Vin01

Name of the Vulnerable Software and Affected Versions: Bullfrog versions prior to 0.8.4 Description: Bullfrog is a GitHub Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration, which can result in sandbox bypass. Recommendations: For versions prior to 0.8.4, update to version 0.8.4 to fix the issue. As a temporary workaround, consider avoiding the use of tcp in GitHub workflows until the update is applied.

**Name of the Vulnerable Software and Affected Versions** go-git versions prior to v5.13 **Description** An argument injection vulnerability was discovered in go-git. The successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. **Recommendations** For go-git versions prior to v5.13, upgrade to version 5.13.0 to mitigate this vulnerability. As a temporary workaround, consider enforcing strict validation rules for values passed in the URL field. Restrict access to the file transport protocol to minimize the risk of exploitation. Avoid using the `file` transport protocol until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** iTerm2 versions 3.5.x through 3.5.1 **Description** An issue was discovered in iTerm2 that allows an attacker to inject arbitrary code into the terminal by abusing title reporting and tmux integration. This is possible due to the unfiltered use of an escape sequence to report a window title, in combination with the built-in tmux integration feature, which is enabled by default. **Recommendations** For iTerm2 versions 3.5.x through 3.5.1, update to version 3.5.2 or later to resolve the issue. As a temporary workaround, consider disabling the tmux integration feature until a patch is available. Restrict access to the terminal to minimize the risk of exploitation. Avoid using the title reporting feature in the affected versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache Superset versions up to and including 2.1.0 **Description** The issue is related to improper REST API permission in Apache Superset, allowing authenticated Gamma users to test network connections, which may lead to a possible Server-Side Request Forgery (SSRF) attack. **Recommendations** For Apache Superset versions up to and including 2.1.0, consider restricting access to the REST API until a patch is available. As a temporary workaround, limit the permissions of Gamma users to prevent them from testing network connections.

**Name of the Vulnerable Software and Affected Versions** Docker Machine versions 0.16.2 and earlier **Description** The issue allows an attacker, who has control of a worker node, to provide crafted version data. This might potentially trick an administrator into performing an unsafe action via escape sequence injection, or might have a data size that causes a denial of service to a bastion node. It is noted that this vulnerability only affects products that are no longer supported by the maintainer. **Recommendations** For Docker Machine versions 0.16.2 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ThingsBoard versions prior to 3.2 **Description** The issue allows an attacker to send malicious links in password-reset emails to victims, pointing to an attacker-controlled server due to lack of validation of the Host header. This enables host header injection in password-reset emails. **Recommendations** For versions prior to 3.2, update to version 3.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of password-reset emails until a patch is available.

Name of the Vulnerable Software and Affected Versions: markdown2 versions through 2.3.5 Description: The issue concerns a flaw in the `safe mode` feature of markdown2, which is intended to sanitize user input against XSS attacks. However, this feature does not properly escape input, allowing for the potential triggering of XSS with a crafted payload. This can be demonstrated by omitting the final `>` character from an IMG tag, showcasing the feature's inability to correctly handle such input. Recommendations: For versions through 2.3.5, consider disabling the `safe mode` feature until a proper fix is available, as it does not provide the intended protection against XSS attacks. Additionally, restricting user input to prevent the inclusion of potentially malicious HTML tags, such as IMG tags without a closing `>`, can help minimize the risk of exploitation.