aswin1906/github-advisory-2022 huggingface dataset:
Return of Pointer Value Outside of Expected Rang in Jenkins Script Security Plugin
Advisory: GHSA-x25x-j4w4-7m59
Aliases: CVE-2019-10356
Published: 2022-05-24T16:51:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Advisory: GHSA-vpqm-88c4-x4cv
Aliases: CVE-2018-17244
Published: 2022-05-13T01:34:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.
golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer
Advisory: GHSA-fcf9-6fv2-fc5v
Aliases: CVE-2018-17143
Published: 2022-05-13T01:19:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <template><tBody><isindex/action=0>, leading to a "panic: runtime error" in inBodyIM in parse.go during an html.Parse call.
Apache ActiveMQ Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet 
Advisory: GHSA-c9gx-27hq-wcvj
Aliases: CVE-2013-1880
Published: 2022-05-17T03:46:32Z

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
Magento 2 Community Edition IDOR Vulnerability
Advisory: GHSA-c33v-23rx-7qqc
Aliases: CVE-2019-7864
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.
Exposure of Resource to Wrong Sphere in Spring Data REST
Advisory: GHSA-4926-qpxg-6r3w
Aliases: CVE-2021-22047
Published: 2022-05-24T19:19:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In Spring Data REST versions 3.4.0 - 3.4.13, 3.5.0 - 3.5.5, and older unsupported versions, HTTP resources implemented by custom controllers using a configured base API path and a controller type-level request mapping are additionally exposed under URIs that can potentially be exposed for unauthorized access depending on the Spring Security configuration.
CSRF vulnerability in Jenkins Flaky Test Handler Plugin
Advisory: GHSA-vjf8-xw6c-wjhq
Aliases: CVE-2020-2237
Published: 2022-05-24T17:25:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Flaky Test Handler Plugin 1.0.4 and earlier does not require POST requests for the "Deflake this build" feature, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to rebuild a project at a previous git revision where the tests were failing.
Improper Authentication in Apache WSS4J
Advisory: GHSA-99v3-9x35-c5vf
Aliases: CVE-2014-3623
Published: 2022-05-13T01:09:20Z

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.
Improper Input Validation in XFire
Advisory: GHSA-5jc8-8xhv-g8qm
Aliases: CVE-2012-5817
Published: 2022-05-17T01:38:40Z

Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Missing Authentication for Critical Function in Apache Airflow
Advisory: GHSA-h88f-r7cw-8fv3
Aliases: CVE-2021-38540
Published: 2022-05-24T19:14:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0, <2.1.3.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-ggww-q2gv-m3g4
Aliases: CVE-2018-19799
Published: 2022-05-14T01:41:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Dolibarr ERP/CRM through 8.0.3 has `/exports/export.php?datatoexport=` XSS.
OnionShare Predictable Pathname
Advisory: GHSA-pwjq-6wrh-5w8q
Aliases: CVE-2018-19960
Published: 2022-05-14T01:36:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

The `debug_mode` function in `web/web.py` in OnionShare through 1.3.1, when `--debug` is enabled, uses the `/tmp/onionshare_server.log` pathname for logging, which might allow local users to overwrite files or obtain sensitive information by using this pathname.
Docker image code execution with Apache Mesos
Advisory: GHSA-32w9-2qpc-5f9v
Aliases: CVE-2019-0204
Published: 2022-05-13T01:04:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A specifically crafted Docker image running under the root user can overwrite the init helper binary of the container runtime and/or the command executor in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.2, 1.6.0 to 1.6.1, and 1.7.0 to 1.7.1. A malicious actor can therefore gain root-level code execution on the host.
phpMyAdmin Multiple XSS Vulnerabilities
Advisory: GHSA-q7v2-w38r-pv7v
Aliases: CVE-2012-4579
Published: 2022-05-17T05:25:11Z

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via a Table Operations (1) TRUNCATE or (2) DROP link for a crafted table name, (3) the Add Trigger popup within a Triggers page that references crafted table names, (4) an invalid trigger-creation attempt for a crafted table name, (5) crafted data in a table, or (6) a crafted tooltip label name during GIS data visualization, a different issue than CVE-2012-4345.
Improper Authentication in Apache Tomcat
Advisory: GHSA-hjfh-7c4v-7q8h
Aliases: CVE-2009-2901
Published: 2022-05-02T03:39:47Z

The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
PyJWT vulnerable to key confusion attacks
Advisory: GHSA-r9jw-mwhq-wp62
Aliases: CVE-2017-11424
Published: 2022-05-13T01:42:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.
Insertion of Sensitive Information into Log File in Apache Tomcat
Advisory: GHSA-c57p-3v2g-w9rg
Aliases: CVE-2011-2204
Published: 2022-05-14T01:17:03Z

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file.

This issue was fixed in Apache Tomcat 7.0.17 but the release votes for the 7.0.17 and 7.0.18 release candidates did not pass. Therefore, users must download 7.0.19 to obtain a version that includes a fix.
Deserialization of Untrusted Data in Spring AMQP
Advisory: GHSA-fx7f-rjqj-52pj
Aliases: CVE-2021-22097
Published: 2022-05-24T19:19:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In Spring AMQP versions 2.2.0 - 2.2.18 and 2.3.0 - 2.3.10, the Spring AMQP Message object, in its toString() method, will deserialize a body for a message with content type application/x-java-serialized-object. It is possible to construct a malicious java.util.Dictionary object that can cause 100% CPU usage in the application if the toString() method is called.
Missing permission checks in Google Kubernetes Engine Jenkins Plugin
Advisory: GHSA-wwr4-79jv-297r
Aliases: CVE-2019-10445
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Google Kubernetes Engine Plugin Prior to version 0.7.1 allows attackers with Overall/Read permission to obtain limited information about the scope of a credential with an attacker-specified credentials ID. This issue is patched in version 0.7.1
Openstack Magnum Unsafe Credential Handling
Advisory: GHSA-793v-r35j-9rp9
Aliases: CVE-2016-7404
Published: 2022-05-24T16:48:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances. While these should just be used for retrieving the instances' SSL certificates, they allow full API access, though and can be used to perform any API operation the user is authorized to perform.
Improper Neutralization of Special Elements used in a Command in Shell-quote
Advisory: GHSA-g4rg-993r-mgx7
Aliases: CVE-2021-42740
Published: 2022-05-24T19:18:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with `exec()`, an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is `{A-z]` instead of the correct `{A-Za-z]`. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Jenkins Publisher Over CIFS Plugin confused deputy vulnerability
Advisory: GHSA-rf7h-9m85-535v
Aliases: CVE-2018-1999038
Published: 2022-05-14T02:21:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 0.11, this form validation method requires POST requests and Overall/Administer permissions.
Django Denial of Service Vulnerability in the authentication framework 
Advisory: GHSA-4c42-4rxm-x6qf
Aliases: CVE-2013-1443
Published: 2022-05-17T04:53:45Z

The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.
Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component
Advisory: GHSA-84cw-mxhv-qvv4
Aliases: CVE-2016-1505
Published: 2022-05-17T03:43:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore.
Improper Neutralization of Input During Web Page Generation in Google Web Toolkit
Advisory: GHSA-x24q-xwrf-66jm
Aliases: CVE-2013-4204
Published: 2022-05-17T01:58:13Z

Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
HashiCorp go-getter unsafe downloads
Advisory: GHSA-fcgg-rvwg-jv58
Aliases: CVE-2022-30321
Published: 2022-05-26T00:01:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Protocol switching, endless redirect, and configuration bypass were possible via abuse of custom HTTP response header processing.
Incorrect Privilege Assignment in Jinja2
Advisory: GHSA-8r7q-cvjq-x353
Aliases: CVE-2014-1402
Published: 2022-05-14T04:04:14Z

The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.
Improper Authorization in Jenkins Core
Advisory: GHSA-8qxp-g8jv-p37x
Aliases: CVE-2019-1003004
Published: 2022-05-13T01:05:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
Magento 2 Community Edition Security Bypass
Advisory: GHSA-p9vf-4jx2-5hpp
Aliases: CVE-2019-8112
Published: 2022-05-24T17:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation.
ChakraCore RCE Vulnerability
Advisory: GHSA-36c3-jcm2-rm3j
Aliases: CVE-2016-7194
Published: 2022-05-14T02:22:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3386, CVE-2016-3389, and CVE-2016-7190.
Jenkins CRX Content Package Deployer Plugin subject to credentials enumeration via Missing Authorization
Advisory: GHSA-4cmq-88f8-53r5
Aliases: CVE-2019-10439
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins CRX Content Package Deployer Plugin prior to version 1.9 in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins. This issue is patched in version 1.9.
django-anymail Includes Sensitive Information in Log Files
Advisory: GHSA-qh9x-mc42-vg4g
Aliases: CVE-2018-1000089
Published: 2022-05-14T03:32:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app. This vulnerability appears to have been fixed in v1.4.
phpMyAdmin DoS Vulnerability
Advisory: GHSA-qgrq-64g6-mmh6
Aliases: CVE-2016-9863
Published: 2022-05-17T02:36:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in phpMyAdmin. With a very large request to table partitioning function, it is possible to invoke a Denial of Service (DoS) attack. All 4.6.x versions (prior to 4.6.5) are affected.
Canvs Canvas XSS Vulnerability
Advisory: GHSA-94hc-7qc9-34rf
Aliases: CVE-2017-1000507
Published: 2022-05-14T03:41:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Canvs Canvas version 3.4.2 contains a Cross Site Scripting (XSS) vulnerability in User's details that can result in denial of service and execution of javascript code.
Cross-site Scripting in Jenkins
Advisory: GHSA-hv45-5j9h-7fhg
Aliases: CVE-2018-1000407
Published: 2022-05-14T01:04:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/Api.java that allows attackers to specify URLs to Jenkins that result in rendering arbitrary attacker-controlled HTML by Jenkins.
Incorrect Authorization in Getahead Direct Web Remoting
Advisory: GHSA-384c-gg34-g96h
Aliases: CVE-2007-0184
Published: 2022-05-01T17:42:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.
Jenkins Alauda DevOps Pipeline Plugin allows attackers with Overall/Read permission to capture credentials stored in Jenkins
Advisory: GHSA-8rfc-v3vj-j62w
Aliases: CVE-2019-16574
Published: 2022-05-24T17:03:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A missing permission check in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
ChakraCore RCE Vulnerability
Advisory: GHSA-2m5h-6g38-jjf2
Aliases: CVE-2019-0568
Published: 2022-05-13T01:21:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0567.
CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code
Advisory: GHSA-g2vx-8v47-4vhh
Aliases: CVE-2010-4335
Published: 2022-05-17T05:44:11Z

The `_validatePost` function in `libs/controller/components/security.php` in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted `data[_Token][fields]` value that is processed by the unserialize function, as demonstrated by modifying the `file_map` cache to execute arbitrary local files.
Plone Arbitrary Code Execution via Unsafe Handling of Pickles
Advisory: GHSA-hf26-vvmx-x8c8
Aliases: CVE-2007-5741
Published: 2022-05-01T18:36:14Z

Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.
Jenkins Maven Release Plugin contains Cross-Site Request Forgery vulnerability
Advisory: GHSA-r4rv-cq77-6p24
Aliases: CVE-2019-10359
Published: 2022-05-24T16:51:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

A cross-site request forgery vulnerability in Jenkins Maven Release Plugin prior to 0.15.0 in the M2ReleaseAction#doSubmit method allowed attackers to perform releases with attacker-specified options.
Apache Geode vulnerable to Incorrect Authorization
Advisory: GHSA-jmg4-x4vp-6c6x
Aliases: CVE-2017-15695
Published: 2022-05-13T01:18:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager, a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Advisory: GHSA-cjcf-wm2p-59h5
Aliases: CVE-2017-3589
Published: 2022-05-13T01:45:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.0 Base Score 3.3 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
LibreNMS XSS Vulnerability
Advisory: GHSA-9m82-f3wx-p625
Aliases: CVE-2018-18478
Published: 2022-05-14T01:53:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Persistent Cross-Site Scripting (XSS) issues in LibreNMS before 1.44 allow remote attackers to inject arbitrary web script or HTML via the dashboard_name parameter in the /ajax_form.php resource, related to html/includes/forms/add-dashboard.inc.php, html/includes/forms/delete-dashboard.inc.php, and html/includes/forms/edit-dashboard.inc.php.
Access control bypass in beego
Advisory: GHSA-qx32-f6g6-fcfr
Aliases: CVE-2022-31259
Published: 2022-05-22T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The route lookup process in beego prior to 1.12.9 and 2.x prior to 2.0.3 allows attackers to bypass access control. When a /`p1`/`p2`/`:name` route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).
Cross-site Scripting in Jolokia agent
Advisory: GHSA-hfpg-gqjw-779m
Aliases: CVE-2018-1000129
Published: 2022-05-14T01:27:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
PHPExcel vulnerable to XXE attacks through libxml
Advisory: GHSA-28rm-rj57-qjpv
Aliases: CVE-2014-2054
Published: 2022-05-17T04:42:46Z

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Apache Tomcat Unrestricted file upload vulnerability
Advisory: GHSA-h6c8-x5r3-pm88
Aliases: CVE-2013-4444
Published: 2022-05-13T01:12:13Z

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.
Improper Authentication in SaltStack Salt
Advisory: GHSA-xf37-qcvf-7m57
Aliases: CVE-2021-22004
Published: 2022-05-24T19:13:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in SaltStack Salt before 3003.3. The salt minion installer will accept and use a minion config file at C:\salt\conf if that file is in place before the installer is run. This allows for a malicious actor to subvert the proper behaviour of the given minion software.
XML External Entity Reference in jbpmmigration
Advisory: GHSA-vc3x-72q4-g3p5
Aliases: CVE-2017-7545
Published: 2022-05-13T01:36:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

It was discovered that the XmlUtils class in jbpmmigration performed expansion of external parameter entities while parsing XML files. A remote attacker could use this flaw to read files accessible to the user running the application server and, potentially, perform other more advanced XML eXternal Entity (XXE) attacks.

The related jbpm-designer project removed use of jbpmmigration completely as a result.
Undertow Uncaught Exception vulnerability
Advisory: GHSA-3f57-w2rp-72fc
Aliases: CVE-2016-7046
Published: 2022-05-17T00:15:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

A long URL proxy request lead to java.nio.BufferOverflowException in Undertow.
Open redirect in ASP.NET Core
Advisory: GHSA-3wcj-rg8q-9cqv
Aliases: CVE-2017-11879
Published: 2022-05-14T03:47:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

ASP.NET Core 2.0 allows an attacker to steal log-in session information such as cookies or authentication tokens via a specially crafted URL aka "ASP.NET Core Elevation Of Privilege Vulnerability".
Djblets Cross-site scripting Vulnerability
Advisory: GHSA-4xf6-xr96-7vmp
Aliases: CVE-2014-3995
Published: 2022-05-17T04:42:00Z

A cross-site scripting (XSS) vulnerability in `gravatars/templatetags/gravatars.py` in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
Advisory: GHSA-wrrh-g7h3-gqmx
Aliases: CVE-2012-0818
Published: 2022-05-17T01:49:58Z

RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
Insufficient Verification of Data Authenticity in Apache Tomcat
Advisory: GHSA-73rx-3f9r-x949
Aliases: CVE-2017-7674
Published: 2022-05-14T01:10:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin. This permitted client and server side cache poisoning in some circumstances.
JFinal file validation vulnerability
Advisory: GHSA-279p-pc38-xx4p
Aliases: CVE-2019-17352
Published: 2022-05-25T19:21:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In JFinal cos before 2019-08-13, as used in JFinal 4.4, there is a vulnerability that can bypass the isSafeFile() function: one can upload any type of file. For example, a .jsp file may be stored and almost immediately deleted, but this deletion step does not occur for certain exceptions.
Credentials transmitted in plain text by Jenkins Logstash Plugin
Advisory: GHSA-5pg8-f89x-wjcx
Aliases: CVE-2020-2143
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Logstash Plugin stores credentials in its global configuration file `jenkins.plugins.logstash.LogstashConfiguration.xml` on the Jenkins controller as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Logstash Plugin 2.3.1 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Logstash Plugin 2.3.2 transmits the credentials in its global configuration encrypted.
Mortbay Jetty Discloses JSP Source Code
Advisory: GHSA-cwq3-qp8v-w8q3
Aliases: CVE-2005-3747
Published: 2022-05-01T02:20:38Z

Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash (`%5C`) characters.  NOTE: this might be the same issue as CVE-2006-2758.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-jpvq-v729-7j2h
Aliases: CVE-2020-2231
Published: 2022-05-24T17:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.
Gogs and Gitea SSRF Vulnerability
Advisory: GHSA-fg3x-rwq9-74cw
Aliases: CVE-2018-15192
Published: 2022-05-14T02:20:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.
Jenkins improperly ensures trust separation
Advisory: GHSA-66cr-6whx-732p
Aliases: CVE-2014-3665
Published: 2022-05-17T03:53:35Z

Jenkins prior to 1.587 and LTS before 1.580.1 do not properly ensure trust separation between a master and slaves, which might allow remote attackers to execute arbitrary code on the master by leveraging access to the slave.
MapProxy CSRF Vulnerability
Advisory: GHSA-g4rw-82hq-8jpr
Aliases: CVE-2017-1000426
Published: 2022-05-13T01:54:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

MapProxy version 1.10.3 and older is vulnerable to a Cross Site Scripting attack in the demo service resulting in possible information disclosure.
ChakraCore RCE Vulnerability
Advisory: GHSA-735f-mx7h-46w8
Aliases: CVE-2017-11910
Published: 2022-05-17T00:11:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
Apache Struts XSS
Advisory: GHSA-9848-v244-962p
Aliases: CVE-2012-1007
Published: 2022-05-14T02:21:24Z

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) `struts-cookbook/processSimple.do` or (3) `struts-cookbook/processDyna.do`.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-qpg9-83fv-x9ch
Aliases: CVE-2019-1003050
Published: 2022-05-13T01:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.
Apache Solr for TYPO3 (solr) extension is vulnerable to Cross-site scripting (XSS)
Advisory: GHSA-xc7q-q62f-wcvr
Aliases: CVE-2013-6289
Published: 2022-05-17T04:58:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Cross-site scripting (XSS) vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
AutoUpdater.NET allows XXE
Advisory: GHSA-75p2-hgw4-g7f7
Aliases: CVE-2019-20627
Published: 2022-05-24T17:12:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AutoUpdater.cs in AutoUpdater.NET before 1.5.8 allows XXE.
ChakraCore RCE Vulnerability
Advisory: GHSA-j762-mr2c-fmp9
Aliases: CVE-2018-0838
Published: 2022-05-13T01:18:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
ChakraCore RCE Vulnerability
Advisory: GHSA-538h-6rv2-wmj3
Aliases: CVE-2016-3214
Published: 2022-05-14T02:24:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3199.
RubyGems Code Injection vulnerability
Advisory: GHSA-7gcp-2gmq-w3xh
Aliases: CVE-2017-0899
Published: 2022-05-13T01:38:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

RubyGems prior to 2.6.13 is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences.
PHP League CommonMark vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-qx76-c53f-5c7q
Aliases: CVE-2018-20583
Published: 2022-05-14T01:40:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in the PHP League CommonMark library versions 0.15.6 through 0.18.x before 0.18.1 allows remote attackers to insert unsafe URLs into HTML (even if allow_unsafe_links is false) via a newline character (e.g., writing javascript as javascri%0apt).
Apache Tomcat Path Traversal Vulnerability
Advisory: GHSA-v5p2-vg3c-pmrr
Aliases: CVE-2007-5461
Published: 2022-05-01T18:33:34Z

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
Concrete CMS Cross-site Scripting via Survey Blocks
Advisory: GHSA-7388-7vq2-m4f4
Aliases: CVE-2021-28145
Published: 2022-05-24T17:44:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct Cross-site Scripting (XSS) attacks via a crafted survey block. This requires at least Editor privileges.
Mule modules contain Directory Traversal
Advisory: GHSA-mwh9-gr45-xvv4
Aliases: CVE-2019-15630
Published: 2022-05-24T16:55:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Directory Traversal in APIkit, http-connector, and OAuth2 Provider modules in Mulesoft 3.x, 4.x and Mulesoft API Gateway (all versions) released before August 1, 2019 allow remote attackers to read files accessible to the Mule process.
phpThumb is vulnerable to Server-Side Request Forgery (SSRF)
Advisory: GHSA-3747-gjc9-vvg6
Aliases: CVE-2013-6919
Published: 2022-05-17T04:19:03Z

The default configuration of phpThumb before 1.7.12 has a false value for the disable_debug option, which allows remote attackers to conduct Server-Side Request Forgery (SSRF) attacks via the src parameter.
Improper Restriction of XML External Entity Reference in  Apache uimaj
Advisory: GHSA-wp2f-hrg2-3r5m
Aliases: CVE-2017-15691
Published: 2022-05-14T00:58:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Apache uimaj prior to 2.10.2, Apache uimaj 3.0.0-xxx prior to 3.0.0-beta, Apache uima-as prior to 2.10.2, Apache uimaFIT prior to 2.4.0, Apache uimaDUCC prior to 2.2.2, this vulnerability relates to an XML external entity expansion (XXE) capability of various XML parsers. UIMA as part of its configuration and operation may read XML from various sources, which could be tainted in ways to cause inadvertent disclosure of local files or other internal content.
.NET Core Denial of Service Vulnerability
Advisory: GHSA-xcvr-qv8h-m7xw
Aliases: CVE-2018-0875
Published: 2022-05-13T01:07:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

.NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of Service vulnerability due to how specially crafted requests are handled, aka ".NET Core Denial of Service Vulnerability".
ChakraCore RCE Vulnerability
Advisory: GHSA-92j2-gg59-4572
Aliases: CVE-2016-3382
Published: 2022-05-14T02:23:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript engine, aka "Scripting Engine Memory Corruption Vulnerability."
Stored XSS vulnerability in Jenkins ECharts API Plugin
Advisory: GHSA-q397-w28f-jx97
Aliases: CVE-2020-2194
Published: 2022-05-24T17:19:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart.

This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Run/Update permission.

ECharts API Plugin 4.7.0-4 escapes the display name.
Uncontrolled Resource Consumption in Hawk
Advisory: GHSA-44pw-h2cw-w3vq
Aliases: CVE-2022-29167
Published: 2022-05-23T20:18:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H

Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse `Host` HTTP header (`Hawk.utils.parseHost()`), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. `parseHost()` was patched in `9.0.1` to use built-in `URL` class to parse hostname instead.`Hawk.authenticate()` accepts `options` argument. If that contains `host` and `port`, those would be used instead of a call to `utils.parseHost()`.
Django Vulnerable to MySQL Injection
Advisory: GHSA-wqjj-hx84-v449
Aliases: CVE-2014-0474
Published: 2022-05-17T03:07:04Z

The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."
ChakraCore RCE Vulnerability
Advisory: GHSA-ww6f-76ff-phhj
Aliases: CVE-2016-3202
Published: 2022-05-14T02:24:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
GeniXCMS XSS Vulnerability
Advisory: GHSA-pwr7-j6g3-hmx6
Aliases: CVE-2017-17431
Published: 2022-05-17T00:11:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, term, to, or token parameter. NOTE: this might overlap CVE-2017-14761, CVE-2017-14762, or CVE-2017-14765.
web2py is vulnerable to password brute-force attack
Advisory: GHSA-gv85-wgxc-vc56
Aliases: CVE-2016-10321
Published: 2022-05-14T00:57:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
Improper Control of Generation of Code in Apache Camel
Advisory: GHSA-x9fv-c87w-55wc
Aliases: CVE-2013-4330
Published: 2022-05-13T01:26:34Z

Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
django-cms CSRF Vulnerability
Advisory: GHSA-2pqc-gv8q-pvqv
Aliases: CVE-2015-5081
Published: 2022-05-17T01:57:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-985w-mqqp-7287
Aliases: CVE-2019-8120
Published: 2022-05-24T17:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user can inject arbitrary Javascript code by manipulating section of a POST request related to customer's email address.
ChakraCore RCE Vulnerability
Advisory: GHSA-p97q-j98q-f98w
Aliases: CVE-2018-8287
Published: 2022-05-13T01:20:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296, CVE-2018-8298.
ChakraCore RCE Vulnerability
Advisory: GHSA-8f4c-h6m3-22rw
Aliases: CVE-2018-8588
Published: 2022-05-13T01:21:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8541, CVE-2018-8542, CVE-2018-8543, CVE-2018-8551, CVE-2018-8555, CVE-2018-8556, CVE-2018-8557.
QuantConnect Lean vulnerable to insecure deserialization
Advisory: GHSA-ww7r-278h-48mh
Aliases: CVE-2020-20136
Published: 2022-05-24T17:36:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration of TypeNameHandling property in Json.NET library. One may avoid this issue by only running Lean in an environment where data provided is trusted.
tlslite remote denial of service vulnerability
Advisory: GHSA-4749-p7rx-8jjj
Aliases: CVE-2015-3220
Published: 2022-05-14T03:07:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The tlslite library before 0.4.9 for Python allows remote attackers to trigger a denial of service (runtime exception and process crash).
ChakraCore RCE Vulnerability
Advisory: GHSA-fw42-4mq4-4qpq
Aliases: CVE-2018-8500
Published: 2022-05-13T01:20:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore.
Pippo RCE Vulnerability
Advisory: GHSA-h892-x453-86wc
Aliases: CVE-2018-18240
Published: 2022-05-13T01:19:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.
Incorrect permission check in Health Advisor by CloudBees Plugin
Advisory: GHSA-c445-xm3f-hmfh
Aliases: CVE-2020-2258
Published: 2022-05-24T17:28:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to view an administrative configuration page.

Health Advisor by CloudBees Plugin 3.2.1 requires Overall/Administer to view its administrative configuration page.
Jenkins Cross-Site Request Forgery vulnerabilities
Advisory: GHSA-fg4r-f9j2-36mw
Aliases: CVE-2013-2034
Published: 2022-05-17T03:51:00Z

Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Advisory: GHSA-68g5-8q7f-m384
Aliases: CVE-2017-7675
Published: 2022-05-14T00:58:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The HTTP/2 implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M21 and 8.5.0 to 8.5.15 bypassed a number of security checks that prevented directory traversal attacks. It was therefore possible to bypass security constraints using a specially crafted URL.
October CMS PHP Code Execution
Advisory: GHSA-q263-j3q9-g964
Aliases: CVE-2017-1000119
Published: 2022-05-13T01:24:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
Exposure of Sensitive Information to an Unauthorized Actor in Apache HttpClient
Advisory: GHSA-gw85-4gmf-m7rh
Aliases: CVE-2011-1498
Published: 2022-05-17T05:39:03Z

Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
Inconsistent documentation in Apache Tomcat
Advisory: GHSA-372q-33vh-8mpc
Aliases: CVE-2017-15706
Published: 2022-05-14T01:10:15Z

As part of the fix for bug 61201, the documentation for Apache Tomcat 9.0.0.M22 to 9.0.1, 8.5.16 to 8.5.23, 8.0.45 to 8.0.47 and 7.0.79 to 7.0.82 included an updated description of the search algorithm used by the CGI Servlet to identify which script to execute. The update was not correct. As a result, some scripts may have failed to execute as expected and other scripts may have been executed unexpectedly. Note that the behaviour of the CGI servlet has remained unchanged in this regard. It is only the documentation of the behaviour that was wrong and has been corrected.
RubyGems Improper Input Validation vulnerability
Advisory: GHSA-qv62-xfj6-32xm
Aliases: CVE-2015-4020
Published: 2022-05-17T00:16:50Z

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.3.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack."

NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3900.