TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4gq5-ch57-c2mg
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-14719
Severity: CRITICAL
CWE: CWE-502
Published: 2019-01-04T19:09:49Z

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Vulnerability: GHSA-fxph-q3j8-mv87
Summary: Deserialization of Untrusted Data in Log4j
Aliases: CVE-2017-5645
Severity: CRITICAL
CWE: CWE-502
Published: 2020-01-06T18:43:38Z

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Vulnerability: GHSA-j4mm-7pj3-jf7v
Summary: HTTP Method Spoofing
Aliases: CVE-2021-43807
Severity: HIGH
CWE: CWE-290
Published: 2021-12-14T21:43:00Z

Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows  attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible.

### Impact

The vulnerability allows attackers to craft links or forms which may change the server state. For example, the following GET request would create a new user:

```sh
% curl -i -u admin:opencast \
  'https://legacy.opencast.org/admin-ng/users/test.json?_method=PUT&username=test&password=attack'
HTTP/2 200
…
```

If an admin is logged in to legacy.opencast.org and accidentally clicks this link, a user will silently be created.


### Patches

This issue is fixed in Opencast 9.10 and 10.0.

### Workarounds

You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case.

### References

- [Fix for 10.0](https://github.com/opencast/opencast/commit/59cb6731067283e54f15462be38b6117d8b9ea8b#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8)
- [Fix for 9.10](https://github.com/opencast/opencast/commit/8f8271e1085f6f8e306c689d6a56b0bb8d076444)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)
Vulnerability: GHSA-h5f5-rj4r-42f6
Summary: Incorrect access control in Neo4j Enterprise Database Server via LDAP authentication
Aliases: CVE-2018-18389
Severity: CRITICAL
CWE: CWE-287
Published: 2018-10-17T17:31:26Z

Due to incorrect access control in Neo4j Enterprise Database Server 3.4.x before 3.4.9, the setting of LDAP for authentication with STARTTLS, and System Account for authorization, allows an attacker to log into the server by sending any valid username with an arbitrary password.
Vulnerability: GHSA-v3xw-c963-f5hc
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11111
Severity: HIGH
CWE: CWE-502
Published: 2020-05-15T18:58:50Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
Vulnerability: GHSA-r86j-2gc6-2cq9
Summary: High severity vulnerability that affects org.apache.hbase:hbase-thrift
Aliases: CVE-2018-8025
Severity: HIGH
CWE: CWE-362
Published: 2018-10-18T18:05:02Z

An issue in Apache HBase affects the optional "Thrift 1" API server when running over HTTP. There is a race-condition which could lead to authenticated sessions being incorrectly applied to users, e.g. one authenticated user would be considered a different user or an unauthenticated user would be treated as an authenticated user. https://issues.apache.org/jira/browse/HBASE-20664 implements a fix for this issue. It has been fixed in versions: 1.2.6.1, 1.3.2.1, 1.4.5, 2.0.1.
Vulnerability: GHSA-7wfc-x4f7-gg2x
Summary: Code injection in Apache Dubbo
Aliases: CVE-2021-30180
Severity: CRITICAL
CWE: CWE-444, CWE-94
Published: 2022-03-18T17:58:01Z

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
Vulnerability: GHSA-g9hh-vvx3-v37v
Summary: Denial of service in HtmlUnit-Neko
Aliases: CVE-2022-28366
Severity: HIGH
Published: 2022-04-23T00:03:04Z

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.
Vulnerability: GHSA-4q98-wr72-h35w
Summary: Improper input validation in Apache Santuario XML Security for Java
Aliases: CVE-2019-12400
Severity: MODERATE
CWE: CWE-20
Published: 2019-08-27T17:41:33Z

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
Vulnerability: GHSA-58pp-9c76-5625
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11112
Severity: HIGH
CWE: CWE-502
Published: 2020-06-10T21:12:41Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
Vulnerability: GHSA-26hm-r6mg-963c
Summary: SQL Injection in JeecgBoot
Aliases: CVE-2021-46089
Severity: CRITICAL
CWE: CWE-89
Published: 2022-01-26T00:01:25Z

In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges. A patch has been released on the repository's `master` branch.
Vulnerability: GHSA-9c8w-jrw3-q2c3
Summary: Cross-site Scripting in OWASP AntiSamy
Aliases: CVE-2021-35043
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-02T16:58:43Z

OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.
Vulnerability: GHSA-5q75-cxcq-wr26
Summary: Low severity vulnerability that affects org.apache.jspwiki:jspwiki-war
Aliases: CVE-2018-20242
Severity: MODERATE
CWE: CWE-79
Published: 2019-02-12T17:26:07Z

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
Vulnerability: GHSA-h4m4-pgp4-whgm
Summary: The reset password form reveal users email address
Aliases: CVE-2021-32731
Severity: MODERATE
CWE: CWE-668, CWE-200
Published: 2021-07-02T19:19:04Z

### Impact
The reset password form reveals the email address of users just by giving their username.

### Patches
The problem has been patched on XWiki 13.2RC1.

### Workarounds
It's possible to manually modify the `resetpasswordinline.vm` to perform the changes made in https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2

### References
https://jira.xwiki.org/browse/XWIKI-18400

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xiwki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-g5mm-vmx4-3rg7
Summary: Improper handling of case sensitivity in Spring Framework
Aliases: CVE-2022-22968
Severity: HIGH
CWE: CWE-178
Published: 2022-04-15T00:00:32Z

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path. Versions 5.3.19 and 5.2.21 contain a patch for this issue.
Vulnerability: GHSA-qhh5-9738-g9mx
Summary: Incorrect Default Permissions in Apache DolphinScheduler
Aliases: CVE-2020-13922
Severity: MODERATE
CWE: CWE-276
Published: 2022-02-09T22:26:32Z

Versions of Apache DolphinScheduler prior to 1.3.2 allowed an ordinary user under any tenant to override another users password through the API interface.
Vulnerability: GHSA-gwrp-pvrq-jmwv
Summary: Path Traversal and Improper Input Validation in Apache Commons IO
Aliases: CVE-2021-29425
Severity: MODERATE
CWE: CWE-20, CWE-22
Published: 2021-04-26T16:04:00Z

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Vulnerability: GHSA-5chj-xprr-7qqx
Summary: Cross-site Scripting in GwtUpload
Aliases: CVE-2020-9447
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-22T16:15:33Z

The file-upload feature in GwtUpload 1.0.3 allows XSS via a crafted filename.
Vulnerability: GHSA-vf7p-j8x6-xvwp
Summary: Incorrect Authorization in Apache Solr
Aliases: CVE-2021-29943
Severity: CRITICAL
CWE: CWE-863
Published: 2021-05-10T15:17:58Z

When using ConfigurableInternodeAuthHadoopPlugin for authentication, Apache Solr versions prior to 8.8.2 would forward/proxy distributed requests using server credentials instead of original client credentials. This would result in incorrect authorization resolution on the receiving hosts.
Vulnerability: GHSA-gc52-xj6p-9pxp
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Aliases: CVE-2019-3868
Severity: MODERATE
CWE: CWE-200
Published: 2019-04-30T15:37:21Z

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.
Vulnerability: GHSA-44cw-p2hm-gpf6
Summary: Disabled Hostname Verification in Opencast
Aliases: CVE-2020-26234
Severity: HIGH
CWE: CWE-297
Published: 2020-12-08T22:37:59Z

Opencast before version 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests.

Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for man-in-the-middle attacks.

### Patches

This problem is fixed in Opencast 7.9 and Opencast 8.9

### Self-Signed Certificates

Please be aware that fixing the problem means that Opencast will not simply accept any self-signed certificates any longer without properly importing them. If you need those, please make sure to import them into the Java key store. Better yet, get a valid certificate e.g. from [Let's Encrypt](https://letsencrypt.org).
Vulnerability: GHSA-42f2-f9vc-6365
Summary: Private key leak in Apache CXF
Aliases: CVE-2019-12423
Severity: HIGH
CWE: CWE-522
Published: 2020-05-22T19:23:04Z

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it is also possible to obtain the keys from a JWK keystore file, by setting the configuration parameter `rs.security.keystore.type` to `jwk`. For this case all keys are returned in this file &quot;as is&quot;, including all private key and secret key credentials. This is an obvious security risk if the user has configured the signature keystore file with private or secret key credentials. From CXF 3.3.5 and 3.2.12, it is mandatory to specify an alias corresponding to the id of the key in the JWK file, and only this key is returned. In addition, any private key information is omitted by default. `oct` keys, which contain secret keys, are not returned at all.
Vulnerability: GHSA-vmm6-w4cf-7f3x
Summary: Authentication Bypass For Endpoints With Anonymous Access in Opencast
Aliases: CVE-2020-5206
Severity: CRITICAL
CWE: CWE-285
Published: 2020-01-30T21:21:30Z

### Impact

Using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access.

This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication.


### Patches

This problem is fixed in Opencast 7.6 and Opencast 8.1


### Workarounds

As a workaround for older, unpatched versions, disabling remember-me cookies in `etc/security/mh_default_org.xml` will mitigate the problem but will obviously also disable this feature without obvious indication. To deactivate this, remove the following line from the security configuration:

```xml
<sec:remember-me … />
```

### References

- [Remember-me cookie in the security configuration file](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336)


### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-9rr6-jpg7-9jg6
Summary: Authentication Bypass by Capture-replay in Apache Spark
Aliases: CVE-2021-38296
Severity: HIGH
CWE: CWE-294
Published: 2022-03-11T00:02:36Z

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later
Vulnerability: GHSA-g5w6-mrj7-75h2
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39141
Severity: HIGH
CWE: CWE-502
Published: 2021-08-25T14:48:31Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39141](https://x-stream.github.io/CVE-2021-39141.html).

### Credits
Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-mm8j-9x84-m9cv
Summary: Arbitrary code injection in json-sanitizer
Aliases: CVE-2021-23899
Severity: CRITICAL
CWE: CWE-611
Published: 2021-06-16T17:34:18Z

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
Vulnerability: GHSA-3357-829x-m9pr
Summary: Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-spring2
Aliases: CVE-2015-5175
Severity: HIGH
CWE: CWE-20
Published: 2018-10-18T16:57:00Z

Application plugins in Apache CXF Fediz before 1.1.3 and 1.2.x before 1.2.1 allow remote attackers to cause a denial of service.
Vulnerability: GHSA-8p8g-f9vg-r7xr
Summary: Moderate severity vulnerability that affects com.squareup.retrofit2:retrofit
Aliases: CVE-2018-1000850
Severity: HIGH
CWE: CWE-22
Published: 2018-12-21T17:48:19Z

Square Retrofit versions from (including) 2.0 to 2.5.0 (excluding) contain a Directory Traversal vulnerability in RequestBuilder class, method addPathParameter. By manipulating the URL an attacker could add or delete resources otherwise unavailable to her. This attack appears to be exploitable via an encoded path parameter on POST, PUT or DELETE request. This vulnerability appears to have been fixed in 2.5.0 and later.
Vulnerability: GHSA-3j6g-hxx5-3q26
Summary: Observable Discrepancy in Apache Kafka
Aliases: CVE-2021-38153
Severity: MODERATE
CWE: CWE-203
Published: 2021-09-23T23:18:58Z

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
Vulnerability: GHSA-hfg5-xpvw-c9x4
Summary: Improper Input Validation in Apache Camel
Aliases: CVE-2020-11971
Severity: HIGH
CWE: CWE-20
Published: 2021-05-21T19:20:30Z

Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel users should upgrade to 3.2.0.
Vulnerability: GHSA-gj76-429m-56wc
Summary: Deserialization of Untrusted Data in Apache Olingo
Aliases: CVE-2019-17556
Severity: CRITICAL
CWE: CWE-502
Published: 2020-02-04T22:38:22Z

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.
Vulnerability: GHSA-h48w-c35p-6m8x
Summary: Out-of-bounds Write in Play Framework
Aliases: CVE-2020-27196
Severity: HIGH
CWE: CWE-787
Published: 2022-02-10T20:23:25Z

An issue was discovered in PlayJava in Play Framework 2.6.0 through 2.8.2. The body parsing of HTTP requests eagerly parses a payload given a Content-Type header. A deep JSON structure sent to a valid POST endpoint (that may or may not expect JSON payloads) causes a StackOverflowError and Denial of Service.
Vulnerability: GHSA-3h2h-xqr2-2jp7
Summary: Cross-site Scripting (XSS) in Apache ActiveMQ Artemis
Aliases: CVE-2020-13932
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-09T22:14:01Z

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.
Vulnerability: GHSA-fxhp-wrw9-3r97
Summary: XML external entity (XXE) injection in Apache Nutch
Aliases: CVE-2021-23901
Severity: CRITICAL
CWE: CWE-611
Published: 2022-03-18T17:46:29Z

An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.  This issue is fixed in Apache Nutch 1.18.
Vulnerability: GHSA-ff2w-cq2g-wv5f
Summary: HTTP Request Smuggling in Netty
Aliases: CVE-2020-7238
Severity: HIGH
CWE: CWE-444
Published: 2020-02-21T18:55:50Z

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.
Vulnerability: GHSA-8786-wg74-f522
Summary: Improper Control of Dynamically-Managed Code Resources in Crafter CMS Crafter Studio
Aliases: CVE-2020-25803
Severity: HIGH
CWE: CWE-913
Published: 2022-02-09T23:07:54Z

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7.
Vulnerability: GHSA-r577-4hq7-73qh
Summary: Remote Code Execution in Apache Dubbo
Aliases: CVE-2021-36162
Severity: HIGH
CWE: CWE-77
Published: 2021-09-08T20:14:24Z

Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
Vulnerability: GHSA-3gg9-f3vh-866f
Summary: Improper Certificate Validation in Graylog
Aliases: CVE-2020-15813
Severity: HIGH
CWE: CWE-295
Published: 2022-02-10T22:39:58Z

Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The connection configuration allows the usage of unencrypted, SSL- or TLS-secured connections. Unfortunately, the Graylog client code (in all versions that support LDAP) does not implement proper certificate validation (regardless of whether the "Allow self-signed certificates" option is used). Therefore, any attacker with the ability to intercept network traffic between a Graylog server and an LDAP server is able to redirect traffic to a different LDAP server (unnoticed by the Graylog server due to the lack of certificate validation), effectively bypassing Graylog's authentication mechanism.
Vulnerability: GHSA-xhw6-hjc9-679m
Summary: Token validation bypass in Pac4j
Aliases: CVE-2021-44878
Severity: HIGH
CWE: CWE-347
Published: 2022-01-08T00:36:05Z

Pac4j v5.1 and earlier allows (by default) clients to accept and successfully validate ID Tokens with "none" algorithm (i.e., tokens with no signature) which is not secure and violates the OpenID Core Specification. The "none" algorithm does not require any signature verification when validating the ID tokens, which allows the attacker to bypass the token validation by injecting a malformed ID token using "none" as the value of "alg" key in the header with an empty signature value.
Vulnerability: GHSA-763g-fqq7-48wg
Summary: XML external entity (XXE) processing ('external-parameter-entities' feature was not fully disabled))
Aliases: CVE-2019-10782
Severity: MODERATE
CWE: CWE-611
Published: 2020-01-31T18:00:07Z

Due to an incomplete fix for [CVE-2019-9658](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9658), checkstyle was still vulnerable to XML External Entity (XXE) Processing.

### Impact

#### User: Build Maintainers

This vulnerability probably doesn't impact Maven/Gradle users as, in most cases, these builds are processing files that are trusted, or pre-vetted by a pull request reviewer before being run on internal CI infrastructure.

#### User: Static Analysis as a Service

If you operate a site/service that parses "untrusted" Checkstyle XML configuration files, you are vulnerable to this and should patch.

Note from the discoverer of the original CVE-2019-9658:

> While looking at a few companies that run Checkstyle/PMD/ect... as a service I notice that it's a common pattern to run the static code analysis tool inside of a Docker container with the following flags:
> ```
> --net=none \
> --privileged=false \
> --cap-drop=ALL
> ```
> Running the analysis in Docker has the advantage that there should be no sensitive local file information that XXE can exfiltrate from the container. Additionally, these flags prevent vulnerabilities in static analysis tools like Checkstyle from being used to exfiltrate data via XXE or to perform SSRF.
> \- [Jonathan Leitschuh](https://twitter.com/jlleitschuh)

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Patched, will be released with version 8.29 at 26 Jan 2020.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No workaround are available

### References

 - [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)
 - GitHub Issue https://github.com/checkstyle/checkstyle/issues/7468

### For more information

If you have any questions or comments about this advisory:
* Open an issue in https://github.com/checkstyle/checkstyle/issues
Vulnerability: GHSA-cjjf-94ff-43w7
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-12022
Severity: HIGH
CWE: CWE-502
Published: 2019-03-25T18:03:09Z

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Vulnerability: GHSA-2363-cqg2-863c
Summary: XML External Entity (XXE) Injection in JDOM
Aliases: CVE-2021-33813
Severity: HIGH
CWE: CWE-611
Published: 2021-07-27T19:02:56Z

An XXE issue in SAXBuilder in JDOM through 2.0.6 allows attackers to cause a denial of service via a crafted HTTP request.  At this time there is not released fixed version of JDOM.  As a workaround, to avoid external entities being expanded, one can call `builder.setExpandEntities(false)` and they won't be expanded.
Vulnerability: GHSA-h2f4-v4c4-6wx4
Summary: Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2018-12545
Severity: HIGH
CWE: CWE-400
Published: 2019-03-28T18:33:38Z

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Vulnerability: GHSA-86fh-j58m-7pf5
Summary: Improper Privilege Management in Apache Ozone
Aliases: CVE-2021-36372
Severity: CRITICAL
CWE: CWE-273
Published: 2021-11-23T17:57:14Z

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
Vulnerability: GHSA-q7pf-qr96-2vq5
Summary: Moderate severity vulnerability that affects io.swagger:swagger-codegen and io.swagger:swagger-parser
Aliases: CVE-2017-1000208
Severity: HIGH
CWE: CWE-502
Published: 2018-10-19T16:46:41Z

A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
Vulnerability: GHSA-g8j8-mgh9-q77p
Summary: File upload leading to RCE in MCMS
Aliases: CVE-2021-46036
Severity: CRITICAL
CWE: CWE-434
Published: 2022-02-19T00:01:25Z

An arbitrary file upload vulnerability in the component /ms/file/uploadTemplate.do of MCMS v5.2.4 allows attackers to execute arbitrary code.
Vulnerability: GHSA-xfv3-rrfm-f2rv
Summary: Information Exposure in Netty
Aliases: CVE-2015-2156
Severity: HIGH
CWE: CWE-20
Published: 2020-06-30T21:01:21Z

Netty before 3.9.8.Final, 3.10.x before 3.10.3.Final, 4.0.x before 4.0.28.Final, and 4.1.x before 4.1.0.Beta5 and Play Framework 2.x before 2.3.9 might allow remote attackers to bypass the httpOnly flag on cookies and obtain sensitive information by leveraging improper validation of cookie name and value characters.
Vulnerability: GHSA-hwpc-8xqv-jvj4
Summary: XStream is vulnerable to a Remote Command Execution attack
Aliases: CVE-2021-21345
Severity: MODERATE
CWE: CWE-94
Published: 2021-03-22T23:28:38Z

### Impact
The vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21345](https://x-stream.github.io/CVE-2021-21345.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-qv32-7r6p-xhhh
Summary: Moderate severity vulnerability that affects com.adobe.xmp:xmpcore
Aliases: CVE-2016-4216
Severity: HIGH
CWE: CWE-611
Published: 2018-10-19T16:39:29Z

XMPCore in Adobe XMP Toolkit for Java before 5.1.3 allows remote attackers to read arbitrary files via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability: GHSA-crv7-7245-f45f
Summary: Improper Handling of Length Parameter Inconsistency in Compress
Aliases: CVE-2021-35516
Severity: HIGH
CWE: CWE-770, CWE-130
Published: 2021-08-02T16:55:15Z

When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Vulnerability: GHSA-7hmh-8gwv-mfvq
Summary: SQL Injection in Kylin
Aliases: CVE-2020-1937
Severity: MODERATE
CWE: CWE-89
Published: 2020-07-27T22:51:47Z

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.
Vulnerability: GHSA-xw4p-crpj-vjx2
Summary: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aliases: CVE-2021-39152
Severity: HIGH
CWE: CWE-502, CWE-918
Published: 2021-08-25T14:46:59Z

### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39152](https://x-stream.github.io/CVE-2021-39152.html).

### Credits
m0d9 of the Security Team of Alibaba Cloud found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-8ffc-79xg-29w8
Summary: Code Injection in Apache Cassandra
Aliases: CVE-2021-44521
Severity: CRITICAL
CWE: CWE-94
Published: 2022-02-12T00:00:48Z

When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
Vulnerability: GHSA-gf7x-2j2x-7f73
Summary: Missing authorization in xwiki-platform
Aliases: CVE-2022-23617
Severity: MODERATE
CWE: CWE-862
Published: 2022-02-09T21:41:46Z

### Impact

Any user with edit right can copy the content of a page it does not have access to by using it as template of a new page.

### Patches

It has been patched in XWiki 13.2CR1 and 12.10.6

### Workarounds

There is no workaround beside patching.

### References

https://jira.xwiki.org/browse/XWIKI-18430

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-pfwp-8pq4-g7pv
Summary: Moderate severity vulnerability that affects com.alipay.sofa:hessian
Aliases: CVE-2019-9212
Severity: CRITICAL
CWE: CWE-502, CWE-184
Published: 2019-03-06T17:36:08Z

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget.
Vulnerability: GHSA-rjmq-6v55-4rjv
Summary: Improper Authorization in org.cometd.oort
Aliases: CVE-2022-24721
Severity: HIGH
CWE: CWE-863
Published: 2022-03-15T19:02:36Z

### Impact
Internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels.
By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other user's (possibly sensitive) data.
By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure.
The issue impacts any version up to 5.0.10, 6.0.5 and 7.0.5.

### Patches
The issue has been fixed in 5.0.11, 6.0.6 and 7.0.6.

### Workarounds
The workaround is to install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.
This workaround could be implemented in any affected version.

### References
cometd/cometd#1146

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@webtide.com](mailto:security@webtide.com)

### Credits
https://www.redteam-pentesting.de/
Vulnerability: GHSA-v33x-prhc-gph5
Summary: Insufficiently Protected Credentials and Improper Authentication in Spring Security
Aliases: CVE-2019-11272
Severity: HIGH
CWE: CWE-522, CWE-287
Published: 2019-06-27T17:24:58Z

Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.
Vulnerability: GHSA-mqvp-7rrg-9jxc
Summary: Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad
Aliases: CVE-2022-26336
Severity: MODERATE
CWE: CWE-770, CWE-20
Published: 2022-03-05T00:00:44Z

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
Vulnerability: GHSA-rc75-cf5c-mxvh
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Aliases: CVE-2019-10755
Severity: MODERATE
CWE: CWE-338
Published: 2019-11-06T17:06:28Z

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Vulnerability: GHSA-2m8h-fgr8-2q9w
Summary: Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized
Aliases: CVE-2016-9878
Severity: HIGH
CWE: CWE-22
Published: 2018-10-04T20:29:55Z

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.
Vulnerability: GHSA-hhh6-cm2m-3fhc
Summary: Allocation of Resources Without Limits or Throttling in iText
Aliases: CVE-2022-24196
Severity: MODERATE
CWE: CWE-770
Published: 2022-02-02T00:01:45Z

iText v7.1.17 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Vulnerability: GHSA-cxfm-5m4g-x7xp
Summary: A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Aliases: CVE-2021-39150
Severity: HIGH
CWE: CWE-502, CWE-918
Published: 2021-08-25T14:47:19Z

### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39150](https://x-stream.github.io/CVE-2021-39150.html).

### Credits
Lai Han of NSFOCUS security team found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-q448-6c3m-cxmj
Summary: Cross-site Scripting in jeecg-boot
Aliases: CVE-2021-44585
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-11T00:01:59Z

jeecg-boot is a code generator. A Cross Site Scripting (XSS) vulnerabilitiy exists in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.
Vulnerability: GHSA-q4rf-3fhx-88pf
Summary: YAML deserialization can run untrusted code
Aliases: CVE-2021-39132
Severity: MODERATE
CWE: CWE-502
Published: 2021-09-01T18:27:01Z

### Impact

An authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition.  An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition.

The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:

* `admin` level access to the `system` resource type

The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: 

* `create` `update` or `admin` level access to a `project_acl` resource
* `create` `update` or `admin` level access to the `system_acl` resource

The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only.

### Patches
Versions 3.4.3, 3.3.14

### Workarounds

Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)

Reporter: Rojan Rijal from Tinder Red Team
Vulnerability: GHSA-m8wh-mqgf-rr8g
Summary: Code injection in Kubernetes Java Client
Aliases: CVE-2021-25738
Severity: MODERATE
CWE: CWE-20
Published: 2021-10-12T17:50:25Z

Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
Vulnerability: GHSA-m6cj-93v6-cvr5
Summary: Infinite loop in junrar
Aliases: CVE-2022-23596
Severity: HIGH
CWE: CWE-400, CWE-835
Published: 2022-02-01T00:47:23Z

### Impact
A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. 

### Patches
The problem is partially patched in 7.4.1

### Workarounds
None

### References

https://github.com/junrar/junrar/issues/73

https://github.com/junrar/junrar/issues/81
Vulnerability: GHSA-m2r5-4w96-qxg5
Summary: Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
Aliases: CVE-2022-24898
Severity: MODERATE
CWE: CWE-611
Published: 2022-04-28T19:31:55Z

### Impact

It's possible in a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service.

For example:

```
{{velocity}}
#set($xml=$services.get('xml'))
#set($xxe_payload = "<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE root[<!ENTITY xxe SYSTEM 'file:///etc/passwd' >]><root><foo>&xxe;</foo></root>")
#set($doc=$xml.parse($xxe_payload))
$xml.serialize($doc)
{{/velocity}}
```

### Patches

The problem has been patched on versions 12.10.10, 13.4.4 and 13.8RC1.

### Workarounds

There's no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

### References

https://jira.xwiki.org/browse/XWIKI-18946

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-v2rg-8cwr-75g8
Summary: Deserializer tampering in Apache Dubbo
Aliases: CVE-2021-25641
Severity: CRITICAL
CWE: CWE-502
Published: 2022-03-18T17:56:08Z

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
Vulnerability: GHSA-cmfg-87vq-g5g4
Summary: Deserialization of untrusted data in FasterXML jackson-databind
Aliases: CVE-2019-12814
Severity: MODERATE
CWE: CWE-502
Published: 2019-07-17T15:26:12Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
Vulnerability: GHSA-qjwc-v72v-fq6r
Summary: HTTP request smuggling in Undertow
Aliases: CVE-2021-20220
Severity: MODERATE
CWE: CWE-444
Published: 2021-06-16T17:47:52Z

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.