ghsa

`<bytes::Bytes as axum_core::extract::FromRequest>::from_request` would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used `Bytes::from_request` internally: - `axum::extract::Form` - `axum::extract::Json` - `String` The fix is also in `axum-core` `0.3.0.rc.2` but `0.3.0.rc.1` _is_ vulnerable. Because `axum` depends on `axum-core` it is vulnerable as well. The vulnerable versions of `axum` are `<= 0.5.15` and `0.6.0.rc.1`. `axum` `>= 0.5.16` and `>= 0.6.0.rc.2` does have the fix and are not vulnerable. The patched versions will set a 2 MB limit by default.

### Impact Pageflow has a membership edit feature which allows users to edit the roles of user memberships associated with an account that they have the `manager` role to (including their own). While the `Entity` dropdown select field is greyed out in the UI, an attacker can use tools which allow sending arbitrary HTTP request to craft a request to the `/admin/users/{user_id}/memberships/{membership_id}` endpoint containing an additional `membership[entity_id]` parameter. This parameter is honored when the membership is updated, allowing an attacker to update the membership object associated with their own account (with `manager` role) to be associated with a different attacker-chosen account instead. Since `account_id`s are enumerable, an attacker can compromise all accounts present on the platform. ### Mitigation Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem. ### For more information If you have any questions or comments about this advisory email us at info(at)codevi...

### Impact The attack allows extracting sensitive properties of database objects that are associated with users or entries belonging to an account that the attacker has access to. Pageflow uses the `ActiveAdmin` Ruby library to provide some management features to its users. `ActiveAdmin` relies on the `Ransack` library to implement search functionality. In its default configuration, `Ransack` will allow for query conditions based on properties of associated database objects [1]. The `*_starts_with`, `*_ends_with` or `*_contains` search matchers [2] can then be abused to exfiltrate sensitive string values of associated database objects via character-by-character brute-force. [1] https://activerecord-hackery.github.io/ransack/going-further/associations/ [2] https://activerecord-hackery.github.io/ransack/getting-started/search-matches/ ### Mitigation Upgrade to version 15.7.1 or 14.5.2 of the `pageflow` gem. ### For more information If you have any questions or comments about this ...

### Impact Users with the permission to create VMIs can construct VMI specs which allow them to read arbitrary files on the host. There are three main attack vectors: 1. Some path fields on the VMI spec were not properly validated and allowed passing in relative paths which would have been mounted into the virt-launcher pod. The fields are: `spec.domain.firmware.kernelBoot.container.kernelPath`, `spec.domain.firmware.kernelBoot.container.initrdPath` as well as `spec.volumes[*].containerDisk.path`. Example: ```yaml apiVersion: [kubevirt.io/v1](http://kubevirt.io/v1) kind: VirtualMachineInstance metadata: name: vmi-fedora spec: domain: devices: disks: - disk: bus: virtio name: containerdisk - disk: bus: virtio name: cloudinitdisk - disk: bus: virtio name: containerdisk1 rng: {} resources: requests: memory: 1024M terminationGracePeriodSeconds: 0 volumes: - containerDisk:...

Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.

A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.

Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue.

Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces. A patch for this issue is available at commit number b0d2d74f13203268ea254b02552600850f28014b.

UniSharp laravel-filemanager (aka Laravel Filemanager) through 2.5.1 allows download?working_dir=%2F.. directory traversal to read arbitrary files, as exploited in the wild in June 2022.

rdiffweb version 2.4.1 is set to a default and leaks error information. Version 2.4.2 fixes this issue.