TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-wmfg-55f9-j8hq
Summary: Server-Side Template Injection
Aliases: CVE-2020-26282
Severity: HIGH
CWE: CWE-74
Published: 2020-12-24T20:49:34Z

### Impact
A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been assigned CVE-2020-26282.

### Patches
Effective Immediately, all users should upgrade to version 2.1.2 or higher.

### Workarounds
None. 

### References
https://securitylab.github.com/research/bean-validation-RCE


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the BrowserUp Proxy repo](http://github.com/browserup/browserup-proxy)
* Contact us via  the [BrowserUp website](https://browserup.com) or email us at [support@browserup.com](mailto:support@browserup.com)
Vulnerability: GHSA-92wj-x78c-m4fx
Summary: Moderate severity vulnerability that affects org.apache.karaf:karaf
Aliases: CVE-2018-11788
Severity: CRITICAL
CWE: CWE-611
Published: 2019-01-07T19:14:49Z

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Vulnerability: GHSA-v7mf-qgxf-qmvf
Summary: Apache Ranger admin users can store some arbitrary javascript code to be executed when normal users login and access policies
Aliases: CVE-2016-8751
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-17T17:21:54Z

Apache Ranger before 0.6.is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies.
Vulnerability: GHSA-74qp-233x-p5j8
Summary: Cross-site scripting (XSS) in Apache Livy
Aliases: CVE-2021-26544
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-13T22:30:41Z

Livy server version 0.7.0-incubating (only) is vulnerable to a cross site scripting issue in the session name. A malicious user could use this flaw to access logs and results of other users' sessions and run jobs with their privileges. This issue is fixed in Livy 0.7.1-incubating.
Vulnerability: GHSA-vpfp-5gwq-g533
Summary: Improper Authentication in Apache ShenYu Admin
Aliases: CVE-2021-37580
Severity: CRITICAL
CWE: CWE-287
Published: 2021-11-17T23:15:30Z

A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0
Vulnerability: GHSA-8vcr-vxm8-293m
Summary: Denial of Service in SheetsJS Pro
Aliases: CVE-2021-32013
Severity: MODERATE
CWE: CWE-400
Published: 2021-07-22T19:48:13Z

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).
Vulnerability: GHSA-ppc3-fpvh-7396
Summary: Improper synchronization in Apache Netbeans HTML/Java API
Aliases: CVE-2020-17534
Severity: HIGH
CWE: CWE-362
Published: 2022-02-09T22:25:18Z

There exists a race condition between the deletion of the temporary file and the creation of the temporary directory in `webkit` subproject of HTML/Java API version 1.7. A similar vulnerability has recently been disclosed in other Java projects and the fix in HTML/Java API version 1.7.1 follows theirs: To avoid local privilege escalation version 1.7.1 creates the temporary directory atomically without dealing with the temporary file.
Vulnerability: GHSA-4xr4-4c65-hj7f
Summary: Apache Tika does not properly initialize the XML parser or choose handlers
Aliases: CVE-2016-4434
Severity: HIGH
CWE: CWE-611
Published: 2018-10-17T15:44:22Z

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.
Vulnerability: GHSA-c8cw-2c5j-xff3
Summary: Incorrect Authorization in Apache Ozone
Aliases: CVE-2021-39234
Severity: MODERATE
CWE: CWE-863
Published: 2021-11-23T17:56:30Z

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
Vulnerability: GHSA-ff84-84q5-fq4f
Summary: Incorrect Authorization in Apache Ozone
Aliases: CVE-2021-39232
Severity: HIGH
CWE: CWE-863
Published: 2021-11-23T17:56:54Z

In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.
Vulnerability: GHSA-rvwf-54qp-4r6v
Summary: XML Entity Expansion in SnakeYAML
Aliases: CVE-2017-18640
Severity: HIGH
CWE: CWE-776
Published: 2021-06-04T21:37:45Z

The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.
Vulnerability: GHSA-52mh-p2m2-w625
Summary: Cross-site Scripting in HAPI FHIR
Aliases: CVE-2019-12741
Severity: MODERATE
CWE: CWE-79
Published: 2019-06-07T20:56:59Z

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)
Vulnerability: GHSA-5949-rw7g-wx7w
Summary: Deserialization of untrusted data in jackson-databind
Aliases: CVE-2021-20190
Severity: HIGH
CWE: CWE-502
Published: 2021-01-20T21:20:15Z

A flaw was found in jackson-databind before 2.9.10.7. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-74mg-6xqx-2vrq
Summary: Deserialization exploitation in Apache Dubbo
Aliases: CVE-2020-11995
Severity: CRITICAL
CWE: CWE-502
Published: 2022-02-09T22:27:01Z

A deserialization vulnerability existed in dubbo 2.7.5 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protool, during Hessian2 deserializing the HashMap object, some functions in the classes stored in HashMap will be executed after a series of program calls, however, those special functions may cause remote command execution. For example, the hashCode() function of the EqualsBean class in rome-1.7.0.jar will cause the remotely load malicious classes and execute malicious code by constructing a malicious request. This issue was fixed in Apache Dubbo 2.6.9 and 2.7.8.
Vulnerability: GHSA-xqj7-j8j5-f2xr
Summary: Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator
Aliases: CVE-2018-1000180
Severity: HIGH
CWE: CWE-327
Published: 2018-10-16T17:44:39Z

Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
Vulnerability: GHSA-j8wc-gxx9-82hx
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Santuario
Aliases: CVE-2021-40690
Severity: HIGH
CWE: CWE-200
Published: 2021-09-20T23:18:41Z

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Vulnerability: GHSA-5mc7-m686-p6jg
Summary: Deserialization of Untrusted Data in Apache Dubbo
Aliases: CVE-2021-30179
Severity: CRITICAL
CWE: CWE-502
Published: 2022-03-18T17:57:32Z

Apache Dubbo prior to 2.6.9 and 2.7.10 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
Vulnerability: GHSA-9vfj-5g7h-4p24
Summary: Server side template injection in Apache Camel
Aliases: CVE-2020-11994
Severity: HIGH
CWE: CWE-74
Published: 2020-07-29T18:08:48Z

Server-Side Template Injection and arbitrary file disclosure on Camel templating components
Vulnerability: GHSA-8c9h-4q7g-fp7h
Summary: Out-of-bounds Read in iText
Aliases: CVE-2022-24198
Severity: MODERATE
CWE: CWE-125
Published: 2022-02-02T00:01:45Z

iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Vulnerability: GHSA-jg6j-jrxv-2hh9
Summary: Cross-site Scripting in Apache Pluto
Aliases: CVE-2021-36738
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-08T00:46:17Z

The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact
Vulnerability: GHSA-xfqh-7356-vqjj
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Aliases: CVE-2019-14820
Severity: MODERATE
CWE: CWE-200
Published: 2020-04-15T21:08:21Z

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
Vulnerability: GHSA-9mxf-g3x6-wv74
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-14721
Severity: CRITICAL
CWE: CWE-918
Published: 2019-01-04T19:07:06Z

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Vulnerability: GHSA-g5m7-57ph-j6p8
Summary: OS Command Injection in Nexus Yum Repository Plugin
Aliases: CVE-2019-5475
Severity: HIGH
CWE: CWE-78
Published: 2019-09-11T23:04:57Z

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.
Vulnerability: GHSA-fj2w-wfgv-mwq6
Summary: Denial of service in CBOR library
Severity: HIGH
CWE: CWE-407
Published: 2022-01-21T23:21:48Z

### Impact
Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.  

Affected versions _include_ versions 4.0.0 through 4.5.0.

This vulnerability was privately reported to me.

### Patches
This issue has been fixed in version 4.5.1.  Users should use the latest version of this library.  (The latest version is not necessarily 4.5.1.  Check the README for [this library's repository](https://github.com/peteroupc/CBOR-Java) to see the latest version's version number.)

### Workarounds

Again, users should use the latest version of this library.

In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if&mdash;

- it begins with a byte other than 0x80 through 0xDF, or
- it does not contain a byte in the range 0xa0 through 0xBF.

Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR-Java).
Vulnerability: GHSA-xmc8-26q4-qjhx
Summary: Denial of Service (DoS) in Jackson Dataformat CBOR
Aliases: CVE-2020-28491
Severity: HIGH
CWE: CWE-770
Published: 2021-12-09T19:17:21Z

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 0 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
Vulnerability: GHSA-867q-77cc-98mv
Summary: Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
Aliases: CVE-2021-21429
Severity: MODERATE
CWE: CWE-377, CWE-379, CWE-552, CWE-378
Published: 2021-04-29T21:51:37Z

### Impact

Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. This vulnerability only impacts unix-like systems where the local system temporary directory is shared between all users. This vulnerability does not impact Windows or modern versions of MacOS.

OpenAPI Generator Maven plug-in creates insecure temporary files during the code generation process. It creates insecure temporary files to store the OpenAPI specification files provided by the users and these temporary files can be read by any users in the system.

The impact of this vulnerability is information disclosure of the contents of the specification file to other local users.

### Patches
The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [OpenAPI Generator Github repo](https://github.com/openAPITools/openapi-generator/)
* Email us at [security@openapitools.org](mailto:security@openapitools.org)
Vulnerability: GHSA-5c6c-w4c4-vgvx
Summary: Cross-site scripting in Jenkins Scriptler Plugin
Aliases: CVE-2021-21668
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T18:45:09Z

Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
Vulnerability: GHSA-477x-w7m6-c6ph
Summary: Improper input validation in Apache Olingo
Aliases: CVE-2019-17555
Severity: HIGH
CWE: CWE-20
Published: 2020-02-04T22:37:15Z

The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.
Vulnerability: GHSA-24r8-fm9r-cpj2
Summary: Low severity vulnerability that affects com.linecorp.armeria:armeria
Aliases: CVE-2019-16771
Severity: LOW
CWE: CWE-113
Published: 2019-12-05T18:40:51Z

## Multiple timing attack vulnerabilities leading to the recovery of secrets based on the use of non-constant time compare function

### Impact

String comparison method in multiple authentication validation in Armeria were known to be vulnerable to timing attacks. This vulnerability is caused by the insecure implementation of `equals` method from `java.lang.String`. While this attack is not practically possible, an attacker still has a potential to attack if the victim's server validates user by using `equals` method.

We would like to thank @chrsow for pointing out the issue.

## Potentially vulnerable codes

https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/OAuth2Token.java#L54
https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/BasicToken.java#L64

### Patches

There are two options to patch this issue.

1. Remove `equals` method; it has been exclusively used for test cases and was never used in any OSS projects that are using Armeria. (But it is worth noting that there are possibilities of closed projects authenticating users by utilizing `equals` method)

2. Use `MessageDigest.isEqual` to compare the credential instead.

### Workarounds

1. Update to the latest version (TBD)

2-1. Users can prevent these vulnerabilities by modifying and implementing timing attack preventions by themselves.

2-2. Precisely speaking, it is possible to compare credentials by securely comparing them after calling methods to directly return the input (namely `Object. accessToken()`, `Object.username()` and `Object.password()`).

### References
- https://cwe.mitre.org/data/definitions/208.html
- https://security.stackexchange.com/questions/111040/should-i-worry-about-remote-timing-attacks-on-string-comparison

### Side Note

Since it is a theoretical attack, there is no PoC available from neither the vendor nor the security team.
Vulnerability: GHSA-p2j7-6g9h-32xh
Summary: Cross site scripting in Shopizer
Aliases: CVE-2022-23059
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-30T00:00:27Z

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
Vulnerability: GHSA-6768-mcjc-8223
Summary: Command injection leading to Remote Code Execution in Apache Storm
Aliases: CVE-2021-38294
Severity: CRITICAL
CWE: CWE-74, CWE-77
Published: 2021-10-27T18:51:22Z

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
Vulnerability: GHSA-hpm9-fx8v-w45v
Summary: Plaintext storage in Jenkins instant-messaging Plugin
Aliases: CVE-2022-28135
Severity: MODERATE
CWE: CWE-256
Published: 2022-03-30T00:00:25Z

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Vulnerability: GHSA-4284-x26r-4hhc
Summary: Cross Site Request Forgery in Apache JSPWiki
Aliases: CVE-2022-24947
Severity: HIGH
CWE: CWE-352
Published: 2022-02-26T00:00:44Z

Apache JSPWiki user preferences form is vulnerable to CSRF attacks, which can lead to account takeover. Apache JSPWiki users should upgrade to 2.11.2 or later.
Vulnerability: GHSA-p826-8vhq-h439
Summary: Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
Aliases: CVE-2021-31411
Severity: HIGH
CWE: CWE-379
Published: 2021-05-06T15:27:12Z

Insecure temporary directory usage in frontend build functionality of `com.vaadin:flow-server` versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

- https://vaadin.com/security/cve-2021-31411
Vulnerability: GHSA-2mxr-89gf-rc4v
Summary: Read permissions not enforced for client provided filter expressions in Elide.
Aliases: CVE-2020-5289
Severity: HIGH
CWE: CWE-285
Published: 2020-03-30T20:09:58Z

### Impact
It is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming they can read at least one other field in the model.  The adversary can construct filter expressions for an inaccessible field to filter a collection.  The presence or absence of models in the returned collection can be used to reconstruct the value of the inaccessible field.

For example, a User model has two fields: _name_ and _role_.  The adversary has read permissions to see the _name_ field of the User collection but not the _role_.  By constructing a filter like the one below, the adversary can determine which users have admin role by presence or absence in the returned collection:
`filter=role=="Admin"`

### Patches
Resolved in Elide 4.5.14 and greater.

### Workarounds
The adversary can only access the fields if a model includes fields with different read permission levels (some less secure and some more secure).  Model security can be adjusted by restricting read permissions on existing models.

### References
Fixed in https://github.com/yahoo/elide/pull/1236

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [elide](https://github.com/yahoo/elide)
* Contact us at [spectrum](https://spectrum.chat/elide?tab=posts)
Vulnerability: GHSA-hf44-3mx6-vhhw
Summary: Navigate endpoint is vulnerable to regex injection that may lead to Denial of Service.
Aliases: CVE-2021-29506
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-19T23:02:57Z

### Impact
The regex injection that may lead to Denial of Service.

### Patches
Will be patched in 2.4 and 3.0

### Workarounds
Versions lower than 2.x are only affected if the navigation module is added

### References
See this pull request for the fix: https://github.com/graphhopper/graphhopper/pull/2304

If you have any questions or comments about this advisory please [send us an Email](https://www.graphhopper.com/contact-form/) or create a topic [here](https://discuss.graphhopper.com/).
Vulnerability: GHSA-gpch-h32j-gx6x
Summary: Insufficiently Protected Credentials in Reactor Netty
Aliases: CVE-2020-5404
Severity: MODERATE
CWE: CWE-522
Published: 2022-02-10T20:24:17Z

The HttpClient from Reactor Netty, versions 0.9.x prior to 0.9.5, and versions 0.8.x prior to 0.8.16, may be used incorrectly, leading to a credentials leak during a redirect to a different domain. In order for this to happen, the HttpClient must have been explicitly configured to follow redirects.
Vulnerability: GHSA-m6cp-vxjx-65j6
Summary: SessionListener can prevent a session from being invalidated breaking logout
Aliases: CVE-2021-34428
Severity: LOW
CWE: CWE-613
Published: 2021-06-23T20:23:04Z

### Impact
If an exception is thrown from the `SessionListener#sessionDestroyed()` method, then the session ID is not invalidated in the session ID manager.   On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated.  This can result in an application used on a shared computer being left logged in.

There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception.    The OP has also identified that during the call to `sessionDestroyed`, the `getLastAccessedTime()` throws an `IllegalStateException`, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out.  If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.

### Workarounds
The application should catch all Throwables within their `SessionListener#sessionDestroyed()` implementations.
Vulnerability: GHSA-p8xr-4v2c-rvgp
Summary: High severity vulnerability that affects org.apache.hbase:hbase
Aliases: CVE-2015-1836
Severity: HIGH
CWE: CWE-284
Published: 2018-10-18T18:04:50Z

Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect ACLs for ZooKeeper coordination state, which allows remote attackers to cause a denial of service (daemon outage), obtain sensitive information, or modify data via unspecified client traffic.
Vulnerability: GHSA-2mh8-gx2m-mr75
Summary: Out-of-Memory Error in Bouncy Castle Crypto
Aliases: CVE-2019-17359
Severity: MODERATE
CWE: CWE-770
Published: 2019-10-17T18:15:16Z

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Vulnerability: GHSA-836g-5fr5-fgcr
Summary: Missing Authentication for Critical Function in Apache TomEE
Aliases: CVE-2020-11969
Severity: HIGH
CWE: CWE-306
Published: 2022-02-10T23:07:37Z

If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Vulnerability: GHSA-fg3j-q579-v8x4
Summary: Uncontrolled memory consumption
Aliases: CVE-2021-31811
Severity: MODERATE
CWE: CWE-770, CWE-789
Published: 2021-06-15T15:54:32Z

In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Vulnerability: GHSA-5993-wwpg-m92c
Summary: Improper Authentication in Apache Ozone
Aliases: CVE-2021-39236
Severity: HIGH
CWE: CWE-287
Published: 2021-11-23T17:56:45Z

In Apache Ozone before 1.2.0, Authenticated users with valid Ozone S3 credentials can create specific OM requests, impersonating any other user.
Vulnerability: GHSA-q656-g2x3-8cgh
Summary: Kylin can receive user input and load any class through Class.forName(...).
Aliases: CVE-2021-31522
Severity: MODERATE
CWE: CWE-470
Published: 2022-01-08T00:43:01Z

Kylin can receive user input and load any class through Class.forName(...). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Vulnerability: GHSA-744r-vv2g-2x6g
Summary: Apache NiFi information disclosure by XXE
Aliases: CVE-2019-10080
Severity: MODERATE
CWE: CWE-611
Published: 2019-12-02T18:17:36Z

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.
Vulnerability: GHSA-c9jj-3wvg-q65h
Summary: Vulnerability that affects org.apache.pdfbox:pdfbox
Aliases: CVE-2019-0228
Severity: CRITICAL
CWE: CWE-611
Published: 2019-07-05T21:12:54Z

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
Vulnerability: GHSA-r97x-3g8f-gx3m
Summary: The Bouncy Castle JCE Provider carry a propagation bug
Aliases: CVE-2016-1000340
Severity: HIGH
Published: 2018-10-17T16:23:50Z

In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
Vulnerability: GHSA-2j2x-hx4g-2gf4
Summary: In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode
Aliases: CVE-2016-1000344
Severity: HIGH
CWE: CWE-1310
Published: 2018-10-18T17:43:55Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider.
Vulnerability: GHSA-54mg-vgrp-mwx9
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack
Aliases: CVE-2019-11808
Severity: LOW
CWE: CWE-338
Published: 2019-05-14T04:01:37Z

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
Vulnerability: GHSA-288c-cq4h-88gq
Summary: XML External Entity (XXE) Injection in Jackson Databind
Aliases: CVE-2020-25649
Severity: HIGH
CWE: CWE-611
Published: 2021-02-18T20:51:54Z

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
Vulnerability: GHSA-5wm5-8q42-rhxg
Summary: File system access via H2 in Apache Ignite
Aliases: CVE-2020-1963
Severity: CRITICAL
CWE: CWE-862
Published: 2020-06-05T16:11:02Z

Apache Ignite uses H2 database to build SQL distributed execution engine. H2 provides SQL functions which could be used by attacker to access to a filesystem.
Vulnerability: GHSA-3qpg-33wr-533j
Summary: Improper Restriction of XML External Entity Reference in Magnolia CMS
Aliases: CVE-2021-46365
Severity: HIGH
CWE: CWE-611
Published: 2022-02-12T00:00:37Z

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted XLF file.
Vulnerability: GHSA-w736-hf9p-qqh3
Summary: Key Caching behavior in the DynamoDB Encryption Client.
Severity: LOW
CWE: CWE-862
Published: 2021-02-08T17:43:36Z

### Impact
This advisory concerns users of MostRecentProvider in the DynamoDB Encryption Client with a key provider like AWS Key Management Service that allows for permissions on keys to be modified.

When key usage permissions were changed at the key provider, time-based key reauthorization logic in MostRecentProvider did not reauthorize the use of the key. This created the potential for keys to be used in the DynamoDB Encryption Client after permissions to do so were revoked at the key provider.

### Patches
Fixed as of 1.15.0.  We recommend users to modify their code and adopt `CachingMostRecentProvider`.

### Workarounds
Users who cannot upgrade to use the `CachingMostRecentProvider` can call `clear()` on the cache to manually flush all of its contents. Next use of the key will force a re-validation to occur with the key provider.
Vulnerability: GHSA-jmv4-73v2-pvgc
Summary: Cross-site Scripting in OpenNMS Horizon
Aliases: CVE-2021-25929
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-25T18:46:58Z

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files.
Vulnerability: GHSA-gx2c-fvhc-ph4j
Summary: Path traversal in Hadoop
Aliases: CVE-2022-26612
Severity: CRITICAL
CWE: CWE-22
Published: 2022-04-08T00:00:21Z

In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3
Vulnerability: GHSA-3qpm-h9ch-px3c
Summary: Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library
Severity: CRITICAL
CWE: CWE-502, CWE-20, CWE-400
Published: 2022-01-06T18:31:23Z

### Summary
The version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser.
It's well detailed at [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) and  CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).

### Impact
Malicious client code could be used to send messages and cause remote code execution on the server.

### Patches
PowerNukkit `1.5.2.1` is a patch-release that only updates the Log4j version to `2.17.0` and should be used instead of `1.5.2.0`.
All versions prior to `1.5.2.1` are affected and are not patched.

### Workarounds
If you can't upgrade, you can use the `-Dlog4j2.formatMsgNoLookups=true` startup argument as remediation, as this prevents the vulnerability from happening.

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/advisories/GHSA-p6xc-xr62-6r2g

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PowerNukkit repository](https://github.com/PowerNukkit/PowerNukkit/issues)
Vulnerability: GHSA-38cg-gg9j-q9j9
Summary: Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak
Aliases: CVE-2019-3875
Severity: MODERATE
CWE: CWE-345, CWE-295
Published: 2019-06-27T17:25:57Z

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.
Vulnerability: GHSA-fcr6-6cph-vmcm
Summary: Stored XSS vulnerability in Jenkins Git Parameter Plugin
Aliases: CVE-2022-29040
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-13T00:00:17Z

Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-q5rx-8c2h-5q7j
Summary: Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service
Aliases: CVE-2021-36152
Severity: CRITICAL
Published: 2022-02-06T00:01:07Z

Apache Gobblin trusts all certificates used for LDAP connections in Gobblin-as-a-Service. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
Vulnerability: GHSA-wq3v-3grq-6f86
Summary: Improper Control of Dynamically-Managed Code Resources in Crafter CMS Crafter Studio
Aliases: CVE-2020-25802
Severity: HIGH
CWE: CWE-913
Published: 2022-02-09T23:07:55Z

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
Vulnerability: GHSA-gf2j-7qwg-4f5x
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2018-14637
Severity: HIGH
CWE: CWE-287, CWE-285
Published: 2018-12-21T17:48:45Z

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
Vulnerability: GHSA-mf27-wg66-m8f5
Summary: A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.
Aliases: CVE-2020-35210
Severity: MODERATE
CWE: CWE-400
Published: 2021-12-17T20:41:09Z

A vulnerability in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via a Raft session flooding attack using Raft OpenSessionRequest messages.
Vulnerability: GHSA-97jg-43c9-q6pf
Summary: Unauthenticated user can retrieve the list of users through uorgsuggest.vm
Aliases: CVE-2022-24819
Severity: MODERATE
CWE: CWE-359
Published: 2022-04-08T21:53:38Z

A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
Vulnerability: GHSA-2ppp-9496-p23q
Summary: Insufficient Entropy in Spring Security
Aliases: CVE-2020-5408
Severity: MODERATE
CWE: CWE-330, CWE-329
Published: 2020-06-15T19:34:31Z

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.
Vulnerability: GHSA-fp5j-3fpf-mhj5
Summary: Sensitive data written to disk unencrypted in Spark
Aliases: CVE-2019-10099
Severity: HIGH
CWE: CWE-312
Published: 2019-08-08T15:18:22Z

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Vulnerability: GHSA-p694-23q3-rvrc
Summary: Remote Code Execution in Apache Synapse
Aliases: CVE-2017-15708
Severity: CRITICAL
CWE: CWE-502, CWE-74
Published: 2020-11-04T18:23:25Z

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue, we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1, Commons Collection has been updated to 3.2.2 version.
Vulnerability: GHSA-2wr2-8qjq-gh55
Summary: Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search
Aliases: CVE-2021-23264
Severity: CRITICAL
CWE: CWE-402, CWE-668
Published: 2021-12-16T15:27:35Z

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
Vulnerability: GHSA-v98j-7crc-wvrj
Summary: Authentication bypass in Apache Shiro
Aliases: CVE-2020-17523
Severity: CRITICAL
CWE: CWE-287
Published: 2022-02-09T22:03:57Z

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Vulnerability: GHSA-58p8-9g59-q2hr
Summary: Potential DOS attack due to unrestricted attachment count in messages
Aliases: CVE-2019-12406
Severity: MODERATE
CWE: CWE-770
Published: 2019-11-08T17:15:11Z

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Vulnerability: GHSA-27xw-p8v6-9jjr
Summary: Moderate severity vulnerability that affects org.springframework.security:spring-security-core
Aliases: CVE-2018-15801
Severity: HIGH
CWE: CWE-345
Published: 2018-12-20T22:01:31Z

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.
Vulnerability: GHSA-v6fq-q792-j46j
Summary: Improper Input Validation in Apache Unomi
Aliases: CVE-2020-11975
Severity: HIGH
CWE: CWE-20
Published: 2022-02-09T23:20:47Z

Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.
Vulnerability: GHSA-h4x4-5qp2-wp46
Summary: Moderate severity vulnerability that affects com.fasterxml.jackson.datatype:jackson-datatype-jsr353
Aliases: CVE-2018-1000873
Severity: MODERATE
CWE: CWE-20
Published: 2018-12-21T17:46:54Z

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Databind that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
Vulnerability: GHSA-244r-fcj3-ghjq
Summary: Exposure of class information in RESTEasy
Aliases: CVE-2021-20289
Severity: MODERATE
CWE: CWE-668, CWE-209
Published: 2021-04-07T21:51:33Z

A flaw was found in RESTEasy in all current versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
Vulnerability: GHSA-9fj5-jg6f-qg5r
Summary: Use of Hard-coded Credentials in Apache Kylin
Aliases: CVE-2021-45458
Severity: MODERATE
CWE: CWE-798, CWE-326
Published: 2022-01-08T00:43:09Z

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Vulnerability: GHSA-p699-3wgc-7h72
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-1339
Severity: MODERATE
CWE: CWE-835
Published: 2018-10-17T15:43:59Z

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.
Vulnerability: GHSA-jx6h-3fjx-cgv5
Summary: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2018-1305
Severity: MODERATE
Published: 2018-10-17T16:31:48Z

Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied once a Servlet had been loaded. Because security constraints defined in this way apply to the URL pattern and any URLs below that point, it was possible - depending on the order Servlets were loaded - for some security constraints not to be applied. This could have exposed resources to users who were not authorised to access them.
Vulnerability: GHSA-qr7j-h6gg-jmgc
Summary: Deserialization of Untrusted Data in jackson-databind
Aliases: CVE-2018-11307
Severity: CRITICAL
CWE: CWE-502
Published: 2019-07-16T17:42:21Z

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
Vulnerability: GHSA-rhq2-2574-78mc
Summary: Unzip function in ZipUtil.java in Hutool allows remote attackers to overwrite arbitrary files via directory traversal
Aliases: CVE-2018-17297
Severity: HIGH
CWE: CWE-22
Published: 2018-10-17T19:54:53Z

The unzip function in ZipUtil.java in Hutool before 4.1.12 allows remote attackers to overwrite arbitrary files via directory traversal sequences in a filename within a ZIP archive.
Vulnerability: GHSA-h436-432x-8fvx
Summary: High severity vulnerability that affects org.apache.commons:commons-compress
Aliases: CVE-2018-1324
Severity: MODERATE
CWE: CWE-835
Published: 2019-03-14T15:41:12Z

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
Vulnerability: GHSA-6566-9526-52v6
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Concord
Aliases: CVE-2020-10591
Severity: HIGH
CWE: CWE-200
Published: 2022-02-10T20:48:47Z

An issue was discovered in Walmart Labs Concord before 1.44.0. CORS Access-Control-Allow-Origin headers have a potentially unsafe dependency on Origin headers, and are not configurable. This allows remote attackers to discover host information, nodes, API metadata, and references to usernames via api/v1/apikey.
Vulnerability: GHSA-2289-pqfq-6wx7
Summary: Unrestricted upload of file with dangerous type in Apache Solr
Aliases: CVE-2019-12409
Severity: CRITICAL
CWE: CWE-434
Published: 2020-01-28T22:26:54Z

The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.
Vulnerability: GHSA-mwcx-532g-8pq3
Summary: Access and integrity issue within Eclipse Jetty
Aliases: CVE-2018-12538
Severity: HIGH
CWE: CWE-384, CWE-6
Published: 2018-10-16T17:44:11Z

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
Vulnerability: GHSA-758m-6g3q-g3hh
Summary: Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard character
Aliases: CVE-2017-7676
Severity: CRITICAL
CWE: CWE-20
Published: 2018-10-17T17:22:38Z

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character - like my*test, test*.txt. This can result in unintended behavior.