ghsa

Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification can be seen by the receiver, and proceeds to send notifications through their different channels. The alerts do not leak data despite this as they are listed based on a visibility check, however, emails are still sent out. This means that, for extensions which restrict access to posts, any actor can bypass the restriction by subscribing to the discussion if the [*Subscriptions*](https://extiverse.com/extension/flarum/subscriptions) extension is enabled. ### Impact The attack allows the leaking of some posts in the forum database, including posts awaiting approval, posts in tags the user has no access to if they could subscribe to a discussion before it becomes private, and posts restricted by third-party extensions. Other leaks could also happen for different ...

Using the mentions feature provided by the flarum/mentions extension, users can mention any post ID on the forum with the special `@"<username>"#p<id>` syntax. The following behavior never changes no matter if the actor should be able to read the mentioned post or not: A URL to the mentioned post is inserted into the actor post HTML, leaking its discussion ID and post number. The `mentionsPosts` relationship included in the `POST /api/posts` and `PATCH /api/posts/<id>` JSON responses leaks the full JSON:API payload of all mentioned posts without any access control. This includes the content, date, number and attributes added by other extensions. An attacker only needs the ability to create new posts on the forum to exploit the vulnerability. This works even if new posts require approval. If they have the ability to edit posts, the attack can be performed even more discreetly by using a single post to scan any size of database and hiding the attack post content afterward. ### Impac...

### Impact * An attacker can inject attributes that are used in other components * An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash. The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files. ### Patches The problem is patched in `[email protected]`. Users should upgrade to `[email protected]`. ### Workarounds No way for users to fix or remediate the vulnerability without upgrading ### References https://github.com/mozilla/node-convict/issues/410

The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and dependencies via SSH. An attacker could exploit this to perform man-in-the-middle (MITM) attacks. This vulnerability has been assigned CVE-2022-46176. ## Overview When an SSH client establishes communication with a server, to prevent MITM attacks the client should check whether it already communicated with that server in the past and what the server's public key was back then. If the key changed since the last connection, the connection must be aborted as a MITM attack is likely taking place. It was discovered that Cargo never implemented such checks, and performed no validation on the server's public key, leaving Cargo users vulnerable to MITM attacks. ## Affected Versions All Rust versions containing Cargo before 1.66.1 are vulnerable. Note that even if you don't explicitly use SSH for alternate registry indexes or crate dependencies, you might be affected b...

Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between `is_nil` and `raise`.

tag.ex in Phoenix Phoenix.HTML (aka phoenix_html) before 3.0.4 allows XSS in HEEx class attributes.

Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive.

The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in `mem.rs`. NOTE: this is unrelated to the https://crates.io/crates/bzip2-rs product.

### Impact Due to a workaround for an old client bug (which has since been fixed), very large JSON payloads in `ModalFormResponsePacket` were able to cause the server to spend a significant amount of time processing the packet. Large numbers of these packets were able to hog CPU time so as to prevent the server from processing other connections in a timely manner. ### Patches The problem has been addressed in 3baa5ab71214f96e6e7ab12cb9beef08118473b5 by removing the workaround code. ### Workarounds Plugins could cancel `DataPacketReceiveEvent` for this packet, decode the data their way, and then call `Player->onFormSubmit()` directly, bypassing the vulnerable code.

### Summary API interfaces with unauthorized access will leak sensitive information /api/v1/clusters/kubeconfig/<clusterName> ### Details Routes using v1 without any restrictions <img width="930" alt="image" src="https://user-images.githubusercontent.com/35884266/211258033-84aa14fb-01d5-459c-af81-e48b7552fabf.png"> Directly pass in `downloadKubeconfig` according to the cluster name <img width="960" alt="image" src="https://user-images.githubusercontent.com/35884266/211258011-d885fda6-06c3-4603-be4a-38d9c9b918b4.png"> pkg/router/v1/white.go no restrictions ```go func downloadKubeconfig(ctx context.Context) { clusterName := ctx.Params().GetString("name") ctx.Header("Content-Disposition", "attachment") ctx.Header("filename", fmt.Sprintf("%s-config", clusterName)) ctx.Header("Content-Type", "application/download") clusterService := service.NewClusterService() str, err := clusterService.GetKubeconfig(clusterName) if err != nil { _, _ = ctx.JSON(err) ctx.StatusCode(http.StatusI...