TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-pq4w-qm9g-qx68
Summary: Insufficient Nonce Validation in Eclipse Milo Client
Aliases: CVE-2019-19135
Severity: HIGH
CWE: CWE-330, CWE-522
Published: 2020-03-16T22:46:50Z

### Impact
Credential replay affecting those connected to a server when *all 3* of the following conditions are met:
- `SecurityPolicy` is `None`
- using username/password or X509-based authentication
- the server has a defect causing it to send null/empty or zeroed nonces 

### Patches
The problem has been patched in version `0.3.6`. A more relaxed treatment of validation as agreed upon by the OPC UA Security Working Group is implemented in version `0.3.7`.

### Workarounds
Do not use username/password or X509-based authentication with `SecurityPolicy` of `None`.

### References
https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf

### For more information
If you have any questions or comments about this advisory:
* Open an issue at [https://github.com/eclipse/milo/issues](https://github.com/eclipse/milo/issues)
* Email [the mailing list](mailto:milo-dev@eclipse.org)
Vulnerability: GHSA-q66c-h853-gqw2
Summary: AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication
Aliases: CVE-2016-4432
Severity: CRITICAL
CWE: CWE-287
Published: 2018-10-16T19:49:48Z

The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
Vulnerability: GHSA-g4cp-h53p-v3v8
Summary: Allocation of Resources Without Limits or Throttling in Undertow
Aliases: CVE-2020-10705
Severity: HIGH
CWE: CWE-770
Published: 2021-04-30T17:28:42Z

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.
Vulnerability: GHSA-89gc-6cw6-4vch
Summary: Spark allows remote attackers to read arbitrary files via a .. (dot dot) in the URI
Aliases: CVE-2016-9177
Severity: HIGH
CWE: CWE-22
Published: 2018-10-04T19:53:35Z

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
Vulnerability: GHSA-4qq9-rrq6-48ff
Summary: Moderate severity vulnerability that affects org.apache.nifi:nifi
Aliases: CVE-2018-17193
Severity: MODERATE
CWE: CWE-79
Published: 2018-12-20T22:02:39Z

The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization, resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Vulnerability: GHSA-2fqw-684c-pvp7
Summary: An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
Aliases: CVE-2020-35213
Severity: HIGH
CWE: CWE-74
Published: 2021-12-17T20:40:50Z

An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
Vulnerability: GHSA-j239-4gqg-5j54
Summary: Inadequate Encryption Strength
Aliases: CVE-2017-1000486
Severity: CRITICAL
CWE: CWE-326
Published: 2021-06-03T19:22:22Z

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution
Vulnerability: GHSA-c8xf-m4ff-jcxj
Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Aliases: CVE-2016-1000339
Severity: MODERATE
Published: 2018-10-17T16:23:38Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
Vulnerability: GHSA-9f3j-pm6f-9fm5
Summary: Race condition in Apache Tomcat
Aliases: CVE-2022-23181
Severity: HIGH
CWE: CWE-367
Published: 2022-02-01T00:45:44Z

The fix for bug CVE-2020-9484 introduced a time of check time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
Vulnerability: GHSA-g5wh-fw4m-2v28
Summary: CSRF vulnerability in Jenkins autonomiq plugin
Aliases: CVE-2022-25194
Severity: HIGH
CWE: CWE-352
Published: 2022-02-16T00:01:23Z

A cross-site request forgery (CSRF) vulnerability in Jenkins autonomiq Plugin 1.15 and earlier allows attackers to connect to an attacker-specified URL server using attacker-specified credentials.
Vulnerability: GHSA-8h77-3xwr-hqhh
Summary: Cross-site scripting in Jenkins Kiuwan Plugin
Aliases: CVE-2021-21666
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-16T17:10:50Z

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
Vulnerability: GHSA-cp67-8w3w-6h9c
Summary: Path Traversal
Aliases: CVE-2020-14366
Severity: HIGH
CWE: CWE-22
Published: 2022-02-09T00:58:03Z

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw
Vulnerability: GHSA-rhg5-fqr3-hrf5
Summary: Injection in DeltaSpike
Aliases: CVE-2019-12416
Severity: MODERATE
CWE: CWE-74
Published: 2022-02-10T20:54:31Z

we got reports for 2 injection attacks against the DeltaSpike windowhandler.js. This is only active if a developer selected the ClientSideWindowStrategy which is not the default.
Vulnerability: GHSA-2mp8-qvqm-3xwq
Summary: Restlet Framework, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request
Aliases: CVE-2017-14868
Severity: HIGH
CWE: CWE-611
Published: 2018-10-17T00:04:31Z

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.
Vulnerability: GHSA-vx85-mj8c-4qm6
Summary: Moderate severity vulnerability that affects org.apache.thrift:libthrift
Aliases: CVE-2018-11798
Severity: MODERATE
CWE: CWE-538
Published: 2019-01-17T13:56:33Z

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.
Vulnerability: GHSA-f3j5-rmmp-3fc5
Summary: Improper Input Validation in jackson-databind
Aliases: CVE-2019-17267
Severity: CRITICAL
CWE: CWE-502
Published: 2020-06-15T18:44:48Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Vulnerability: GHSA-59g9-7gfx-c72p
Summary: Infinite loop in Tomcat due to parsing error
Aliases: CVE-2021-41079
Severity: HIGH
CWE: CWE-20
Published: 2021-09-20T20:45:44Z

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Vulnerability: GHSA-42j4-733x-5vcf
Summary: Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7
Aliases: CVE-2020-36320
Severity: HIGH
CWE: CWE-400
Published: 2021-04-19T14:49:32Z

Unsafe validation RegEx in `EmailValidator` class in `com.vaadin:vaadin-server` versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

- https://vaadin.com/security/cve-2020-36320
Vulnerability: GHSA-p5pg-wm9q-8v6r
Summary: Improper Handling of Exceptional Conditions inn metadata-extractor
Aliases: CVE-2022-24613
Severity: MODERATE
CWE: CWE-755
Published: 2022-02-25T00:01:05Z

metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.
Vulnerability: GHSA-cq9c-55r7-455x
Summary: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Aliases: CVE-2018-11787
Severity: HIGH
CWE: CWE-287
Published: 2019-01-07T19:14:51Z

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised.
Vulnerability: GHSA-729f-wvj3-c4pj
Summary: Remote code execution in UReport
Aliases: CVE-2020-21125
Severity: HIGH
CWE: CWE-22
Published: 2021-09-20T20:45:03Z

An arbitrary file creation vulnerability in UReport 2.2.9 allows attackers to execute arbitrary code.
Vulnerability: GHSA-g86w-v5vg-9gxf
Summary: Directory traversal attack in Spring Cloud Config
Aliases: CVE-2020-5405
Severity: MODERATE
CWE: CWE-22, CWE-23
Published: 2020-06-05T16:11:36Z

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
Vulnerability: GHSA-xwgq-pcqx-hpmv
Summary: URL Redirection to Untrusted Site (Open Redirect) in Ktor
Aliases: CVE-2019-19703
Severity: MODERATE
CWE: CWE-601
Published: 2020-02-12T18:45:50Z

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.
Vulnerability: GHSA-8rx6-v5q4-xw3j
Summary: XML External Entity Reference in Jenkins Coverage/Complexity Scatter Plot Plugin
Aliases: CVE-2022-28154
Severity: HIGH
CWE: CWE-611
Published: 2022-03-30T00:00:23Z

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-rcj2-vvjx-87pm
Summary: Missing Encryption of Sensitive Data in arrow-kt Arrow
Aliases: CVE-2019-11404
Severity: MODERATE
CWE: CWE-311
Published: 2019-04-22T17:15:40Z

arrow-kt Arrow before 0.9.0 resolved Gradle build artifacts (for compiling and building the published JARs) over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by an MITM attack.
Vulnerability: GHSA-6hgm-866r-3cjv
Summary: Insecure Deserialization in Apache Commons Collection
Aliases: CVE-2015-6420
Severity: HIGH
Published: 2020-06-15T20:36:20Z

Serialized-object interfaces in Java applications using the Apache Commons Collections (ACC) library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object.
Vulnerability: GHSA-wc4x-4gm2-74j8
Summary: Improper Certificate Validation in Apache Geode
Aliases: CVE-2019-10091
Severity: MODERATE
CWE: CWE-295
Published: 2022-02-10T20:51:04Z

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.
Vulnerability: GHSA-32xf-jwmv-9hf3
Summary: Directory traversal attack in Spring Cloud Config
Aliases: CVE-2020-5410
Severity: MODERATE
CWE: CWE-23
Published: 2020-06-05T16:13:20Z

Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
Vulnerability: GHSA-gggp-gh2p-996x
Summary: Path Traversal in LemMinX
Aliases: CVE-2022-0673
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-19T00:01:27Z

A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files is possible due to directory traversal.
Vulnerability: GHSA-f94m-mqhr-mc29
Summary: Moderate severity vulnerability that affects io.spray:spray-json_2.10, io.spray:spray-json_2.11, and io.spray:spray-json_2.12
Aliases: CVE-2018-18853
Severity: HIGH
CWE: CWE-400
Published: 2018-11-09T17:42:26Z

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.
Vulnerability: GHSA-64x2-gq24-75pv
Summary: Cross-site scripting in Apache CXF
Aliases: CVE-2020-13954
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-22T16:15:23Z

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Vulnerability: GHSA-m72m-mhq2-9p6c
Summary: Uncaught Exception in jsoup
Aliases: CVE-2021-37714
Severity: HIGH
CWE: CWE-835, CWE-248
Published: 2021-08-23T19:42:38Z

### Impact
_What kind of vulnerability is it? Who is impacted?_
Those using jsoup to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to jsoup 1.14.2

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Users may rate limit input parsing. Users should limit the size of inputs based on system resources. Users should implement thread watchdogs to cap and timeout parse runtimes.
Vulnerability: GHSA-cfw5-v7cw-69cw
Summary: Critical severity vulnerability that affects org.apache.directory.api:apache-ldap-api
Aliases: CVE-2018-1337
Severity: CRITICAL
CWE: CWE-200
Published: 2018-11-09T17:49:49Z

In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
Vulnerability: GHSA-vf77-8h7g-gghp
Summary: Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
Aliases: CVE-2020-13934
Severity: HIGH
CWE: CWE-119, CWE-476
Published: 2022-02-08T22:05:00Z

An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
Vulnerability: GHSA-52vv-3vf7-f7wh
Summary: Server-Side Request Forgery and Uncontrolled Resource Consumption in LemMinX
Aliases: CVE-2022-0671
Severity: CRITICAL
CWE: CWE-918, CWE-400
Published: 2022-02-19T00:01:28Z

A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.
Vulnerability: GHSA-q4hg-rmq2-52q9
Summary: Improper Locking in Apache Tomcat
Aliases: CVE-2019-10072
Severity: MODERATE
CWE: CWE-667
Published: 2019-06-26T01:09:40Z

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Vulnerability: GHSA-5679-7qrc-5m7j
Summary: IDOR can reveal execution data and logs to unauthorized user in Rundeck
Aliases: CVE-2020-11009
Severity: MODERATE
CWE: CWE-200, CWE-639
Published: 2020-04-29T16:31:12Z

### Impact

Authenticated users can craft a request that reveals Execution data and logs  and Job details that they are not authorized to see.

> Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher.

### Details

An authenticated user could craft a request to:

* View Executions and download execution logs without access to `read` or `view` the associated Job, or ad-hoc resource.
* Get the list of running executions in a project, without Event `read` access, if they have `read` access to view the project.
* View the Options definitions of a Job without access to view the Job.
* View the definition of a workflow step of a Job without access to view the Job.
* View the SCM diff of a modified Job definition if SCM is enabled, without Project `export` access level.
* View the New User Profile Form for a different username, without User `admin` access. Note: they would not be allowed to create or modify a profile for a different user, or reveal any user profile information for a different user.

Some authenticated API requests were not correctly checking appropriate authorization levels:

* The list of running Executions would be sent without `read` access to Events.
* The Plugin Input Parameters for a SCM plugin would be sent without authorization for project `import`,`scm_import`,`export`, or `scm_export` actions.
* Job Retry action could retry an execution without `read` or `view` access to the Execution, which would reveal the Execution's option values. (`run` access to the Job was still required).

### Patches
Upgrade to Rundeck version 3.2.6

### Workarounds
None

### References
[3.2.6 Release Notes](https://docs.rundeck.com/docs/history/3_2_x/version-3.2.6.html)

### Report
If you have any questions or comments about this advisory:
* Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [http://rundeck.com/security](http://rundeck.com/security)

Reporter: Justine Osborne of Apple Information Security
Vulnerability: GHSA-xwx6-vmj4-5rv8
Summary: Denial of service via deserialization attack in nifi
Aliases: CVE-2017-15703
Severity: MODERATE
CWE: CWE-502
Published: 2019-10-25T19:42:50Z

A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.
Vulnerability: GHSA-7wq4-89xx-g62j
Summary: Password exposure in ShenYu
Aliases: CVE-2022-23223
Severity: HIGH
CWE: CWE-522
Published: 2022-01-28T22:13:57Z

The HTTP response will disclose the user password. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Vulnerability: GHSA-2p6p-v69p-9mm9
Summary: XSS in login form
Aliases: CVE-2019-13235
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-12T22:58:16Z

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
Vulnerability: GHSA-9rgv-h7x4-qw8g
Summary: Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2018-12536
Severity: MODERATE
CWE: CWE-209
Published: 2018-10-19T16:15:56Z

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
Vulnerability: GHSA-hwvv-438r-mhvj
Summary: Exposure of Sensitive Information to an Unauthorized Actor
Aliases: CVE-2021-22134
Severity: MODERATE
CWE: CWE-200
Published: 2021-03-18T19:23:57Z

A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.
Vulnerability: GHSA-ccjp-w723-2jf2
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2015-3271
Severity: MODERATE
CWE: CWE-200
Published: 2018-10-17T15:44:10Z

Apache Tika server (aka tika-server) in Apache Tika 1.9 might allow remote attackers to read arbitrary files via the HTTP fileUrl header.
Vulnerability: GHSA-v83p-xwm9-v4g8
Summary: Injection in Apache Archiva
Aliases: CVE-2020-9495
Severity: MODERATE
CWE: CWE-74
Published: 2022-02-10T23:06:22Z

Apache Archiva login service before 2.2.5 is vulnerable to LDAP injection. A attacker is able to retrieve user attribute data from the connected LDAP server by providing special values to the login form. With certain characters it is possible to modify the LDAP filter used to query the LDAP users. By measuring the response time for the login request, arbitrary attribute data can be retrieved from LDAP user objects.
Vulnerability: GHSA-8gw6-w5rw-4g5c
Summary: Incorrect Default Permissions in Apache JSPWiki
Aliases: CVE-2021-44140
Severity: CRITICAL
CWE: CWE-276
Published: 2021-11-29T17:59:24Z

Remote attackers may delete arbitrary files in a system hosting a JSPWiki instance, versions up to 2.11.0.M8, by using a carefuly crafted http request on logout, given that those files are reachable to the user running the JSPWiki instance. Apache JSPWiki users should upgrade to 2.11.0 or later.
Vulnerability: GHSA-xpmx-h7xq-xffh
Summary: Potential access control security issue in apollo-adminservice
Aliases: CVE-2020-15170
Severity: HIGH
CWE: CWE-20
Published: 2020-10-02T16:33:41Z

### Impact
If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have built-in access control. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations.

### Patches
Access control for admin service was added in #3233 and was released in [v1.7.1](https://github.com/ctripcorp/apollo/releases/tag/v1.7.1).

### Workarounds
To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.

### Credits
[Lexu](https://github.com/lllllx) reported the issue and provided the required information to reproduce it.

### References
[Apollo Security Guidence](https://github.com/ctripcorp/apollo/wiki/Apollo%E4%BD%BF%E7%94%A8%E6%8C%87%E5%8D%97#71-%E5%AE%89%E5%85%A8%E7%9B%B8%E5%85%B3)

### For more information
If you have any questions or comments about this advisory:
* Open an [issue](https://github.com/ctripcorp/apollo/issues)
* Email to one of the active [project maintainers](https://github.com/ctripcorp/apollo/graphs/contributors)
Vulnerability: GHSA-fqgw-6qj5-8hmp
Summary: Infinite Loop in Apache James
Aliases: CVE-2021-40111
Severity: MODERATE
CWE: CWE-835
Published: 2022-01-08T00:40:37Z

In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite loops resulting in expensive CPU computations and OutOfMemory exceptions. This can be used for a Denial Of Service attack. The IMAP user needs to be authenticated to exploit this vulnerability. This affected Apache James prior to version 3.6.1. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade.
Vulnerability: GHSA-mj8x-cpr8-x39h
Summary: Remote code execution in Apache Tapestry
Aliases: CVE-2021-27850
Severity: CRITICAL
CWE: CWE-502, CWE-922
Published: 2021-06-16T17:33:19Z

A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.2, upgrade to 5.6.3 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.
Vulnerability: GHSA-77hp-pfxw-4w63
Summary: Moderate severity vulnerability that affects org.codelibs.fess:fess
Aliases: CVE-2018-1000822
Severity: CRITICAL
CWE: CWE-611
Published: 2018-12-20T22:02:09Z

codelibs fess version before commit faa265b contains a XML External Entity (XXE) vulnerability in GSA XML file parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via specially crafted GSA XML files. This vulnerability appears to have been fixed in after commit faa265b.
Vulnerability: GHSA-j84c-j8qm-g47r
Summary: The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password
Aliases: CVE-2016-0733
Severity: CRITICAL
CWE: CWE-287
Published: 2018-10-17T17:21:11Z

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password, which allows remote attackers to bypass authentication by leveraging knowledge of a valid username.
Vulnerability: GHSA-wph7-x527-w3h5
Summary: Missing Release of Resource after Effective Lifetime in Apache Tomcat
Aliases: CVE-2021-42340
Severity: HIGH
CWE: CWE-772
Published: 2021-10-15T18:51:34Z

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
Vulnerability: GHSA-6w62-hx7r-mw68
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39154
Severity: HIGH
CWE: CWE-502, CWE-434
Published: 2021-08-25T14:46:38Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39154](https://x-stream.github.io/CVE-2021-39154.html).

### Credits
ka1n4t found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-4jf5-jggp-g56j
Summary: Cross-Site Request Forgery in com.softwaremill.akka-http-session:core_2.12
Aliases: CVE-2020-28452
Severity: HIGH
CWE: CWE-352
Published: 2022-01-06T20:23:05Z

This affects the package com.softwaremill.akka-http-session:core_2.12 from 0 and before 0.6.1; all versions of package com.softwaremill.akka-http-session:core_2.11; the package com.softwaremill.akka-http-session:core_2.13 from 0 and before 0.6.1. CSRF protection can be bypassed by forging a request that contains the same value for both the X-XSRF-TOKEN header and the XSRF-TOKEN cookie value, as the check in randomTokenCsrfProtection only checks that the two values are equal and non-empty.
Vulnerability: GHSA-94qw-r73x-j7hg
Summary: Users with ROLE_COURSE_ADMIN can create new users in Opencast
Aliases: CVE-2020-5231
Severity: MODERATE
CWE: CWE-285
Published: 2020-01-30T21:21:37Z

### Impact

Users with the role `ROLE_COURSE_ADMIN` can use the user-utils endpoint to create new users not including the role `ROLE_ADMIN`. For example:

```bash
# Use the admin to create a new user with ROLE_COURSE_ADMIN using the admin user.
# We expect this to work.
% curl -i -u admin:opencast 'https://example.opencast.org/user-utils/xy.json' -X PUT \
  --data 'password=f&roles=%5B%22ROLE_COURSE_ADMIN%22%5D'
HTTP/2 201

# Use the new user to create more new users.
# We don't expüect a user with just role ROLE_COURSE_ADMIN to succeed.
# But it does work
% curl -i -u xy:f 'https://example.opencast.org/user-utils/ab.json' -X PUT \
  --data 'password=f&roles=%5B%22ROLE_COURSE_ADMIN%22%5D'
HTTP/2 201
```
`ROLE_COURSE_ADMIN` is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this role allows user creation.

### Patches

This issue is fixed in 7.6 and 8.1 which both ship a new default security configuration.

### Workarounds

You can fix this issue by removing all instances of `ROLE_COURSE_ADMIN` in your organization's security configuration (`etc/security/mh_default_org.xml` by default).

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-pfj3-56hm-jwq5
Summary: Template injection in cron-utils
Aliases: CVE-2020-26238
Severity: CRITICAL
CWE: CWE-74
Published: 2020-11-24T23:48:38Z

### Impact
A Template Injection was identified in cron-utils enabling attackers to inject arbitrary Java EL expressions, leading to unauthenticated Remote Code Execution (RCE) vulnerability. Versions up to 9.1.2 are susceptible to this vulnerability. Please note, that only projects using the @Cron annotation to validate untrusted Cron expressions are affected.

### Patches
The issue was patched and a new version released. Please upgrade to version 9.1.3.

### Workarounds
There are no known workarounds up to this moment.

### References
A description of the issue is provided in [issue 461](https://github.com/jmrozanec/cron-utils/issues/461)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [cron-utils Github repository](https://github.com/jmrozanec/cron-utils)
Vulnerability: GHSA-rhcw-wjcm-9h6g
Summary: Denial of service in Undertow
Aliases: CVE-2020-27782
Severity: HIGH
CWE: CWE-400
Published: 2022-02-09T00:54:12Z

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.
Vulnerability: GHSA-3c7p-vv5r-cmr5
Summary: Incorrect Authorization in Apache Solr
Aliases: CVE-2020-13957
Severity: CRITICAL
CWE: CWE-863
Published: 2022-02-10T00:31:27Z

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
Vulnerability: GHSA-7hfm-57qf-j43q
Summary: Excessive Iteration in Compress
Aliases: CVE-2021-35515
Severity: HIGH
CWE: CWE-835, CWE-834
Published: 2021-08-02T16:55:07Z

When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.
Vulnerability: GHSA-54g4-5cf6-hjp3
Summary: Exposure of Sensitive Information to an Unauthorized Actor and Observable Timing Discrepancy in Apache Hive
Aliases: CVE-2020-1926
Severity: MODERATE
CWE: CWE-200, CWE-208
Published: 2022-02-09T00:48:54Z

Apache Hive cookie signature verification used a non constant time comparison which is known to be vulnerable to timing attacks. This could allow recovery of another users cookie signature. The issue was addressed in Apache Hive 2.3.8
Vulnerability: GHSA-5v34-g2px-j4fw
Summary: Improper Handling of Length Parameter Inconsistency in Apache Ant
Aliases: CVE-2021-36374
Severity: MODERATE
CWE: CWE-130
Published: 2021-08-02T16:56:31Z

When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Vulnerability: GHSA-rvh4-g2rj-hr9c
Summary: Path Traversal in Jenkins Warnings Next Generation Plugin
Aliases: CVE-2022-23107
Severity: HIGH
CWE: CWE-22
Published: 2022-01-21T23:38:05Z

Jenkins Warnings Next Generation Plugin 9.10.2 and earlier does not restrict the name of a file when configuring custom ID, allowing attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system.
Vulnerability: GHSA-7qx4-pp76-vrqh
Summary: Remote code execution in Apache Commons Configuration
Aliases: CVE-2020-1953
Severity: CRITICAL
CWE: CWE-20
Published: 2020-05-21T19:08:08Z

Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
Vulnerability: GHSA-xmvg-w4f9-99r7
Summary: Moderate severity vulnerability that affects org.bedework.caleng:bw-calendar-engine
Aliases: CVE-2018-1000836
Severity: CRITICAL
CWE: CWE-611
Published: 2018-12-20T22:02:51Z

bw-calendar-engine version <= bw-calendar-engine-3.12.0 contains a XML External Entity (XXE) vulnerability in IscheduleClient XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This attack appear to be exploitable via Man in the Middle or malicious server.
Vulnerability: GHSA-3h68-wvv6-8r5h
Summary: Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak
Aliases: CVE-2020-1940
Severity: HIGH
CWE: CWE-200, CWE-212
Published: 2021-12-10T17:20:11Z

The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed.
Vulnerability: GHSA-m738-3rc4-5xv3
Summary: A user without PR can reset user authentication failures information
Aliases: CVE-2021-32729
Severity: LOW
CWE: CWE-693, CWE-287
Published: 2021-07-02T19:19:31Z

### Impact
The script service method used to reset the authentication failures record can be executed by any user with Script rights and does not require Programming rights as it should have.
Note that being able to reset the authentication failure record mean that an attacker with script right might use it to try performing a bruteforce attack since she'd been able to virtually deactivate the mechanism introduced to mitigate those attacks.

### Patches
The problem has been patched in version 12.6.8, 12.10.4 and 13.0.

### Workarounds
There's no workaround besides upgrading and being careful on which user should have Script right access. Note that any bruteforce attack on the authentication should be visible in the logs since the authentication failures are logged.

### References
https://jira.xwiki.org/browse/XWIKI-18276

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [the security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-gc37-9g7f-96fx
Summary: Exposure of sensitive information in Apache Ozone
Aliases: CVE-2021-41532
Severity: MODERATE
CWE: CWE-668
Published: 2021-11-23T18:17:50Z

In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
Vulnerability: GHSA-8grg-q944-cch5
Summary: SQL Injection in Hibernate ORM
Aliases: CVE-2019-14900
Severity: MODERATE
CWE: CWE-89
Published: 2022-02-10T23:05:04Z

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
Vulnerability: GHSA-2q8x-2p7f-574v
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39153
Severity: HIGH
CWE: CWE-502
Published: 2021-08-25T14:46:49Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream, if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39153](https://x-stream.github.io/CVE-2021-39153.html).

### Credits
Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-hp5x-rqf7-43vf
Summary: Improper Handling of Exceptional Conditions and Improper Input Validation in Reactor Netty
Aliases: CVE-2020-5403
Severity: MODERATE
CWE: CWE-755, CWE-20
Published: 2022-02-10T20:24:21Z

Reactor Netty HttpServer, versions 0.9.3 and 0.9.4, is exposed to a URISyntaxException that causes the connection to be closed prematurely instead of producing a 400 response.
Vulnerability: GHSA-59jw-jqf4-3wq3
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21344
Severity: MODERATE
CWE: CWE-502, CWE-434
Published: 2021-03-22T23:28:23Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21344](https://x-stream.github.io/CVE-2021-21344.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-2cfc-865j-gm4w
Summary: XML External Entity Reference in detekt
Aliases: CVE-2022-0272
Severity: HIGH
CWE: CWE-611
Published: 2022-04-22T00:00:36Z

Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
Vulnerability: GHSA-7fm6-2qw4-g3x3
Summary: High severity vulnerability that affects ro.pippo:pippo-core
Aliases: CVE-2018-18628
Severity: CRITICAL
CWE: CWE-502
Published: 2018-10-24T19:46:20Z

An issue was discovered in Pippo 1.11.0. The function SerializationSessionDataTranscoder.decode() calls ObjectInputStream.readObject() to deserialize a SessionData object without checking the object types. An attacker can create a malicious object, base64 encode it, and place it in the PIPPO_SESSION field of a cookie. Sending this cookie may lead to remote code execution.
Vulnerability: GHSA-63qc-p2x4-9fgf
Summary: Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library
Aliases: CVE-2019-11777
Severity: MODERATE
CWE: CWE-755, CWE-346
Published: 2019-09-17T22:47:11Z

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.
Vulnerability: GHSA-9h9c-f287-c6vp
Summary: High severity vulnerability that affects org.apache.syncope:syncope-core
Aliases: CVE-2018-17184
Severity: MODERATE
CWE: CWE-799
Published: 2018-11-06T23:16:18Z

A malicious user with enough administration entitlements can inject html-like elements containing JavaScript statements into Connector names, Report names, AnyTypeClass keys and Policy descriptions. When another user with enough administration entitlements edits one of the Entities above via Admin Console, the injected JavaScript code is executed.
Vulnerability: GHSA-6jmm-mp6w-4rrg
Summary: OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser
Aliases: CVE-2022-29546
Severity: MODERATE
CWE: CWE-400
Published: 2022-04-26T21:14:57Z

### Impact
NekoHtml Parser suffers from a denial of service vulnerability on versions 2.60.0 and below. A specifically crafted input regarding the parsing of processing instructions leads to heap memory consumption. Please update to version 2.61.0.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/HtmlUnit/htmlunit-neko](https://github.com/HtmlUnit/htmlunit-neko)
* Email us at [rbri at rbri.de]
Vulnerability: GHSA-gprm-xqrc-c2j3
Summary: Command Injection in Kylin
Aliases: CVE-2020-1956
Severity: HIGH
CWE: CWE-78
Published: 2020-07-27T22:51:44Z

Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Vulnerability: GHSA-hx5g-8hq2-8x4w
Summary: SQL Injection in Kylin
Aliases: CVE-2020-13926
Severity: CRITICAL
CWE: CWE-89
Published: 2020-07-27T22:51:40Z

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.
Vulnerability: GHSA-gf2v-9hp6-44qg
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2016-3083
Severity: HIGH
CWE: CWE-295
Published: 2019-03-14T15:40:32Z

Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.