# Vulnerabilities published in 2023


- [GHSA-f99h-w337-mv56](https://insights.sbomify.com/GHSA-f99h-w337-mv56/): Panic when parsing ranges with invalid masks in github.com/malfunkt/iprange (not scored)
- [GHSA-f8pq-3926-8gx5](https://insights.sbomify.com/GHSA-f8pq-3926-8gx5/): Unsanitized user controlled input in module generation (not scored)
- [GHSA-f5v5-ccqc-6w36](https://insights.sbomify.com/GHSA-f5v5-ccqc-6w36/): TLS certificate common name validation bypass (not scored)
- [GHSA-f2wx-xjfw-xjv6](https://insights.sbomify.com/GHSA-f2wx-xjfw-xjv6/): topgrade Time-of-check Time-of-use (TOCTOU) Race Condition in remove_dir_all (not scored)
- [GHSA-f28g-86hc-823q](https://insights.sbomify.com/GHSA-f28g-86hc-823q/): Tokenizer vulnerable to client brute-force of token secrets (not scored)
- [GHSA-cw7j-v52w-fp5r](https://insights.sbomify.com/GHSA-cw7j-v52w-fp5r/): copyparty vulnerable to reflected cross-site scripting via hc parameter (not scored)
- [GHSA-crhg-xgrg-vvcc](https://insights.sbomify.com/GHSA-crhg-xgrg-vvcc/): a12nserver vulnerable to potential SQL Injections via Knex dependency (not scored)
- [GHSA-cpmr-mw4j-99r7](https://insights.sbomify.com/GHSA-cpmr-mw4j-99r7/): Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/ (not scored)
- [GHSA-cp47-r258-q626](https://insights.sbomify.com/GHSA-cp47-r258-q626/): Vega vulnerable to arbitrary code execution when clicking href links (not scored)
- [GHSA-cfxh-frx4-9gjg](https://insights.sbomify.com/GHSA-cfxh-frx4-9gjg/): Cross-site Scripting in @spscommerce/ds-react (not scored)
- [GHSA-c45c-39f6-6gw9](https://insights.sbomify.com/GHSA-c45c-39f6-6gw9/): Rancher generated tokens not revoked after modifications made to authentication provider (not scored)
- [GHSA-c2hm-mjxv-89r4](https://insights.sbomify.com/GHSA-c2hm-mjxv-89r4/): Multiple soundness issues (not scored)
- [GHSA-9wmc-rg4h-28wv](https://insights.sbomify.com/GHSA-9wmc-rg4h-28wv/): github.com/kumahq/kuma affected by CVE-2023-44487 (not scored)
- [GHSA-9wgg-m99q-hhfc](https://insights.sbomify.com/GHSA-9wgg-m99q-hhfc/): Expired tokens can be renewed without validating the account password (not scored)
- [GHSA-9vx8-f5c4-862x](https://insights.sbomify.com/GHSA-9vx8-f5c4-862x/): XML External Entity (XXE) vulnerability in apoc.import.graphml (not scored)
- [GHSA-9qwg-crg9-m2vc](https://insights.sbomify.com/GHSA-9qwg-crg9-m2vc/): `openssl` `SubjectAlternativeName` and `ExtendedKeyUsage::other` allow arbitrary file read (not scored)
- [GHSA-9phh-r37v-34wh](https://insights.sbomify.com/GHSA-9phh-r37v-34wh/): lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files (not scored)
- [GHSA-9jxr-mwpp-w643](https://insights.sbomify.com/GHSA-9jxr-mwpp-w643/): Improper header validation in httpsoft/http-message (not scored)
- [GHSA-9j5w-2cqc-cwj9](https://insights.sbomify.com/GHSA-9j5w-2cqc-cwj9/): Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor (not scored)
- [GHSA-99jv-8292-2hpm](https://insights.sbomify.com/GHSA-99jv-8292-2hpm/): Impact The eventing-gitlab cluster-local server doesn't set `ReadHeaderTimeout`‬‭ which could lead do a DDoS‬ ‭attack, where a large gro (not scored)
- [GHSA-94vc-p8w7-5p49](https://insights.sbomify.com/GHSA-94vc-p8w7-5p49/): Bundled libwebp in imagecodecs vulnerable (not scored)
- [GHSA-946c-f9w6-2c25](https://insights.sbomify.com/GHSA-946c-f9w6-2c25/): Download route allows filename change in eZpublish kernel (not scored)
- [GHSA-8wx3-324g-w4qq](https://insights.sbomify.com/GHSA-8wx3-324g-w4qq/): OpenSearch uncontrolled resource consumption (not scored)
- [GHSA-8www-cffh-4q98](https://insights.sbomify.com/GHSA-8www-cffh-4q98/): Anyone with a share link can RESET all website data in Umami (not scored)
- [GHSA-8qxh-2gh8-r923](https://insights.sbomify.com/GHSA-8qxh-2gh8-r923/): cheqd-node subject to Cosmos SDK "Barberry" vulnerability (not scored)
- [GHSA-8f24-6m29-wm2r](https://insights.sbomify.com/GHSA-8f24-6m29-wm2r/): use-after-free in tracing (not scored)
- [GHSA-8c6x-g4fw-8rf4](https://insights.sbomify.com/GHSA-8c6x-g4fw-8rf4/): Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats. (not scored)
- [GHSA-8c37-7qx3-4c4p](https://insights.sbomify.com/GHSA-8c37-7qx3-4c4p/): Blst has logical error in SigValidate in Go bindings (not scored)
- [GHSA-87mf-9wg6-ppf8](https://insights.sbomify.com/GHSA-87mf-9wg6-ppf8/): Ouroboros is Unsound (not scored)
- [GHSA-86q5-qcjc-7pv4](https://insights.sbomify.com/GHSA-86q5-qcjc-7pv4/): Presto JDBC Server-Side Request Forgery by nextUri (not scored)
- [GHSA-83fm-w79m-64r5](https://insights.sbomify.com/GHSA-83fm-w79m-64r5/): Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs (not scored)
- [GHSA-829q-v5g8-hhxc](https://insights.sbomify.com/GHSA-829q-v5g8-hhxc/): CakePHP has incorrect Cross-Site Request Forgery validation (not scored)
- [GHSA-7ww5-4wqc-m92c](https://insights.sbomify.com/GHSA-7ww5-4wqc-m92c/): containerd allows RAPL to be accessible to a container (not scored)
- [GHSA-7vwr-g6pm-9hc8](https://insights.sbomify.com/GHSA-7vwr-g6pm-9hc8/): Cookie leakage between different users in fastapi-proxy-lib (not scored)
- [GHSA-7vpr-3ppw-qrpj](https://insights.sbomify.com/GHSA-7vpr-3ppw-qrpj/): Imageflow affected by libwebp zero-day and should not be used with malicious source images. (not scored)
- [GHSA-7vh7-fw88-wj87](https://insights.sbomify.com/GHSA-7vh7-fw88-wj87/): Several quadratic complexity bugs may lead to denial of service in Commonmarker (not scored)
- [GHSA-7vcx-v65q-9wpg](https://insights.sbomify.com/GHSA-7vcx-v65q-9wpg/): XML-RPC for PHP's `Wrapper::buildClientWrapperCode` method allows code injection via malicious `$client` argument (not scored)
- [GHSA-7p92-x423-vwj6](https://insights.sbomify.com/GHSA-7p92-x423-vwj6/): Plonk verifier KZG multi point verification (not scored)
- [GHSA-7mc6-x925-7qvx](https://insights.sbomify.com/GHSA-7mc6-x925-7qvx/): Test code in published microsoft-graph-beta package exposes phpinfo() (not scored)
- [GHSA-7crc-r3wg-cfgf](https://insights.sbomify.com/GHSA-7crc-r3wg-cfgf/): Json response for search reveals Solr credentials (not scored)
- [GHSA-7cgc-fjv4-52x6](https://insights.sbomify.com/GHSA-7cgc-fjv4-52x6/): Malware in pre-build binaries of bignum (not scored)
- [GHSA-7c94-gvvj-r3mg](https://insights.sbomify.com/GHSA-7c94-gvvj-r3mg/): cheqd-node affected by Inter-blockchain Communication (IBC) protocol "Huckleberry" vulnerability (not scored)
- [GHSA-7c2q-5qmr-v76q](https://insights.sbomify.com/GHSA-7c2q-5qmr-v76q/): DoS vulnerabilities persist in ESAPI file uploads despite remediation of CVE-2023-24998 (not scored)
- [GHSA-76r7-h46w-463r](https://insights.sbomify.com/GHSA-76r7-h46w-463r/): Cross Site Scripting (XSS) in Model\DataObject\Data\UrlSlug (not scored)
- [GHSA-72fp-w44g-625q](https://insights.sbomify.com/GHSA-72fp-w44g-625q/): Signing DynamoDB Sets when using the AWS Database Encryption SDK. (not scored)
- [GHSA-6xv5-86q9-7xr8](https://insights.sbomify.com/GHSA-6xv5-86q9-7xr8/): SecureJoin: on windows, paths outside of the rootfs could be inadvertently produced (not scored)
- [GHSA-6x4h-9622-fqr6](https://insights.sbomify.com/GHSA-6x4h-9622-fqr6/): Improper validation in meraki (not scored)
- [GHSA-6w5f-5wgr-qjg5](https://insights.sbomify.com/GHSA-6w5f-5wgr-qjg5/): Constellation allows Emergency shell access during initramfs boot phase (not scored)
- [GHSA-6r78-m64m-qwcf](https://insights.sbomify.com/GHSA-6r78-m64m-qwcf/): Moq v4.20.0-rc to 4.20.1 share hashed user data (not scored)
- [GHSA-6hg4-vp5q-47mw](https://insights.sbomify.com/GHSA-6hg4-vp5q-47mw/): CakePHP allows direct access of prefixed controller actions (not scored)
- [GHSA-6hcf-g6gr-hhcr](https://insights.sbomify.com/GHSA-6hcf-g6gr-hhcr/): `openssl` `X509Extension::new` and `X509Extension::new_nid` null pointer dereference (not scored)
- [GHSA-6g3j-p5g6-992f](https://insights.sbomify.com/GHSA-6g3j-p5g6-992f/): OpenSearch StackOverflow vulnerability (not scored)
- [GHSA-68jh-rf6x-836f](https://insights.sbomify.com/GHSA-68jh-rf6x-836f/): @apollo/server vulnerable to unsafe application of Content Security Policy via reused nonces (not scored)
- [GHSA-636f-xm5j-pj9m](https://insights.sbomify.com/GHSA-636f-xm5j-pj9m/): Several quadratic complexity bugs may lead to denial of service in Commonmarker (not scored)
- [GHSA-5x5q-8cgm-2hjq](https://insights.sbomify.com/GHSA-5x5q-8cgm-2hjq/): Karate has vulnerable dependency on json-smart package (CVE-2023-1370) (not scored)
- [GHSA-5x36-7567-3cw6](https://insights.sbomify.com/GHSA-5x36-7567-3cw6/): partial_sort contains Out-of-bounds Read in release mode (not scored)
- [GHSA-5wrg-8fxp-cx9r](https://insights.sbomify.com/GHSA-5wrg-8fxp-cx9r/): passport-wsfed-saml2 Signature Bypass vulnerability (not scored)
- [GHSA-5fp6-4xw3-xqq3](https://insights.sbomify.com/GHSA-5fp6-4xw3-xqq3/): @keystone-6/core's bundled cuid package known to be insecure (not scored)
- [GHSA-5fm9-h728-fwpj](https://insights.sbomify.com/GHSA-5fm9-h728-fwpj/): trust-dns vulnerable to Remote Attackers causing Denial-of-Service (packet loops) with crafted DNS packets (not scored)
- [GHSA-5cpq-8wj7-hf2v](https://insights.sbomify.com/GHSA-5cpq-8wj7-hf2v/): Vulnerable OpenSSL included in cryptography wheels (not scored)
- [GHSA-58qw-p7qm-5rvh](https://insights.sbomify.com/GHSA-58qw-p7qm-5rvh/): Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations (not scored)
- [GHSA-56fm-hfp3-x3w3](https://insights.sbomify.com/GHSA-56fm-hfp3-x3w3/): Wallabag user can disable 2FA unintentionally (not scored)
- [GHSA-54xq-cgqr-rpm3](https://insights.sbomify.com/GHSA-54xq-cgqr-rpm3/): sharp vulnerability in libwebp dependency CVE-2023-4863 (not scored)
- [GHSA-4xgv-j62q-h3rj](https://insights.sbomify.com/GHSA-4xgv-j62q-h3rj/): Panic during unmarshal of Hello Verify Request in github.com/pion/dtls/v2 (not scored)
- [GHSA-4vjr-crvh-383h](https://insights.sbomify.com/GHSA-4vjr-crvh-383h/): @napi-rs/image affected by libwebp CVE (not scored)
- [GHSA-4rgc-5g6r-2rjf](https://insights.sbomify.com/GHSA-4rgc-5g6r-2rjf/): lakeFS logs S3 credentials in plain text (not scored)
- [GHSA-4q83-7cq4-p6wg](https://insights.sbomify.com/GHSA-4q83-7cq4-p6wg/): `tokio::io::ReadHalf<T>::unsplit` is Unsound (not scored)
- [GHSA-4q66-g4mm-8rg5](https://insights.sbomify.com/GHSA-4q66-g4mm-8rg5/): Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE (not scored)
- [GHSA-4mqg-h5jf-j9m7](https://insights.sbomify.com/GHSA-4mqg-h5jf-j9m7/): TorchServe Pre-Auth Remote Code Execution (not scored)
- [GHSA-4h72-34j6-j8x7](https://insights.sbomify.com/GHSA-4h72-34j6-j8x7/): Maloja error page XSS vulnerability (not scored)
- [GHSA-4c29-gfrp-g6x9](https://insights.sbomify.com/GHSA-4c29-gfrp-g6x9/): CefSharp affected by libvpx's heap buffer overflow in vp8 encoding (not scored)
- [GHSA-48wp-p9qv-4j64](https://insights.sbomify.com/GHSA-48wp-p9qv-4j64/): Commonmarker vulnerable to to several quadratic complexity bugs that may lead to denial of service (not scored)
- [GHSA-48m6-wm5p-rr6h](https://insights.sbomify.com/GHSA-48m6-wm5p-rr6h/): Insufficient covariance check makes self_cell unsound (not scored)
- [GHSA-475v-pq2g-fp9g](https://insights.sbomify.com/GHSA-475v-pq2g-fp9g/): s2n-quic potential denial of service via crafted stream frames (not scored)
- [GHSA-3wxx-jxwc-mg39](https://insights.sbomify.com/GHSA-3wxx-jxwc-mg39/): bottlerocket dependency openssl has a double free vulnerability (not scored)
- [GHSA-3w9w-9833-gcpv](https://insights.sbomify.com/GHSA-3w9w-9833-gcpv/): Security bug in ConvertToSinglePlane when used with untrusted content from the DDS loader (not scored)
- [GHSA-3mv5-343c-w2qg](https://insights.sbomify.com/GHSA-3mv5-343c-w2qg/): Ref methods into_ref, into_mut, into_slice, and into_slice_mut are unsound when used with cell::Ref or cell::RefMut (not scored)
- [GHSA-3hwm-922r-47hw](https://insights.sbomify.com/GHSA-3hwm-922r-47hw/): Stud42 vulnerable to denial of service (not scored)
- [GHSA-3gxf-9r58-2ghg](https://insights.sbomify.com/GHSA-3gxf-9r58-2ghg/): `openssl` `X509NameBuilder::build` returned object is not thread safe (not scored)
- [GHSA-37xq-q42p-rv3p](https://insights.sbomify.com/GHSA-37xq-q42p-rv3p/): ntpd has Dependency on Vulnerable Third-Party Component (not scored)
- [GHSA-373w-rj84-pv6x](https://insights.sbomify.com/GHSA-373w-rj84-pv6x/): SafeURL-Python's hostname blocklist does not block FQDNs (not scored)
- [GHSA-36xm-35qq-795w](https://insights.sbomify.com/GHSA-36xm-35qq-795w/): Exposes reference to non-Sync data to an arbitrary thread (not scored)
- [GHSA-344m-qcjq-xgrf](https://insights.sbomify.com/GHSA-344m-qcjq-xgrf/): Vulnerable OpenSSL included in sgx-dcap-quote-verify-python (not scored)
- [GHSA-3244-8mff-w398](https://insights.sbomify.com/GHSA-3244-8mff-w398/): Reflected XSS in Gotify's /docs via import of outdated Swagger UI (not scored)
- [GHSA-2xpm-cmvw-3jcc](https://insights.sbomify.com/GHSA-2xpm-cmvw-3jcc/): Reflected XSS in Application Logger module (not scored)
- [GHSA-2w8w-qhg4-f78j](https://insights.sbomify.com/GHSA-2w8w-qhg4-f78j/): A stored XSS in jaeger UI might allow an attacker who controls a trace to perform arbitrary jaeger queries (not scored)
- [GHSA-2qv5-7mw5-j3cg](https://insights.sbomify.com/GHSA-2qv5-7mw5-j3cg/): spin-rs initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers (not scored)
- [GHSA-2fch-hv74-fgw9](https://insights.sbomify.com/GHSA-2fch-hv74-fgw9/): Cross site scripting (XSS) in wwbn/avideo (not scored)
- [GHSA-2c7c-3mj9-8fqh](https://insights.sbomify.com/GHSA-2c7c-3mj9-8fqh/): Decryption of malicious PBES2 JWE objects can consume unbounded system resources (not scored)
- [GHSA-26hr-q2wp-rvc5](https://insights.sbomify.com/GHSA-26hr-q2wp-rvc5/): Impact When lakeFS is configured with **ALL** of the following: - Configuration option `auth.encrypt.secret_key` passed through environm (not scored)
- [GHSA-23px-mw2p-46qm](https://insights.sbomify.com/GHSA-23px-mw2p-46qm/): Cosmos-SDK Cosmovisor component may be vulnerable to denial of service (not scored)
- [GHSA-2326-pfpj-vx3h](https://insights.sbomify.com/GHSA-2326-pfpj-vx3h/): lexical-core has multiple soundness issues (not scored)
- [GHSA-22rr-f3p8-5gf8](https://insights.sbomify.com/GHSA-22rr-f3p8-5gf8/): Directus affected by VM2 sandbox escape vulnerability (not scored)
- [DRUPAL-CORE-2023-004](https://insights.sbomify.com/DRUPAL-CORE-2023-004/): Drupal core provides a page that outputs the markup from `phpinfo()` to assist with diagnosing PHP configuration. (not scored)
- [DRUPAL-CORE-2023-003](https://insights.sbomify.com/DRUPAL-CORE-2023-003/): The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages. (not scored)
- [DRUPAL-CORE-2023-002](https://insights.sbomify.com/DRUPAL-CORE-2023-002/): The Media module does not properly check entity access in some circumstances. (not scored)
- [DRUPAL-CORE-2023-001](https://insights.sbomify.com/DRUPAL-CORE-2023-001/): The Media Library module does not properly check entity access in some circumstances. (not scored)
- [DRUPAL-CONTRIB-2023-055](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-055/): This module allows you to turn various data sources (Eg CSV or JSON file) into interactive visualisation. (not scored)
- [DRUPAL-CONTRIB-2023-054](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-054/): The Group module has the ability to make content private to specific groups. (not scored)
- [DRUPAL-CONTRIB-2023-053](https://insights.sbomify.com/DRUPAL-CONTRIB-2023-053/): The Xsendfile module enables fast transfer for private files in Drupal. (not scored)

---
From sbomify Insights: https://insights.sbomify.com/years/2023/page/122/