TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-6f54-3qr9-pjgj
Summary: Unauthenticated Access Via OAI-PMH
Aliases: CVE-2020-5228
Severity: HIGH
CWE: CWE-862
Published: 2020-01-30T21:22:06Z

### Impact

Media publication via OAI-PMH allows unauthenticated public access to all media and metadata by default. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge.


### Patches

The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to require users with `ROLE_ADMIN` by default. In addition to this, Opencast 9 removes the OAI-PMH publication from the default workflow, making the publication a conscious decision users have to make by updating their workflows.

### Workarounds

In the organization security configuration (`etc/security/mh_default_org.xml`), change the roles required for accessing `/oaipmh` from `ROLE_ANONYMOUS` to `ROLE_ADMIN`.

### References

- [Public access configuration in the organization's security configuration](https://github.com/opencast/opencast/blob/1fb812c7810c78f09f29a7f455ff920417924307/etc/security/mh_default_org.xml#L271-L276)

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-jwqm-c9f2-2cq3
Summary: Cleartext Transmission of Sensitive Information, Inclusion of Functionality from Untrusted Control Sphere , and Download of Code Without Integrity Check in Eclipse hawkBit 
Aliases: CVE-2019-10240
Severity: HIGH
CWE: CWE-319, CWE-829, CWE-494
Published: 2019-04-15T16:19:23Z

Eclipse hawkBit versions prior to 0.3.0M2 resolved Maven build artifacts for the Vaadin based UI over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of hawkBit might be infected.
Vulnerability: GHSA-c332-w4jm-55wv
Summary: Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Aliases: CVE-2021-31409
Severity: HIGH
CWE: CWE-400
Published: 2021-05-04T17:42:02Z

Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Vulnerability: GHSA-4mpj-488r-vh6m
Summary: Path traversal in Neo4j Graph Database
Aliases: CVE-2021-42767
Severity: CRITICAL
CWE: CWE-22
Published: 2022-02-01T22:01:14Z

### Impact
Directory Traversal Vulnerabilities found in several functions of apoc plugins in Neo4j Graph database. The attacker can retrieve and download files from outside the configured directory on the affected server. Under some circumstances, the attacker can also create files.

### Patches
The users should aim to use the latest released version compatible with their Neo4j version. The minimum versions containing patch for this vulnerability (for Neo4j 4.2, 4.3, and 4.4 bundled with APOC, upgrade to the appropriate patched version):
3.5 - bundle n/a, standalone 3.5.0.17
4.2 - bundle 4.2.13, standalone 4.2.10
4.3 - bundle 4.3.9, standalone 4.3.0.4
4.4 - bundle 4.4.2, standalone 4.4.0.1

### Workarounds
If you cannot upgrade the library, you can control the [allowlist of the functions](https://neo4j.com/docs/operations-manual/current/reference/configuration-settings/#config_dbms.security.procedures.allowlist) that can be used in your system:


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [neo4j-apoc-procedures](https://github.com/neo4j-contrib/neo4j-apoc-procedures)
* Email us at [security@neo4j.com](mailto:security@neo4j.com)

### Credits
We want to publicly recognize the contribution of Nicolai Grødum from the Red Team of PwC Norway for reporting this issue and following the responsible disclosure [policy](https://neo4j.com/trust-center/responsible-disclosure/).
Vulnerability: GHSA-qcgx-crrx-38v5
Summary: Denial of service in DataCommunicator class in Vaadin 8
Aliases: CVE-2021-33609
Severity: MODERATE
CWE: CWE-400
Published: 2021-10-13T18:54:09Z

Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Vulnerability: GHSA-pc4w-8v5j-29w9
Summary: Deserialization of Untrusted Data in Neo4j
Aliases: CVE-2021-34371
Severity: CRITICAL
CWE: CWE-502
Published: 2021-09-01T18:31:29Z

Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.
Vulnerability: GHSA-38cr-2ph5-frr9
Summary: Apache Struts REST Plugin can potentially allow a DoS attack
Aliases: CVE-2018-1327
Severity: HIGH
CWE: CWE-91
Published: 2018-10-16T19:35:26Z

The Apache Struts REST Plugin is using XStream library which is vulnerable and allow perform a DoS attack when using a malicious request with specially crafted XML payload. Upgrade to the Apache Struts version 2.5.16 and switch to an optional Jackson XML handler as described here http://struts.apache.org/plugins/rest/#custom-contenttypehandlers. Another option is to implement a custom XML handler based on the Jackson XML handler from the Apache Struts 2.5.16.
Vulnerability: GHSA-rmm5-g63h-m6g9
Summary: Moderate severity vulnerability that affects ro.pippo:pippo-core
Aliases: CVE-2018-20059
Severity: CRITICAL
CWE: CWE-611
Published: 2018-12-19T19:24:39Z

jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
Vulnerability: GHSA-jgcr-fg3g-qvw8
Summary: Improper permission handling in Apache Solr
Aliases: CVE-2021-29262
Severity: HIGH
CWE: CWE-522, CWE-279
Published: 2021-05-10T15:18:17Z

When starting Apache Solr versions prior to 8.8.2, configured with the SaslZkACLProvider or VMParamsAllAndReadonlyDigestZkACLProvider and no existing security.json znode, if the optional read-only user is configured then Solr would not treat that node as a sensitive path and would allow it to be readable. Additionally, with any ZkACLProvider, if the security.json is already present, Solr will not automatically update the ACLs.
Vulnerability: GHSA-95cm-88f5-f2c7
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-10672
Severity: HIGH
Published: 2020-04-23T16:32:59Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
Vulnerability: GHSA-h362-m8f2-5x7c
Summary: Password Hashing: Do not use MD5
Aliases: CVE-2020-5229
Severity: LOW
CWE: CWE-327
Published: 2020-01-30T21:21:58Z

### Impact

User passwords are stored in the database using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially for popular users like the default `admin` user.

This essentially means that for an attacker, it might be feasible to reconstruct a user's password given access to these hashes.

Note that attackers needing access to the hashes means that they must gain access to the database in which these are stored first to be able to start cracking the passwords.


### Patches

The problem is addressed in Opencast 8.1 which now uses the modern and much stronger bcrypt password hashing algorithm for storing passwords. Note, that old hashes remain MD5 until the password is updated.

For a list of users whose password hashes are stored using MD5, take a look at the `/user-utils/users/md5.json` REST endpoint.


### Workarounds

There is no workaround.

### References

- [MD5 (Wikipedia)](https://en.wikipedia.org/wiki/MD5)
- [bcrypt (Wikipedia)](https://en.wikipedia.org/wiki/Bcrypt)
- [How weak is MD5 as a password hashing function?](https://security.stackexchange.com/q/52461)


### For more information

If you have any questions or comments about this advisory:

- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at security@opencast.org
Vulnerability: GHSA-6w3v-66mj-2qm6
Summary: Moderate severity vulnerability that affects org.apache.qpid:apache-qpid-broker-j
Aliases: CVE-2018-1298
Severity: MODERATE
CWE: CWE-20
Published: 2018-10-19T16:41:46Z

A Denial of Service vulnerability was found in Apache Qpid Broker-J 7.0.0 in functionality for authentication of connections for AMQP protocols 0-8, 0-9, 0-91 and 0-10 when PLAIN or XOAUTH2 SASL mechanism is used. The vulnerability allows unauthenticated attacker to crash the broker instance. AMQP 1.0 and HTTP connections are not affected. An authentication of incoming AMQP connections in Apache Qpid Broker-J is performed by special entities called "Authentication Providers". Each Authentication Provider can support several SASL mechanisms which are offered to the connecting clients as part of SASL negotiation process. The client chooses the most appropriate SASL mechanism for authentication. Authentication Providers of following types supports PLAIN SASL mechanism: Plain, PlainPasswordFile, SimpleLDAP, Base64MD5PasswordFile, MD5, SCRAM-SHA-256, SCRAM-SHA-1. XOAUTH2 SASL mechanism is supported by Authentication Providers of type OAuth2. If an AMQP port is configured with any of these Authentication Providers, the Broker may be vulnerable.
Vulnerability: GHSA-f34x-8pf6-qc9c
Summary: HTTP header injection in Sonatype Nexus Repository
Aliases: CVE-2021-40143
Severity: HIGH
CWE: CWE-74
Published: 2021-09-08T17:42:18Z

Sonatype Nexus Repository 3.x through 3.33.1-01 is vulnerable to an HTTP header injection. By sending a crafted HTTP request, a remote attacker may disclose sensitive information or request external resources from a vulnerable instance.
Vulnerability: GHSA-cf6r-3wgc-h863
Summary: Polymorphic deserialization of malicious object in jackson-databind
Aliases: CVE-2019-14892
Severity: HIGH
CWE: CWE-502
Published: 2020-05-15T18:58:58Z

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
Vulnerability: GHSA-v596-fwhq-8x48
Summary: High severity vulnerability that affects org.springframework.security:spring-security-core, org.springframework.security:spring-security-core , and org.springframework:spring-core
Aliases: CVE-2018-1199
Severity: MODERATE
CWE: CWE-20
Published: 2018-10-17T20:01:54Z

Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before 4.2.4, and 5.0.x before 5.0.1; and Spring Framework 4.3.x before 4.3.14 and 5.0.x before 5.0.3) does not consider URL path parameters when processing security constraints. By adding a URL path parameter with special encodings, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. In this particular attack, different character encodings used in path parameters allows secured Spring MVC static resource URLs to be bypassed.
Vulnerability: GHSA-mh8g-hprg-8363
Summary: Hard-Coded Key Used For Remember-me Token in Opencast
Aliases: CVE-2020-5222
Severity: MODERATE
CWE: CWE-798
Published: 2020-01-30T21:21:44Z

### Impact

The security configuration in `etc/security/mh_default_org.xml` enables a remember-me cookie based on a hash created from the [username, password, and an additional system key](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html). Opencast has hard-coded this system key in the large XML file and never mentions to change this, basically ensuring that all systems use the same key:

```xml
<sec:remember-me key="opencast" user-service-ref="userDetailsService" />
```

This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials. For example, a remember-me token obtained from develop.opencast.org can be used on stable.opencast.org without actually knowing the log-in credentials.

Such an attack will usually not work on different installations – assuming that safe, unique passwords are used – but it is basically guaranteed to work to get access to all machines of one cluster if a token from one machine is compromised.

### Patches

This problem is fixed in Opencast 7.6 and Opencast 8.1

### Workarounds

We strongly recommend updating to the patched version. Still, as a workaround for older versions, in `etc/security/mh_default_org.xml`, set a custom key for each server:

```xml
<sec:remember-me key="CUSTOM_RANDOM_KEY" user-service-ref="userDetailsService" />
```

### References

- [Relevant lines in the security configuration](https://github.com/opencast/opencast/blob/161ee619382f144dc35eea211fc6b556025b98e1/etc/security/mh_default_org.xml#L335-L336)
- [Spring Security Remember-Me Authentication Documentation](https://docs.spring.io/spring-security/site/docs/3.0.x/reference/remember-me.html#remember-me-hash-token)

### For more information
If you have any questions or comments about this advisory:
- Open an issue in [opencast/opencast](https://github.com/opencast/opencast/issues)
- For security-relevant information, email us at [security@opencast.org](mailto:security@opencast.org)

### Thanks
Thanks to @LukasKalbertodt for reporting the issue.
Vulnerability: GHSA-5qfv-rr79-chx5
Summary: Cross-site Scripting in Ignite Realtime Openfire
Aliases: CVE-2019-15488
Severity: MODERATE
CWE: CWE-79
Published: 2019-08-27T17:37:33Z

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
Vulnerability: GHSA-8p36-q63g-68qh
Summary: Autobinding vulnerability in MITREid Connect
Aliases: CVE-2021-27582
Severity: CRITICAL
CWE: CWE-915
Published: 2021-05-13T22:31:22Z

org/mitre/oauth2/web/OAuthConfirmationController.java in the OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Mass Assignment (aka Autobinding) vulnerability. This arises due to unsafe usage of the @ModelAttribute annotation during the OAuth authorization flow, in which HTTP request parameters affect an authorizationRequest.
Vulnerability: GHSA-872g-2h8h-362q
Summary: High severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2016-4800
Severity: CRITICAL
CWE: CWE-284
Published: 2018-10-19T16:16:16Z

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
Vulnerability: GHSA-vwxj-6m5m-rrvh
Summary: The REST Plugin in Apache Struts is using an outdated XStream library
Aliases: CVE-2017-9793
Severity: HIGH
CWE: CWE-20
Published: 2018-10-16T19:37:22Z

The REST Plugin in Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
Vulnerability: GHSA-mf7q-gw5f-q8jj
Summary: Cross-site Scripting in Apache Zeppelin
Aliases: CVE-2021-27578
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-07T22:55:56Z

Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0.
Vulnerability: GHSA-c2cp-3xj9-97w9
Summary: Denial of service in Spring Security OAuth
Aliases: CVE-2022-22969
Severity: MODERATE
CWE: CWE-400
Published: 2022-04-22T00:00:33Z

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.
Vulnerability: GHSA-hwj3-m3p6-hj38
Summary: dom4j allows External Entities by default which might enable XXE attacks
Aliases: CVE-2020-10683
Severity: CRITICAL
CWE: CWE-611
Published: 2020-06-05T16:13:36Z

dom4j before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

Note: This advisory applies to `dom4j:dom4j` version 1.x legacy artifacts.  To resolve this a change to the latest version of `org.dom4j:dom4j` is recommended.
Vulnerability: GHSA-2x6r-7427-95cm
Summary: Deserialization of Untrusted Data in Apache Camel RabbitMQ
Aliases: CVE-2020-11972
Severity: HIGH
CWE: CWE-502
Published: 2021-05-21T19:20:47Z

Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Vulnerability: GHSA-f32v-vf79-p29q
Summary: Improper authorization in Keycloak
Aliases: CVE-2022-1466
Severity: HIGH
CWE: CWE-863
Published: 2022-04-27T00:00:19Z

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.
Vulnerability: GHSA-qcxh-w3j9-58qr
Summary: Denial of Service in Tomcat
Aliases: CVE-2019-0199
Severity: HIGH
CWE: CWE-400
Published: 2020-06-15T18:51:09Z

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.14 and 8.5.0 to 8.5.37 accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
Vulnerability: GHSA-v528-7hrm-frqp
Summary: Improper Check for Unusual or Exceptional Conditions in json-smart
Aliases: CVE-2021-27568
Severity: CRITICAL
CWE: CWE-754
Published: 2021-06-16T18:03:47Z

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
Vulnerability: GHSA-p2xq-vcm7-xjj6
Summary: Low severity vulnerability that affects org.apache.mesos:mesos
Aliases: CVE-2018-11793
Severity: HIGH
CWE: CWE-119
Published: 2019-03-06T17:36:22Z

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Vulnerability: GHSA-49r2-73m6-pp8f
Summary: Directory traversal in development mode handler in Vaadin 14 and 15-17
Aliases: CVE-2020-36321
Severity: MODERATE
CWE: CWE-20, CWE-22
Published: 2021-04-19T14:51:58Z

Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

- https://vaadin.com/security/cve-2020-36321
Vulnerability: GHSA-h3cw-g4mq-c5x2
Summary: Code Injection in jackson-databind
Aliases: CVE-2020-24616
Severity: HIGH
CWE: CWE-502, CWE-94
Published: 2021-12-09T19:14:51Z

This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
Vulnerability: GHSA-86qr-9vqc-pgc6
Summary: Code execution in Spring Integration
Aliases: CVE-2020-5413
Severity: CRITICAL
CWE: CWE-502
Published: 2020-08-05T14:53:06Z

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.
Vulnerability: GHSA-p8pq-r894-fm8f
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39146
Severity: HIGH
CWE: CWE-502
Published: 2021-08-25T14:47:57Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39146](https://x-stream.github.io/CVE-2021-39146.html).

### Credits
Ceclin and YXXX from the Tencent Security Response Center found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-vhxc-8jjq-859j
Summary: Moderate severity vulnerability that affects org.apache.ranger:ranger
Aliases: CVE-2016-6815
Severity: MODERATE
Published: 2018-10-17T17:21:44Z

In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.
Vulnerability: GHSA-g6ww-2x43-h963
Summary: Cross-site scripting in Apache JSPWiki
Aliases: CVE-2019-10090
Severity: MODERATE
CWE: CWE-79
Published: 2019-10-11T18:41:44Z

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Vulnerability: GHSA-mgpf-hhgf-cxg4
Summary: In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin.
Aliases: CVE-2021-45457
Severity: MODERATE
CWE: CWE-522
Published: 2022-01-08T00:43:16Z

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Vulnerability: GHSA-9gp4-qrff-c648
Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Aliases: CVE-2016-1000345
Severity: MODERATE
Published: 2018-10-18T18:04:13Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding.
Vulnerability: GHSA-vmm8-82m2-pcp5
Summary: Use of a Broken or Risky Cryptographic Algorithm in PostgreSQL
Aliases: CVE-2020-25694
Severity: HIGH
CWE: CWE-327
Published: 2022-02-15T01:57:18Z

A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, an opportunity for a man-in-the-middle attack, or the ability to observe clear-text transmissions, could exist. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Vulnerability: GHSA-94jq-q5v2-76wj
Summary: Improper certificate management in AWS IoT Device SDK v2
Aliases: CVE-2021-40828
Severity: MODERATE
CWE: CWE-295
Published: 2021-11-24T21:02:24Z

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.3.3), Python (versions prior to 1.5.18), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.1) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on Windows. This issue has been addressed in aws-c-io submodule versions 0.9.13 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.3.3 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.5.18 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Microsoft Windows. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Microsoft Windows.
Vulnerability: GHSA-v4rr-65x6-g69f
Summary: XXE vulnerability in Jenkins Flaky Test Handler Plugin
Aliases: CVE-2022-28140
Severity: HIGH
CWE: CWE-611
Published: 2022-03-30T00:00:25Z

Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Vulnerability: GHSA-h4rc-386g-6m85
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-11620
Severity: HIGH
CWE: CWE-502
Published: 2020-04-23T20:19:02Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
Vulnerability: GHSA-64xx-cq4q-mf44
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39139
Severity: HIGH
CWE: CWE-502
Published: 2021-08-25T14:48:47Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below.  However, this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39139](https://x-stream.github.io/CVE-2021-39139.html).

### Credits
Lai Han of nsfocus security team found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-hp5r-mhgp-56c9
Summary: Cross-site Scriptin in JSPWiki
Aliases: CVE-2019-10078
Severity: MODERATE
CWE: CWE-79
Published: 2019-06-06T15:29:29Z

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.
Vulnerability: GHSA-84q7-p226-4x5w
Summary: Moderate severity vulnerability that affects org.eclipse.jetty:jetty-server
Aliases: CVE-2017-7656
Severity: HIGH
CWE: CWE-444
Published: 2018-10-19T16:16:27Z

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Vulnerability: GHSA-gg9m-x3cg-69vh
Summary: Access key stored in plain text by Jenkins Metrics Plugin
Aliases: CVE-2022-20621
Severity: MODERATE
CWE: CWE-522
Published: 2022-01-13T00:00:57Z

Jenkins Metrics Plugin 4.0.2.8 and earlier stores an access key unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Vulnerability: GHSA-7vx9-xjhr-rw6h
Summary: Cross-site Scripting in Eclipse Jetty
Aliases: CVE-2019-10241
Severity: MODERATE
CWE: CWE-79
Published: 2019-04-23T16:06:02Z

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
Vulnerability: GHSA-q897-9jxf-jg9r
Summary: Security check skip in Apache Dubbo
Aliases: CVE-2021-37579
Severity: CRITICAL
CWE: CWE-502
Published: 2021-09-10T17:56:23Z

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
Vulnerability: GHSA-rxmr-c9jm-7mm8
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2018-1284
Severity: LOW
CWE: CWE-200
Published: 2018-11-21T22:24:22Z

In Apache Hive 0.6.0 to 2.3.2, malicious user might use any xpath UDFs (xpath/xpath_string/xpath_boolean/xpath_number/xpath_double/xpath_float/xpath_long/xpath_int/xpath_short) to expose the content of a file on the machine running HiveServer2 owned by HiveServer2 user (usually hive) if hive.server2.enable.doAs=false.
Vulnerability: GHSA-82mf-mmh7-hxp5
Summary: Directory traversal in development mode handler in Vaadin 14 and 15-17
Severity: MODERATE
CWE: CWE-20
Published: 2021-04-19T14:48:15Z

Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

- https://vaadin.com/security/cve-2020-36321
Vulnerability: GHSA-3cv4-xxv7-934q
Summary: Improper Verification of Cryptographic Signature in Apache Pulsar
Aliases: CVE-2021-22160
Severity: CRITICAL
CWE: CWE-347
Published: 2021-06-01T21:53:49Z

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Vulnerability: GHSA-2c25-xfpq-8w9r
Summary: Cross-site scripting in jfinal
Aliases: CVE-2021-33348
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-13T15:22:14Z

An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.
Vulnerability: GHSA-8fx9-5hx8-crhm
Summary: Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal
Aliases: CVE-2017-12611
Severity: CRITICAL
CWE: CWE-20
Published: 2018-10-16T19:35:40Z

In Apache Struts 2.0.1 through 2.3.33 and 2.5 through 2.5.10, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.
Vulnerability: GHSA-c738-77x8-wmq5
Summary: Uncontrolled Resource Consumption in XNIO
Aliases: CVE-2020-14340
Severity: MODERATE
CWE: CWE-400
Published: 2021-06-08T22:29:29Z

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
Vulnerability: GHSA-vjqw-r3ww-wj2w
Summary: Expression Language Injection in Apache Syncope
Aliases: CVE-2020-1959
Severity: CRITICAL
CWE: CWE-917
Published: 2021-06-16T17:18:58Z

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code.
Vulnerability: GHSA-rpvr-mw7r-25xx
Summary: Path traversal in MCMS
Aliases: CVE-2021-46062
Severity: HIGH
CWE: CWE-22
Published: 2022-02-19T00:01:24Z

MCMS v5.2.5 was discovered to contain an arbitrary file deletion vulnerability via the component oldFileName.
Vulnerability: GHSA-m98g-63qj-fp8j
Summary: Reflected XSS on clients-registrations endpoint
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-28T21:01:28Z

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.

### Acknowledgement

Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.
Vulnerability: GHSA-fjqm-246c-mwqg
Summary: In Bouncy Castle JCE Provider the other party DH public key is not fully validated
Aliases: CVE-2016-1000346
Severity: LOW
Published: 2018-10-17T16:27:28Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation.
Vulnerability: GHSA-h6xq-3h62-99qx
Summary: Cross-site scripting in Apache Atlas
Aliases: CVE-2020-13928
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T20:51:46Z

Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability.
Vulnerability: GHSA-f93p-f762-vr53
Summary: Reflected Cross-Site Scripting in Apache CXF
Aliases: CVE-2019-17573
Severity: MODERATE
CWE: CWE-79
Published: 2020-06-10T20:02:33Z

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically not present in modern browsers, who remove dot segments before sending the request. However, Mobile applications may be vulnerable.
Vulnerability: GHSA-2382-qx5h-rvqh
Summary: SQL Injection in odata4j
Aliases: CVE-2016-11023
Severity: HIGH
CWE: CWE-89
Published: 2021-05-07T15:52:56Z

odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE, this product is apparently discontinued.
Vulnerability: GHSA-9qgc-p27w-3hjg
Summary: High severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
Aliases: CVE-2018-16131
Severity: HIGH
CWE: CWE-400
Published: 2018-10-22T20:37:07Z

The decodeRequest and decodeRequestWith directives in Lightbend Akka HTTP 10.1.x through 10.1.4 and 10.0.x through 10.0.13 allow remote attackers to cause a denial of service (memory consumption and daemon crash) via a ZIP bomb.
Vulnerability: GHSA-xgrx-xpv2-6vp4
Summary: Improper Authentication in Apache ActiveMQ
Aliases: CVE-2020-13920
Severity: MODERATE
CWE: CWE-306
Published: 2022-02-09T22:15:00Z

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
Vulnerability: GHSA-p426-qw2p-v95v
Summary: Argument Injection in Apache Geode server
Aliases: CVE-2017-15694
Severity: MODERATE
CWE: CWE-88
Published: 2019-06-26T01:09:35Z

When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the cluster.
Vulnerability: GHSA-rqj9-cq6j-958r
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2018-11766
Severity: HIGH
Published: 2018-12-21T17:50:26Z

In Apache Hadoop 2.7.4 to 2.7.6, the security fix for CVE-2016-6811 is incomplete. A user who can escalate to yarn user can possibly run arbitrary commands as root user.
Vulnerability: GHSA-r3gr-cxrf-hg25
Summary: Serialization gadgets exploit in jackson-databind
Aliases: CVE-2020-35491
Severity: HIGH
CWE: CWE-502, CWE-913
Published: 2021-12-09T19:15:11Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.
Vulnerability: GHSA-m9cj-v55f-8x26
Summary: Authentication Bypass in keycloak
Aliases: CVE-2020-27826
Severity: HIGH
CWE: CWE-250
Published: 2022-03-18T17:55:26Z

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.
Vulnerability: GHSA-r9ch-m4fh-fc7q
Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Aliases: CVE-2016-1000341
Severity: MODERATE
Published: 2018-10-17T16:24:00Z

In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well.
Vulnerability: GHSA-f62v-xpxf-3v68
Summary: Code injection in Apache Ant
Aliases: CVE-2020-11979
Severity: HIGH
CWE: CWE-74, CWE-94
Published: 2021-02-03T19:16:35Z

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Vulnerability: GHSA-26p8-xrj2-mv53
Summary: Apache NiFi process group information disclosure
Aliases: CVE-2019-10083
Severity: MODERATE
CWE: CWE-200
Published: 2019-12-02T18:18:37Z

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.
Vulnerability: GHSA-67f6-c8mx-4q2m
Summary: Uncontrolled Resource Consumption in JPA Server in HAPI FHIR
Aliases: CVE-2021-32053
Severity: MODERATE
CWE: CWE-400
Published: 2021-06-16T17:21:11Z

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
Vulnerability: GHSA-gh38-x2wm-xmc8
Summary: Code injection in ShenYu
Aliases: CVE-2021-45029
Severity: CRITICAL
CWE: CWE-94
Published: 2022-01-28T22:13:27Z

Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Vulnerability: GHSA-r2pp-x4mm-4999
Summary: Moderate severity vulnerability that affects org.neo4j.procedure:apoc
Aliases: CVE-2018-1000820
Severity: CRITICAL
CWE: CWE-611
Published: 2018-12-20T22:02:02Z

neo4j-contrib neo4j-apoc-procedures version before commit 45bc09c contains a XML External Entity (XXE) vulnerability in XML Parser that can result in Disclosure of confidential data, denial of service, SSRF, port scanning. This vulnerability appears to have been fixed in after commit 45bc09c.
Vulnerability: GHSA-9448-c9wq-jg9v
Summary: Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Aliases: CVE-2018-11786
Severity: HIGH
CWE: CWE-269
Published: 2018-12-21T17:49:33Z

In Apache Karaf prior to 4.2.0 release, if the sshd service in Karaf is left on so an administrator can manage the running instance, any user with rights to the Karaf console can pivot and read/write any file on the file system to which the Karaf process user has access. This can be locked down a bit by using chroot to change the root directory to protect files outside of the Karaf install directory; it can be further locked down by defining a security manager policy that limits file system access to those directories beneath the Karaf home that are necessary for the system to run. However, this still allows anyone with ssh access to the Karaf process to read and write a large number of files as the Karaf process user.
Vulnerability: GHSA-vmfg-rjjm-rjrj
Summary: Deserialization of Untrusted Data
Aliases: CVE-2017-5929
Severity: CRITICAL
CWE: CWE-502
Published: 2021-06-07T16:07:36Z

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access allow data to be deserialized over a Java Socket, via an ObjectInputStream, without validating the data beforehand. When data is received from the Socket, to be logged, it is deserialized into Java objects.An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the Socket, which may result in execution of arbitrary code when those objects are deserialized. Note that although logback-core is implicated by the Logback project here, the Sonatype Security Research team discovered that the vulnerability is actually present in the logback-classic and logback-access components. Versions prior to 1.2.0 are vulnerable, as stated in the advisory.
Vulnerability: GHSA-cxx2-fp39-rf3r
Summary: Cross-Site Scripting in JSPWiki
Aliases: CVE-2019-10076
Severity: MODERATE
CWE: CWE-79
Published: 2019-06-06T15:29:22Z

A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
Vulnerability: GHSA-72w9-fcj5-3fcg
Summary: Improper Authentication in Apache Shiro
Aliases: CVE-2020-11989
Severity: CRITICAL
CWE: CWE-287
Published: 2021-05-07T15:53:10Z

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. Apache Shiro before 1.5.3, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Vulnerability: GHSA-q8wc-9xvp-g3c3
Summary: Cross-site scripting in Sakai
Aliases: CVE-2019-16148
Severity: MODERATE
CWE: CWE-79
Published: 2019-09-23T18:33:18Z

Sakai through 12.6 allows XSS via a chat user name.
Vulnerability: GHSA-gfx6-ph4q-q54q
Summary: Moderate severity vulnerability that affects com.typesafe.akka:akka-http-core_2.11 and com.typesafe.akka:akka-http-core_2.12
Aliases: CVE-2017-1000118
Severity: HIGH
CWE: CWE-119
Published: 2018-10-22T20:53:02Z

Akka HTTP versions <= 10.0.5 Illegal Media Range in Accept Header Causes StackOverflowError Leading to Denial of Service
Vulnerability: GHSA-r28h-x6hv-2fq3
Summary: Improper Verification of Cryptographic Signature in starkbank-ecdsa
Aliases: CVE-2021-43570
Severity: CRITICAL
CWE: CWE-347
Published: 2021-11-10T20:48:00Z

The verify function in the Stark Bank Java ECDSA library (ecdsa-java) 1.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Vulnerability: GHSA-3w73-fmf3-hg5c
Summary: Policies not properly enforced in OWASP Java HTML Sanitizer
Aliases: CVE-2021-42575
Severity: CRITICAL
CWE: CWE-20
Published: 2021-10-19T20:15:50Z

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the `SELECT`, `STYLE`, and `OPTION` elements.
Vulnerability: GHSA-2rq5-68hm-h4j8
Summary: Cross-Site Request Forgery in OpenNMS Horizon
Aliases: CVE-2021-25931
Severity: HIGH
CWE: CWE-352
Published: 2021-05-25T18:46:55Z

In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to CSRF, due to no CSRF protection at `/opennms/admin/userGroupView/users/updateUser`. This flaw allows assigning `ROLE_ADMIN` security role to a normal user. Using this flaw, an attacker can trick the admin user to assign administrator privileges to a normal user by enticing him to click upon an attacker-controlled website.
Vulnerability: GHSA-cc94-3v9c-7rm8
Summary: Apache ActiveMQ webconsole admin GUI is open to XSS
Aliases: CVE-2020-1941
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-21T21:08:56Z

In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.