6.2 released as a patch: 1.6.2-0-0.

### Workarounds
If upgrading is not possible, then ensure the -Dlog4j2.formatMsgNoLookups=true system property is set on both client- and server-side components.

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/splunk/splunk-library-javalogging/issues
* Email us at [devinfo@splunk.com](mailto:devinfo@splunk.com)
GitHub Security Advisory: GHSA-9342-92gg-6v29
Package: org.eclipse.angus:smtp (MAVEN)
Severity: MODERATE (CVSS 7.5)
CWE: CWE-147: Improper Neutralization of Input Terminators
Vulnerable versions: < 2.0.4
Patched in: 2.0.4

Summary: Jakarta Mail vulnerable to SMTP Injection

Details:
In Jakarta Mail 2.2 it is possible to preform a SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.
GitHub Security Advisory: GHSA-qj5r-2r5p-phc7
Package: org.keycloak:keycloak-services (MAVEN)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
Vulnerable versions: <= 26.3.2
Patched in: unpatched

Summary: Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability

Details:
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references.

### Original Description
A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks.
GitHub Security Advisory: GHSA-3j6h-5v68-hvqg
Package: com.liferay:com.liferay.captcha.impl (MAVEN)
Severity: MODERATE (CVSS 0.0)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 4.0.17
Patched in: 4.0.17

Summary: Liferay Portal CAPTCHA Bypass for Gogo Shell

Details:
The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through 2024.Q2.13, 2024.Q3.0 through 2024.Q3.13, 2024.Q4.0 through 2024.Q4.7, 2025.Q1.0 through 2025.Q1.15 and 7.4 update 80 through update 92 and then attackers can run scripts in the Gogo shell.
GitHub Security Advisory: GHSA-57q2-6cp4-9mq3
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 17.0.0-rc-1, < 17.2.0-rc-1
Patched in: 17.2.0-rc-1

Summary: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Details:
### Impact
The XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending `?xpage=xml` to the URL includes password and email properties stored on a document that aren't named `password` or `email`. This allows any user to obtain the salted and hashed user account validation or password reset token. As those tokens are randomly generated strings, the immediate impact of this should be low. The user's password and email itself aren't exposed as those fields are named `password` and `email` and thus aren't affected. However, depending on how the wiki is used, there could be extensions or custom code that store passwords in plain text in such password properties that would be exposed by this vulnerability.

### Patches
This vulnerability has been fixed by completely removing the output of password and email fields in this XML export in versions 17.2.0 RC1, 16.10.5 and 16.4.7.

### Workarounds
If this XML export isn't needed, the file `templates/xml.vm` in the deployed WAR can be deleted. There isn't any feature in XWiki itself that depends on this XML export.
GitHub Security Advisory: GHSA-57q2-6cp4-9mq3
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 16.5.0-rc-1, < 16.10.5
Patched in: 16.10.5

Summary: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Details:
### Impact
The XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending `?xpage=xml` to the URL includes password and email properties stored on a document that aren't named `password` or `email`. This allows any user to obtain the salted and hashed user account validation or password reset token. As those tokens are randomly generated strings, the immediate impact of this should be low. The user's password and email itself aren't exposed as those fields are named `password` and `email` and thus aren't affected. However, depending on how the wiki is used, there could be extensions or custom code that store passwords in plain text in such password properties that would be exposed by this vulnerability.

### Patches
This vulnerability has been fixed by completely removing the output of password and email fields in this XML export in versions 17.2.0 RC1, 16.10.5 and 16.4.7.

### Workarounds
If this XML export isn't needed, the file `templates/xml.vm` in the deployed WAR can be deleted. There isn't any feature in XWiki itself that depends on this XML export.
GitHub Security Advisory: GHSA-57q2-6cp4-9mq3
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 1.1, < 16.4.7
Patched in: 16.4.7

Summary: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Details:
### Impact
The XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending `?xpage=xml` to the URL includes password and email properties stored on a document that aren't named `password` or `email`. This allows any user to obtain the salted and hashed user account validation or password reset token. As those tokens are randomly generated strings, the immediate impact of this should be low. The user's password and email itself aren't exposed as those fields are named `password` and `email` and thus aren't affected. However, depending on how the wiki is used, there could be extensions or custom code that store passwords in plain text in such password properties that would be exposed by this vulnerability.

### Patches
This vulnerability has been fixed by completely removing the output of password and email fields in this XML export in versions 17.2.0 RC1, 16.10.5 and 16.4.7.

### Workarounds
If this XML export isn't needed, the file `templates/xml.vm` in the deployed WAR can be deleted. There isn't any feature in XWiki itself that depends on this XML export.
GitHub Security Advisory: GHSA-57q2-6cp4-9mq3
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 17.0.0-rc-1, < 17.2.0-rc-1
Patched in: 17.2.0-rc-1

Summary: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Details:
### Impact
The XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending `?xpage=xml` to the URL includes password and email properties stored on a document that aren't named `password` or `email`. This allows any user to obtain the salted and hashed user account validation or password reset token. As those tokens are randomly generated strings, the immediate impact of this should be low. The user's password and email itself aren't exposed as those fields are named `password` and `email` and thus aren't affected. However, depending on how the wiki is used, there could be extensions or custom code that store passwords in plain text in such password properties that would be exposed by this vulnerability.

### Patches
This vulnerability has been fixed by completely removing the output of password and email fields in this XML export in versions 17.2.0 RC1, 16.10.5 and 16.4.7.

### Workarounds
If this XML export isn't needed, the file `templates/xml.vm` in the deployed WAR can be deleted. There isn't any feature in XWiki itself that depends on this XML export.
GitHub Security Advisory: GHSA-57q2-6cp4-9mq3
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 16.5.0-rc-1, < 16.10.5
Patched in: 16.10.5

Summary: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Details:
### Impact
The XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending `?xpage=xml` to the URL includes password and email properties stored on a document that aren't named `password` or `email`. This allows any user to obtain the salted and hashed user account validation or password reset token. As those tokens are randomly generated strings, the immediate impact of this should be low. The user's password and email itself aren't exposed as those fields are named `password` and `email` and thus aren't affected. However, depending on how the wiki is used, there could be extensions or custom code that store passwords in plain text in such password properties that would be exposed by this vulnerability.

### Patches
This vulnerability has been fixed by completely removing the output of password and email fields in this XML export in versions 17.2.0 RC1, 16.10.5 and 16.4.7.

### Workarounds
If this XML export isn't needed, the file `templates/xml.vm` in the deployed WAR can be deleted. There isn't any feature in XWiki itself that depends on this XML export.
GitHub Security Advisory: GHSA-57q2-6cp4-9mq3
Package: org.xwiki.platform:xwiki-platform-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 1.1, < 16.4.7
Patched in: 16.4.7

Summary: XWiki exposes passwords and emails stored in fields not named password/email in xml.vm

Details:
### Impact
The XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending `?xpage=xml` to the URL includes password and email properties stored on a document that aren't named `password` or `email`. This allows any user to obtain the salted and hashed user account validation or password reset token. As those tokens are randomly generated strings, the immediate impact of this should be low. The user's password and email itself aren't exposed as those fields are named `password` and `email` and thus aren't affected. However, depending on how the wiki is used, there could be extensions or custom code that store passwords in plain text in such password properties that would be exposed by this vulnerability.

### Patches
This vulnerability has been fixed by completely removing the output of password and email fields in this XML export in versions 17.2.0 RC1, 16.10.5 and 16.4.7.

### Workarounds
If this XML export isn't needed, the file `templates/xml.vm` in the deployed WAR can be deleted. There isn't any feature in XWiki itself that depends on this XML export.
GitHub Security Advisory: GHSA-r38m-cgpg-qj69
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 17.0.0-rc-1, < 17.2.0-rc-1
Patched in: 17.2.0-rc-1

Summary: XWiki leaks password hashes and other accessible password properties

Details:
### Impact
Any user with edit right on a page of the wiki can create an XClass with a database list property that references a password property, for example the password hash that is stored for users. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view.

### Patches
This vulnerability has been pached in XWiki 16.4.7, 16.10.5, and 17.2.0 by disallowing the use of password properties in database list properties. Additionally, queries for email properties are disallowed, too, when email obfuscation is enabled.

### Workarounds
We're not aware of any workarounds.
GitHub Security Advisory: GHSA-r38m-cgpg-qj69
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 16.5.0-rc-1, < 16.10.5
Patched in: 16.10.5

Summary: XWiki leaks password hashes and other accessible password properties

Details:
### Impact
Any user with edit right on a page of the wiki can create an XClass with a database list property that references a password property, for example the password hash that is stored for users. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view.

### Patches
This vulnerability has been pached in XWiki 16.4.7, 16.10.5, and 17.2.0 by disallowing the use of password properties in database list properties. Additionally, queries for email properties are disallowed, too, when email obfuscation is enabled.

### Workarounds
We're not aware of any workarounds.
GitHub Security Advisory: GHSA-r38m-cgpg-qj69
Package: org.xwiki.platform:xwiki-platform-legacy-oldcore (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
Vulnerable versions: >= 9.8-rc-1, < 16.4.7
Patched in: 16.4.7

Summary: XWiki leaks password hashes and other accessible password properties

Details:
### Impact
Any user with edit right on a page of the wiki can create an XClass with a database list property that references a password property, for example the password hash that is stored for users. When adding an object of that XClass, the content of that password property is displayed. In practice, with a standard rights setup, this means that any user with an account on the wiki can access password hashes of all users, and possibly other password properties (with hashed or plain storage) that are on pages that the user can view.

### Patches
This vulnerability has been pached in XWiki 16.4.7, 16.10.5, and 17.2.0 by disallowing the use of password properties in database list properties. Additionally, queries for email properties are disallowed, too, when email obfuscation is enabled.

### Workarounds
We're not aware of any workarounds.