TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-83r3-c79w-f6wc
Summary: High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2015-7521
Severity: HIGH
CWE: CWE-287
Published: 2018-11-21T22:23:49Z

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.
Vulnerability: GHSA-73xv-w5gp-frxh
Summary: Logic error in Legion of the Bouncy Castle BC Java
Aliases: CVE-2020-28052
Severity: HIGH
CWE: CWE-670
Published: 2021-04-30T16:14:15Z

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Vulnerability: GHSA-73cq-fhp3-8rpw
Summary: Moderate severity vulnerability that affects org.restlet.jse:org.restlet
Aliases: CVE-2014-1868
Severity: MODERATE
CWE: CWE-776
Published: 2018-10-17T00:04:53Z

Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
Vulnerability: GHSA-959q-32g8-vvp7
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2017-12161
Severity: MODERATE
CWE: CWE-602
Published: 2018-10-18T16:50:05Z

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.
Vulnerability: GHSA-6mqq-8r44-vmjc
Summary: Low severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2018-1334
Severity: MODERATE
CWE: CWE-200
Published: 2019-03-14T15:41:04Z

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
Vulnerability: GHSA-7ph6-5cmq-xgjq
Summary: Path traversal in xwiki-platform-skin-skinx
Aliases: CVE-2022-23620
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-09T21:53:29Z

### Impact

AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document reference when serializing it on filesystem, so it's easy to mess up the HTML export process with reference elements containing filesystem syntax like "../", "./". or "/" in general (the last two not causing any security threat, but can cause conflicts with others serialized files).

### Patches

Fixed in 13.6-rc-1

### Workarounds

* giving script or subwiki admin right only to trusted people
* disabling HTML/PDF export

### References

https://jira.xwiki.org/browse/XWIKI-18819

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki Security Mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-gchq-9r68-6jwv
Summary: Cross-Site Request Forgery in Jenkins Credentials Plugin
Aliases: CVE-2021-21648
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-16T17:24:31Z

Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
Vulnerability: GHSA-vm59-329q-p468
Summary: Cross-site Scripting in Apache UIMA
Aliases: CVE-2018-8035
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-14T04:00:37Z

This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.
Vulnerability: GHSA-4fcw-pq4r-f4q7
Summary: Server-Side Request Forgery in Spinnaker Orca
Aliases: CVE-2020-9298
Severity: HIGH
CWE: CWE-918
Published: 2021-05-07T15:54:31Z

The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.
Vulnerability: GHSA-5q8m-mqmx-pxp9
Summary: Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
Aliases: CVE-2018-1274
Severity: HIGH
CWE: CWE-770
Published: 2018-10-17T17:23:44Z

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
Vulnerability: GHSA-c7fh-chf7-jr5x
Summary: ReDOS in Vfsjfilechooser2
Aliases: CVE-2021-29061
Severity: HIGH
CWE: CWE-770
Published: 2022-01-06T18:44:27Z

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 which occurs when the application attempts to validate crafted URIs.
Vulnerability: GHSA-vrh8-27q8-fr8f
Summary: Low severity vulnerability that affects org.apache.solr:solr-core
Aliases: CVE-2017-3164
Severity: HIGH
CWE: CWE-918
Published: 2019-03-14T15:39:56Z

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.
Vulnerability: GHSA-v35c-49j6-q8hq
Summary: Security Constraint Bypass in Spring Security
Aliases: CVE-2016-9879
Severity: HIGH
Published: 2020-09-15T20:30:34Z

Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification (see below). Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed.

Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath() and getPathInfo() [1].

Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified.

Users of IBM WebSphere Application Server 8.5.x are known to be affected.

Users of other containers that implement the Servlet specification may be affected.

[1] https://issues.apache.org/bugzilla/show_bug.cgi?id=25015

## Affected Pivotal Products and Versions
Severity is high unless otherwise noted.
- Spring Security 3.2.0 - 3.2.9
- Spring Security 4.0.x - 4.1.3
- Spring Security 4.2.0
- Older unsupported versions are also affected

## Mitigation
Adopting one of the following mitigations will protect against this vulnerability.

- Use a Servlet container known not to include path parameters in the return values for getServletPath() and getPathInfo()
- Upgrading to Spring Security 3.2.10, 4.1.4 or 4.2.1 will reject the request with a RequestRejectedException if the presence of an encoded "/" is detected. Note: If you wish to disable this feature it can be disabled by setting the DefaultHttpFirewall.allowUrlEncodedSlash = true. However, disabling this feature will mean applications are vulnerable (in containers that return path parameters in getServletPath() or getPathInfo()).

## Credit
The issue was identified by Shumpei Asahara & Yuji Ito from NTT DATA Corporation and responsibly reported to Pivotal.
Vulnerability: GHSA-5qx5-vg5w-5mx3
Summary: Stored XSS vulnerability in Jenkins Badge Plugin
Aliases: CVE-2022-23108
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-13T00:00:54Z

Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Vulnerability: GHSA-7cj4-gj8m-m2f7
Summary: Authentication bypass in Apache Shiro
Aliases: CVE-2020-17510
Severity: CRITICAL
CWE: CWE-287
Published: 2021-04-22T16:13:23Z

Apache Shiro before 1.7.0, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Vulnerability: GHSA-j379-9jr9-w5cq
Summary: Moderate severity vulnerability that affects com.squareup.retrofit2:retrofit
Aliases: CVE-2018-1000844
Severity: CRITICAL
CWE: CWE-611
Published: 2018-12-21T17:48:26Z

Square Open Source Retrofit versions prior to commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437 contain a XML External Entity (XXE) vulnerability in JAXB. An attacker could use this to remotely read files from the file system or to perform SSRF. This vulnerability appears to have been fixed in commit 4a693c5aeeef2be6c7ecf80e7b5ec79f6ab59437.
Vulnerability: GHSA-rgh3-987h-wpmw
Summary: XML External Entity Injection in XStream
Aliases: CVE-2016-3674
Severity: HIGH
CWE: CWE-200
Published: 2020-06-30T22:48:14Z

Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in XStream before 1.4.9 allow remote attackers to read arbitrary files via a crafted XML document.
Vulnerability: GHSA-wr5r-m8pc-85j9
Summary: Low severity vulnerability that affects org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml
Aliases: CVE-2019-3772
Severity: LOW
CWE: CWE-611
Published: 2019-01-25T16:18:49Z

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Vulnerability: GHSA-54fx-gm74-q676
Summary: Permissions bypass in SmallRye
Aliases: CVE-2020-1729
Severity: MODERATE
CWE: CWE-863
Published: 2022-03-18T17:55:47Z

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
Vulnerability: GHSA-hf4p-jm7r-vjjj
Summary: Deserialization of Untrusted Data in EthereumJ
Aliases: CVE-2018-15890
Severity: CRITICAL
CWE: CWE-502
Published: 2019-07-26T16:10:39Z

An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.
Vulnerability: GHSA-9h6g-6mxg-vvp4
Summary: Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Severity: MODERATE
CWE: CWE-208
Published: 2021-04-19T14:47:18Z

Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.

- https://vaadin.com/security/cve-2021-31406
Vulnerability: GHSA-c8cc-p3j7-4c7f
Summary: Moderate severity vulnerability that affects org.apache.mesos:mesos
Aliases: CVE-2018-8023
Severity: MODERATE
CWE: CWE-200
Published: 2018-10-17T19:54:14Z

Apache Mesos can be configured to require authentication to call the Executor HTTP API using JSON Web Token (JWT). In Apache Mesos versions pre-1.4.2, 1.5.0, 1.5.1, 1.6.0 the comparison of the generated HMAC value against the provided signature in the JWT implementation used is vulnerable to a timing attack because instead of a constant-time string comparison routine a standard `==` operator has been used. A malicious actor can therefore abuse the timing difference of when the JWT validation function returns to reveal the correct HMAC value.
Vulnerability: GHSA-jjpq-gp5q-8q6w
Summary: Cross-site scripting in Apache Tomcat
Aliases: CVE-2019-0221
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-30T03:30:42Z

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Vulnerability: GHSA-4c7h-f2j9-9c46
Summary: Missing permission Phoenix AutoTest Plugin
Aliases: CVE-2022-28158
Severity: MODERATE
CWE: CWE-862
Published: 2022-03-30T00:00:21Z

A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Vulnerability: GHSA-6xq8-pvg4-3mf3
Summary: Moderate severity vulnerability that affects org.eclipse.rdf4j:rdf4j-runtime
Aliases: CVE-2018-1000644
Severity: CRITICAL
CWE: CWE-611
Published: 2018-10-19T16:54:11Z

Eclipse RDF4j version < 2.4.0 Milestone 2 contains a XML External Entity (XXE) vulnerability in RDF4j XML parser parsing RDF files that can result in the disclosure of confidential data, denial of service, server side request forgery, port scanning. This attack appear to be exploitable via Specially crafted RDF file.
Vulnerability: GHSA-36hp-jr8h-556f
Summary: Authentication Bypass
Aliases: CVE-2021-29441
Severity: HIGH
CWE: CWE-290
Published: 2021-04-27T20:09:17Z

When configured to use authentication (`-Dnacos.core.auth.enabled=true`) Nacos uses the `AuthFilter` servlet filter to enforce authentication. This filter has a [backdoor](https://github.com/alibaba/nacos/blob/5fa05aef52f7432aeab19fe53035431b9d8c91d9/core/src/main/java/com/alibaba/nacos/core/auth/AuthFilter.java#L78-L81) that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the `user-agent` HTTP header so it can be easily spoofed.

The following request to the `configuration` endpoint gets rejected as we are not providing any credentials:
```
❯ curl -X POST "http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld"
{"timestamp":"2020-12-02T14:33:57.154+0000","status":403,"error":"Forbidden","message":"unknown user!","path":"/nacos/v1/cs/configs"}                                                                                                       
```

However the following one gets accepted by using the `Nacos-Server` user-agent header:
```
❯ curl -X POST -A Nacos-Server "http://127.0.0.1:8848/nacos/v1/cs/configs?dataId=nacos.cfg.dataIdfoo&group=foo&content=helloWorld"
true 
```

#### Impact

This issue may allow any user to carry out any administrative tasks on the Nacos server.
Vulnerability: GHSA-xwg3-qrcg-w9x6
Summary: Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Aliases: CVE-2021-31404
Severity: MODERATE
CWE: CWE-208, CWE-203
Published: 2021-04-19T14:51:25Z

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 through 13), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.

- https://vaadin.com/security/cve-2021-31404
Vulnerability: GHSA-c6j7-4fr9-c76p
Summary: Incorrect permissions in Apache Ozone
Aliases: CVE-2021-39235
Severity: MODERATE
CWE: CWE-732
Published: 2021-11-23T18:17:41Z

In Apache Ozone before 1.2.0, Ozone Datanode doesn't check the access mode parameter of the block token. Authenticated users with valid READ block token can do any write operation on the same block.
Vulnerability: GHSA-f96g-24cg-f24w
Summary: SQL Injection in odata4j
Aliases: CVE-2016-11024
Severity: HIGH
CWE: CWE-89
Published: 2021-05-07T15:52:41Z

odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
Vulnerability: GHSA-fpqp-v323-44xv
Summary: Cross-site scripting in Apache Ranger
Aliases: CVE-2019-12397
Severity: MODERATE
CWE: CWE-79
Published: 2019-08-16T14:01:35Z

Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.
Vulnerability: GHSA-9gph-22xh-8x98
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36179
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:15:54Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
Vulnerability: GHSA-r53v-vm87-f72c
Summary: Moderate severity vulnerability that affects org.apache.axis:axis
Aliases: CVE-2014-3596
Severity: MODERATE
CWE: CWE-297
Published: 2018-10-16T20:50:58Z

The getCN function in Apache Axis 1.4 and earlier does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5784.
Vulnerability: GHSA-2pmw-cvc7-frvh
Summary: SQL injection in MCMS
Aliases: CVE-2021-44868
Severity: CRITICAL
CWE: CWE-89
Published: 2022-02-18T00:00:34Z

A problem was found in ming-soft MCMS v5.1. There is a sql injection vulnerability in /ms/cms/content/list.do
Vulnerability: GHSA-xxgp-pcfc-3vgc
Summary: Privilege Escalation in Hibernate Validator
Aliases: CVE-2017-7536
Severity: HIGH
CWE: CWE-470
Published: 2020-06-15T19:57:48Z

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
Vulnerability: GHSA-j23j-q57m-63v3
Summary: Denial of service in DataCommunicator class in Vaadin 8
Severity: MODERATE
CWE: CWE-400
Published: 2021-10-13T18:54:50Z

Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Vulnerability: GHSA-6jmf-mxwf-r3jc
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Kafka
Aliases: CVE-2019-12399
Severity: HIGH
CWE: CWE-319
Published: 2020-05-12T00:39:27Z

When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, or 2.3.0 are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.
Vulnerability: GHSA-7hwc-46rm-65jh
Summary: Denial of service in XStream
Aliases: CVE-2017-7957
Severity: HIGH
CWE: CWE-20
Published: 2020-06-30T22:48:24Z

XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application crash, as demonstrated by an xstream.fromXML("<void/>") call.
Vulnerability: GHSA-53x6-4x5p-rrvv
Summary: Denial of Service in Apache Commons Compress
Aliases: CVE-2019-12402
Severity: HIGH
CWE: CWE-835
Published: 2019-10-11T18:41:08Z

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Vulnerability: GHSA-g8hw-794c-4j9g
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-1271
Severity: MODERATE
CWE: CWE-22
Published: 2018-10-17T20:07:03Z

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
Vulnerability: GHSA-rm7f-mpcj-w4f6
Summary: Command injection in Apache Unomi
Aliases: CVE-2021-31164
Severity: HIGH
CWE: CWE-74
Published: 2021-06-16T17:17:24Z

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements.
Vulnerability: GHSA-qxxx-2pp7-5hmx
Summary: A deserialization flaw was discovered in the jackson-databind
Aliases: CVE-2017-7525
Severity: CRITICAL
CWE: CWE-502, CWE-184
Published: 2018-10-16T17:21:35Z

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
Vulnerability: GHSA-6v7w-535j-rq5m
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2015-3192
Severity: MODERATE
CWE: CWE-119
Published: 2018-10-17T20:29:12Z

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.
Vulnerability: GHSA-rvfc-g8j5-9ccf
Summary: Generation of Error Message Containing Sensitive Information in keybloack
Aliases: CVE-2020-1717
Severity: MODERATE
CWE: CWE-209
Published: 2022-02-09T00:59:06Z

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
Vulnerability: GHSA-fpj7-9xm6-8hgr
Summary: Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin
Aliases: CVE-2022-23106
Severity: MODERATE
CWE: CWE-208, CWE-203
Published: 2022-01-21T23:38:30Z

Jenkins Configuration as Code Plugin 1.55 and earlier used a non-constant time comparison function when validating an authentication token allowing attackers to use statistical methods to obtain a valid authentication token.
Vulnerability: GHSA-j229-2h63-rvh9
Summary: Improper Authentication for Keycloak
Aliases: CVE-2020-1718
Severity: MODERATE
CWE: CWE-287
Published: 2022-02-09T00:59:32Z

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
Vulnerability: GHSA-2wqp-jmcc-mc77
Summary: Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Aliases: CVE-2021-31405
Severity: HIGH
CWE: CWE-400
Published: 2021-04-19T14:47:34Z

Unsafe validation RegEx in `EmailField` component in `com.vaadin:vaadin-text-field-flow` versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

- https://vaadin.com/security/cve-2021-31405
Vulnerability: GHSA-9q69-g5gc-9fgf
Summary: Cross-Site Request Forgery in Vert.x-Web framework
Aliases: CVE-2020-35217
Severity: HIGH
CWE: CWE-352
Published: 2021-04-22T16:16:18Z

Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.
Vulnerability: GHSA-xc67-hjx6-cgg6
Summary: Installation information leak in Eclipse Jetty
Aliases: CVE-2019-10247
Severity: MODERATE
CWE: CWE-200, CWE-213
Published: 2019-04-23T16:07:12Z

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
Vulnerability: GHSA-c38m-7h53-g9v4
Summary: Path traversal in Apache James
Aliases: CVE-2021-40525
Severity: CRITICAL
CWE: CWE-22
Published: 2022-01-21T23:36:47Z

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.
Vulnerability: GHSA-whww-v56c-cgv2
Summary: Deserialization of Untrusted Data in Apache Dubbo
Aliases: CVE-2020-1948
Severity: CRITICAL
CWE: CWE-502
Published: 2022-02-10T22:39:17Z

This vulnerability can affect all Dubbo users stay on version 2.7.6 or lower. An attacker can send RPC requests with unrecognized service name or method name along with some malicious parameter payloads. When the malicious parameter is deserialized, it will execute some malicious code. More details can be found below.
Vulnerability: GHSA-h65f-jvqw-m9fj
Summary: Infinite Loop in Apache Xerces Java
Aliases: CVE-2022-23437
Severity: MODERATE
CWE: CWE-91
Published: 2022-01-27T16:13:07Z

There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
Vulnerability: GHSA-5cf4-jqwp-584g
Summary: Moderate severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2018-11767
Severity: HIGH
CWE: CWE-269
Published: 2019-03-25T16:17:32Z

In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.
Vulnerability: GHSA-xpv2-8ppj-79hh
Summary: Expression injection in AviatorScript
Aliases: CVE-2021-41862
Severity: CRITICAL
CWE: CWE-74
Published: 2021-10-04T20:14:31Z

AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).
Vulnerability: GHSA-gw4j-4229-q4px
Summary: Server-Side Request Forgery in Apache Dubbo
Aliases: CVE-2021-25640
Severity: MODERATE
CWE: CWE-918
Published: 2022-03-18T17:56:45Z

In Apache Dubbo prior to 2.6.9 and 2.7.10, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
Vulnerability: GHSA-chp4-rv79-68j3
Summary: Apache serialization mechanism does not have a list of classes allowed for serialization/deserialization
Aliases: CVE-2018-1295
Severity: CRITICAL
CWE: CWE-502
Published: 2018-10-16T20:53:44Z

In Apache Ignite 2.3 or earlier, the serialization mechanism does not have a list of classes allowed for serialization/deserialization, which makes it possible to run arbitrary code when 3-rd party vulnerable classes are present in Ignite classpath. The vulnerability can be exploited if the one sends a specially prepared form of a serialized object to one of the deserialization endpoints of some Ignite components - discovery SPI, Ignite persistence, Memcached endpoint, socket steamer.
Vulnerability: GHSA-8crv-49fr-2h6j
Summary: Moderate severity vulnerability that affects org.springframework.security:spring-security-core and org.springframework:spring-core
Aliases: CVE-2016-5007
Severity: HIGH
CWE: CWE-285
Published: 2018-10-17T20:30:12Z

Both Spring Security 3.2.x, 4.0.x, 4.1.0 and the Spring Framework 3.2.x, 4.0.x, 4.1.x, 4.2.x rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Security to not recognize certain paths as not protected that are in fact mapped to Spring MVC controllers that should be protected. The problem is compounded by the fact that the Spring Framework provides richer features with regards to pattern matching as well as by the fact that pattern matching in each Spring Security and the Spring Framework can easily be customized creating additional differences.
Vulnerability: GHSA-4qw8-pgpr-p9mq
Summary: Bash command injection in Apache Zeppelin
Aliases: CVE-2019-10095
Severity: HIGH
CWE: CWE-77, CWE-78
Published: 2021-09-07T22:56:43Z

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Vulnerability: GHSA-4mv7-cq75-3qjm
Summary: Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
Aliases: CVE-2015-7940
Severity: MODERATE
CWE: CWE-200
Published: 2018-10-17T16:27:50Z

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
Vulnerability: GHSA-cvj4-g3gx-8vqq
Summary: Restlet Framework allows remote attackers to access arbitrary files via a crafted REST API HTTP request
Aliases: CVE-2017-14949
Severity: HIGH
CWE: CWE-611
Published: 2018-10-17T00:04:18Z

Restlet Framework before 2.3.12 allows remote attackers to access arbitrary files via a crafted REST API HTTP request that conducts an XXE attack, because only general external entities (not parameter external entities) are properly considered. This is related to XmlRepresentation, DOMRepresentation, SaxRepresentation, and JacksonRepresentation.
Vulnerability: GHSA-q74r-4xw3-ppx9
Summary: Stored cross-site scripting in Grid component in Vaadin 7 and 8
Aliases: CVE-2019-25028
Severity: MODERATE
CWE: CWE-80, CWE-79
Published: 2021-04-19T14:49:48Z

Missing variable sanitization in `Grid` component in `com.vaadin:vaadin-server` versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector.

- https://vaadin.com/security/cve-2019-25028
Vulnerability: GHSA-g644-pr5v-vppf
Summary: Insertion of Sensitive Information into Log File in Apache NiFi
Aliases: CVE-2020-9486
Severity: HIGH
CWE: CWE-532
Published: 2022-01-06T20:41:02Z

In Apache NiFi 1.10.0 to 1.11.4, the NiFi stateless execution engine produced log output which included sensitive property values. When a flow was triggered, the flow definition configuration JSON was printed, potentially containing sensitive values in plaintext.
Vulnerability: GHSA-cvx5-m8vg-vxgc
Summary: Arbitrary filesystem write access from velocity.
Aliases: CVE-2022-24897
Severity: HIGH
CWE: CWE-22
Published: 2022-04-28T21:16:40Z

### Impact

The velocity scripts is not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Now writing an attacking script in velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. 

### Patches
The problem has been patched on versions 12.6.7, 12.10.3 and 13.0RC1.

### Workarounds
There's no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

### References
https://jira.xwiki.org/browse/XWIKI-5168

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)
Vulnerability: GHSA-59j4-wjwp-mw9m
Summary: Sandbox Bypass in Apache Velocity Engine
Aliases: CVE-2020-13936
Severity: HIGH
CWE: CWE-20
Published: 2022-01-06T20:32:36Z

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache Velocity Engine versions up to 2.2.
Vulnerability: GHSA-p99p-726h-c8v5
Summary: Moderate severity vulnerability that affects org.apache.juddi:juddi-client
Aliases: CVE-2018-1307
Severity: HIGH
CWE: CWE-611
Published: 2018-10-19T16:42:15Z

In Apache jUDDI 3.2 through 3.3.4, if using the WADL2Java or WSDL2Java classes, which parse a local or remote XML document and then mediates the data structures into UDDI data structures, there are little protections present against entity expansion and DTD type of attacks. Mitigation is to use 3.3.5.
Vulnerability: GHSA-qg5x-66hp-cw5p
Summary: Uncontrolled Resource Consumption in Apache DolphinScheduler
Aliases: CVE-2022-25598
Severity: HIGH
CWE: CWE-400
Published: 2022-03-31T00:00:23Z

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
Vulnerability: GHSA-2f88-5hg8-9x2x
Summary: Origin Validation Error in Apache Maven
Aliases: CVE-2021-26291
Severity: CRITICAL
CWE: CWE-346
Published: 2021-06-16T17:32:49Z

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
Vulnerability: GHSA-43fp-vwwg-qgv6
Summary: Moderate severity vulnerability that affects org.apache.nifi:nifi
Aliases: CVE-2018-17194
Severity: HIGH
CWE: CWE-20
Published: 2018-12-20T22:02:32Z

When a client request to a cluster node was replicated to other nodes in the cluster for verification, the Content-Length was forwarded. On a DELETE request, the body was ignored, but if the initial request had a Content-Length value other than 0, the receiving nodes would wait for the body and eventually timeout. Mitigation: The fix to check DELETE requests and overwrite non-zero Content-Length header values was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Vulnerability: GHSA-w3gh-g32m-cvhr
Summary: High severity vulnerability that affects org.apache.cxf.fediz:fediz-jetty8, org.apache.cxf.fediz:fediz-jetty9, org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3
Aliases: CVE-2018-8038
Severity: HIGH
CWE: CWE-20
Published: 2018-10-18T16:56:47Z

Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider response in the application plugins, or in the Identity Provider itself when parsing certain XML-based parameters.
Vulnerability: GHSA-c77r-6f64-478q
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2017-2582
Severity: MODERATE
CWE: CWE-200, CWE-201
Published: 2018-10-18T16:49:40Z

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.
Vulnerability: GHSA-xv5h-v7jh-p2qh
Summary: Authentication bypass for specific endpoint
Aliases: CVE-2021-29442
Severity: HIGH
CWE: CWE-306
Published: 2021-04-27T20:09:25Z

The [`ConfigOpsController`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java) lets the user perform management operations like querying the database or even wiping it out. While the [`/data/remove`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L133-L135) endpoint is properly protected with the `@Secured` annotation, the [`/derby`](https://github.com/alibaba/nacos/blob/57459227863485d064ff25b3d5e24e714dcf218f/config/src/main/java/com/alibaba/nacos/config/server/controller/ConfigOpsController.java#L99-L100) endpoint is not protected and can be openly accessed by unauthenticated users. 

For example, the following request will list the tables of the database:
```
❯ curl -X GET 'http://console.nacos.io/nacos/v1/cs/ops/derby?sql=select+st.tablename+from+sys.systables+st'
{"code":200,"message":null,"data":[{"TABLENAME":"APP_CONFIGDATA_RELATION_PUBS"},{"TABLENAME":"APP_CONFIGDATA_RELATION_SUBS"},{"TABLENAME":"APP_LIST"},{"TABLENAME":"CONFIG_INFO"},{"TABLENAME":"CONFIG_INFO_AGGR"},{"TABLENAME":"CONFIG_INFO_BETA"},{"TABLENAME":"CONFIG_INFO_TAG"},{"TABLENAME":"CONFIG_TAGS_RELATION"},{"TABLENAME":"GROUP_CAPACITY"},{"TABLENAME":"HIS_CONFIG_INFO"},{"TABLENAME":"PERMISSIONS"},{"TABLENAME":"ROLES"},{"TABLENAME":"SYSALIASES"},{"TABLENAME":"SYSCHECKS"},{"TABLENAME":"SYSCOLPERMS"},{"TABLENAME":"SYSCOLUMNS"},{"TABLENAME":"SYSCONGLOMERATES"},{"TABLENAME":"SYSCONSTRAINTS"},{"TABLENAME":"SYSDEPENDS"},{"TABLENAME":"SYSDUMMY1"},{"TABLENAME":"SYSFILES"},{"TABLENAME":"SYSFOREIGNKEYS"},{"TABLENAME":"SYSKEYS"},{"TABLENAME":"SYSPERMS"},{"TABLENAME":"SYSROLES"},{"TABLENAME":"SYSROUTINEPERMS"},{"TABLENAME":"SYSSCHEMAS"},{"TABLENAME":"SYSSEQUENCES"},{"TABLENAME":"SYSSTATEMENTS"},{"TABLENAME":"SYSSTATISTICS"},{"TABLENAME":"SYSTABLEPERMS"},{"TABLENAME":"SYSTABLES"},{"TABLENAME":"SYSTRIGGERS"},{"TABLENAME":"SYSUSERS"},{"TABLENAME":"SYSVIEWS"},{"TABLENAME":"TENANT_CAPACITY"},{"TABLENAME":"TENANT_INFO"},{"TABLENAME":"USERS"}]}% 
```

These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)
Vulnerability: GHSA-4487-x383-qpph
Summary: Moderate severity vulnerability that affects org.springframework:spring-core
Aliases: CVE-2018-1272
Severity: HIGH
Published: 2018-10-17T20:27:47Z

Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.
Vulnerability: GHSA-jgwr-3qm3-26f3
Summary: Potential remote code execution in Apache Tomcat
Aliases: CVE-2021-25329
Severity: CRITICAL
CWE: CWE-502
Published: 2021-03-19T20:11:13Z

The fix for CVE-2020-9484 was incomplete. When using Apache Tomcat 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41, 8.5.0 to 8.5.61 or 7.0.0. to 7.0.107 with a configuration edge case that was highly unlikely to be used, the Tomcat instance was still vulnerable to CVE-2020-9494. Note that both the previously published prerequisites for CVE-2020-9484 and the previously published mitigations for CVE-2020-9484 also apply to this issue.
Vulnerability: GHSA-h8w4-qv99-f7vj
Summary: High severity vulnerability that affects org.springframework.security.oauth:spring-security-oauth2
Aliases: CVE-2018-15758
Severity: HIGH
Published: 2018-10-19T22:00:28Z

Spring Security OAuth, versions 2.3 prior to 2.3.4, and 2.2 prior to 2.2.3, and 2.1 prior to 2.1.3, and 2.0 prior to 2.0.16, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can craft a request to the approval endpoint that can modify the previously saved authorization request and lead to a privilege escalation on the subsequent approval. This scenario can happen if the application is configured to use a custom approval endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and use a custom Approval Endpoint that declares AuthorizationRequest as a controller method argument. This vulnerability does not expose applications that: Act in the role of an Authorization Server and use the default Approval Endpoint, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
Vulnerability: GHSA-2hpg-vwqj-6h6w
Summary: Authentication bypass in Apache Kylin
Aliases: CVE-2020-13937
Severity: MODERATE
CWE: CWE-922
Published: 2022-02-10T20:25:56Z

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.
Vulnerability: GHSA-6w39-qhmq-g8cp
Summary: CSRF vulnerability in Jenkins Publish Over FTP Plugin
Aliases: CVE-2022-29050
Severity: HIGH
CWE: CWE-352
Published: 2022-04-13T00:00:16Z

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials.
Vulnerability: GHSA-65fg-84f6-3jq3
Summary: SQL Injection in Log4j 1.2.x
Aliases: CVE-2022-23305
Severity: CRITICAL
CWE: CWE-89
Published: 2022-01-21T23:26:47Z

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Vulnerability: GHSA-f9hv-mg5h-xcw9
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-19360
Severity: CRITICAL
CWE: CWE-502
Published: 2019-01-04T19:06:57Z

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
Vulnerability: GHSA-qqv6-5w6p-3pgr
Summary: Moderate severity vulnerability that affects org.hswebframework.web:hsweb-commons
Aliases: CVE-2018-20594
Severity: MODERATE
CWE: CWE-79
Published: 2019-01-04T17:43:30Z

An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.
Vulnerability: GHSA-7fr2-94h7-ccg2
Summary: An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
Aliases: CVE-2020-35209
Severity: HIGH
Published: 2021-12-17T20:41:33Z

An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
Vulnerability: GHSA-j823-4qch-3rgm
Summary: Deserialization of untrusted data in Jackson Databind
Aliases: CVE-2020-14060
Severity: HIGH
CWE: CWE-502
Published: 2020-06-18T14:44:46Z

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
Vulnerability: GHSA-f9xh-2qgp-cq57
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36188
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:16:42Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
Vulnerability: GHSA-vp37-2f9p-3vr3
Summary: Cross-site Scripting in OWASP AntiSamy
Aliases: CVE-2022-29577
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-23T00:03:04Z

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
Vulnerability: GHSA-w9jg-gvgr-354m
Summary: Resource Exhaustion in Spring Security
Aliases: CVE-2021-22119
Severity: HIGH
CWE: CWE-863, CWE-400
Published: 2021-07-02T18:33:34Z

Spring Security versions 5.5.x prior to 5.5.1, 5.4.x prior to 5.4.7, 5.3.x prior to 5.3.10 and 5.2.x prior to 5.2.11 are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client Web and WebFlux application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session or multiple sessions.