Security
Headlines
HeadlinesLatestCVEs

Source

ghsa

GHSA-fqcv-rfp6-wv92: Microweber Cross-site Scripting vulnerability

Microweber 1.3.4 and prior is vulnerable to stored cross-site scripting via an alert on the `Editing` page. This issue is fixed in commit 42efa981a2239d042d910069952d6276497bdcf1.

ghsa
#xss#vulnerability#web#git
GHSA-hh54-53m7-7ffj: alist Incorrect Access Control vulnerability

alist <=3.16.3 is vulnerable to Incorrect Access Control. Low privilege accounts can upload any file.

GHSA-x2w4-c67p-g44j: Grafana Missing Synchronization vulnerability

Grafana is an open-source platform for monitoring and observability. Using public dashboards users can query multiple distinct data sources using mixed queries. However such query has a possibility of crashing a Grafana instance. The only feature that uses mixed queries at the moment is public dashboards, but it's also possible to cause this by calling the query API directly. This might enable malicious users to crash Grafana instances through that endpoint. Users may upgrade to version 9.4.12 and 9.5.3 to receive a fix.

GHSA-wm7r-3qxj-5xgq: Grafana Improper Access Control vulnerability

Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a test alert using the API as the API does not check access to this function. This might enable malicious users to abuse the functionality by sending multiple alert messages to e-mail and Slack, spamming users, prepare Phishing attack or block SMTP server. Users may upgrade to version 9.5.3, 9.4.12, 9.3.15, 9.2.19 and 8.5.26 to receive a fix.

GHSA-qcm3-vfq5-wfr2: RedCloth Regular Expression Denial of Service issue

A Regular Expression Denial of Service (ReDoS) issue was discovered in the `sanitize_html` function of RedCloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload.

GHSA-6w63-h3fj-q4vw: fast-xml-parser vulnerable to Regex Injection via Doctype Entities

### Impact "fast-xml-parser" allows special characters in entity names, which are not escaped or sanitized. Since the entity name is used for creating a regex for searching and replacing entities in the XML body, an attacker can abuse it for DoS attacks. By crafting an entity name that results in an intentionally bad performing regex and utilizing it in the entity replacement step of the parser, this can cause the parser to stall for an indefinite amount of time. ### Patches The problem has been resolved in v4.2.4 ### Workarounds Avoid using DOCTYPE parsing by `processEntities: false` option. ### References _Are there any links users can visit to find out more?_

GHSA-86h2-2g4g-29qx: avo possible unsafe reflection / partial DoS vulnerability

### Summary The polymorphic field type stores the classes to operate on when updating a record with user input, and does not validate them in the back end. This can lead to unexpected behavior, remote code execution, or application crashes when viewing a manipulated record. ### Details After reviewing the polymorphic field implementation and performing some black box approaches, we identified a potential security issue related to the use of safe_constantize / constantize. This Rails functionality is capable of searching for classes within the Rails context and returning the class for further use. Because Avo does not validate user input when updating or creating a new polymorphic resource, it is possible to create database entries with completely different or invalid class names than the preselected ones. Avo assumes that the class specified by the user request is a valid one and attempts to work with it, which may result in dangerous behavior and code execution. ### PoC ![image](ht...

GHSA-2fqm-m4r2-fh98: kiwitcms vulnerable to stored cross-site scripting via unrestricted file upload

### Impact Kiwi TCMS allows users to upload attachments to test plans, test cases, etc. Earlier versions of Kiwi TCMS had introduced upload validators in order to prevent potentially dangerous files from being uploaded and Content-Security-Policy definition to prevent cross-site-scripting attacks. The upload validation checks were not 100% robust which left the possibility to circumvent them and upload a potentially dangerous file which allows execution of arbitrary JavaScript in the browser. Additionally we've discovered that Nginx's `proxy_pass` directive will strip some headers negating protections built into Kiwi TCMS when served behind a reverse proxy. ### Patches - Improved file upload validation code - Updated Nginx reverse proxy configuration for ***.tenant.kiwitcms.org** ### Workarounds If serving Kiwi TCMS behind a reverse proxy make sure that additional header values are still passed to the client browser. If they aren't redefine them inside the proxy configuration. S...

GHSA-xhg5-42rf-296r: notation-go's verification bypass can cause users to verify the wrong artifact

### Impact An attacker who controls or compromises a registry can lead a user to verify the wrong artifact. ### Patches The problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.6). Users should upgrade their notation-go library to [v1.0.0-rc.6](https://github.com/notaryproject/notation-go/releases/tag/v1.0.0-rc.6) or above. ### Workarounds User should use secure and trusted container registries. ### Credits The `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT), Pritesh Bandi (@priteshbandi) for root cause analysis.

GHSA-rvrx-rrwh-r9p6: Notation's default `maxSignatureAttempts` in `notation verify` enables an endless data attack

### Impact An attacker who controls or compromises a registry can make the registry serve an infinite number of signatures for the artifact, causing a denial of service to the host machine running `notation verify`. ### Patches The problem has been fixed in the release [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6). Users should upgrade their notation packages to [v1.0.0-rc.6](https://github.com/notaryproject/notation/releases/tag/v1.0.0-rc.6) or above. ### Workarounds User should use secure and trusted container registries ### Credits The `notation` project would like to thank Adam Korczynski (@AdamKorcz) for responsibly disclosing the issue found during an security audit (facilitated by OSTIF and sponsored by CNCF) and Shiwei Zhang (@shizhMSFT) for root cause analysis.