aswin1906/github-advisory-2022 huggingface dataset:
Cross-Site Request Forgery
Advisory: GHSA-q42q-523g-3fwv
Aliases: CVE-2020-7780
Published: 2022-02-09T23:06:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

This affects the package com.softwaremill.akka-http-session:core_2.13 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.12 before 0.5.11; the package com.softwaremill.akka-http-session:core_2.11 before 0.5.11. For older versions, endpoints protected by randomTokenCsrfProtection could be bypassed with an empty X-XSRF-TOKEN header and an empty XSRF-TOKEN cookie.
Authentication bypass in Apache Shiro
Advisory: GHSA-v98j-7crc-wvrj
Aliases: CVE-2020-17523
Published: 2022-02-09T22:03:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
Deserialization of Untrusted Data in bson
Advisory: GHSA-4jwp-vfvf-657p
Aliases: CVE-2019-2391
Published: 2022-02-10T23:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Cross-site Scripting in microweber
Advisory: GHSA-4p92-fv6v-fhfj
Aliases: CVE-2022-0723
Published: 2022-02-27T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Microweber prior to 1.2.11 is vulnerable to reflected cross-site scripting.
Gitea Remote Code Execution (RCE)
Advisory: GHSA-hf6f-jq25-8gq9
Aliases: CVE-2018-18926
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.
Cross-site scripting in forkcms
Advisory: GHSA-vp4x-94ff-2cmv
Aliases: CVE-2020-23263
Published: 2022-02-10T22:29:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Persistent Cross-site scripting vulnerability on Fork CMS version 5.8.2 allows remote attackers to inject arbitrary Javascript code via the "navigation_title" parameter and the "title" parameter in /private/en/pages/add.
Denial of Service in docker2aci
Advisory: GHSA-gfh2-7jg5-653p
Aliases: CVE-2016-8579
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

docker2aci <= 0.12.3 has an infinite loop when handling local images with cyclic dependency chain.
Integer Overflow or Wraparound in TensorFlow
Advisory: GHSA-wcv5-vrvr-3rx2
Published: 2022-02-09T23:34:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The Grappler component of TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) in [constant folding](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/constant_folding.cc#L963-L1035):

```cc
  for (const auto& output_prop : output_props) {
    const PartialTensorShape output_shape(output_prop.shape());
    // ...
  }
```
  
The `output_prop` tensor has a shape that is controlled by user input and this can result in triggering one of the `CHECK`s in the `PartialTensorShape` constructor. This is an instance of [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197).

### Patches
We have patched the issue in GitHub commit [be7b286d40bc68cb0b56f702186cc4837d508058](https://github.com/tensorflow/tensorflow/commit/be7b286d40bc68cb0b56f702186cc4837d508058).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Path traversal in xwiki-platform-skin-skinx
Advisory: GHSA-7ph6-5cmq-xgjq
Aliases: CVE-2022-23620
Published: 2022-02-09T21:53:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:H

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document reference when serializing it on filesystem, so it's easy to mess up the HTML export process with reference elements containing filesystem syntax like "../", "./". or "/" in general (the last two not causing any security threat, but can cause conflicts with others serialized files). Patch can be found in 13.6-rc-1. Giving script or subwiki admin right only to trusted people and disabling HTML/PDF export can be done as workaround.
Authentication Bypass
Advisory: GHSA-rgjg-66cx-5x9m
Aliases: CVE-2018-15727
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Grafana before 4.6.4 and 5.x before 5.2.3 allows authentication bypass because an attacker can generate a valid "remember me" cookie knowing only a username of an LDAP or OAuth user.
Memory leak in decoding PNG images
Advisory: GHSA-fq6p-6334-8gr4
Aliases: CVE-2022-23585
Published: 2022-02-09T23:26:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

### Impact
When [decoding PNG images](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/kernels/image/decode_image_op.cc#L322-L416) TensorFlow can produce a memory leak if the image is invalid.
After calling `png::CommonInitDecode(..., &decode)`, the `decode` value contains allocated buffers which can only be freed by calling `png::CommonFreeDecode(&decode)`. However, several error case in the function implementation invoke the `OP_REQUIRES` macro which immediately terminates the execution of the function, without allowing for the memory free to occur.
  
### Patches   
We have patched the issue in GitHub commit [ab51e5b813573dc9f51efa335aebcf2994125ee9](https://github.com/tensorflow/tensorflow/commit/ab51e5b813573dc9f51efa335aebcf2994125ee9).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Cross-site Scripting pimcore
Advisory: GHSA-mxh3-2699-98g9
Aliases: CVE-2022-0510
Published: 2022-02-09T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

pimcore version 10.3.0 and prior is vulnerable to cross-site scripting.
Open redirect in microweber
Advisory: GHSA-rw98-5846-pqhx
Aliases: CVE-2022-0597
Published: 2022-02-16T00:01:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Deserialization of Untrusted Data in Jodd
Advisory: GHSA-jrg3-qq99-35g7
Aliases: CVE-2018-21234
Published: 2022-02-10T23:03:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
Improper Handling of Exceptional Conditions inn metadata-extractor
Advisory: GHSA-p5pg-wm9q-8v6r
Aliases: CVE-2022-24613
Published: 2022-02-25T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.
Improper Input Validation in Apache Solr
Advisory: GHSA-2467-h365-j7hm
Aliases: CVE-2020-13941
Published: 2022-02-10T00:31:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Reported in SOLR-14515 (private) and fixed in SOLR-14561 (public), released in Solr version 8.6.0. The Replication handler (https://lucene.apache.org/solr/guide/8_6/index-replication.html#http-api-commands-for-the-replicationhandler) allows commands backup, restore and deleteBackup. Each of these take a location parameter, which was not validated, i.e you could read/write to any location the solr user can access.
Improper Authentication in Capsule Proxy
Advisory: GHSA-9cwv-cppx-mqjm
Aliases: CVE-2022-23652
Published: 2022-02-23T21:17:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

Using a malicious `Connection` header, an attacker with a proper authentication mechanism could start a privilege escalation towards the Kubernetes API Server, being able to exploit the `cluster-admin` Role bound to `capsule-proxy`.

### Patches

Patch has been merged in the v0.2.1 release.

### Workarounds

Upgrading is mandatory.
Incorrect Authorization in runc
Advisory: GHSA-fgv8-vj5c-2ppq
Aliases: CVE-2019-16884
Published: 2022-02-22T15:38:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-f268-65qc-98vg
Aliases: CVE-2020-13943
Published: 2022-02-09T23:03:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7, 9.0.0.M1 to 9.0.37 or 8.5.0 to 8.5.57 exceeded the agreed maximum number of concurrent streams for a connection (in violation of the HTTP/2 protocol), it was possible that a subsequent request made on that connection could contain HTTP headers - including HTTP/2 pseudo headers - from a previous request rather than the intended headers. This could lead to users seeing responses for unexpected resources.
Incorrect Authorization in Apache Solr
Advisory: GHSA-j346-h5wc-rw2m
Aliases: CVE-2018-11802
Published: 2022-02-09T23:19:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In Apache Solr, the cluster can be partitioned into multiple collections and only a subset of nodes actually host any given collection. However, if a node receives a request for a collection it does not host, it proxies the request to a relevant node and serves the request. Solr bypasses all authorization settings for such requests. This affects all Solr versions prior to 7.7 that use the default authorization mechanism of Solr (RuleBasedAuthorizationPlugin).
Prototype Pollution in handlebars
Advisory: GHSA-765h-qjxv-5f44
Aliases: CVE-2021-23383
Published: 2022-02-10T23:51:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Improper Authentication in Apache ActiveMQ
Advisory: GHSA-xgrx-xpv2-6vp4
Aliases: CVE-2020-13920
Published: 2022-02-09T22:15:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache ActiveMQ uses LocateRegistry.createRegistry() to create the JMX RMI registry and binds the server to the "jmxrmi" entry. It is possible to connect to the registry without authentication and call the rebind method to rebind jmxrmi to something else. If an attacker creates another server to proxy the original, and bound that, he effectively becomes a man in the middle and is able to intercept the credentials when an user connects. Upgrade to Apache ActiveMQ 5.15.12.
OS Command Injection and Command Injection in kill-port-process
Advisory: GHSA-xp4x-j9vh-c3wf
Aliases: CVE-2019-15609
Published: 2022-02-10T20:20:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The kill-port-process package version &lt; 2.2.0 is vulnerable to a Command Injection vulnerability.
Arbitrary file delete in ectouch/ectouch
Advisory: GHSA-ph62-8768-r87v
Aliases: CVE-2022-25098
Published: 2022-02-25T00:01:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

ECTouch v2 suffers from arbitrary file deletion due to insufficient filtering of the filename parameter.
Reachable Assertion in Tensorflow
Advisory: GHSA-j3mj-fhpq-qqjj
Aliases: CVE-2022-23571
Published: 2022-02-09T23:28:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
When decoding a tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments, if the tensors have an invalid `dtype` and 0 elements or an invalid shape. This allows attackers to cause denial of services in TensorFlow processes.

### Patches
We have patched the issue in GitHub commit [5b491cd5e41ad63735161cec9c2a568172c8b6a3](https://github.com/tensorflow/tensorflow/commit/5b491cd5e41ad63735161cec9c2a568172c8b6a3).
  
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range. 
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Gadget chain attack in Nippy
Advisory: GHSA-p5gm-fgfx-hr7h
Aliases: CVE-2020-24164
Published: 2022-02-10T20:55:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A deserialization flaw is present in Taoensso Nippy before 2.14.2. In some circumstances, it is possible for an attacker to create a malicious payload that, when deserialized, will allow arbitrary code to be executed. This occurs because there is automatic use of the Java Serializable interface.
Integer overflow leading to crash in Tensorflow
Advisory: GHSA-x4qx-4fjv-hmw6
Aliases: CVE-2022-21738
Published: 2022-02-09T23:45:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact 
The [implementation of `SparseCountSparseOutput`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/count_ops.cc#L168-L273) can be made to crash a TensorFlow process by an integer overflow whose result is then used in a memory allocation:

```python
import tensorflow as tf
import numpy as np
    
tf.raw_ops.SparseCountSparseOutput(
  indices=[[1,1]],
  values=[2],
  dense_shape=[2 ** 31, 2 ** 32],
  weights=[1],
  binary_output=True,
  minlength=-1,
  maxlength=-1,
  name=None)
```

### Patches
We have patched the issue in GitHub commit [6f4d3e8139ec724dbbcb40505891c81dd1052c4a](https://github.com/tensorflow/tensorflow/commit/6f4d3e8139ec724dbbcb40505891c81dd1052c4a).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Class Loading Vulnerability in Artemis
Advisory: GHSA-227w-wv4j-67h4
Published: 2022-02-09T22:30:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

### Impact
This affects all Artemis users who test Java assignments. **Ares is not required.**
Students code that gets automatically tested can run arbitrary code in the container,
or arbitrary code on the machine of an assessor in case of manual correction.

### Patches
The problem cannot be resolved easily in Ares itself. Use the Maven Enforcer Plugin as follows:

```xml
<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <version>3.0.0</version>
    <executions>
        <execution>
            <id>enforce-no-student-code-in-trusted-packages</id>
            <phase>process-classes</phase>
            <goals>
                <goal>enforce</goal>
            </goals>
        </execution>
    </executions>
    <configuration>
        <rules>
            <requireFilesDontExist>
                <files>
                    <!-- ADD HERE THE RULES ARES TELLS YOU ARE MISSING -->
                </files>
            </requireFilesDontExist>
        </rules>
    </configuration>
</plugin>
```

This fails the build if student classes reside in such packages that Ares trusts. Trusted packages added in Ares using `@AddTrustedPackage` should be added as well.

### For more information
If you have any questions or comments about this advisory:
* Open a discussion https://github.com/ls1intum/Ares/discussions
* Open an issue in https://github.com/ls1intum/Ares/issues
* Email us, see https://github.com/ls1intum/Ares/security/policy

### References
See the assignment of Julius that passes the tests in TUM Artemis course: "Test - Praktikum: Grundlagen der Programmierung (Testkurs für Tutoren) - Security Tests" (if that still exists in 2022).

Also see #15 for almost the same problem.
Cross-site Scripting in librenms
Advisory: GHSA-gj26-g5qf-jrh7
Aliases: CVE-2022-0589
Published: 2022-02-16T00:01:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
DOM-based cross-site scripting in Froala Editor
Advisory: GHSA-h236-g5gh-vq6c
Aliases: CVE-2019-19935
Published: 2022-02-10T23:32:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Froala WYSIWYG HTML Editor is a lightweight WYSIWYG HTML Editor written in JavaScript that enables rich text editing capabilities for web applications. A DOM-based cross-site scripting (XSS) vulnerability exists in versions before 3.2.3 because HTML code in the editor is not correctly sanitized when inserted into the DOM. This allows an attacker that can control the editor content to execute arbitrary JavaScript in the context of the victim’s session.
SQL Injection in Casdoor
Advisory: GHSA-m358-g4rp-533r
Aliases: CVE-2022-24124
Published: 2022-02-01T00:49:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations.
OS Command Injection in systeminformation
Advisory: GHSA-8j36-q8x7-pm6q
Aliases: CVE-2020-7778
Published: 2022-02-09T23:14:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Serialization vulnerability in Apache Tapestry
Advisory: GHSA-c566-2grg-mjwg
Aliases: CVE-2020-17531
Published: 2022-02-09T22:50:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A Java Serialization vulnerability was found in Apache Tapestry 4. Apache Tapestry 4 will attempt to deserialize the "sp" parameter even before invoking the page's validate method, leading to deserialization without authentication. Apache Tapestry 4 reached end of life in 2008 and no update to address this issue will be released. Apache Tapestry 5 versions are not vulnerable to this issue. Users of Apache Tapestry 4 should upgrade to the latest Apache Tapestry 5 version.
Access Restriction Bypass in Docker
Advisory: GHSA-44gg-pmqr-4669
Aliases: CVE-2014-6408
Published: 2022-02-15T01:57:18Z

Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.
Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible
Advisory: GHSA-j667-c2hm-f2wp
Aliases: CVE-2020-14332
Published: 2022-02-09T21:59:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.
Prototype Pollution in undefsafe
Advisory: GHSA-332q-7ff2-57h2
Aliases: CVE-2019-10795
Published: 2022-02-09T22:34:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.
Infinite Loop in Apache Tomcat
Advisory: GHSA-m7jv-hq7h-mq7c
Aliases: CVE-2020-13935
Published: 2022-02-08T22:05:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
Observable Response Discrepancy in Flask-AppBuilder
Advisory: GHSA-wfjw-w6pv-8p7f
Aliases: CVE-2022-21659
Published: 2022-02-01T00:47:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact
User enumeration in database authentication in Flask-AppBuilder  < 3.4.4. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in.

### Patches
Upgrade to 3.4.4

### Workarounds

### References

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Division by zero in Tensorflow
Advisory: GHSA-v3f7-j968-4h5f
Aliases: CVE-2022-21725
Published: 2022-02-10T00:15:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact 
The [estimator for the cost of some convolution operations](https://github.com/tensorflow/tensorflow/blob/ffa202a17ab7a4a10182b746d230ea66f021fe16/tensorflow/core/grappler/costs/op_level_cost_estimator.cc#L189-L198) can be made to execute a division by 0:

```python
import tensorflow as tf

@tf.function
def test():
  y=tf.raw_ops.AvgPoolGrad(
    orig_input_shape=[1,1,1,1],
    grad=[[[[1.0],[1.0],[1.0]]],[[[2.0],[2.0],[2.0]]],[[[3.0],[3.0],[3.0]]]],
    ksize=[1,1,1,1],
    strides=[1,1,1,0],
    padding='VALID',
    data_format='NCHW')
  return y

test()
```

The function fails to check that the stride argument is stricly positive:

```cc
int64_t GetOutputSize(const int64_t input, const int64_t filter,
                      const int64_t stride, const Padding& padding) {
  // Logic for calculating output shape is from GetWindowedOutputSizeVerbose() 
  // function in third_party/tensorflow/core/framework/common_shape_fns.cc.
  if (padding == Padding::VALID) {
    return (input - filter + stride) / stride;
  } else {  // SAME.
    return (input + stride - 1) / stride;
  }
} 
```

Hence, the fix is to add a check for the stride argument to ensure it is valid.

### Patches
We have patched the issue in GitHub commit [3218043d6d3a019756607643cf65574fbfef5d7a](https://github.com/tensorflow/tensorflow/commit/3218043d6d3a019756607643cf65574fbfef5d7a).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yu Tian of Qihoo 360 AIVul Team.
Git LFS can execute a Git binary from the current directory on Windows
Advisory: GHSA-cx3w-xqmc-84g5
Aliases: CVE-2021-21237
Published: 2022-02-15T00:30:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

### Impact
On Windows, if Git LFS operates on a malicious repository with a git.bat or git.exe file in the current directory, that program would be executed, permitting the attacker to execute arbitrary code. This does not affect Unix systems.

This is the result of an incomplete fix for CVE-2020-27955.

This issue occurs because on Windows, [Go includes (and prefers) the current directory when the name of a command run does not contain a directory separator](https://github.com/golang/go/issues/38736).

### Patches
This version should be patched in v2.13.2, which will be released in coordination with this security advisory.

### Workarounds
Other than avoiding untrusted repositories or using a different operating system, there is no workaround.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:

- Start a discussion in [the Git LFS discussion page](https://github.com/git-lfs/git-lfs/discussions).
- If you cannot open a discussion, please email the core team using their usernames at `github.com`.
CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE
Advisory: GHSA-x92v-xv3x-9v29
Aliases: CVE-2022-25207
Published: 2022-02-16T00:01:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML.

As the plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, attackers can have Jenkins parse a crafted XML response that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Out of bounds read and write in Tensorflow
Advisory: GHSA-77gp-3h4r-6428
Aliases: CVE-2022-23574
Published: 2022-02-09T23:25:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
There is a typo in TensorFlow's [`SpecializeType`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/framework/full_type_util.cc#L81-L102) which results in heap OOB read/write:

```cc
for (int i = 0; i < op_def.output_arg_size(); i++) {
  // ...
  for (int j = 0; j < t->args_size(); j++) {
    auto* arg = t->mutable_args(i);
    // ...
  }
} 
```

Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data.

### Patches
We have patched the issue in GitHub commit [0657c83d08845cc434175934c642299de2c0f042](https://github.com/tensorflow/tensorflow/commit/0657c83d08845cc434175934c642299de2c0f042).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Injection in op-browser
Advisory: GHSA-3hq6-rmv7-39vh
Aliases: CVE-2020-7625
Published: 2022-02-10T23:45:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.
Business Logic Errors in microweber
Advisory: GHSA-3p9j-442x-hjp7
Aliases: CVE-2022-0689
Published: 2022-02-20T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

microweber prior to 1.2.11 allows multiple uses of a single-use coupon.
containernetworking/cni improper limitation of path name
Advisory: GHSA-xjqr-g762-pxwp
Aliases: CVE-2021-20206
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Remote code execution in xwiki-platform
Advisory: GHSA-mgjw-2wrp-r535
Aliases: CVE-2022-23616
Published: 2022-02-09T21:32:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
It's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki.

### Patches
The problem has been patched in XWiki 13.1RC1 with a complete refactoring of the Reset password feature.

### Workarounds
There's different possible workarounds, all consisting in modifying the XWiki/ResetPassword page.
  - the Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page
  - the script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password. 

### References
https://jira.xwiki.org/browse/XWIKI-16661

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](https://jira.xwiki.org)
* Email us at [Security mailing-list](mailto:security@xwiki.org)
Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
Advisory: GHSA-vp9j-rghq-8jhh
Aliases: CVE-2020-10744
Published: 2022-02-09T21:59:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
Improper Initialization in OpenZeppelin
Advisory: GHSA-88g8-f5mf-f5rj
Aliases: CVE-2021-46320
Published: 2022-02-05T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.
Exposure of Resource to Wrong Sphere in Drupal Core
Advisory: GHSA-mmjr-5q74-p3m4
Aliases: CVE-2020-13670
Published: 2022-02-12T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file. This issue affects: Drupal Core 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Validation bypass in frourio
Advisory: GHSA-8xxm-h73r-ghfj
Aliases: CVE-2022-23623
Published: 2022-02-07T22:37:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

## 日本語

### 影響
v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。

### パッチ
frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。

### ワークアラウンド
controller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。

### さらなる情報

このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。
* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。

## English

### Impact
Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)

### Patches
Please update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.

### Workarounds
Validate objects from request with class-transformer in controllers by yourself, or prevent using validators.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [frourio](https://github.com/frouriojs/frourio)
Access Restriction Bypass in kubernetes
Advisory: GHSA-xx8c-m748-xr4j
Aliases: CVE-2016-1905
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.
Path traversal and dereference of symlinks in Argo CD
Advisory: GHSA-63qx-x74g-jcr7
Aliases: CVE-2022-24348
Published: 2022-02-07T19:06:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact

All versions of Argo CD are vulnerable to a path traversal bug that allows to pass arbitrary values files to be consumed by Helm charts. 

Additionally, it is possible to craft special Helm chart packages containing value files that are actually symbolic links, pointing to arbitrary files outside the repository's root directory.

If an attacker with permissions to create or update Applications knows or can guess the full path to a file containing valid YAML, they can create a malicious Helm chart to consume that YAML as values files, thereby gaining access to data they would otherwise have no access to. 

The impact can especially become critical in environments that make use of encrypted value files (e.g. using plugins with git-crypt or SOPS) containing sensitive or confidential data, and decrypt these secrets to disk before rendering the Helm chart.

Also, because any error message from `helm template` is passed back to the user, and these error messages are quite verbose, enumeration of files on the repository server's file system is possible.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.0
* v2.2.4
* v2.1.9

We urge users of Argo CD to update their installation to one of the fixed versions as listed above.

### Workarounds

No workaround for this issue.

### References

* https://apiiro.com/blog/malicious-kubernetes-helm-charts-can-be-used-to-steal-sensitive-information-from-argo-cd-deployments
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24348

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel `#argo-cd`

### Credits

The path traversal vulnerability was discovered and reported by Moshe Zioni, VP Security Research, [Apiiro](https://www.apiiro.com). 

During the development of a fix for the path traversal vulnerability, the Argo CD team discovered the related issue with symbolic links.

The Argo CD team would like to thank Moshe Zioni for the responsible disclosure, and the constructive discussions during handling this issue!
Cross-site Scripting (XSS) in Apache ActiveMQ Artemis
Advisory: GHSA-3h2h-xqr2-2jp7
Aliases: CVE-2020-13932
Published: 2022-02-09T22:14:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache ActiveMQ Artemis 2.5.0 to 2.13.0, a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.
Kubernetes Unsafe Cacheing 
Advisory: GHSA-2575-pghm-6qqx
Aliases: CVE-2019-11244
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by `--cache-dir` (defaulting to `$HOME/.kube/http-cache`), written with world-writeable permissions (`rw-rw-rw-`). If `--cache-dir` is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
Use After Free in HashiCorp Nomad
Advisory: GHSA-77cr-6gr8-7rr9
Aliases: CVE-2020-27195
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
Symlink Attack in kubectl cp
Advisory: GHSA-34jx-wx69-9x8v
Aliases: CVE-2019-1002101
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user’s machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user’s machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0.
Cross-site scripting in @atlaskit/editor-core
Advisory: GHSA-p5ch-w78f-xh44
Aliases: CVE-2019-20903
Published: 2022-02-10T20:34:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.
Apache Geode SSL endpoint verification vulnerability
Advisory: GHSA-wc4x-4gm2-74j8
Aliases: CVE-2019-10091
Published: 2022-02-10T20:51:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

When TLS is enabled with ssl-endpoint-identification-enabled set to true, Apache Geode fails to perform hostname verification of the entries in the certificate SAN during the SSL handshake. This could compromise intra-cluster communication using a man-in-the-middle attack.
Integer overflows in Tensorflow
Advisory: GHSA-6445-fm66-fvq2
Aliases: CVE-2022-23568
Published: 2022-02-09T23:39:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact 
The [implementation of `AddManySparseToTensorsMap`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_tensors_map_ops.cc) is vulnerable to an integer overflow which results in a `CHECK`-fail when building new `TensorShape` objects (so, an assert failure based denial of service):

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.AddManySparseToTensorsMap(
    sparse_indices=[(0,0),(0,1),(0,2),(4,3),(5,0),(5,1)],
    sparse_values=[1,1,1,1,1,1],
    sparse_shape=[2**32,2**32],
    container='',
    shared_name='',
    name=None)
```

We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The latter is an instance of [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197) and is easily fixed by replacing a call to `TensorShape` constructor with a call to `BuildTensorShape` static helper factory.
### Patches
We have patched the issue in GitHub commits [b51b82fe65ebace4475e3c54eb089c18a4403f1c](https://github.com/tensorflow/tensorflow/commit/b51b82fe65ebace4475e3c54eb089c18a4403f1c) and [a68f68061e263a88321c104a6c911fe5598050a8](https://github.com/tensorflow/tensorflow/commit/a68f68061e263a88321c104a6c911fe5598050a8).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Remote code execution in Apache Struts
Advisory: GHSA-jc35-q369-45pv
Aliases: CVE-2020-17530
Published: 2022-02-09T22:51:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
Prototype Pollution in js-data
Advisory: GHSA-mqgv-67vx-g4m5
Aliases: CVE-2020-28442
Published: 2022-02-09T22:45:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package js-data prior to 3.0.10 are vulnerable to Prototype Pollution via the `deepFillIn` function.
Privilege Escalation in Kubernetes
Advisory: GHSA-579h-mv94-g4gp
Aliases: CVE-2018-1002105
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
Insertion of Sensitive Information Into Debugging Code in Microweber
Advisory: GHSA-mjvc-j6rv-9xj8
Aliases: CVE-2022-0721
Published: 2022-02-24T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Microweber prior to 1.3 may expose sensitive information about a server and a user when running the server in debug mode.
Server-side request forgery (SSRF) in Apache Batik
Advisory: GHSA-cmx4-p4v5-hmr5
Aliases: CVE-2019-17566
Published: 2022-02-09T00:46:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
Improper Authentication in Apache Spark
Advisory: GHSA-wgx7-jwwm-cgjv
Aliases: CVE-2020-9480
Published: 2022-02-10T23:05:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Path Traversal in w-zip
Advisory: GHSA-fr6q-jv7j-35g3
Aliases: CVE-2022-0401
Published: 2022-02-02T00:01:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Path Traversal in NPM w-zip prior to 1.0.12.
Improper Restriction of XML External Entity Reference in Magnolia CMS
Advisory: GHSA-3qpg-33wr-533j
Aliases: CVE-2021-46365
Published: 2022-02-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue in the Export function of Magnolia v6.2.3 and below allows attackers to execute arbitrary code via a crafted XLF file.
Unrestricted Upload of File with Dangerous Type in Liferay Portal and Liferay DXP
Advisory: GHSA-c7f6-4vx5-4263
Aliases: CVE-2020-15839
Published: 2022-02-10T20:46:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Liferay Portal before 7.3.3, and Liferay DXP 7.1 before fix pack 18 and 7.2 before fix pack 6, does not restrict the size of a multipart/form-data POST action, which allows remote authenticated users to conduct denial-of-service attacks by uploading large files.
Cross-site Scripting in microweber
Advisory: GHSA-rgp5-m2pq-3fmg
Aliases: CVE-2022-0690
Published: 2022-02-20T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Authorization Bypass Through User-Controlled Key in url-parse
Advisory: GHSA-hgjh-723h-mx2j
Aliases: CVE-2022-0686
Published: 2022-02-21T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key.