TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-c7c7-xm8g-xm36
Summary: Moderate severity vulnerability that affects net.mingsoft:ms-mcms
Aliases: CVE-2018-18830
Severity: CRITICAL
CWE: CWE-434
Published: 2018-11-01T14:48:29Z

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.
Vulnerability: GHSA-g9fw-9x87-rmrj
Summary: Privilege Context Switching Error in Elasticsearch
Aliases: CVE-2020-7020
Severity: LOW
CWE: CWE-269, CWE-270
Published: 2021-03-18T19:27:13Z

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
Vulnerability: GHSA-3jmw-c69h-426c
Summary: Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Aliases: CVE-2021-39133
Severity: HIGH
CWE: CWE-352
Published: 2021-09-01T18:26:48Z

### Impact

A user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.

### Patches
Available in Rundeck 3.4.3 and 3.3.14


### Workarounds

Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)
Vulnerability: GHSA-x2w5-5m2g-7h5m
Summary: High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Aliases: CVE-2018-14720
Severity: CRITICAL
CWE: CWE-502, CWE-611
Published: 2019-01-04T19:09:46Z

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
Vulnerability: GHSA-99wh-973f-779p
Summary: XML External Entity Reference in Hazelcast
Aliases: CVE-2022-0265
Severity: CRITICAL
CWE: CWE-611
Published: 2022-03-04T00:00:15Z

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
Vulnerability: GHSA-px9f-597f-wmcf
Summary: Uncontrolled Resource Consumption in Apache OpenMeetings server
Aliases: CVE-2021-27576
Severity: HIGH
CWE: CWE-400
Published: 2021-06-16T17:43:36Z

If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0
Vulnerability: GHSA-ww97-9w65-2crx
Summary: Improper Input Validation in Apache Solr
Aliases: CVE-2019-17558
Severity: MODERATE
CWE: CWE-20, CWE-94, CWE-74
Published: 2020-02-12T18:45:28Z

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).
Vulnerability: GHSA-q3vw-4jx3-rrr2
Summary: Validation bypass vulnerability 
Severity: LOW
Published: 2020-09-23T17:20:09Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-j9wr-49vq-rm5g
Summary: Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
Severity: HIGH
CWE: CWE-402
Published: 2021-04-19T14:46:49Z

Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

- https://vaadin.com/security/cve-2021-31407
Vulnerability: GHSA-wrvw-hg22-4m67
Summary: A potential Denial of Service issue in protobuf-java
Aliases: CVE-2021-22569
Severity: HIGH
CWE: CWE-696
Published: 2022-01-07T22:31:44Z

## Summary

A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data.

Reporter: [OSS-Fuzz](https://github.com/google/oss-fuzz)

Affected versions: All versions of Java Protobufs (including Kotlin and JRuby) prior to the versions listed below. Protobuf "javalite" users (typically Android) are not affected.

## Severity

[CVE-2021-22569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22569) **High** - CVSS Score: 7.5,  An implementation weakness in how unknown fields are parsed in Java. A small (~800 KB) malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated GC pauses.

## Proof of Concept

For reproduction details, please refer to the oss-fuzz issue that identifies the specific inputs that exercise this parsing weakness.

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

- protobuf-java (3.16.1, 3.18.2, 3.19.2) 
- protobuf-kotlin (3.18.2, 3.19.2)
- google-protobuf [JRuby  gem only] (3.19.2)
Vulnerability: GHSA-5p34-5m6p-p58g
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-9546
Severity: CRITICAL
CWE: CWE-502
Published: 2020-04-23T21:08:40Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
Vulnerability: GHSA-gwfq-qwmp-x9xg
Summary: Cross-site scripting in Apache JSPWiki
Aliases: CVE-2019-10087
Severity: MODERATE
CWE: CWE-79
Published: 2019-10-11T18:41:50Z

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Vulnerability: GHSA-5gvm-hrw5-h6xf
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2015-1772
Severity: HIGH
CWE: CWE-287
Published: 2019-03-14T15:40:44Z

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
Vulnerability: GHSA-4ffq-6g62-j4v4
Summary: Cross-Site Request Forgery in the Jenkins Claim plugin
Aliases: CVE-2021-21620
Severity: MODERATE
CWE: CWE-352
Published: 2021-06-16T17:29:43Z

A cross-site request forgery (CSRF) vulnerability in Jenkins Claim Plugin 2.18.1 and earlier allows attackers to change claims.
Vulnerability: GHSA-rhh9-cm65-3w54
Summary: Improper Authentication in Apache Hadoop
Aliases: CVE-2018-11765
Severity: HIGH
CWE: CWE-287
Published: 2021-04-30T17:29:30Z

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
Vulnerability: GHSA-8rhc-48pp-52gr
Summary: High severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2017-12612
Severity: HIGH
CWE: CWE-502
Published: 2018-11-09T17:43:25Z

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.1.2, 2.2.0 or later.
Vulnerability: GHSA-8jrj-525p-826v
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-39145
Severity: HIGH
CWE: CWE-502
Published: 2021-08-25T14:48:12Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-39145](https://x-stream.github.io/CVE-2021-39145.html).

### Credits
李安诺 (Li4n0) from Alibaba Cloud Security Team and Smi1e of DBAPPSecurity WEBIN Lab found and reported the issue independently to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-cpx9-4rwv-486v
Summary: Hessian protocol configuration vulnerability in Apache Dubbo
Aliases: CVE-2021-36163
Severity: CRITICAL
CWE: CWE-502
Published: 2021-09-08T20:14:14Z

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
Vulnerability: GHSA-vh2r-x97c-2vpr
Summary: SQL Injection in Jeecg-boot
Aliases: CVE-2022-22880
Severity: CRITICAL
CWE: CWE-89
Published: 2022-02-17T00:00:26Z

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.
Vulnerability: GHSA-74cv-f58x-f9wf
Summary: XStream is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling as long as the executing process has sufficient rights
Aliases: CVE-2021-21343
Severity: MODERATE
CWE: CWE-502, CWE-73
Published: 2021-03-22T23:28:13Z

### Impact
The processed stream at unmarshalling time contains type information to recreate the formerly written objects.  XStream creates therefore new instances based on these type information.  An attacker can manipulate the processed input stream and replace or inject objects, that result in the deletion of a file on the local host. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21343](https://x-stream.github.io/CVE-2021-21343.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-683w-6h9j-57wq
Summary: Moderate severity vulnerability that affects org.owasp.antisamy:antisamy
Aliases: CVE-2016-10006
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-18T17:21:47Z

In OWASP AntiSamy before 1.5.5, by submitting a specially crafted input (a tag that supports style with active content), you could bypass the library protections and supply executable code. The impact is XSS.
Vulnerability: GHSA-jh6m-3pqw-242h
Summary: Authentication Bypass by Primary Weakness in keycloak
Aliases: CVE-2020-14359
Severity: HIGH
CWE: CWE-305
Published: 2022-02-09T00:56:04Z

A vulnerability was found in all versions of keycloak, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.
Vulnerability: GHSA-vp5x-3v8r-qprw
Summary: Deserialization of Untrusted Data in Dubbo
Aliases: CVE-2021-43297
Severity: CRITICAL
CWE: CWE-502
Published: 2022-01-12T22:51:04Z

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some imformation for users, which may cause remote command execution. This issue affects Apache Dubbo Apache Dubbo 2.6.x versions prior to 2.6.12; Apache Dubbo 2.7.x versions prior to 2.7.15; Apache Dubbo 3.0.x versions prior to 3.0.5.
Vulnerability: GHSA-86wm-rrjm-8wh8
Summary: Buffer not correctly recycled in Gzip Request inflation
Aliases: CVE-2020-27218
Severity: MODERATE
CWE: CWE-226
Published: 2020-12-02T18:28:18Z

### Impact
If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection and if an 
attacker can send a request with a body that is received entirely by not consumed by the application, then a subsequent request
on the same connection will see that body prepended to it's body.

The attacker will not see any data, but may inject data into the body of the subsequent request

CVE score is [4.8 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L&version=3.1)

### Workarounds
The problem can be worked around by either:
- Disabling compressed request body inflation by GzipHandler.
- By always fully consuming the request content before sending a response.
- By adding a `Connection: close` to any response where the servlet does not fully consume request content.
Vulnerability: GHSA-v8j6-6c2r-r27c
Summary: Expression Language Injection in Apache Struts
Aliases: CVE-2021-31805
Severity: CRITICAL
CWE: CWE-917
Published: 2022-04-13T00:00:30Z

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
Vulnerability: GHSA-23x4-m842-fmwf
Summary: Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI-Generator online generator
Aliases: CVE-2021-21428
Severity: HIGH
CWE: CWE-269, CWE-377, CWE-379, CWE-378
Published: 2021-05-11T00:04:40Z

### Impact

On Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory.

This vulnerability is local privilege escalation because the contents of the outputFolder can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled.

openapi-generator-online creates insecure temporary folders with `File.createTempFile` during the code generation process. The insecure temporary folders store the auto-generated files which can be read and appended to by any users on the system.

### Vulnerable Code

https://github.com/OpenAPITools/openapi-generator/blob/c6530519975341d7784a252132b2f0854f488901/modules/openapi-generator-online/src/main/java/org/openapitools/codegen/online/service/Generator.java#L184-L187

This vulnerability exists due to a race condition between the deletion of the randomly generated temporary file and the creation of the temporary directory.

```java
File outputFolder = File.createTempFile("codegen-", "-tmp"); // Attacker knows the full path of the file that will be generated
// delete the file that was created
outputFolder.delete(); // Attacker sees file is deleted and begins a race to create their own directory before the code generator
// and make a directory of the same name
// SECURITY VULNERABILITY: Race Condition! - Attacker beats the code generator and now owns this directory
outputFolder.mkdir();
```

### Patches
The issue has been patched by changing the underlying logic to use `Files.createTempFile` and has been released in the v5.1.0 stable version.

This vulnerability has the same root cause as CVE-2021-21363 from the `swagger-api/swagger-codegen` project as this project and that one both share the same original source tree.
See: https://github.com/swagger-api/swagger-codegen/security/advisories/GHSA-pc22-3g76-gm6j

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [OpenAPI Generator Github repo](https://github.com/openAPITools/openapi-generator/)
* Email us at [security@openapitools.org](mailto:security@openapitools.org)
Vulnerability: GHSA-vvw4-rfwf-p6hx
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Aliases: CVE-2020-17527
Severity: HIGH
CWE: CWE-200
Published: 2022-02-09T22:58:06Z

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Vulnerability: GHSA-rmrm-75hp-phr2
Summary: Improper Input Validation in Hibernate Validator
Aliases: CVE-2020-10693
Severity: MODERATE
CWE: CWE-20
Published: 2021-06-04T21:36:34Z

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
Vulnerability: GHSA-p479-rwhp-rwjx
Summary: Cross-site scripting in Jenkins Scriptler Plugin
Aliases: CVE-2021-21667
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-06T18:45:29Z

Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.
Vulnerability: GHSA-cf8j-64h9-6q58
Summary: CSRF in Play Framework
Aliases: CVE-2020-12480
Severity: MODERATE
CWE: CWE-352
Published: 2020-08-18T17:30:25Z

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.
Vulnerability: GHSA-fv7x-4hpc-hf9f
Summary: Moderate severity vulnerability that affects org.apache.cxf.fediz:fediz-spring, org.apache.cxf.fediz:fediz-spring2, and org.apache.cxf.fediz:fediz-spring3
Aliases: CVE-2017-12631
Severity: MODERATE
CWE: CWE-352
Published: 2018-10-18T16:57:21Z

Apache CXF Fediz ships with a number of container-specific plugins to enable WS-Federation for applications. A CSRF (Cross Style Request Forgery) style vulnerability has been found in the Spring 2, Spring 3 and Spring 4 plugins in versions before 1.4.3 and 1.3.3. The vulnerability can result in a security context that is set up using a malicious client's roles for the given enduser.
Vulnerability: GHSA-7q5g-gph2-4rc6
Summary: Upload of file to arbitrary path in Apache Flink
Aliases: CVE-2020-17518
Severity: HIGH
CWE: CWE-22, CWE-23
Published: 2022-02-09T22:29:52Z

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.
Vulnerability: GHSA-743r-5g92-5vgf
Summary: Improper certificate management in AWS IoT Device SDK v2
Aliases: CVE-2021-40829
Severity: MODERATE
CWE: CWE-295
Published: 2021-11-24T21:11:16Z

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
Vulnerability: GHSA-qpfq-ph7r-qv6f
Summary: XStream is vulnerable to an Arbitrary Code Execution attack
Aliases: CVE-2021-21347
Severity: MODERATE
CWE: CWE-502, CWE-434
Published: 2021-03-22T23:29:00Z

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21347](https://x-stream.github.io/CVE-2021-21347.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Vulnerability: GHSA-pv39-qp28-4mgh
Summary: Improper Restriction of XML External Entity Reference in soa-model
Aliases: CVE-2021-43090
Severity: CRITICAL
CWE: CWE-611
Published: 2022-03-26T00:00:32Z

Soa-model is a toolkit and Java API for WSDL, WADL and XML Schema. An XML External Entity (XXE) vulnerability exists in versions of soa-model prior to 1.6.4 in the WSDLParser function. This issue has been fixed in version 1.6.4.
Vulnerability: GHSA-fmmc-742q-jg75
Summary: Polymorphic typing issue
Aliases: CVE-2019-16943
Severity: CRITICAL
CWE: CWE-502
Published: 2019-11-13T00:32:27Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
Vulnerability: GHSA-g4gg-9f62-jfph
Summary: Moderate severity vulnerability that affects com.orientechnologies:orientdb-studio
Aliases: CVE-2015-2918
Severity: MODERATE
CWE: CWE-20
Published: 2018-10-18T17:41:40Z

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Vulnerability: GHSA-6cw8-7j6c-hccp
Summary: Moderate severity vulnerability that affects io.vertx:vertx-core
Aliases: CVE-2018-12537
Severity: MODERATE
CWE: CWE-93
Published: 2018-10-19T17:43:36Z

In Eclipse Vert.x version 3.0 to 3.5.1, the HttpServer response headers and HttpClient request headers do not filter carriage return and line feed characters from the header value. This allow unfiltered values to inject a new header in the client request or server response.
Vulnerability: GHSA-8vf3-4w62-m3pq
Summary: XSS in Keycloak
Aliases: CVE-2020-1697
Severity: MODERATE
CWE: CWE-79
Published: 2020-04-15T21:09:09Z

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.
Vulnerability: GHSA-6fvx-r7hx-3vh6
Summary: JavaMelody has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
Aliases: CVE-2018-15531
Severity: CRITICAL
CWE: CWE-611
Published: 2018-10-17T18:28:00Z

JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
Vulnerability: GHSA-rcp4-jm2v-mr3f
Summary: Cross-site scripting in Shopizer
Aliases: CVE-2021-33561
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-08T23:10:24Z

A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.
Vulnerability: GHSA-wgx7-jwwm-cgjv
Summary: Improper Authentication in Apache Spark
Aliases: CVE-2020-9480
Severity: CRITICAL
CWE: CWE-287, CWE-306
Published: 2022-02-10T23:05:20Z

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Vulnerability: GHSA-79rg-7mv3-jrr5
Summary: Rating Script Service expose XWiki to SQL injection
Aliases: CVE-2021-21380
Severity: HIGH
CWE: CWE-89
Published: 2021-03-23T22:48:01Z

### Impact
This issue impacts only XWiki with the Ratings API installed.
The Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. 
This might lead to an SQL script injection quite easily for any user having Script rights on XWiki.

### Patches
The problem has been patched in XWiki 12.9RC1.

### Workarounds
The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.

### References
https://jira.xwiki.org/browse/XWIKI-17662

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](http://jira.xwiki.org)
* Email us at our [security mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-c99h-fgqm-6679
Summary: UnixAuthenticationService in Apache Ranger was updated to correctly handle user input to avoid Stack-based buffer overflow
Aliases: CVE-2018-11778
Severity: HIGH
CWE: CWE-787
Published: 2018-10-17T17:22:23Z

UnixAuthenticationService in Apache Ranger 1.2.0 was updated to correctly handle user input to avoid Stack-based buffer overflow. Versions prior to 1.2.0 should be upgraded to 1.2.0
Vulnerability: GHSA-c6p9-24rc-jr5h
Summary: Remote Code Execution and download tracking in Mintegral SDK
Aliases: CVE-2020-7744
Severity: MODERATE
CWE: CWE-319
Published: 2021-04-22T16:15:15Z

"This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background)."
Vulnerability: GHSA-xvm2-9xvc-hx7f
Summary: Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer
Aliases: CVE-2022-23640
Severity: CRITICAL
CWE: CWE-611
Published: 2022-03-02T21:30:54Z

### Impact
Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.

### Patches
Upgrade to version 2.1.0.

### Workarounds
No known workaround.

### References
https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [monitorjbl/excel-streaming-reader](https://github.com/monitorjbl/excel-streaming-reader)
Vulnerability: GHSA-g94p-h263-c26q
Summary: Cross Site Request Forgery in Mingsoft MCMS
Aliases: CVE-2022-27340
Severity: HIGH
CWE: CWE-352
Published: 2022-04-23T00:03:01Z

MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
Vulnerability: GHSA-p66x-2cv9-qq3v
Summary: Arbitrary code execution in Apache Commons BeanUtils
Aliases: CVE-2014-0114
Severity: HIGH
Published: 2020-06-10T23:38:01Z

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Vulnerability: GHSA-568q-9fw5-28wf
Summary: Moderate severity vulnerability that affects org.postgresql:pgjdbc-aggregate
Aliases: CVE-2018-10936
Severity: MODERATE
CWE: CWE-297
Published: 2018-10-19T16:53:33Z

A weakness was found in postgresql-jdbc before version 42.2.5. It was possible to provide an SSL Factory and not check the host name if a host name verifier was not provided to the driver. This could lead to a condition where a man-in-the-middle attacker could masquerade as a trusted server by providing a certificate for the wrong host, as long as it was signed by a trusted CA.
Vulnerability: GHSA-jfmf-w293-8xr8
Summary: Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Severity: HIGH
Published: 2021-10-13T18:55:52Z

Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Vulnerability: GHSA-3pph-2595-cgfh
Summary: There is a XML external entity expansion (XXE) vulnerability in Apache Solr 
Aliases: CVE-2018-1308
Severity: HIGH
CWE: CWE-611
Published: 2018-10-17T19:55:46Z

This vulnerability in Apache Solr 1.2 to 6.6.2 and 7.0.0 to 7.2.1 relates to an XML external entity expansion (XXE) in the `&dataConfig=<inlinexml>` parameter of Solr's DataImportHandler. It can be used as XXE using file/ftp/http protocols in order to read arbitrary local files from the Solr server or the internal network.
Vulnerability: GHSA-pwr6-p3fh-grc2
Summary: Arbitrary code execution in Magnolia CMS
Aliases: CVE-2021-46364
Severity: HIGH
Published: 2022-02-12T00:00:37Z

A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.
Vulnerability: GHSA-55xh-53m6-936r
Summary: Improper Verification of Cryptographic Signature in aws-encryption-sdk-java
Severity: MODERATE
CWE: CWE-347
Published: 2021-06-01T21:17:36Z

### Impact

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. 

This update addresses an issue where certain invalid ECDSA signatures incorrectly passed validation. These signatures provide defense in depth and there is no impact on the integrity of decrypted plaintext.

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. 

For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to process per message. This configuration provides customers with a way to limit the number of AWS KMS Decrypt API calls that the ESDK will make per message. This setting will reject messages with more EDKs than the configured limit.

Finally, this update adds early rejection of invalid messages with certain invalid combinations of algorithm suite and header data.

### Patches

Fixed in versions 1.9 and 2.2. We recommend that all users upgrade to address these issues.

Customers leveraging the ESDK’s streaming features have several options to protect signature validation. One is to ensure that client code reads to the end of the stream before using released plaintext. With this release, using the new API for streaming and falling back to the non-streaming decrypt API for signed messages prevents using any plaintext from signed data before the signature is validated. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

Users processing ESDK messages from untrusted sources should use the new maximum encrypted data keys parameter. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

### Workarounds

None

### For more information

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#digital-sigs

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x
Vulnerability: GHSA-8xpj-9j9g-fc9r
Summary: SQL Injection in elide-datastore-aggregation
Aliases: CVE-2022-24827
Severity: HIGH
CWE: CWE-89
Published: 2022-04-08T22:43:17Z

### Impact
When leveraging the following together:

- Elide Aggregation Data Store for Analytic Queries
- Parameterized Columns (A column that requires a client provided parameter)
- A parameterized column of type TEXT

There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection.  A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns.  This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters.

### Patches
A [fix](https://github.com/yahoo/elide/pull/2581) is provided in [Elide 6.1.4](https://github.com/yahoo/elide/releases/tag/6.1.4).

### Workarounds
The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted).   Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [elide](https://github.com/yahoo/elide)
* Contact us in [Discord](https://discord.com/invite/3vh8ac57cc)
Vulnerability: GHSA-4rjf-mxfm-98h5
Summary: SQL injection vulnerability in the policy admin tool in Apache Ranger
Aliases: CVE-2016-2174
Severity: HIGH
CWE: CWE-89
Published: 2018-10-17T17:21:29Z

SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
Vulnerability: GHSA-3wc8-659g-r88q
Summary: Low severity vulnerability that affects org.springframework.batch:spring-batch-core
Aliases: CVE-2019-3774
Severity: LOW
CWE: CWE-611
Published: 2019-01-25T16:18:56Z

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Vulnerability: GHSA-phj8-4cq3-794g
Summary: Unencrypted storage of client side sessions
Aliases: CVE-2021-29481
Severity: MODERATE
CWE: CWE-312
Published: 2021-07-01T17:02:13Z

### Impact

The default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies.

Note: the documentation does point this out and encourage users to add an encryption key, but it is not mandatory.

For this to be a vulnerability, some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example, the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies.

The proposed change is to change the default behaviour to use a randomly generated encryption key. This would mean that sessions do not survive app restarts, but this is already the behaviour given the random signing key.

### Patches

As of version 1.9.0, a securely randomly generated signing key is used.

### Workarounds

Supply an encryption key, as per the documentation recommendation.

### References

- https://github.com/ratpack/ratpack/pull/1590
Vulnerability: GHSA-h896-mx9x-g32g
Summary: XML External Entity injection in Apache Camel
Aliases: CVE-2019-0188
Severity: HIGH
CWE: CWE-611
Published: 2019-05-29T18:15:50Z

Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
Vulnerability: GHSA-p9j6-4pjr-gp48
Summary: Path Traversal in MPXJ
Aliases: CVE-2020-35460
Severity: MODERATE
CWE: CWE-22
Published: 2020-12-18T18:28:23Z

common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.
Vulnerability: GHSA-3jq8-jg75-rqv6
Summary: Moderate severity vulnerability that affects org.apache.nifi:nifi
Aliases: CVE-2018-17195
Severity: HIGH
CWE: CWE-863, CWE-319
Published: 2018-12-20T22:02:45Z

The template upload API endpoint accepted requests from different domain when sent in conjunction with ARP spoofing + man in the middle (MiTM) attack, resulting in a CSRF attack. The required attack vector is complex, requiring a scenario with client certificate authentication, same subnet access, and injecting malicious code into an unprotected (plaintext HTTP) website which the targeted user later visits, but the possible damage warranted a Severe severity level. Mitigation: The fix to apply Cross-Origin Resource Sharing (CORS) policy request filtering was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Vulnerability: GHSA-wm47-8v5p-wjpj
Summary: Possible request smuggling in HTTP/2 due missing validation
Aliases: CVE-2021-21295
Severity: MODERATE
CWE: CWE-444
Published: 2021-03-09T18:49:49Z

### Impact
If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up.  This is fine as long as the request is not proxied through as HTTP/1.1.
If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling.  

In a proxy case, users  may assume the content-length is validated somehow, which is not the case.  If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked.

An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1.   A sample attack request looks like:

```
POST / HTTP/2
:authority:: externaldomain.com
Content-Length: 4

asdfGET /evilRedirect HTTP/1.1
Host: internaldomain.com
```

Users are only affected if all of this is `true`:
 * `HTTP2MultiplexCodec` or `Http2FrameCodec` is used
 * `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects
 * These  HTTP/1.1 objects are forwarded to another remote peer.
 

### Patches
This has been patched in 4.1.60.Final

### Workarounds
The user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.

### References
Related change to workaround the problem: https://github.com/Netflix/zuul/pull/980
Vulnerability: GHSA-778x-2mqv-w6xw
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2016-8629
Severity: MODERATE
CWE: CWE-284
Published: 2018-10-18T16:48:01Z

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
Vulnerability: GHSA-vv38-4xcj-q4rw
Summary: Cross-site Scripting in Apache Knox SSO
Aliases: CVE-2021-42357
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-21T23:52:00Z

When using Apache Knox SSO prior to 1.6.1, a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.
Vulnerability: GHSA-4fh8-pm7g-pmxq
Summary: Authentication bypass in Apache Hadoop
Aliases: CVE-2018-11764
Severity: HIGH
CWE: CWE-306
Published: 2022-02-10T20:28:06Z

Web endpoint authentication check is broken in Apache Hadoop 3.0.0-alpha4, 3.0.0-beta1, and 3.0.0. Authenticated users may impersonate any user even if no proxy user is configured.
Vulnerability: GHSA-46j3-r4pj-4835
Summary: The host name verification missing in Apache Tomcat
Aliases: CVE-2018-8034
Severity: HIGH
CWE: CWE-295
Published: 2018-10-17T16:32:43Z

The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.
Vulnerability: GHSA-xrg9-wwrq-xmx9
Summary: Missing Authorization
Aliases: CVE-2021-21661
Severity: MODERATE
CWE: CWE-862
Published: 2021-06-16T17:11:30Z

Jenkins Kubernetes CLI Plugin 1.10.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Vulnerability: GHSA-8w26-6f25-cm9x
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36185
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:16:02Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource.
Vulnerability: GHSA-p7w9-8mxw-p3g7
Summary: Improper Certificate Validation in Hutool
Aliases: CVE-2022-22885
Severity: CRITICAL
CWE: CWE-295
Published: 2022-02-17T00:00:26Z

Hutool v5.7.18's HttpRequest was discovered to ignore all TLS/SSL certificate validation.
Vulnerability: GHSA-3944-787c-f852
Summary: Persistent Cross-Site scripting in Nexus Repository Manager
Aliases: CVE-2020-10203
Severity: MODERATE
CWE: CWE-79
Published: 2020-04-14T15:27:21Z

Sonatype Nexus Repository before 3.21.2 allows XSS.