TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-6wf9-jmg9-vxcc
Summary: XStream can cause a Denial of Service
Aliases: CVE-2021-39140
Severity: MODERATE
CWE: CWE-502, CWE-835
Published: 2021-08-25T14:48:39Z

### Impact
The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39140](https://x-stream.github.io/CVE-2021-39140.html).

### Credits
The vulnerability was discovered and reported by Lai Han of nsfocus security team.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-hf23-9pf7-388p
Summary: Deserialization of Untrusted Data and Code Injection in xstream
Aliases: CVE-2019-10173
Severity: CRITICAL
CWE: CWE-502, CWE-94
Published: 2019-07-26T16:09:47Z

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Vulnerability: GHSA-9m6f-7xcq-8vf8
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36183
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:16:34Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool.
Vulnerability: GHSA-7rjr-3q55-vv33
Summary: Incomplete fix for Apache Log4j vulnerability
Aliases: CVE-2021-45046
Severity: CRITICAL
CWE: CWE-502
Published: 2021-12-14T18:01:28Z

# Impact

The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. 

## Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.

# Mitigation

Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).

Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.
Vulnerability: GHSA-73wx-rpj3-mx46
Summary: Path traversal in MCMS
Aliases: CVE-2021-46037
Severity: HIGH
CWE: CWE-22
Published: 2022-02-19T00:01:25Z

MCMS v5.2.4 was discovered to contain an arbitrary file deletion vulnerability via the component /template/unzip.do.
Vulnerability: GHSA-6g3c-2mh5-7q6x
Summary: Missing validation of JWT signature in `ManyDesigns/Portofino`
Aliases: CVE-2021-29451
Severity: CRITICAL
CWE: CWE-347
Published: 2021-04-19T14:56:33Z

### Impact
https://github.com/ManyDesigns/Portofino before version 5.2.1 did not properly verify the signature of JSON Web Tokens.
This allows forging a valid JWT.

### Patches
The issue will be patched in the upcoming 5.2.1 release.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/ManyDesigns/Portofino](https://github.com/ManyDesigns/Portofino)
Vulnerability: GHSA-w534-q4xf-h5v2
Summary: XSS in Mapfish Print relating to JSONP support
Aliases: CVE-2020-15231
Severity: LOW
CWE: CWE-79
Published: 2020-07-07T16:32:49Z

### Impact
A user can use the JSONP support to do a Cross-site scripting.

### Patches
Use version >= 3.24

### Workarounds
No

### References
* https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e
* https://cwe.mitre.org/data/definitions/79.html

### For more information
If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397
Vulnerability: GHSA-w729-7633-2fw5
Summary: Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
Aliases: CVE-2021-40865
Severity: CRITICAL
CWE: CWE-502
Published: 2021-10-27T18:52:06Z

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Vulnerability: GHSA-jc6q-27mw-p55w
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2017-2646
Severity: HIGH
CWE: CWE-835
Published: 2018-10-18T16:49:29Z

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.
Vulnerability: GHSA-8m5h-hrqm-pxm2
Summary: Path traversal in the OWASP Enterprise Security API
Aliases: CVE-2022-23457
Severity: HIGH
CWE: CWE-22
Published: 2022-04-27T21:09:43Z

### Impact
The default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path.

### Patches
This vulnerability is patched in release 2.3.0.0 of ESAPI. See https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.3.0.0 for details.

### Workarounds
Yes; in theory, one _could_ write the own implementation of the Validator interface. This would most easily be done by sub-classing a version of the affected `DefaultValidator` class and then overriding the affected `getValidDirectoryPath()` to correct the issue. However, this is not recommended.


### For more information
If you have any questions or comments about this advisory:
* Email one of the project co-leaders. See email addresses listed on  the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders".
* Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.
Vulnerability: GHSA-6v73-fgf6-w5j7
Summary: Code Injection in Spring Cloud Function
Aliases: CVE-2022-22963
Severity: CRITICAL
CWE: CWE-94
Published: 2022-04-03T00:00:59Z

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Vulnerability: GHSA-fqwf-pjwf-7vqv
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-10673
Severity: MODERATE
Published: 2020-05-15T18:59:04Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
Vulnerability: GHSA-2p3x-qw9c-25hh
Summary: XStream can cause a Denial of Service.
Aliases: CVE-2021-21341
Severity: HIGH
CWE: CWE-502, CWE-400, CWE-835
Published: 2021-03-22T23:27:51Z

### Impact
The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21341](https://x-stream.github.io/CVE-2021-21341.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-7pm4-g2qj-j85x
Summary: CSRF attack via CORS preflight requests with Spring MVC or Spring WebFlux
Aliases: CVE-2020-5397
Severity: MODERATE
CWE: CWE-352
Published: 2020-01-21T20:59:33Z

Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
Vulnerability: GHSA-r2v5-5vcr-h3vq
Summary: Cross-site Scripting in Apache Zeppelin
Aliases: CVE-2018-1328
Severity: MODERATE
CWE: CWE-79
Published: 2019-04-24T16:07:36Z

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph".
Vulnerability: GHSA-vwqq-5vrc-xw9h
Summary: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Aliases: CVE-2020-9488
Severity: LOW
CWE: CWE-295
Published: 2020-06-05T14:15:51Z

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.
Vulnerability: GHSA-49h4-g8p5-jgq6
Summary: Moderate severity vulnerability that affects org.apache.juddi:juddi-client
Aliases: CVE-2015-5241
Severity: MODERATE
CWE: CWE-601
Published: 2018-10-16T19:49:32Z

After logging into the portal, the logout jsp page redirects the browser back to the login page after. It is feasible for malicious users to redirect the browser to an unintended web page in Apache jUDDI 3.1.2, 3.1.3, 3.1.4, and 3.1.5 when utilizing the portlets based user interface also known as 'Pluto', 'jUDDI Portal', 'UDDI Portal' or 'uddi-console'. User session data, credentials, and auth tokens are cleared before the redirect.
Vulnerability: GHSA-p979-4mfw-53vg
Summary: HTTP Request Smuggling in Netty
Aliases: CVE-2019-16869
Severity: HIGH
CWE: CWE-444
Published: 2019-10-11T18:41:23Z

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
Vulnerability: GHSA-7c6q-jqwc-4423
Summary: Path Traversal in Crafter CMS Crafter Studio
Aliases: CVE-2017-15681
Severity: CRITICAL
CWE: CWE-22
Published: 2022-02-09T23:07:59Z

In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE.
Vulnerability: GHSA-gc67-crq6-hgh5
Summary: Improper Input Validation in Parquet-MR
Aliases: CVE-2021-41561
Severity: HIGH
CWE: CWE-20
Published: 2022-01-06T23:59:25Z

Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions.
Vulnerability: GHSA-29f8-q7mf-7cqj
Summary: Logic error in Apache Pinot
Aliases: CVE-2022-23974
Severity: HIGH
CWE: CWE-674
Published: 2022-04-06T00:01:28Z

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
Vulnerability: GHSA-4pv3-63jw-4jw2
Summary: Missing Release of Memory after Effective Lifetime in Apache Tika
Aliases: CVE-2020-9489
Severity: MODERATE
CWE: CWE-401
Published: 2021-05-07T15:53:40Z

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.
Vulnerability: GHSA-qgcg-p3v2-9h4p
Summary: Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix
Aliases: CVE-2020-5412
Severity: MODERATE
CWE: CWE-441, CWE-610
Published: 2021-04-30T17:29:42Z

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
Vulnerability: GHSA-qpp2-2mcp-2wm5
Summary: Unauthenticated user can list hidden document from multiple velocity templates in XWiki
Aliases: CVE-2022-24820
Severity: MODERATE
CWE: CWE-200, CWE-359
Published: 2022-04-08T22:00:54Z

### Impact
A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents.

### Patches
The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1.

### Workarounds
There is no known workaround for this problem.

### References
https://jira.xwiki.org/browse/XWIKI-16544

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-hh3j-x4mc-g48r
Summary: Insufficiently Protected Credentials in Apache Tomcat
Aliases: CVE-2019-12418
Severity: HIGH
CWE: CWE-522
Published: 2019-12-26T18:22:36Z

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
Vulnerability: GHSA-pqhq-xx62-2v2p
Summary: Cross-site scripting in Apache NiFi
Aliases: CVE-2020-1933
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T20:35:39Z

A XSS vulnerability was found in Apache NiFi 1.0.0 to 1.10.0. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.
Vulnerability: GHSA-6q3p-36f4-cwxv
Summary: Server-Side Request Forgery in UReport
Aliases: CVE-2020-21122
Severity: HIGH
CWE: CWE-918
Published: 2021-09-20T20:45:21Z

UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
Vulnerability: GHSA-qcj6-jqrg-4wp2
Summary: Template injection in thymeleaf-spring5
Aliases: CVE-2021-43466
Severity: CRITICAL
CWE: CWE-94
Published: 2021-11-10T19:52:33Z

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Vulnerability: GHSA-hvwm-2624-rp9x
Summary: Moderate severity vulnerability that affects org.apache.activemq:activemq-web-console
Aliases: CVE-2018-8006
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-30T20:48:58Z

An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
Vulnerability: GHSA-q7fr-vqhq-v5xr
Summary: Improper Access Control in Apache ActiveMQ Artemis
Aliases: CVE-2021-26118
Severity: HIGH
CWE: CWE-287, CWE-284
Published: 2021-06-16T17:39:05Z

While investigating ARTEMIS-2964 it was found that the creation of advisory messages in the OpenWire protocol head of Apache ActiveMQ Artemis 2.15.0 bypassed policy based access control for the entire session. Production of advisory messages was not subject to access control in error.
Vulnerability: GHSA-cw6w-q88j-6mqf
Summary: Potential session hijack in Apache CXF 
Aliases: CVE-2019-12419
Severity: CRITICAL
CWE: CWE-863
Published: 2019-11-08T17:12:59Z

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Vulnerability: GHSA-9hx8-2mrv-r674
Summary: Deserialization of Untrusted Data in Apache jUDDI
Aliases: CVE-2021-37578
Severity: CRITICAL
CWE: CWE-502
Published: 2021-08-09T20:41:37Z

Apache jUDDI uses several classes related to Java's Remote Method Invocation (RMI) which (as an extension to UDDI) provides an alternate transport for accessing UDDI services.

RMI uses the default Java serialization mechanism to pass parameters in RMI invocations. A remote attacker can send a malicious serialized object to the above RMI entries. The objects get deserialized without any check on the incoming data. In the worst case, it may let the attacker run arbitrary code remotely. 

For both jUDDI web service applications and jUDDI clients, the usage of RMI is disabled by default. Since this is an optional feature and an extension to the UDDI protocol, the likelihood of impact is low. Starting with 3.3.10, all RMI related code was removed.
Vulnerability: GHSA-w6rq-6h34-vh7q
Summary: Cached redirect poisoning via X-Forwarded-Host header
Aliases: CVE-2021-29479
Severity: HIGH
CWE: CWE-807
Published: 2021-07-01T17:02:38Z

A user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key.

Users are only vulnerable if they do not configure a custom `PublicAddress` instance. A custom `PublicAddress` can be specified by using [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-). For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable.

### Impact

This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.

### Patches

As of Ratpack 1.9.0, two changes have been made that mitigate this vulnerability:

1. The default PublicAddress implementation no longer infers the address from the request context, instead relying on the configured bind host/port
2. Relative redirects issued by the application are no longer absolutized; they are passed through as-is

### Workarounds

In production, ensure that [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-) correctly configures the server.

### References
 - https://portswigger.net/web-security/web-cache-poisoning
Vulnerability: GHSA-q6w2-89hq-hq27
Summary: Cross-site scripting in keycloak
Aliases: CVE-2021-20195
Severity: CRITICAL
CWE: CWE-20, CWE-79
Published: 2021-06-08T23:02:43Z

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-h6rp-8v4j-hwph
Summary: High severity vulnerability that affects org.apache.camel:camel-core
Aliases: CVE-2014-0003
Severity: HIGH
Published: 2018-10-16T23:13:49Z

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
Vulnerability: GHSA-6v52-mj5r-7j2m
Summary: Moderate severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2018-8037
Severity: MODERATE
CWE: CWE-362
Published: 2018-10-17T16:33:02Z

If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NIO and NIO2 connectors that did not correctly track the closure of the connection when an async request was completed by the application and timed out by the container at the same time. This could also result in a user seeing a response intended for another user. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.9 and 8.5.5 to 8.5.31.
Vulnerability: GHSA-mw25-f5r2-hpc6
Summary: Insertion of Sensitive Information into Log File in Apache Geode
Aliases: CVE-2021-34797
Severity: HIGH
CWE: CWE-532
Published: 2022-01-06T22:23:25Z

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.
Vulnerability: GHSA-hvv8-336g-rx3m
Summary: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aliases: CVE-2021-21342
Severity: MODERATE
CWE: CWE-502, CWE-918
Published: 2021-03-22T23:28:01Z

### Impact
The processed stream at unmarshalling time contains type information to recreate the formerly written objects. XStream creates therefore new instances based on these type information.  An attacker can manipulate the processed input stream and replace or inject objects, that result in a server-side forgery request. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21342](https://x-stream.github.io/CVE-2021-21342.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-5fvx-2jj3-6mff
Summary: Insufficiently Protected Credentials in Elasticsearch
Aliases: CVE-2021-22132
Severity: MODERATE
CWE: CWE-522
Published: 2021-03-18T19:27:27Z

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Vulnerability: GHSA-hcxx-mp6g-6gr9
Summary: Opencast publishes global system account credentials
Aliases: CVE-2018-16153
Severity: LOW
CWE: CWE-522, CWE-200
Published: 2021-12-14T21:43:48Z

The issue was mostly mitigated before, drastically reducing the risk. See references below for more information.

### Impact

Opencast before version 10.6 will try to authenticate against any external services listed in a media package when it is trying to access the files, sending the global system user's credentials, regardless of the target being part of the Opencast cluster or not.

Previous mitigations already prevented clear text authentications for such requests (e.g. HTTP Basic authentication), but with enough malicious intent, even hashed credentials can be broken.

### Patches

Opencast 10.6 will now send authentication requests only against servers which are part of the Opencast cluster, preventing external services from getting any form of authentication attempt in the first place.

### Workarounds

No workaround available.

### References

- [Patch fixing the issue](https://github.com/opencast/opencast/commit/776d5588f39c61eb04c03bb955416c4f77629d51)
- [Original security notice](https://groups.google.com/a/opencast.org/g/security-notices/c/XRZzRiqp-NE)
- [Original security mitigation](https://github.com/opencast/opencast/commit/fe8c3d3a60dc5869b468957270dbad5f8c30ead6)

### For more information

If you have any questions or comments about this advisory:
- Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
- Email us at [security@opencast.org](mailto:security@opencast.org)
Vulnerability: GHSA-mcg9-64cp-xwp7
Summary: Server-Side Request Forgery in Hawt Hawtio
Aliases: CVE-2019-9827
Severity: CRITICAL
CWE: CWE-918
Published: 2019-07-05T21:08:09Z

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
Vulnerability: GHSA-fxp8-7h5w-h235
Summary: XSS in search engine
Aliases: CVE-2019-13234
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-12T22:58:11Z

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
Vulnerability: GHSA-w4x9-4f5x-8jj8
Summary: Low severity vulnerability that affects      org.apache.hive:hive-exec, org.apache.hive:hive, and org.apache.hive:hive-service
Aliases: CVE-2014-0228
Severity: LOW
CWE: CWE-284
Published: 2018-11-21T22:23:29Z

Apache Hive before 0.13.1, when in SQL standards based authorization mode, does not properly check the file permissions for (1) import and (2) export statements, which allows remote authenticated users to obtain sensitive information via a crafted URI.
Vulnerability: GHSA-c4rh-4376-gff4
Summary: Improper certificate management in AWS IoT Device SDK v2
Aliases: CVE-2021-40830
Severity: MODERATE
CWE: CWE-295
Published: 2021-11-24T21:12:04Z

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host's trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker's data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user's private keys to authenticate against the MQTT broker. The 'aws_tls_ctx_options_override_default_trust_store_*' function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.
Vulnerability: GHSA-v2wx-jj66-2hp7
Summary: Cross-site Scripting in Wildfly
Aliases: CVE-2021-3536
Severity: LOW
CWE: CWE-79
Published: 2021-05-25T18:45:05Z

A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
Vulnerability: GHSA-2j6v-xpf3-xvrv
Summary: Use of Externally-Controlled Format String in wire-avs
Aliases: CVE-2021-41193
Severity: HIGH
CWE: CWE-134
Published: 2022-03-01T18:58:23Z

### Impact
A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.

### Patches
* The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)

### Workarounds
* No workaround known

### References
* Fixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe

### For more information

If you have any questions or comments about this advisory feel free to email us at [vulnerability-report@wire.com](mailto:vulnerability-report@wire.com)
Vulnerability: GHSA-wp4h-pvgw-5727
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
Aliases: CVE-2019-0230
Severity: CRITICAL
CWE: CWE-915
Published: 2021-12-02T14:50:51Z

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Vulnerability: GHSA-5mh9-r3rr-9597
Summary: Code execution vulnerability in HtmlUnit
Aliases: CVE-2020-5529
Severity: HIGH
CWE: CWE-665
Published: 2020-05-21T21:08:33Z

HtmlUnit prior to 2.37.0 contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is done in an improper way, hence a malicious JavaScript code can execute arbitrary Java code on the application.
Vulnerability: GHSA-g2fg-mr77-6vrm
Summary: Uncontrolled Resource Consumption in Apache Thrift
Aliases: CVE-2020-13949
Severity: HIGH
CWE: CWE-400
Published: 2021-03-12T21:33:55Z

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
Vulnerability: GHSA-m929-7fr6-cvjg
Summary: Spring Data Commons, used in combination with XMLBeam, contains a property binder vulnerability caused by improper restriction of XML external entity references
Aliases: CVE-2018-1259
Severity: HIGH
CWE: CWE-611
Published: 2018-10-17T17:23:36Z

Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
Vulnerability: GHSA-ffvq-7w96-97p7
Summary: Denial of Service in Spring Framework
Aliases: CVE-2018-15756
Severity: HIGH
Published: 2020-06-15T19:34:50Z

Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, versions 4.3.x prior to 4.3.20, and older unsupported versions on the 4.2.x branch provide support for range requests when serving static resources through the ResourceHttpRequestHandler, or starting in 5.0 when an annotated controller returns an org.springframework.core.io.Resource. A malicious user (or attacker) can add a range header with a high number of ranges, or with wide ranges that overlap, or both, for a denial of service attack. This vulnerability affects applications that depend on either spring-webmvc or spring-webflux. Such applications must also have a registration for serving static resources (e.g. JS, CSS, images, and others), or have an annotated controller that returns an org.springframework.core.io.Resource. Spring Boot applications that depend on spring-boot-starter-web or spring-boot-starter-webflux are ready to serve static resources out of the box and are therefore vulnerable.
Vulnerability: GHSA-m6mm-q862-j366
Summary: Improper Input Validation in Keycloak
Aliases: CVE-2020-1714
Severity: MODERATE
CWE: CWE-20
Published: 2022-02-09T00:56:14Z

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
Vulnerability: GHSA-v6w3-2prq-h95f
Summary: Improper Input Validation in Jakarta Expression Language
Aliases: CVE-2021-28170
Severity: MODERATE
CWE: CWE-917, CWE-20
Published: 2021-10-06T17:48:38Z

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Vulnerability: GHSA-9vvp-fxw6-jcxr
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11113
Severity: HIGH
CWE: CWE-502
Published: 2020-05-15T18:58:47Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
Vulnerability: GHSA-xp5j-wj4h-2jq9
Summary: Injection and Improper Input Validation in Apache Unomi
Aliases: CVE-2020-13942
Severity: CRITICAL
CWE: CWE-20, CWE-74
Published: 2022-02-10T00:30:54Z

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Vulnerability: GHSA-p5xp-6vpf-jwvh
Summary: Improper Input Validation and Cross-Site Request Forgery in Keycloak
Aliases: CVE-2019-10199
Severity: HIGH
CWE: CWE-20, CWE-352
Published: 2019-09-23T18:32:27Z

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
Vulnerability: GHSA-hrcp-8f3q-4w2c
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21351
Severity: MODERATE
CWE: CWE-502, CWE-434
Published: 2021-03-22T23:29:37Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21351](https://x-stream.github.io/CVE-2021-21351.html).

### Credits
wh1t3p1g G5-RD6@IIE found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-fmpq-w5q6-9vf9
Summary: Moderate severity vulnerability that affects org.apache.jspwiki:jspwiki-main
Aliases: CVE-2019-0224
Severity: MODERATE
CWE: CWE-79
Published: 2019-04-02T15:46:48Z

In Apache JSPWiki 2.9.0 to 2.11.0.M2, a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database, nor would an attacker be able to execute js on someone else's browser; only on its own browser.
Vulnerability: GHSA-3mqv-8gxg-pfm4
Summary: Cross-site scripting in twitter-server
Aliases: CVE-2020-35774
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T22:37:28Z

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
Vulnerability: GHSA-24wf-7vf2-pv59
Summary: XXE vulnerability on Launch import with externally-defined DTD file
Aliases: CVE-2021-29620
Severity: HIGH
CWE: CWE-611
Published: 2021-06-28T16:38:29Z

### Impact
Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

### Patches
Fixed with: https://github.com/reportportal/service-api/pull/1392

### Binaries
`docker pull reportportal/service-api:5.4.0`
https://github.com/reportportal/service-api/packages/846871?version=5.4.0

### For more information
If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)
Vulnerability: GHSA-chj8-5xgw-wcvj
Summary: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Aliases: CVE-2016-8750
Severity: MODERATE
CWE: CWE-90
Published: 2019-01-07T19:14:46Z

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
Vulnerability: GHSA-cxrj-66c5-9fmh
Summary: Spring Framework when used in combination with any versions of Spring Security contains an authorization bypass
Aliases: CVE-2018-1258
Severity: HIGH
CWE: CWE-863
Published: 2018-10-17T20:05:49Z

Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted.
Vulnerability: GHSA-29q4-gxjq-rx5c
Summary: Remote Code Execution in SCIMono
Aliases: CVE-2021-21479
Severity: HIGH
CWE: CWE-62, CWE-77, CWE-74, CWE-917, CWE-59, CWE-690
Published: 2021-02-10T02:31:53Z

### Impact
It is possible for attacker to inject and execute java expression and compromising the availability and integrity of the system.

### Patches
The issue was fixed on  [0.0.19 version](https://mvnrepository.com/artifact/com.sap.scimono/scimono-server/0.0.19)
Vulnerability: GHSA-3gm7-v7vw-866c
Summary: XML External Entity (XXE) Injection in Apache Solr
Aliases: CVE-2019-0193
Severity: HIGH
CWE: CWE-94
Published: 2019-08-01T19:17:35Z

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
Vulnerability: GHSA-484q-784p-8m5h
Summary: Cross-site Scripting in keycloak
Aliases: CVE-2020-10776
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T00:58:15Z

A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
Vulnerability: GHSA-rcwj-2hj2-vmjj
Summary: Insufficient Session Expiration in Apache NiFi Registry
Aliases: CVE-2020-9482
Severity: MODERATE
CWE: CWE-613
Published: 2022-02-09T00:23:06Z

If NiFi Registry 0.1.0 to 0.5.0 uses an authentication mechanism other than PKI, when the user clicks Log Out, NiFi Registry invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi Registry.
Vulnerability: GHSA-qrx8-8545-4wg2
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39148
Severity: HIGH
CWE: CWE-502
Published: 2021-08-25T14:47:38Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39148](https://x-stream.github.io/CVE-2021-39148.html).

### Credits
wh1t3p1g from TSRC (Tencent Security Response Center) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-rvjg-gxwx-j5gf
Summary: OIDC Logout redirect in keycloak
Aliases: CVE-2020-10734
Severity: LOW
CWE: CWE-601
Published: 2022-04-28T17:13:58Z

A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability.
Vulnerability: GHSA-25pc-85qf-6j69
Summary: Deserialization of Untrusted Data in Apache Storm
Aliases: CVE-2018-11779
Severity: CRITICAL
CWE: CWE-502
Published: 2019-08-01T19:17:53Z

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.
Vulnerability: GHSA-mm57-9j6q-rxm2
Summary: High severity vulnerability that affects com.typesafe.akka:akka-actor_2.11 and com.typesafe.akka:akka-actor_2.12
Aliases: CVE-2017-1000034
Severity: HIGH
CWE: CWE-502
Published: 2018-10-22T20:52:38Z

Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.
Vulnerability: GHSA-ghgj-3xqr-6jfm
Summary: Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2015-2080
Severity: HIGH
CWE: CWE-200
Published: 2018-11-09T17:50:00Z

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Vulnerability: GHSA-f263-c949-w85g
Summary: Improper Authorization in Google OAuth Client
Aliases: CVE-2020-7692
Severity: HIGH
CWE: CWE-863, CWE-862
Published: 2021-09-28T16:16:52Z

PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
Vulnerability: GHSA-fcrx-8829-jpqx
Summary: Improper Restriction of XML External Entity Reference in wutka jox
Aliases: CVE-2021-43142
Severity: MODERATE
CWE: CWE-611
Published: 2022-04-01T00:00:45Z

An XML External Entity (XXE) vulnerability exists in wutka jox 1.16 in the readObject method in JOXSAXBeanInput.