TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-wg37-7mrv-cfwm
Summary: Low severity vulnerability that affects org.apache.jmeter:ApacheJMeter
Aliases: CVE-2019-0187
Severity: CRITICAL
CWE: CWE-502, CWE-327
Published: 2019-03-07T18:47:57Z

Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.
Vulnerability: GHSA-h7j7-pw3v-3v3x
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2018-10912
Severity: MODERATE
CWE: CWE-835
Published: 2018-10-18T16:49:54Z

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.
Vulnerability: GHSA-rpq8-mmwh-q9hm
Summary: Directory traversal in Eclipse Mojarra
Aliases: CVE-2020-6950
Severity: HIGH
CWE: CWE-22
Published: 2021-09-01T18:23:58Z

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
Vulnerability: GHSA-6phf-73q6-gh87
Summary: Insecure Deserialization in Apache Commons Beanutils
Aliases: CVE-2019-10086
Severity: HIGH
CWE: CWE-502
Published: 2020-06-15T20:36:17Z

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
Vulnerability: GHSA-r4x2-3cq5-hqvp
Summary: The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins
Aliases: CVE-2018-8014
Severity: CRITICAL
CWE: CWE-1188
Published: 2018-10-17T16:32:32Z

The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.
Vulnerability: GHSA-26gr-cvq3-qxgf
Summary: Improper Authentication in Apache Shiro
Aliases: CVE-2020-1957
Severity: CRITICAL
CWE: CWE-287
Published: 2021-05-07T15:53:18Z

Apache Shiro before 1.5.2, when using Apache Shiro with Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
Vulnerability: GHSA-8vh8-vc28-m2hf
Summary: Potential to access user credentials from the log files when debug logging enabled
Aliases: CVE-2019-10212
Severity: CRITICAL
CWE: CWE-532
Published: 2019-11-20T01:33:54Z

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
Vulnerability: GHSA-4pm3-f52j-8ggh
Summary: Improper Input Validation in GeoServer
Aliases: CVE-2022-24847
Severity: HIGH
CWE: CWE-20
Published: 2022-04-22T20:39:10Z

### Impact
The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism.
In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API.

### Patches
The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 2.19.6.

### Workarounds
Protection can be achieved by making the GUI (``geoserver/web``), the REST configuration (``geoserver/rest``) and the embedded GeoWebCache configuration (``geoserver/gwc/rest``) unreachable from remote hosts, in addition to protecting access to the file system where the GeoServer configuration is stored.
Vulnerability: GHSA-jgmr-wrwx-mgfj
Summary: Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA
Aliases: CVE-2019-3797
Severity: MODERATE
CWE: CWE-200, CWE-89
Published: 2019-05-14T04:02:35Z

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Vulnerability: GHSA-mc84-pj99-q6hh
Summary: Improper Handling of Length Parameter Inconsistency in Compress
Aliases: CVE-2021-36090
Severity: HIGH
CWE: CWE-130
Published: 2021-08-02T16:55:53Z

When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package.
Vulnerability: GHSA-vvjc-q5vr-52q6
Summary: Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks
Aliases: CVE-2016-8749
Severity: CRITICAL
CWE: CWE-502
Published: 2018-10-16T23:13:00Z

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.
Vulnerability: GHSA-jvfv-hrrc-6q72
Summary: Improper Restriction of XML External Entity Reference in Liquibase
Aliases: CVE-2022-0839
Severity: CRITICAL
CWE: CWE-611
Published: 2022-03-05T00:00:45Z

The XMLChangeLogSAXParser() function in Liquibase prior to version 4.8.0 contains an issue that may lead to to Improper Restriction of XML External Entity Reference.
Vulnerability: GHSA-fp5r-v3w9-4333
Summary: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data
Aliases: CVE-2021-4104
Severity: HIGH
CWE: CWE-502
Published: 2021-12-14T19:49:31Z

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Vulnerability: GHSA-hjm9-576q-399p
Summary: Moderate severity vulnerability that affects org.esigate:esigate-core
Aliases: CVE-2018-1000854
Severity: CRITICAL
CWE: CWE-74
Published: 2018-12-21T17:46:23Z

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.
Vulnerability: GHSA-544x-2jx9-4pfg
Summary: Path traversal in Apache Karaf
Aliases: CVE-2022-22932
Severity: MODERATE
CWE: CWE-22
Published: 2022-01-28T22:25:03Z

Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as obr:* commands are not very used and the entry is set by user. This has been fixed in revision: https://gitbox.apache.org/repos/asf?p=karaf.git;h=36a2bc4 https://gitbox.apache.org/repos/asf?p=karaf.git;h=52b70cf Mitigation: Apache Karaf users should upgrade to 4.2.15 or 4.3.6 or later as soon as possible, or use correct path. JIRA Tickets: https://issues.apache.org/jira/browse/KARAF-7326
Vulnerability: GHSA-7qqr-3pj3-q2f5
Summary: XSS issues in the management interface
Aliases: CVE-2019-13236
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-12T22:58:21Z

In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
Vulnerability: GHSA-9jg9-6wm2-x7p5
Summary: Server-Side Request Forgery in Karaf
Aliases: CVE-2020-11980
Severity: MODERATE
CWE: CWE-918
Published: 2022-02-10T23:04:32Z

In Karaf, JMX authentication takes place using JAAS and authorization takes place using ACL files. By default, only an "admin" can actually invoke on an MBean. However there is a vulnerability there for someone who is not an admin, but has a "viewer" role. In the 'etc/jmx.acl.cfg', such as role can call get*. It's possible to authenticate as a viewer role + invokes on the MLet getMBeansFromURL method, which goes off to a remote server to fetch the desired MBean, which is then registered in Karaf. At this point the attack fails as "viewer" doesn't have the permission to invoke on the MBean. Still, it could act as a SSRF style attack and also it essentially allows a "viewer" role to pollute the MBean registry, which is a kind of privilege escalation. The vulnerability is low as it's possible to add a ACL to limit access. Users should update to Apache Karaf 4.2.9 or newer.
Vulnerability: GHSA-rwh9-8xx8-4wfm
Summary: Cross-site Scripting in OpenCRX
Aliases: CVE-2021-25959
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-30T20:50:21Z

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
Vulnerability: GHSA-q93h-jc49-78gg
Summary: jackson-databind mishandles the interaction between serialization gadgets and typing
Aliases: CVE-2020-9547
Severity: CRITICAL
CWE: CWE-502
Published: 2020-05-15T18:59:10Z

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
Vulnerability: GHSA-q4xf-3pmq-3hw8
Summary: Improper Restriction of XML External Entity Reference in Apache NiFi
Aliases: CVE-2020-13940
Severity: MODERATE
CWE: CWE-611
Published: 2022-01-06T20:41:00Z

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).
Vulnerability: GHSA-h822-r4r5-v8jg
Summary: Polymorphic Typing issue in FasterXML jackson-databind
Aliases: CVE-2019-14540
Severity: CRITICAL
CWE: CWE-502
Published: 2019-09-23T18:33:25Z

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
Vulnerability: GHSA-2vp8-jv5v-6qh6
Summary: Allocation of resources without limits or throttling in keycloak-model-infinispan
Aliases: CVE-2021-3637
Severity: HIGH
CWE: CWE-770
Published: 2021-07-13T17:43:23Z

A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack.
Vulnerability: GHSA-mm9x-g8pc-w292
Summary: Denial of Service in Netty
Aliases: CVE-2020-11612
Severity: HIGH
CWE: CWE-770, CWE-119, CWE-400
Published: 2020-06-15T19:36:16Z

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
Vulnerability: GHSA-r6j9-8759-g62w
Summary: Improper Restriction of XML External Entity Reference in jackson-mapper-asl
Aliases: CVE-2019-10172
Severity: HIGH
CWE: CWE-611
Published: 2020-02-04T22:39:19Z

A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar to CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.
Vulnerability: GHSA-gc79-gh4f-9g6w
Summary: Server Side Template Injection in MCMS
Aliases: CVE-2021-46063
Severity: CRITICAL
CWE: CWE-74
Published: 2022-02-19T00:01:24Z

MCMS v5.2.5 was discovered to contain a Server Side Template Injection (SSTI) vulnerability via the Template Management module.
Vulnerability: GHSA-cccf-7xw3-p2vr
Summary: HTTP Request Smuggling in Undertow
Aliases: CVE-2020-10719
Severity: MODERATE
CWE: CWE-444
Published: 2021-04-30T17:28:33Z

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
Vulnerability: GHSA-h79p-32mx-fjj9
Summary: Apache Camel Netty enables Java deserialization by default
Aliases: CVE-2020-11973
Severity: HIGH
CWE: CWE-502
Published: 2020-05-21T21:09:04Z

Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
Vulnerability: GHSA-cqcf-4g4h-rghf
Summary: Cross-site scripting in Apache Archiva
Aliases: CVE-2019-0213
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-14T04:00:31Z

In Apache Archiva before 2.2.4, it is possible to write files to the archiva server at arbitrary locations by using the artifact upload mechanism. Existing files can be overwritten, if the archiva run user has appropriate permission on the filesystem for the target file.
Vulnerability: GHSA-93c4-vf86-3rj7
Summary: Reflected cross-site scripting in vaadin-menu-bar webjar resources in Vaadin 14
Aliases: CVE-2021-33611
Severity: MODERATE
CWE: CWE-79
Published: 2021-11-03T17:33:32Z

Missing output sanitization in test sources in `org.webjars.bowergithub.vaadin:vaadin-menu-bar` versions 1.0.0 through 1.2.0 (Vaadin 14.0.0 through 14.4.4) allows remote attackers to execute malicious JavaScript in browser by opening crafted URL.
Vulnerability: GHSA-v54f-xcmp-43cr
Summary: Deserialization of Untrusted Data in Apache ShardingSphere
Aliases: CVE-2020-1947
Severity: HIGH
CWE: CWE-502
Published: 2022-02-10T20:39:47Z

In Apache ShardingSphere(incubator) 4.0.0-RC3 and 4.0.0, the ShardingSphere&#39;s web console uses the SnakeYAML library for parsing YAML inputs to load datasource configuration. SnakeYAML allows to unmarshal data to a Java type By using the YAML tag. Unmarshalling untrusted data can lead to security flaws of RCE.
Vulnerability: GHSA-76f4-fw33-6j2v
Summary: Potential sensitive data exposure in applications using Vaadin 15
Severity: LOW
CWE: CWE-200
Published: 2021-04-19T14:48:26Z

Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`

- https://vaadin.com/security/cve-2020-36319
Vulnerability: GHSA-2g9q-chq2-w8qw
Summary: Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2017-12625
Severity: MODERATE
CWE: CWE-200
Published: 2019-03-14T15:40:16Z

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.
Vulnerability: GHSA-j8g6-2wh7-6439
Summary: Apache Tika allows Java code execution for serialized objects embedded in MATLAB files
Aliases: CVE-2016-6809
Severity: CRITICAL
CWE: CWE-502
Published: 2018-10-17T15:44:36Z

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.
Vulnerability: GHSA-3gp6-hhfw-4gqx
Summary: Padding oracle attacks
Aliases: CVE-2010-3300
Severity: MODERATE
CWE: CWE-649
Published: 2021-08-13T15:22:24Z

It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.
Vulnerability: GHSA-9x2h-hvg6-4r5p
Summary: Improper Authentication in Apache Zeppelin
Aliases: CVE-2018-1317
Severity: HIGH
CWE: CWE-287
Published: 2019-04-24T16:06:52Z

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.
Vulnerability: GHSA-p435-w4xm-jj8x
Summary: Hadoop token in temp file visible to all users in Apache Gobblin
Aliases: CVE-2021-36151
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-06T00:01:07Z

In Apache Gobblin, the Hadoop token is written to a temp file that is visible to all local users on Unix-like systems. This affects versions <= 0.15.0. Users should update to version 0.16.0 which addresses this issue.
Vulnerability: GHSA-75vw-3m5v-fprh
Summary: corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Aliases: CVE-2022-0239
Severity: CRITICAL
CWE: CWE-611
Published: 2022-01-21T23:43:11Z

corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Vulnerability: GHSA-9r24-gp44-h3pm
Summary: High severity vulnerability that affects org.apache.tika:tika-core
Aliases: CVE-2018-1335
Severity: HIGH
Published: 2018-10-17T15:43:43Z

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
Vulnerability: GHSA-grg4-wf29-r9vv
Summary: Bzip2Decoder doesn't allow setting size restrictions for decompressed data
Aliases: CVE-2021-37136
Severity: HIGH
CWE: CWE-400
Published: 2021-09-09T17:11:21Z

### Impact
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).


All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

### Workarounds
No workarounds other than not using the `Bzip2Decoder`

### References

Relevant code areas:

https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305
Vulnerability: GHSA-hrmr-f5m6-m9pq
Summary: Moderate severity vulnerability that affects org.apache.commons:commons-compress
Aliases: CVE-2018-11771
Severity: MODERATE
CWE: CWE-835
Published: 2018-10-19T16:41:27Z

When reading a specially crafted ZIP archive, the read method of Apache Commons Compress 1.7 to 1.17's ZipArchiveInputStream can fail to return the correct EOF indication after the end of the stream has been reached. When combined with a java.io.InputStreamReader this can lead to an infinite stream, which can be used to mount a denial of service attack against services that use Compress' zip package.
Vulnerability: GHSA-fmj2-7wx8-qj4v
Summary: Server-side request forgery (SSRF) in Apache XmlGraphics Commons
Aliases: CVE-2020-11988
Severity: HIGH
CWE: CWE-20, CWE-918
Published: 2022-02-09T00:45:56Z

Apache XmlGraphics Commons 2.4 is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Vulnerability: GHSA-4pc7-vqv5-5r3v
Summary: ECP SAML binding bypasses authentication flows
Aliases: CVE-2021-3827
Severity: MODERATE
Published: 2022-04-27T21:25:59Z

### Description
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
Vulnerability: GHSA-h39x-m55c-v55h
Summary: Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location
Aliases: CVE-2018-12542
Severity: CRITICAL
CWE: CWE-22
Published: 2018-10-17T16:20:45Z

In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the StaticHandler uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '\' (forward slashes) sequences that can resolve to a location that is outside of that directory when running on Windows Operating Systems.
Vulnerability: GHSA-29qj-rvv6-qrmv
Summary: Cross-site scripting in RESTEasy
Aliases: CVE-2020-10688
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-15T16:05:22Z

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
Vulnerability: GHSA-xgc9-9w4v-h33h
Summary: High severity vulnerability that affects org.apache.syncope:syncope-core
Aliases: CVE-2018-1321
Severity: HIGH
CWE: CWE-20
Published: 2018-11-06T23:17:27Z

An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
Vulnerability: GHSA-f6vf-pq8c-69m4
Summary: Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
Aliases: CVE-2019-17195
Severity: CRITICAL
CWE: CWE-755, CWE-754
Published: 2019-10-16T18:31:17Z

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Vulnerability: GHSA-hxvf-35w8-f5mw
Summary: Cross-Site Request Forgery in Magnolia CMS
Aliases: CVE-2021-46366
Severity: HIGH
CWE: CWE-352
Published: 2022-02-12T00:00:37Z

An issue in the Login page of Magnolia CMS v6.2.3 and below allows attackers to exploit both an Open Redirect vulnerability and Cross-Site Request Forgery (CSRF) in order to brute force and exfiltrate users' credentials.
Vulnerability: GHSA-rrvx-pwf8-p59p
Summary: In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values
Aliases: CVE-2016-1000343
Severity: HIGH
Published: 2018-10-17T16:24:22Z

In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator.
Vulnerability: GHSA-72j4-94rx-cr6w
Summary: Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak
Aliases: CVE-2020-1694
Severity: MODERATE
CWE: CWE-183, CWE-732
Published: 2022-02-09T00:57:02Z

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.
Vulnerability: GHSA-76qr-mmh8-cp8f
Summary: Moderate severity vulnerability that affects com.sparkjava:spark-core
Aliases: CVE-2018-9159
Severity: MODERATE
CWE: CWE-22
Published: 2018-10-19T16:56:00Z

In Spark before 2.7.2, a remote attacker can read unintended static files via various representations of absolute or relative pathnames, as demonstrated by file: URLs and directory traversal sequences. NOTE: this product is unrelated to Ignite Realtime Spark.
Vulnerability: GHSA-qh2g-7h5p-mxf4
Summary: Credentials bypass in Apache Druid
Aliases: CVE-2020-1958
Severity: MODERATE
CWE: CWE-200, CWE-74
Published: 2022-02-09T22:05:39Z

When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.
Vulnerability: GHSA-qjw2-hr98-qgfh
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-24750
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:15:36Z

FasterXML jackson-databind 2.x before 2.6.7.5 and from 2.7.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
Vulnerability: GHSA-xgjc-49cw-529m
Summary: Moderate severity vulnerability that affects org.b3log:symphony
Aliases: CVE-2019-9142
Severity: MODERATE
CWE: CWE-79
Published: 2019-03-06T17:35:49Z

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
Vulnerability: GHSA-pr5m-4w22-8483
Summary: XXS in NanoHTTPD
Aliases: CVE-2020-13697
Severity: MODERATE
CWE: CWE-79
Published: 2021-02-25T16:32:34Z

An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.
Vulnerability: GHSA-33xh-xch9-p6hj
Summary: Incorrect Authorization in Apache Ozone
Aliases: CVE-2021-39233
Severity: CRITICAL
CWE: CWE-863
Published: 2021-11-23T18:17:59Z

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
Vulnerability: GHSA-8h56-v53h-5hhj
Summary: Remote Code Execution - JavaEL Injection (low privileged accounts) in Nexus Repository Manager
Aliases: CVE-2020-10204
Severity: HIGH
CWE: CWE-20
Published: 2020-04-14T15:27:14Z

Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
Vulnerability: GHSA-wc6f-cjcp-cc33
Summary: Improper Certificate Validation in Apache IoTDB
Aliases: CVE-2020-1952
Severity: HIGH
CWE: CWE-295
Published: 2022-01-06T19:45:30Z

An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, clients could execute code remotely.
Vulnerability: GHSA-g8jj-899q-8x3j
Summary: Cross-site scripting in json-sanitizer
Aliases: CVE-2020-13973
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T23:04:13Z

OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON, and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript, may be able to confuse the HTML parser as to where the SCRIPT element ends, and cause non-script content to be interpreted as JavaScript.
Vulnerability: GHSA-cfqj-9g2g-w7q6
Summary: Cross-site Scripting in Apache JSPWiki
Aliases: CVE-2021-40369
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-02T17:49:14Z

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.
Vulnerability: GHSA-gq67-pp9w-43gp
Summary: Cryptographically weak CSRF tokens in Apache MyFaces
Aliases: CVE-2021-26296
Severity: HIGH
CWE: CWE-330, CWE-352
Published: 2021-06-16T17:31:39Z

In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.


Mitigation:
Existing web.xml configuration parameters can be used to direct
MyFaces to use SecureRandom for CSRF token generation:

org.apache.myfaces.RANDOM_KEY_IN_VIEW_STATE_SESSION_TOKEN=secureRandom
org.apache.myfaces.RANDOM_KEY_IN_CSRF_SESSION_TOKEN=secureRandom
org.apache.myfaces.RANDOM_KEY_IN_WEBSOCKET_SESSION_TOKEN=secureRandom
Vulnerability: GHSA-8c4j-34r4-xr8g
Summary: Unsafe Deserialization in jackson-databind
Aliases: CVE-2020-36180
Severity: HIGH
CWE: CWE-502
Published: 2021-12-09T19:16:18Z

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.cpdsadapter.DriverAdapterCPDS.
Vulnerability: GHSA-xqfj-vm6h-2x34
Summary: Improper Handling of Length Parameter Inconsistency in Compress
Aliases: CVE-2021-35517
Severity: HIGH
CWE: CWE-770, CWE-130
Published: 2021-08-02T16:55:39Z

When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package.
Vulnerability: GHSA-4w2q-9hp2-vxj5
Summary: Path Traversal in Caucho Resin
Aliases: CVE-2021-44138
Severity: HIGH
CWE: CWE-22
Published: 2022-04-05T00:00:28Z

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.
Vulnerability: GHSA-w6gv-3r3v-gwgj
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2017-2585
Severity: MODERATE
CWE: CWE-200
Published: 2018-10-18T16:47:41Z

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
Vulnerability: GHSA-v84g-cf5j-xjqx
Summary: Path Traversal in Apache James Server
Aliases: CVE-2022-22931
Severity: MODERATE
CWE: CWE-22
Published: 2022-02-08T00:00:34Z

Apache James Server prior to version 3.6.2 contains a path traversal vulnerability. The fix for CVE-2021-40525 does not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file repository This enables a user to access other users data stores (limited to user names being prefixed by the value of the username being used).
Vulnerability: GHSA-2x7v-w2mv-f3rx
Summary: Improper Authentication in Atlassian Connect Spring Boot
Aliases: CVE-2021-26077
Severity: HIGH
CWE: CWE-287
Published: 2021-06-16T17:23:12Z

Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
Vulnerability: GHSA-v569-g72v-q434
Summary: Low severity vulnerability that affects org.apache.hadoop:hadoop-main
Aliases: CVE-2018-1296
Severity: HIGH
CWE: CWE-200
Published: 2019-02-12T17:26:12Z

In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
Vulnerability: GHSA-hvpr-9cr6-q5v7
Summary: High severity vulnerability that affects org.apache.camel:camel-snakeyaml
Aliases: CVE-2017-3159
Severity: HIGH
CWE: CWE-502
Published: 2018-10-16T17:21:42Z

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.
Vulnerability: GHSA-7hjp-97g3-rq93
Summary: Moderate severity vulnerability that affects net.mingsoft:ms-mcms
Aliases: CVE-2018-18831
Severity: HIGH
CWE: CWE-22
Published: 2018-11-01T14:47:04Z

An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file (in the position parameter) to an arbitrary directory via a ../ Directory Traversal in the url parameter.
Vulnerability: GHSA-3h5r-928v-mxhh
Summary: Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Severity: LOW
CWE: CWE-754
Published: 2021-04-19T14:49:13Z

Missing check in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

- https://vaadin.com/security/cve-2018-25007
Vulnerability: GHSA-xx68-jfcg-xmmf
Summary: High severity vulnerability that affects commons-fileupload:commons-fileupload
Aliases: CVE-2014-0050
Severity: HIGH
CWE: CWE-20
Published: 2018-12-21T17:51:42Z

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
Vulnerability: GHSA-4x25-f45x-grv5
Summary: Missing encryption in Apache Directory Studio
Aliases: CVE-2021-33900
Severity: HIGH
CWE: CWE-311
Published: 2021-08-09T20:40:53Z

While investigating DIRSTUDIO-1219 it was noticed that configured StartTLS encryption was not applied when any SASL authentication mechanism (DIGEST-MD5, GSSAPI) was used. While investigating DIRSTUDIO-1220 it was noticed that any configured SASL confidentiality layer was not applied. This issue affects Apache Directory Studio version 2.0.0.v20210213-M16 and prior versions.
Vulnerability: GHSA-8wx2-9q48-vm9r
Summary: RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application
Aliases: CVE-2020-5398
Severity: HIGH
CWE: CWE-79, CWE-494
Published: 2020-01-21T20:59:09Z

In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download (RFD) attack when it sets a "Content-Disposition" header in the response where the filename attribute is derived from user supplied input.
Vulnerability: GHSA-wrx7-qgmj-mf2q
Summary: Server-Side Request Forgery in Apache Kylin
Aliases: CVE-2021-27738
Severity: MODERATE
CWE: CWE-918
Published: 2022-01-08T00:43:04Z

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator. For endpoints accepting node details in HTTP message body, unauthenticated (but limited) server-side request forgery (SSRF) can be achieved. This issue affects Apache Kylin Apache Kylin 3 versions prior to 3.1.2.
Vulnerability: GHSA-9fcp-vcq9-9h2h
Summary: Moderate severity vulnerability that affects org.craftercms:crafter-studio
Aliases: CVE-2018-19907
Severity: HIGH
CWE: CWE-78
Published: 2018-12-19T19:24:18Z

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.
Vulnerability: GHSA-2467-h365-j7hm
Summary: Improper Input Validation in Apache Solr
Aliases: CVE-2020-13941
Severity: MODERATE
CWE: CWE-20
Published: 2022-02-10T00:31:31Z

Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.
Vulnerability: GHSA-f268-65qc-98vg
Summary: Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Aliases: CVE-2020-13943
Severity: MODERATE
CWE: CWE-200
Published: 2022-02-09T23:03:53Z

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Vulnerability: GHSA-c57f-4vp2-jqhm
Summary: Insecure temporary directory usage in frontend build functionality of Vaadin 14 and 15-19
Severity: MODERATE
CWE: CWE-379
Published: 2021-05-06T15:27:04Z

Insecure temporary directory usage in frontend build functionality of `com.vaadin:flow-server` versions 2.0.9 through 2.5.2 (Vaadin 14.0.3 through Vaadin 14.5.2), 3.0 prior to 6.0 (Vaadin 15 prior to 19), and 6.0.0 through 6.0.5 (Vaadin 19.0.0 through 19.0.4) allows local users to inject malicious code into frontend resources during application rebuilds.

- https://vaadin.com/security/cve-2021-31411
Vulnerability: GHSA-mh7g-99w9-xpjm
Summary: Remote code execution occurs in Apache Solr
Aliases: CVE-2017-12629
Severity: CRITICAL
CWE: CWE-611
Published: 2018-10-17T19:56:17Z

Remote code execution occurs in Apache Solr before versions 5.5.5, 6.6.2 and 7.1.0 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr
Vulnerability: GHSA-v3cg-h3f6-2242
Summary: Injection in MockServer
Aliases: CVE-2021-32827
Severity: MODERATE
CWE: CWE-74
Published: 2021-08-30T16:24:38Z

MockServer is open source software which enables easy mocking of any system you integrate with via HTTP or HTTPS. An attacker that can trick a victim into visiting a malicious site while running MockServer locally, will be able to run arbitrary code on the MockServer machine. With an overly broad default CORS configuration MockServer allows any site to send cross-site requests. Additionally, MockServer allows you to create dynamic expectations using Javascript or Velocity templates. Both engines may allow an attacker to execute arbitrary code on-behalf of MockServer. By combining these two issues (Overly broad CORS configuration + Script injection), an attacker could serve a malicious page so that if a developer running MockServer visits it, they will get compromised. For more details including a PoC see the referenced GHSL-2021-059.
Vulnerability: GHSA-rrfq-g5fq-fc9c
Summary: Moderate severity vulnerability that affects org.apache.hive:hive-exec
Aliases: CVE-2018-11777
Severity: HIGH
Published: 2018-11-21T22:25:04Z

In Apache Hive 2.3.3, 3.1.0 and earlier, local resources on HiveServer2 machines are not properly protected against malicious user if ranger, sentry or sql standard authorizer is not in use.
Vulnerability: GHSA-6qj8-c27w-rp33
Summary: Cross-site scripting in Apache Syncome EndUser
Aliases: CVE-2019-17557
Severity: LOW
CWE: CWE-79
Published: 2022-01-06T19:38:07Z

It was found that the Apache Syncope EndUser UI login page prio to 2.0.15 and 2.1.6 reflects the successMessage parameters. By this mean, a user accessing the Enduser UI could execute javascript code from URL query string.
Vulnerability: GHSA-6wqp-v4v6-c87c
Summary: Deserialization of Untrusted Data
Aliases: CVE-2018-12023
Severity: HIGH
CWE: CWE-502
Published: 2020-06-15T18:44:51Z

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
Vulnerability: GHSA-v6wr-fch2-vm5w
Summary: Moderate severity vulnerability that affects com.orientechnologies:orientdb-studio
Aliases: CVE-2015-2913
Severity: MODERATE
CWE: CWE-200
Published: 2018-10-18T17:41:27Z

server/network/protocol/http/OHttpSessionManager.java in the Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 improperly relies on the java.util.Random class for generation of random Session ID values, which makes it easier for remote attackers to predict a value by determining the internal state of the PRNG in this class.
Vulnerability: GHSA-26v6-w6fw-rh94
Summary: Apache Camel can allow remote attackers to execute arbitrary commands
Aliases: CVE-2015-5348
Severity: HIGH
Published: 2018-10-16T23:12:20Z

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
Vulnerability: GHSA-qrg9-f472-qwfm
Summary: Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Aliases: CVE-2021-31412
Severity: MODERATE
CWE: CWE-668, CWE-1295
Published: 2021-06-28T16:55:58Z

Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided.

- https://vaadin.com/security/cve-2021-31412
Vulnerability: GHSA-pjfr-qf3p-3q25
Summary: When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server
Aliases: CVE-2017-12615
Severity: HIGH
CWE: CWE-434
Published: 2018-10-17T16:30:31Z

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
Vulnerability: GHSA-5vjc-qx43-r747
Summary: Stored Cross-site Scripting in folder-auth plugin
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-18T23:57:52Z

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

See https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2646
Vulnerability: GHSA-9959-6p3m-wxpc
Summary: Denial of service in Netty
Aliases: CVE-2014-3488
Severity: MODERATE
CWE: CWE-119
Published: 2020-06-30T21:01:31Z

The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.
Vulnerability: GHSA-4wjq-69rc-8wcp
Summary: Path Traversal in Apache Camel
Aliases: CVE-2019-0194
Severity: HIGH
CWE: CWE-22
Published: 2019-05-02T15:21:34Z

Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also affected.
Vulnerability: GHSA-qcc4-3rxf-gf4m
Summary: Unauthorized property update in CheckboxGroup component in Vaadin 12-14 and 15-20
Aliases: CVE-2021-33605
Severity: MODERATE
CWE: CWE-754
Published: 2021-08-30T16:16:38Z

Improper check in `CheckboxGroup` in `com.vaadin:vaadin-checkbox-flow` versions 1.2.0 prior to 2.0.0 (Vaadin 12.0.0 prior to 14.0.0), 2.0.0 prior to 3.0.0 (Vaadin 14.0.0 prior to 14.5.0), 3.0.0 through 4.0.1 (Vaadin 15.0.0 through 17.0.11), 14.5.0 through 14.6.7 (Vaadin 14.5.0 through 14.6.7), and 18.0.0 through 20.0.5 (Vaadin 18.0.0 through 20.0.5) allows attackers to modify the value of a disabled `Checkbox` inside enabled `CheckboxGroup` component via unspecified vectors.

- https://vaadin.com/security/cve-2021-33605
Vulnerability: GHSA-62ww-4p3p-7fhj
Summary: API information disclosure flaw in Elasticsearch
Aliases: CVE-2021-22135
Severity: MODERATE
CWE: CWE-200
Published: 2021-07-02T18:33:02Z

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
Vulnerability: GHSA-64q9-f38h-9mwx
Summary: Protection Mechanism Failure in Jenkins Doktor Plugin
Aliases: CVE-2022-25204
Severity: MODERATE
CWE: CWE-693
Published: 2022-02-16T00:01:18Z

Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists.