ghsa

### Impact Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed. This is due to a path traversal vulnerability when extracting the `.tar.gz` file of the package being scanned, which exists by design in the `tarfile.TarFile.extractall` function. See also https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall ### Remediation Upgrade to GuardDog v0.1.5 or more recent. ### References * https://semgrep.dev/r?q=trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal * https://www.trellix.com/en-us/about/newsroom/stories/research/tarfile-exploiting-the-world.html * https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall

### Impact > A request forgery attack can be performed on Varnish Cache servers that have the HTTP/2 protocol turned on. An attacker may introduce characters through the HTTP/2 pseudo-headers that are invalid in the context of an HTTP/1 request line, causing the Varnish server to produce invalid HTTP/1 requests to the backend. This may in turn be used to successfully exploit vulnerabilities in a server behind the Varnish server. > -- https://varnish-cache.org/security/VSV00011.html#vsv00011 ### Patches This is fixed in Varnish 6.0.11; Varnish 6.0.11 is available in `kube-httpcache` versions v0.7.1 and later. ### Workarounds See [upstream mitigation hints](https://varnish-cache.org/security/VSV00011.html#mitigation). ### References - https://varnish-cache.org/security/VSV00011.html#vsv00011

** UNSUPPORTED WHEN ASSIGNED ** Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, which applies the the (also unsupported) 4.x version line. NOTE: This vulnerability only affects Apache Tapestry version line 3.x, which is no longer supported by the maintainer. Users are recommended to upgrade to a supported version line of Apache Tapestry.

ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).

**Description** Prior to Opencast 12.5 Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. **Impact** The vulnerability allows attackers to redirect users to sites outside of your Opencast install, potentially facilitating phishing attacks or other security issues. **Patches** This issue is fixed in Opencast 12.5 and newer **References** [Patch fixing the issue](https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017) **If you have any questions or comments about this advisory**: Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues) Email us at [[email protected]](mailto:[email protected])

### Description An issue was discovered in Sinatra 2.0 before 2.2.3 and 3.0 before 3.0.4. An application is vulnerable to a reflected file download (RFD) attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input. ### References * https://www.blackhat.com/docs/eu-14/materials/eu-14-Hafif-Reflected-File-Download-A-New-Web-Attack-Vector.pdf * https://github.com/advisories/GHSA-8x94-hmjh-97hq

Zenario CMS 9.3.57186 is vulnerable to RCE.

Tribal Systems Zenario CMS 9.3.57595 is vulnerable to session fixation. In Zenario CMS, the user session identifier (authentication token) is issued to the browser prior to authentication but is not changed after user logout and login again into the application when "Remember me" option active. Failing to issue a new session ID following a successful login introduces the possibility for an attacker to set up a trap session on the device the victim is likely to login with. The attack may be initiated remotely and an exploit has been disclosed.

### Impact The crewjam/saml go library is vulnerable to an authentication bypass when processing SAML responses containing multiple Assertion elements. ### Patches This issue has been corrected in version 0.4.9 ### Credit This issue was reported by Felix Wilhelm from Google Project Zero.

### Summary A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release (16.0.1). The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the groups' dropdown functionality. ### Impact Successful attacks of this vulnerability can result a privileged attacker to load a XSS script, and steal data from other users. The impact can be considered moderate to low, considering privileged credentials are required. ### References - Please refer to the Keycloak Security mailing list for more information.