TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-3x7h-5hfr-hvjm
Summary: Moderate severity vulnerability that affects io.undertow:undertow-core
Aliases: CVE-2017-2670
Severity: MODERATE
CWE: CWE-835
Published: 2018-10-19T16:54:56Z

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.
Vulnerability: GHSA-fmqw-vqh5-cwq9
Summary: Apache NiFi user log out issue
Aliases: CVE-2019-12421
Severity: HIGH
CWE: CWE-613
Published: 2019-12-02T18:19:39Z

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.
Vulnerability: GHSA-f9pg-g9xw-r5g2
Summary: SQL Injection in Jeecg-boot
Aliases: CVE-2022-22881
Severity: CRITICAL
CWE: CWE-89
Published: 2022-02-17T00:00:25Z

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /sys/user/queryUserComponentData.
Vulnerability: GHSA-h8q5-g2cj-qr5h
Summary: Apache Tika is vulnerable to entity expansions which can lead to a denial of service attack
Aliases: CVE-2018-11796
Severity: HIGH
CWE: CWE-611
Published: 2018-10-17T15:43:25Z

In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
Vulnerability: GHSA-3w6p-8f82-gw8r
Summary: Using JMSAppender in log4j configuration may lead to deserialization of untrusted data
Severity: HIGH
CWE: CWE-502
Published: 2021-12-17T20:42:38Z

### Impact

ClickHouse JDBC Bridge uses [slf4j-log4j12 1.7.32](https://repo1.maven.org/maven2/org/slf4j/slf4j-log4j12/1.7.32/), which depends on [log4j 1.2.17](https://repo1.maven.org/maven2/log4j/log4j/1.2.17/). It allows a remote attacker to execute code on the server, if you changed default log4j configuration by adding JMSAppender and an insecure JMS broker.

### Patches

The patch version `2.0.7` removed log4j dependency by replacing `slf4j-log4j12` to `slf4j-jdk14`. Logging configuration is also changed from `log4j.properties` to `logging.properties`.

### Workarounds

1. Do NOT change log4j configuration to use JMSAppender along with insecure JMS broker
2. Alternatively, you can issue below command to remove `JMSAppender.class`:

```(bash)
# install zip command if you don't have
apt-get update && apt-get install -y zip
# remove the class
zip -d clickhouse-jdbc-bridge*.jar ru/yandex/clickhouse/jdbcbridge/internal/log4j/net/JMSAppender.class
```

### References

Please refer to [CVE-2021-4104](https://access.redhat.com/security/cve/CVE-2021-4104) to read more.

### For more information

If you have any questions or comments about this advisory, please feel free to open an issue in the repository.
Vulnerability: GHSA-24ww-mc5x-xc43
Summary: Man-in-the-middle attack in Apache Cassandra
Aliases: CVE-2020-13946
Severity: MODERATE
CWE: CWE-668
Published: 2021-05-07T15:54:46Z

In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle attack and capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and perform unauthorised operations. Users should also be aware of CVE-2019-2684, a JRE vulnerability that enables this issue to be exploited remotely.
Vulnerability: GHSA-767j-jfh2-jvrc
Summary: Potential HTTP request smuggling in Apache Tomcat
Aliases: CVE-2019-17569
Severity: MODERATE
CWE: CWE-444
Published: 2020-02-28T01:10:58Z

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.
Vulnerability: GHSA-v9j2-q4q5-cxh4
Summary: No CSRF protection on the password change form
Aliases: CVE-2021-32730
Severity: MODERATE
CWE: CWE-352
Published: 2021-07-02T19:19:13Z

### Impact
It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki.

### Patches
The problem has been patched in XWiki 12.10.5, 13.2RC1.

### Workarounds
It's possible to apply the patch manually by modifying the `register_macros.vm` template like in https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257.

### References
https://jira.xwiki.org/browse/XWIKI-18315

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Vulnerability: GHSA-6jv7-28mv-qp9c
Summary: Missing permission check in Jenkins autonomiq Plugin
Aliases: CVE-2022-25195
Severity: MODERATE
CWE: CWE-862
Published: 2022-02-16T00:01:23Z

A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Vulnerability: GHSA-2pwh-52h7-7j84
Summary: JavaScript execution via malicious molfiles (XSS)
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-16T19:52:49Z

### Impact
The viewer plugin implementation of `<mol:molecule>` renders molfile data directly inside a `<script>` tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.

### Patches
Patched in v0.3.0: Molfile data is now rendered as value of a hidden `<input>` tag and escaped via JSF's mechanisms.

### Workarounds
No workaround available.
Vulnerability: GHSA-whw7-h25v-9qvx
Summary: Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, and org.apache.cxf.fediz:fediz-spring2
Aliases: CVE-2017-7661
Severity: MODERATE
CWE: CWE-352
Published: 2018-10-18T16:56:38Z

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3, Jetty 8 and Jetty 9 plugins in Apache CXF Fediz prior to 1.4.0, 1.3.2 and 1.2.4.
Vulnerability: GHSA-2xpp-75vr-22vq
Summary: Low severity vulnerability that affects org.apache.nifi:nifi
Aliases: CVE-2018-17192
Severity: MODERATE
CWE: CWE-1021
Published: 2018-12-20T22:02:24Z

The X-Frame-Options headers were applied inconsistently on some HTTP responses, resulting in duplicate or missing security headers. Some browsers would interpret these results incorrectly, allowing clickjacking attacks. Mitigation: The fix to consistently apply the security headers was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Vulnerability: GHSA-q39c-5vh5-vw2p
Summary: Improper Authentication in Apereo CAS
Aliases: CVE-2020-27178
Severity: HIGH
CWE: CWE-287
Published: 2021-08-02T16:47:10Z

Apereo CAS 5.3.x before 5.3.16, 6.x before 6.1.7.2, 6.2.x before 6.2.4, and 6.3.x before 6.3.0-RC4 mishandles secret keys with Google Authenticator for multifactor authentication.
Vulnerability: GHSA-h6qv-f5gf-8gcf
Summary: Missing Authorization in Jenkins P4 plugin
Aliases: CVE-2021-21654
Severity: MODERATE
CWE: CWE-862
Published: 2021-06-16T17:29:35Z

Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.
Vulnerability: GHSA-3rhm-67j6-42jq
Summary: Moderate severity vulnerability that affects com.jason-goodwin:authentikat-jwt_2.12
Aliases: CVE-2017-18239
Severity: CRITICAL
Published: 2018-11-09T17:50:40Z

A time-sensitive equality check on the JWT signature in the JsonWebToken.validate method in main/scala/authentikat/jwt/JsonWebToken.scala in authentikat-jwt (aka com.jason-goodwin/authentikat-jwt) version 0.4.5 and earlier allows the supplier of a JWT token to guess bit after bit of the signature by repeating validation requests.
Vulnerability: GHSA-m59c-jpc8-m2x4
Summary: In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder 
Aliases: CVE-2018-1336
Severity: HIGH
CWE: CWE-835
Published: 2018-10-17T16:32:18Z

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.
Vulnerability: GHSA-jcq3-cprp-m333
Summary: Privilege escalation in mysql-connector-jav
Aliases: CVE-2019-2692
Severity: MODERATE
CWE: CWE-843
Published: 2020-07-01T17:12:20Z

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).
Vulnerability: GHSA-f68h-hfqp-8rmv
Summary: Path Traversal in Crafter CMS Crafter Studio
Aliases: CVE-2017-15684
Severity: HIGH
CWE: CWE-22
Published: 2022-02-09T23:08:03Z

Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
Vulnerability: GHSA-3hrc-f439-727g
Summary: Moderate severity vulnerability that affects org.apache.camel:camel-core
Aliases: CVE-2015-0263
Severity: MODERATE
CWE: CWE-611
Published: 2018-10-16T23:08:43Z

XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.
Vulnerability: GHSA-g99m-3m46-4gm9
Summary: Infinite Loop in Apache Sanselan
Aliases: CVE-2018-17202
Severity: HIGH
CWE: CWE-835
Published: 2019-05-14T04:00:47Z

Certain input files could make the code to enter into an infinite loop when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
Vulnerability: GHSA-3gx9-37ww-9qw6
Summary: Code injection in Spring Cloud Gateway
Aliases: CVE-2022-22947
Severity: CRITICAL
CWE: CWE-94
Published: 2022-03-04T00:00:15Z

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.
Vulnerability: GHSA-5mf7-26mw-3rqr
Summary: Moderate severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-1338
Severity: MODERATE
CWE: CWE-835
Published: 2018-10-17T15:50:45Z

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.
Vulnerability: GHSA-xrr9-rh8p-433v
Summary: Request smuggling is possible when both chunked TE and content length specified
Aliases: CVE-2020-5207
Severity: LOW
CWE: CWE-444
Published: 2020-01-27T19:28:40Z

### Impact
Request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle alone \n as a headers separator.

### Patches
https://github.com/ktorio/ktor/pull/1547

### Workarounds
None except migrating to a better proxy.

### References
https://portswigger.net/web-security/request-smuggling
https://tools.ietf.org/html/rfc7230#section-9.5
Vulnerability: GHSA-338v-3958-8v8r
Summary: Information disclosure in JBoss Weld
Aliases: CVE-2014-8122
Severity: MODERATE
CWE: CWE-362
Published: 2020-06-10T20:54:15Z

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.
Vulnerability: GHSA-7qmg-qg53-mrp8
Summary: Cross-site scripting in Apache JSPWiki
Aliases: CVE-2019-12404
Severity: MODERATE
CWE: CWE-79
Published: 2019-10-11T18:41:59Z

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Vulnerability: GHSA-558x-2xjg-6232
Summary: Allocation of Resources Without Limits or Throttling in Spring Framework
Aliases: CVE-2022-22950
Severity: MODERATE
CWE: CWE-770
Published: 2022-04-03T00:01:00Z

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0 - 5.2.19, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
Vulnerability: GHSA-r8j4-96mx-rjcc
Summary: Improper Restriction of XML External Entity Reference in skylot/jadx
Aliases: CVE-2022-0219
Severity: MODERATE
CWE: CWE-611
Published: 2022-01-21T18:13:42Z

skylot/jadx prior to 1.3.2 is vulnerable to Improper Restriction of XML External Entities when a user is tricked into exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle, leading to possible local file disclosure.
Vulnerability: GHSA-cpcr-74q9-74gp
Summary: Broken Authentication in Atlassian Connect Spring Boot
Aliases: CVE-2021-26074
Severity: MODERATE
CWE: CWE-863, CWE-287
Published: 2021-05-10T15:19:04Z

Broken Authentication in Atlassian Connect Spring Boot (ACSB) from version 1.1.0 before version 2.1.3. Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions between 1.1.0 - 2.1.2 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
Vulnerability: GHSA-869j-5855-hjpm
Summary: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf
Aliases: CVE-2019-0191
Severity: MODERATE
CWE: CWE-22
Published: 2019-03-25T16:16:44Z

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.
Vulnerability: GHSA-xcrm-qpp8-hcw4
Summary: Moderate severity vulnerability that affects org.apache.struts:struts2-rest-plugin
Aliases: CVE-2017-15707
Severity: MODERATE
CWE: CWE-20
Published: 2018-10-16T19:35:55Z

In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated JSON-lib library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted JSON payload.
Vulnerability: GHSA-9295-mhf3-v33m
Summary: Insecure temporary file in Netflix OSS Hollow
Aliases: CVE-2021-28099
Severity: MODERATE
CWE: CWE-377
Published: 2021-03-29T18:25:26Z

> ID: NFLX-2021-001
> Title: Local information disclosure in Hollow
> Release Date: 2021-03-23
> Credit: Security Researcher @JLLeitschuh

# Overview

Security researcher @JLLeitschuh reported that Netflix Hollow (a Netflix OSS project available here: https://github.com/Netflix/hollow) writes to a local temporary directory before validating the permissions on it.

# Impact

An attacker with the ability to create directories and set permissions on the local filesystem could pre-create this directory and read or modify anything written there by the Hollow process.

# Description

Since the `Files.exists(parent)` is run before creating the directories, an attacker can pre-create these directories with wide permissions. Additionally, since an insecure source of randomness is used, the file names to be created can be deterministically calculated.

# Workarounds and Fixes

Avoid running Hollow in configurations that share a filesystem with less-trusted processes. May be fixed in a future release.
Vulnerability: GHSA-jmf4-pq78-f8vj
Summary: Moderate severity vulnerability that affects org.apache.hive:hive-jdbc
Aliases: CVE-2018-1314
Severity: MODERATE
CWE: CWE-862
Published: 2018-11-21T22:24:50Z

In Apache Hive 2.3.3, 3.1.0 and earlier, Hive "EXPLAIN" operation does not check for necessary authorization of involved entities in a query. An unauthorized user can do "EXPLAIN" on arbitrary table or view and expose table metadata and statistics.
Vulnerability: GHSA-fr26-qjc8-mvjx
Summary: Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Severity: MODERATE
Published: 2021-10-13T18:56:12Z

Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided.
Vulnerability: GHSA-rp4x-wxqv-cf9m
Summary: Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Aliases: CVE-2019-25027
Severity: MODERATE
CWE: CWE-79, CWE-81
Published: 2021-04-19T14:52:29Z

Missing output sanitization in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

- https://vaadin.com/security/cve-2019-25027
Vulnerability: GHSA-45xm-v8gq-7jqx
Summary: Excessive memory allocation
Aliases: CVE-2018-12541
Severity: MODERATE
CWE: CWE-119, CWE-789
Published: 2018-10-17T16:19:59Z

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSocket HTTP upgrade implementation buffers the full http request before doing the handshake, holding the entire request body in memory. There should be a reasonnable limit (8192 bytes) above which the WebSocket gets an HTTP response with the 413 status code and the connection gets closed.
Vulnerability: GHSA-jvpp-hxjj-5ccc
Summary: Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ
Aliases: CVE-2015-7559
Severity: MODERATE
CWE: CWE-20, CWE-306
Published: 2019-08-01T19:17:45Z

It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
Vulnerability: GHSA-c9hw-wf7x-jp9j
Summary: Improper Privilege Management in Tomcat
Aliases: CVE-2020-1938
Severity: CRITICAL
CWE: CWE-269
Published: 2020-06-15T18:51:21Z

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: returning arbitrary files from anywhere in the web application, processing any file in the web application as a JSP Further, if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this, along with the ability to process a file as a JSP, made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31, 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31, 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.
Vulnerability: GHSA-j8jw-g6fq-mp7h
Summary: SQL injection in hibernate-core
Aliases: CVE-2020-25638
Severity: HIGH
CWE: CWE-89
Published: 2022-02-09T22:57:29Z

"A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity."
Vulnerability: GHSA-x3rh-m7vp-35f2
Summary: Operation on a Resource after Expiration or Release in Jetty Server
Aliases: CVE-2019-17638
Severity: CRITICAL
CWE: CWE-675, CWE-672
Published: 2020-08-05T14:52:59Z

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with response2 data. Thread1 then proceeds to write the buffer that now contains response2 data. This results in client1, which issued request1 and expects responses, to see response2 which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.).
Vulnerability: GHSA-6h7w-fc84-x7p6
Summary: StaticFile.fromUrl can leak presence of a directory
Aliases: CVE-2021-32643
Severity: MODERATE
CWE: CWE-22
Published: 2021-05-28T15:54:39Z

### Impact

`StaticFile.fromUrl` can leak the presence of a directory on a server when the `URL` scheme is not `file://`, and the URL points to a fetchable resource under its scheme and authority.  The function returns `F[None]`, indicating no resource, if `url.getFile` is a directory, without first checking the scheme or authority of the URL.  If a URL connection to the scheme and URL would return a stream, and the path in the URL exists as a directory on the server, the presence of the directory on the server could be inferred from the 404 response.  The contents and other metadata about the directory are not exposed.

This affects http4s versions:
* 0.21.7 through 0.21.23
* 0.22.0-M1 through 0.22.0-M8
* 0.23.0-M1
* 1.0.0-M1 through 1.0.0-M22

### Patches

The [patch](https://github.com/http4s/http4s/commit/52e1890665410b4385e37b96bc49c5e3c708e4e9) is available in the following versions:

* v0.21.24
* v0.22.0-RC1
* v0.23.0-RC1
* v1.0.0-M23

Note: a previous version of this advisory incorrectly referred to 0.22.0-M9 and 0.23.0-M2.

### Workarounds

Don't call `StaticFile.fromUrl` with non-file URLs.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the http4s repository](https://github.com/http4s/http4s)
* Disclose further vulnerabilities according to the [http4s security policy](https://github.com/http4s/http4s/blob/main/SECURITY.md)
Vulnerability: GHSA-23gj-368h-92pq
Summary: Path Traversal in DKPro Core
Aliases: CVE-2019-11082
Severity: HIGH
CWE: CWE-22
Published: 2019-05-29T18:05:11Z

core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.
Vulnerability: GHSA-gp32-7h29-rpxm
Summary: Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle
Aliases: CVE-2019-9658
Severity: MODERATE
CWE: CWE-611
Published: 2019-03-14T15:39:14Z

Checkstyle prior to 8.18 loads external DTDs by default, which can potentially lead to denial of service attacks or the leaking of confidential information.
Vulnerability: GHSA-phwj-86vx-cfjc
Summary: Cross-site scripting in Apache Jena Fuseki
Aliases: CVE-2021-33192
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-13T15:21:35Z

A vulnerability in the HTML pages of Apache Jena Fuseki allows an attacker to execute arbitrary javascript on certain page views. This issue affects Apache Jena Fuseki from version 2.0.0 to version 4.0.0 (inclusive).
Vulnerability: GHSA-673j-qm5f-xpv8
Summary: Arbitrary File Write Vulnerability
Severity: MODERATE
Published: 2022-02-16T00:08:18Z

### Overview
The connection properties for configuring a pgjdbc connection are not meant to be exposed to an unauthenticated attacker. While allowing an attacker to specify arbitrary connection properties could lead to a compromise of a system, that's a defect of an application that allows unauthenticated attackers that level of control.

It's not the job of the pgjdbc driver to decide whether a given log file location is acceptable. End user applications that use the pgjdbc driver must ensure that filenames are valid and restrict unauthenticated attackers from being able to supply arbitrary values. That's not specific to the pgjdbc driver either, it would be true for any library that can write to the application's local file system.

While we do not consider this a security issue with the driver, we have decided to remove the loggerFile and loggerLevel connection properties in the next release of the driver. Removal of those properties does not make exposing the JDBC URL or connection properties to an attacker safe and we continue to suggest that applications do not allow untrusted users to specify arbitrary connection properties. We are removing them to prevent misuse and their functionality can be delegated to java.util.logging.

If you identify an application that allows remote users to specify a complete JDBC URL or properties without validating it's contents, we encourage you to notify the application owner as that may be a security defect in that specific application.

### Impact
It is possible to specify an arbitrary filename in the loggerFileName connection parameter
"jdbc:postgresql://localhost:5432/test?user=test&password=test&loggerLevel=DEBUG&loggerFile=./blah.jsp&<%Runtime.getRuntime().exec(request.getParameter(\"i\"));%>"

This creates a valid JSP file which could lead to a Remote Code Execution 

### Patches
Problem has been resolved in version 42.3.3

### Workarounds
sanitize the inputs to the driver
Vulnerability: GHSA-2hw2-62cp-p9p7
Summary: Access control bypass in Apache ZooKeeper
Aliases: CVE-2019-0201
Severity: MODERATE
CWE: CWE-862
Published: 2019-05-29T18:54:11Z

An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper?s getACL() command doesn?t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
Vulnerability: GHSA-ghm8-mmx7-xvg2
Summary: Information Exposure in Apache Tapestry
Aliases: CVE-2021-30638
Severity: HIGH
CWE: CWE-200
Published: 2022-03-18T17:53:58Z

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.
Vulnerability: GHSA-hv53-q76c-7f8c
Summary: OS Command Injection in OpenTSDB
Aliases: CVE-2020-35476
Severity: CRITICAL
CWE: CWE-78
Published: 2021-08-02T17:02:21Z

A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
Vulnerability: GHSA-wcp5-m52f-mhh5
Summary: Improper Restriction of XML External Entity Reference in MPXJ
Aliases: CVE-2020-25020
Severity: CRITICAL
CWE: CWE-611
Published: 2021-05-07T15:54:36Z

"MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components."
Vulnerability: GHSA-g973-978j-2c3p
Summary: Denial of Service in SheetJS Pro
Aliases: CVE-2021-32014
Severity: MODERATE
CWE: CWE-345, CWE-400
Published: 2021-07-22T19:47:15Z

SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (CPU consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js.
Vulnerability: GHSA-9xcj-c8cr-8c3c
Summary: In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack
Aliases: CVE-2019-17563
Severity: HIGH
CWE: CWE-384
Published: 2019-12-26T18:22:26Z

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.
Vulnerability: GHSA-qmqc-x3r4-6v39
Summary: Polymorphic deserialization of malicious object in jackson-databind
Aliases: CVE-2019-14893
Severity: HIGH
CWE: CWE-502
Published: 2020-05-15T18:59:07Z

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
Vulnerability: GHSA-p8p6-rcp6-4mrm
Summary: Uncontrolled Recursion in Play Framework
Aliases: CVE-2020-26883
Severity: HIGH
CWE: CWE-674
Published: 2022-02-10T20:23:01Z

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.
Vulnerability: GHSA-xgxp-9x8p-gcw4
Summary: SQL Injection
Aliases: CVE-2020-25695
Severity: HIGH
CWE: CWE-89
Published: 2022-02-15T01:57:18Z

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-93g4-3phc-g4xw
Summary: SQL injection in Apache DolphinScheduler 
Aliases: CVE-2021-27644
Severity: HIGH
CWE: CWE-89
Published: 2021-11-03T17:30:18Z

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center. (Only applicable to MySQL data source with internal login account password)
Vulnerability: GHSA-c99r-67x4-whj6
Summary: Reflected cross-site scripting in development mode handler in Vaadin 14, 15-19
Aliases: CVE-2021-33604
Severity: LOW
CWE: CWE-172
Published: 2021-06-28T16:56:07Z

URL encoding error in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

- https://vaadin.com/security/cve-2021-33604
Vulnerability: GHSA-jmx8-355m-8vwh
Summary: Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Aliases: CVE-2018-25007
Severity: LOW
CWE: CWE-754
Published: 2021-04-19T14:53:09Z

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

- https://vaadin.com/security/cve-2018-25007
Vulnerability: GHSA-qfjv-998w-q48f
Summary: High severity vulnerability that affects org.apache.syncope:syncope-core
Aliases: CVE-2018-17186
Severity: HIGH
CWE: CWE-611
Published: 2018-11-06T23:15:46Z

An administrator with workflow definition entitlements can use DTD to perform malicious operations, including but not limited to file read, file write, and code execution.
Vulnerability: GHSA-g6v7-vqhx-6v6c
Summary: XML External Entity Reference in org.opencms:opencms-core
Aliases: CVE-2021-3312
Severity: MODERATE
CWE: CWE-611
Published: 2021-10-12T17:23:40Z

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Vulnerability: GHSA-gwcr-j4wh-j3cq
Summary: Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability
Aliases: CVE-2021-28169
Severity: MODERATE
CWE: CWE-200
Published: 2021-06-10T15:43:22Z

Requests to the `ConcatServlet` and `WelcomeFilter` are able to access protected resources within the `WEB-INF` directory. For example a request to the `ConcatServlet` with a URI of `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

This occurs because both `ConcatServlet` and `WelcomeFilter` decode the supplied path to verify it is not within the `WEB-INF` or `META-INF` directories. It then uses this decoded path to call `RequestDispatcher` which will also do decoding of the path. This double decoding allows paths with a doubly encoded `WEB-INF` to bypass this security check.

### Impact
This affects all versions of `ConcatServlet` and `WelcomeFilter` in versions before 9.4.41, 10.0.3 and 11.0.3.

### Workarounds

If you cannot update to the latest version of Jetty, you can instead deploy your own version of the [`ConcatServlet`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/ConcatServlet.java) and/or the [`WelcomeFilter`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java) by using the code from the latest version of Jetty.
Vulnerability: GHSA-jwgx-9mmh-684w
Summary: Credential exposure through log files in Undertow
Aliases: CVE-2019-3888
Severity: CRITICAL
CWE: CWE-532
Published: 2019-06-13T20:02:56Z

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)
Vulnerability: GHSA-mr95-9rr4-668f
Summary: High severity vulnerability that affects com.typesafe.akka:akka-actor_2.11 and com.typesafe.akka:akka-actor_2.12
Aliases: CVE-2018-16115
Severity: CRITICAL
CWE: CWE-338
Published: 2018-10-22T20:44:26Z

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. The custom RNG implementations were not configured by default but examples in the documentation showed (and therefore implicitly recommended) using the custom ones. This can be used by an attacker to compromise the communication if these random number generators are enabled in configuration. It would be possible to eavesdrop, replay, or modify the messages sent with Akka Remoting/Cluster.
Vulnerability: GHSA-rfmp-jvr7-hx78
Summary: Inadequate Encryption Strength in Apache NiFi
Aliases: CVE-2020-9491
Severity: HIGH
CWE: CWE-327
Published: 2022-01-06T20:41:06Z

In Apache NiFi 1.2.0 to 1.11.4, the NiFi UI and API were protected by mandating TLS v1.2, as well as listening connections established by processors like ListenHTTP, HandleHttpRequest, etc. However intracluster communication such as cluster request replication, Site-to-Site, and load balanced queues continued to support TLS v1.0 or v1.1.
Vulnerability: GHSA-5hv6-mh8q-q9v8
Summary: RCE in XWiki
Aliases: CVE-2020-15252
Severity: HIGH
CWE: CWE-74, CWE-94
Published: 2020-10-16T16:55:49Z

### Impact

Any user with SCRIPT right (EDIT right before XWiki 7.4) can gain access to the application server Servlet context which contains tools allowing to instantiate arbitrary Java objects and invoke methods that may lead to arbitrary code execution.

### Patches

It has been patched in both version XWiki 12.5 and XWiki 11.10.6.

### Workarounds

The only workaround is to give SCRIPT right only to trusted users.

### References

https://jira.xwiki.org/browse/XWIKI-17423

It's been reported by the GitHub Security Lab under https://jira.xwiki.org/browse/XWIKI-17141.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-vgg8-72f2-qm23
Summary: Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2017-7657
Severity: CRITICAL
CWE: CWE-444, CWE-190
Published: 2018-10-19T16:15:34Z

In Eclipse Jetty, versions 9.2.x and older, 9.3.x, transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Vulnerability: GHSA-4w82-r329-3q67
Summary: Deserialization of Untrusted Data in jackson-databind
Aliases: CVE-2020-8840
Severity: CRITICAL
CWE: CWE-502
Published: 2020-03-04T20:52:14Z

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5 and 2.9.x before 2.9.10.2  lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Vulnerability: GHSA-f26x-pr96-vw86
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-11040
Severity: MODERATE
CWE: CWE-829
Published: 2018-10-16T17:43:45Z

Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for REST controllers and MappingJackson2JsonView for browser requests. Both are not enabled by default in Spring Framework nor Spring Boot, however, when MappingJackson2JsonView is configured in an application, JSONP support is automatically ready to use through the "jsonp" and "callback" JSONP parameters, enabling cross-domain requests.
Vulnerability: GHSA-v7ff-8wcx-gmc5
Summary: Authorization Before Parsing and Canonicalization in jetty
Aliases: CVE-2021-28164
Severity: MODERATE
CWE: CWE-863, CWE-551, CWE-200
Published: 2021-04-06T17:31:01Z

Release 9.4.37 introduced a more precise implementation of [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.3) with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours.   The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain `%2e` or `%2e%2e` segments to access protected resources within the `WEB-INF` directory.  For example a request to `/context/%2e/WEB-INF/web.xml` can retrieve the `web.xml` file.  This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS can be enabled by updating `start.d/http.ini` to include: jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS.
Vulnerability: GHSA-vx6f-6rp6-f2px
Summary: Cross-Site Request Forgery in Jenkins dbCharts Plugin
Aliases: CVE-2022-25205
Severity: HIGH
CWE: CWE-352
Published: 2022-02-16T00:01:17Z

A cross-site request forgery (CSRF) vulnerability in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers to connect to an attacker-specified database via JDBC using attacker-specified credentials and to determine if a class is available in the Jenkins instance.
Vulnerability: GHSA-phg2-9c5g-m4q7
Summary: Low severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2018-17190
Severity: CRITICAL
Published: 2018-11-21T22:19:30Z

In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.

# Mitigation
Enable authentication on any Spark standalone cluster that is not otherwise secured from unwanted access, for example by network-level restrictions. Use spark.authenticate and related security properties described at https://spark.apache.org/docs/latest/security.html
Vulnerability: GHSA-7rp6-w7mg-h8rw
Summary: XML External Entity Reference in Apache Jena
Aliases: CVE-2021-39239
Severity: HIGH
CWE: CWE-611
Published: 2021-09-20T20:22:05Z

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.
Vulnerability: GHSA-7r83-w6r8-fh6w
Summary: Reflected Cross-site Scripting (XSS) in ACS Commons
Aliases: CVE-2021-21043
Severity: MODERATE
CWE: CWE-79, CWE-787
Published: 2021-05-13T22:31:14Z

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly. An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.
Vulnerability: GHSA-567x-m4wm-87v8
Summary: Infinite loop in Apache Tika
Aliases: CVE-2021-28657
Severity: MODERATE
CWE: CWE-400, CWE-835
Published: 2021-05-10T15:23:25Z

A carefully crafted or corrupt file may trigger an infinite loop in Tika's MP3Parser up to and including Tika 1.25. Apache Tika users should upgrade to 1.26 or later.
Vulnerability: GHSA-q2xp-75m7-gv52
Summary: Moderate severity vulnerability that affects net.sf.robocode:robocode.api
Aliases: CVE-2019-10648
Severity: CRITICAL
CWE: CWE-20, CWE-862
Published: 2019-04-02T15:36:49Z

Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
Vulnerability: GHSA-8vmx-qmch-mpqg
Summary: High severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Aliases: CVE-2019-0232
Severity: HIGH
CWE: CWE-78
Published: 2019-04-18T14:27:35Z

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).
Vulnerability: GHSA-2r2v-q399-qq93
Summary: Request injection in Spring Cloud Gateway
Aliases: CVE-2021-22051
Severity: MODERATE
CWE: CWE-863, CWE-352
Published: 2021-11-10T19:45:02Z

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
Vulnerability: GHSA-fm6q-97gw-c4wh
Summary: Secret exposure in Jenkins HashiCorp Vault Plugin
Aliases: CVE-2022-25186
Severity: MODERATE
CWE: CWE-693
Published: 2022-02-16T00:01:28Z

Jenkins HashiCorp Vault Plugin 3.8.0 and earlier implements functionality that allows agent processes to retrieve any Vault secrets for use on the agent, allowing attackers able to control agent processes to obtain Vault secrets for an attacker-specified path and key.