aswin1906/github-advisory-2022 huggingface dataset:
Symfony Session Fixation Vulnerability
Advisory: GHSA-g4rg-rw65-8hfg
Aliases: CVE-2018-11385
Published: 2022-05-14T01:22:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the Security component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. A session fixation vulnerability within the "Guard" login feature may allow an attacker to impersonate a victim towards the web application if the session id value was previously known to the attacker.
Improper Input Validation in Apache Karaf
Advisory: GHSA-m6g3-xq5q-4hg9
Aliases: CVE-2014-0219
Published: 2022-05-14T01:42:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Apache Karaf before 4.0.10 enables a shutdown port on the loopback interface, which allows local users to cause a denial of service (shutdown) by sending a shutdown command to all listening high ports.
Shopware vulnerable to Cross-site Scripting
Advisory: GHSA-fxf3-wx3c-76pf
Aliases: CVE-2020-13971
Published: 2022-05-24T17:24:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Shopware before 6.2.3, authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.
Improper Neutralization of Input During Web Page Generation  in Apache Tomcat
Advisory: GHSA-c78g-qwpw-2jgv
Aliases: CVE-2010-4172
Published: 2022-05-14T02:42:46Z

Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.
ChakraCore RCE Vulnerability
Advisory: GHSA-xxp7-423f-hcp4
Aliases: CVE-2018-8467
Published: 2022-05-13T01:20:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8367, CVE-2018-8465, CVE-2018-8466.
keycloak-httpd-client-install Insecure Secrets
Advisory: GHSA-89c9-3758-737w
Aliases: CVE-2017-15112
Published: 2022-05-14T00:55:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.
Login screen allows message spoofing if SSO is enabled
Advisory: GHSA-xmg8-99r8-jc2j
Aliases: CVE-2022-24905
Published: 2022-05-24T12:26:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

### Impact

A vulnerability was found in Argo CD that allows an attacker to spoof error messages on the login screen when SSO is enabled.

In order to exploit this vulnerability, an attacker would have to trick the victim to visit a specially crafted URL which contains the message to be displayed.

As far as the research of the Argo CD team concluded, it is not possible to specify any active content (e.g. Javascript) or other HTML fragments (e.g. clickable links) in the spoofed message.

### Patched versions

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.4
* v2.2.9
* v2.1.15

### Workarounds

No workaround available.

#### Mitigations

It is advised to update to an Argo CD version containing a fix for this issue (see *Patched versions* above).

### Credits

This vulnerability was discovered by Naufal Septiadi (<naufal@horangi.com>) and reported to us in a responsible way. 

### For more information

<!-- Use only one of the paragraphs below. Remove all others. -->

<!-- For Argo CD -->

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Cross-site Scripting in Eclipse Mojarra
Advisory: GHSA-rjhx-c9qh-qh8f
Aliases: CVE-2019-17091
Published: 2022-05-24T16:57:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces, allows Reflected XSS because a client window field is mishandled.
Cross-Site Request Forgery in Jenkins
Advisory: GHSA-rgmj-mccj-h9mx
Aliases: CVE-2018-1000195
Published: 2022-05-13T01:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

A server-side request forgery vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in ZipExtractionInstaller.java that allows users with Overall/Read permission to have Jenkins submit a HTTP GET request to an arbitrary URL and learn whether the response is successful (200) or not.
Cross-site Scripting in Auth0 Lock
Advisory: GHSA-7ww6-75fj-jcj7
Aliases: CVE-2022-29172
Published: 2022-05-24T20:49:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Overview

In versions before and including `11.32.2`, when the “additional signup fields” feature [is configured](https://github.com/auth0/lock#additional-sign-up-fields), a malicious actor can inject invalidated HTML code into these additional fields, which is then stored in the service `user_metdata` payload (using the `name` property).

Verification emails, when applicable, are generated using this metadata. It is therefor possible for an actor to craft a malicious link by injecting HTML, which is then rendered as the recipient's name within the delivered email template.

### Am I affected?
You are impacted by this vulnerability if you are using `auth0-lock` version `11.32.2` or lower and are using the “additional signup fields” feature in your application.

### How to fix that?
Upgrade to version `11.33.0`.

### Will this update impact my users?
Additional signup fields that have been added to the signup tab on Lock will have HTML tags stripped from user input from version `11.33.0` onwards. The user will not receive any validation warning or feedback, but backend data will no longer include HTML.
Elevation of privilege in ASP.NET Core
Advisory: GHSA-xr8f-59pp-rxxh
Aliases: CVE-2019-1302
Published: 2022-05-24T22:00:33Z

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.
Plone Unauthenticated Write Vulnerability
Advisory: GHSA-w6g9-xccc-347h
Aliases: CVE-2020-7941
Published: 2022-05-24T17:07:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.
Tarball permission preservation in puppet
Advisory: GHSA-vw22-465p-8j5w
Aliases: CVE-2017-10689
Published: 2022-05-13T01:41:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

When installing a module using the system tar, the PMT will filter filesystem permissions to a sane value. This may just be based on the user's umask.

When using minitar, files are unpacked with whatever permissions are in the tarball. This is potentially unsafe, as tarballs can be easily created with weird permissions.
Code-execution backdoor in marcador
Advisory: GHSA-57qv-h9m7-jxfg
Aliases: CVE-2022-28470
Published: 2022-05-09T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.
LXD vulnerable to Race Condition
Advisory: GHSA-8mpq-fmr3-6jxv
Aliases: CVE-2015-1340
Published: 2022-05-24T16:44:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

LXD before version 0.19-0ubuntu5 `doUidshiftIntoContainer()` has an unsafe `Chmod()` call that races against the stat in the `Filepath.Walk()` function. A symbolic link created in that window could cause any file on the system to have any mode of the attacker's choice.

### Specific Go Packages Affected
github.com/lxc/lxd/shared
Insecure Temporary File in Jinja2
Advisory: GHSA-fqh9-2qgg-h84h
Aliases: CVE-2014-0012
Published: 2022-05-17T04:01:00Z

FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.
Apache Solr for TYPO3 (solr) extension is vulnerable to Insecure Unserialize
Advisory: GHSA-7m7g-jq4m-98w5
Aliases: CVE-2013-6288
Published: 2022-05-17T04:58:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Unspecified vulnerability in the Apache Solr for TYPO3 (solr) extension before 2.8.3 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."
CSRF vulnerability in Jenkins Team Foundation Server Plugin allow capturing credentials
Advisory: GHSA-263q-5pj7-j6hj
Aliases: CVE-2021-21638
Published: 2022-05-24T17:45:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Team Foundation Server Plugin 5.157.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
wolfCrypt leaks cryptographic information via timing side channel
Advisory: GHSA-q95h-vc86-hv77
Aliases: CVE-2019-13628
Published: 2022-05-24T16:57:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

wolfSSL and wolfCrypt 4.0.0 and earlier (when configured without `--enable-fpecc`, `--enable-sp`, or` --enable-sp-math`) contain a timing side channel in ECDSA signature generation. This allows a local attacker, able to precisely measure the duration of signature operations, to infer information about the nonces used and potentially mount a lattice attack to recover the private key used. The issue occurs because ecc.c scalar multiplication might leak the bit length.
Docker Registry has Allocation of Resources Without Limits or Throttling
Advisory: GHSA-h62f-wm92-2cmw
Aliases: CVE-2017-11468
Published: 2022-05-13T01:16:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.
Missing permission checks in Jenkins Warnings Next Generation Plugin allow listing workspace contents
Advisory: GHSA-7j3x-xm4j-jfj7
Aliases: CVE-2021-21626
Published: 2022-05-24T17:44:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Warnings Next Generation Plugin 8.4.4 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents. A sequence of requests can be used to effectively list workspace contents.

Warnings Next Generation Plugin 8.5.0 requires Item/Configure permission to validate patterns with workspace contents.
Deserialization of Untrusted Data in Gson
Advisory: GHSA-4jrv-ppp4-jm57
Aliases: CVE-2022-25647
Published: 2022-05-03T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

The package `com.google.code.gson:gson` before 2.8.9 is vulnerable to Deserialization of Untrusted Data via the `writeReplace()` method in internal classes, which may lead to denial of service attacks.
ChakraCore RCE Vulnerability
Advisory: GHSA-3j65-2jcq-w9fr
Aliases: CVE-2018-0933
Published: 2022-05-13T01:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
Plone Sandbox Bypass
Advisory: GHSA-25jh-5h5r-h33m
Aliases: CVE-2012-5493
Published: 2022-05-17T04:32:23Z

`gtbn.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.
Code Injection in Django
Advisory: GHSA-rvq6-mrpv-m6rm
Aliases: CVE-2014-0472
Published: 2022-05-17T03:07:04Z

The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."
Incorrect permission checks in Jenkins Matrix Authorization Strategy Plugin may allow accessing some items
Advisory: GHSA-96jw-3xw4-mq9p
Aliases: CVE-2021-21623
Published: 2022-05-24T17:44:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Items (like jobs) can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well.

Matrix Authorization Strategy Plugin 2.6.5 and earlier does not correctly perform permission checks to determine whether an item should be accessible.

This allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.\n\nMatrix Authorization Strategy Plugin 2.6.6 requires Item/Read permission on parent items to grant Item/Read permission on an individual item.

As a workaround in older releases, do not grant permissions on individual items to users who do not have access to parent items.

In case of problems, the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.security.AuthorizationMatrixProperty.checkParentPermissions` can be set to false, completely disabling this fix.
Cobbler arbitrary code execution
Advisory: GHSA-96hw-v598-jvgh
Aliases: CVE-2017-1000469
Published: 2022-05-14T03:49:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user.
Authorization bypass in Spring Security
Advisory: GHSA-hh32-7344-cg2f
Aliases: CVE-2022-22978
Published: 2022-05-20T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Spring Security versions 5.5.6 and 5.5.7 and older unsupported versions, RegexRequestMatcher can easily be misconfigured to be bypassed on some servlet containers. Applications using RegexRequestMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Stored XSS vulnerability in Jenkins ECharts API Plugin
Advisory: GHSA-x9rq-9h44-f84v
Aliases: CVE-2020-2193
Published: 2022-05-24T17:19:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ECharts API Plugin 4.7.0-3 and earlier does not escape the parser identifier when rendering charts.

This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Job/Configure permission.

ECharts API Plugin 4.7.0-4 escapes the parser identifier.
Joomla! vulnerable to CRLF injection
Advisory: GHSA-h22q-g2c7-2jwj
Aliases: CVE-2007-4190
Published: 2022-05-01T18:21:10Z

CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) allows remote attackers to inject arbitrary HTTP headers and probably conduct HTTP response splitting attacks via CRLF sequences in the url parameter.  NOTE: this can be leveraged for cross-site scripting (XSS) attacks.  NOTE: some of these details are obtained from third party information.
Apache Superset SQL Injection when template processing is enabled
Advisory: GHSA-pg8m-4p8j-2p56
Aliases: CVE-2021-41971
Published: 2022-05-24T19:17:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.
Magento 2 Community Edition SQLi Vulnerability
Advisory: GHSA-4j6w-9rf8-hg7r
Aliases: CVE-2019-7139
Published: 2022-05-24T22:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Sony Neural Network Libraries reliance on untrusted inputs prior to v1.0.10
Advisory: GHSA-4q2w-rw7m-xqw6
Aliases: CVE-2019-10844
Published: 2022-05-13T01:07:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nbla/logger.cpp in libnnabla.a in Sony Neural Network Libraries (aka nnabla) prior to v1.0.10 relies on the HOME environment variable, which might be untrusted.
Symfony Cryptographic Vulnerability
Advisory: GHSA-jjx5-fq5g-8xpc
Aliases: CVE-2016-1902
Published: 2022-05-17T03:54:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Stored XSS vulnerability in Locked Files Report Plugin
Advisory: GHSA-9rhc-vjjp-gccw
Aliases: CVE-2020-2271
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Locked Files Report Plugin 1.6 and earlier does not escape locked files' names in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Exposure of Sensitive Information in moodle
Advisory: GHSA-fj6p-g234-rrv3
Aliases: CVE-2022-30598
Published: 2022-05-19T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-6456-xjm5-g3pg
Aliases: CVE-2018-1999007
Published: 2022-05-13T01:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers with the ability to control the existence of some URLs in Jenkins to define JavaScript that would be executed in another user's browser when that other user views HTTP 404 error pages while Stapler debug mode is enabled.
Improper Limitation of a Pathname to a Restricted Directory in SharpZipLib
Advisory: GHSA-cqj4-m2pc-v9m5
Aliases: CVE-2018-1002208
Published: 2022-05-13T01:35:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Command Injection in Pygments
Advisory: GHSA-fff8-4w9p-7v76
Aliases: CVE-2015-8557
Published: 2022-05-17T02:37:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The FontManager._get_nix_font_path function in formatters/img.py in Pygments 1.2.2 through 2.0.2 allows remote attackers to execute arbitrary commands via shell metacharacters in a font name.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Qpid Broker for Java
Advisory: GHSA-8vvh-crqv-jm64
Aliases: CVE-2016-8741
Published: 2022-05-17T02:24:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Apache Qpid Broker for Java can be configured to use different so called AuthenticationProviders to handle user authentication. Among the choices are the SCRAM-SHA-1 and SCRAM-SHA-256 AuthenticationProvider types. It was discovered that these AuthenticationProviders in Apache Qpid Broker for Java 6.0.x before 6.0.6 and 6.1.x before 6.1.1 prematurely terminate the SCRAM SASL negotiation if the provided user name does not exist thus allowing remote attacker to determine the existence of user accounts. The Vulnerability does not apply to AuthenticationProviders other than SCRAM-SHA-1 and SCRAM-SHA-256.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-vpg9-gq7j-mxqg
Aliases: CVE-2019-8144
Published: 2022-05-24T17:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through PageBuilder template methods.
Cross-site Scripting in Apache Struts
Advisory: GHSA-m3x6-9v6h-4g28
Aliases: CVE-2016-4003
Published: 2022-05-14T01:57:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in the URLDecoder function in JRE before 1.8, as used in Apache Struts 2.x before 2.3.28, when using a single byte page encoding, allows remote attackers to inject arbitrary web script or HTML via multi-byte characters in a url-encoded parameter.
Centreon XSS Vulnerability
Advisory: GHSA-7g3c-hrc6-5v4j
Aliases: CVE-2018-19280
Published: 2022-05-14T00:55:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.
Improper Privilege Management in Cilium
Advisory: GHSA-fmrf-gvjp-5j5g
Aliases: CVE-2022-29179
Published: 2022-05-24T21:15:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

### Impact

If an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed, the attacker can leverage Cilium's Kubernetes service account to gain access to cluster privileges that are more permissive than what is minimally required to operate Cilium. In affected releases, this service account had access to modify and delete `Pod` and `Node` resources. 

### Patches

The problem has been fixed and is available on versions >=1.9.16, >=1.10.11, >=1.11.5

### Workarounds

There are no workarounds available.

### Acknowledgements

The Cilium community has worked together with members of Isovalent, Amazon and Palo Alto Networks to prepare these mitigations.  Special thanks to Micah Hausler (AWS), Robert Clark (AWS), Yuval Avrahami (Palo Alto Networks), and Shaul Ben Hai (Palo Alto Networks) for their cooperation.

### For more information

If you have any questions or comments about this advisory:

Email us at [security@cilium.io](mailto:security@cilium.io)
Missing permission checks in Zephyr for JIRA Test Management Plugin
Advisory: GHSA-2q7j-52xg-x8fm
Aliases: CVE-2020-2216
Published: 2022-05-24T17:22:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified username and password.
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles
Advisory: GHSA-mrxv-65rv-6hxq
Aliases: CVE-2012-4413
Published: 2022-05-17T01:42:10Z

OpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.
python-apt Flawed Package Integrity Check
Advisory: GHSA-rp8m-h266-53jh
Aliases: CVE-2019-15795
Published: 2022-05-24T17:12:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

python-apt only checks the MD5 sums of downloaded files in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py in version 1.9.0ubuntu1 and earlier. This allows a man-in-the-middle attack which could potentially be used to install altered packages and has been fixed in versions 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
Plone XSS
Advisory: GHSA-v3hp-f8qr-cf3p
Aliases: CVE-2016-7138
Published: 2022-05-14T02:45:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CodeIgniter Rest Server XXE Vulnerability
Advisory: GHSA-cc7g-9pcj-7gwm
Aliases: CVE-2015-3907
Published: 2022-05-24T16:49:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CodeIgniter Rest Server (aka codeigniter-restserver) 2.7.1 allows XXE attacks.
eyeD3 is vulnerable to arbitrary file modification via symlink attack
Advisory: GHSA-4r2w-w73w-36jm
Aliases: CVE-2014-1934
Published: 2022-05-14T02:09:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

tag.py in eyeD3 (aka python-eyed3) 0.7.5 and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
Cross-Site Request Forgery in Jenkins Alauda Kubernetes Suport Plugin
Advisory: GHSA-5hvr-3fcr-wx8c
Aliases: CVE-2019-16575
Published: 2022-05-24T17:03:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.
ChakraCore RCE Vulnerability
Advisory: GHSA-8rqh-8726-83h7
Aliases: CVE-2018-8133
Published: 2022-05-13T01:20:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0943, CVE-2018-8130, CVE-2018-8145, CVE-2018-8177.
Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file
Advisory: GHSA-5c97-gxr3-r368
Aliases: CVE-2019-16572
Published: 2022-05-24T17:03:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Weibo Plugin 1.0.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Apache ODE Path Traversal vulnerability
Advisory: GHSA-jf7g-5q92-4hp2
Aliases: CVE-2018-1316
Published: 2022-05-14T03:35:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The ODE process deployment web service was sensible to deployment messages with forged names. Using a path for the name was allowing directory traversal, resulting in the potential writing of files under unwanted locations, the overwriting of existing files or their deletion. This issue was addressed in Apache ODE 1.3.3 which was released in 2009, however the incorrect name CVE-2008-2370 was used on the advisory by mistake.
Integer Overflow or Wraparound in Apache Tomcat
Advisory: GHSA-475f-74wp-pqv5
Aliases: CVE-2014-0075
Published: 2022-05-14T01:10:19Z

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Advisory: GHSA-r58r-74gx-6wx3
Aliases: CVE-2017-15412
Published: 2022-05-14T02:19:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use after free in libxml2 before 2.9.5, as used in Google Chrome prior to 63.0.3239.84 and other products, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
View name validation bypass in Jenkins
Advisory: GHSA-w2hv-rcqr-2h7r
Aliases: CVE-2021-21640
Published: 2022-05-24T17:46:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not properly check that a newly created view has an allowed name. When a form to create a view is submitted, the name is included twice in the submission. One instance is validated, but the other instance is used to create the value.

This allows attackers with View/Create permission to create views with invalid or already-used names.

Jenkins 2.287, LTS 2.277.2 uses the same submitted value for validation and view creation.
Typo3 Information Disclosure
Advisory: GHSA-vccp-5v5h-p8m6
Aliases: CVE-2014-3946
Published: 2022-05-17T04:42:47Z

Failing to respect user groups of logged in users when caching queries, Extbase is susceptible to information disclosure. The query caching (introduced in Extbase 6.2) used to cache queries that query results for a specific user group were presented to a different group.
Improper Authentication in Apache ActiveMQ
Advisory: GHSA-p358-58jj-hp65
Aliases: CVE-2013-3060
Published: 2022-05-17T03:46:28Z

The web console in Apache ActiveMQ before 5.8.0 does not require authentication, which allows remote attackers to obtain sensitive information or cause a denial of service via HTTP requests.
Moodle XSS Vulnerability
Advisory: GHSA-9jf6-wq34-fg9w
Aliases: CVE-2019-14881
Published: 2022-05-24T17:11:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in moodle 3.7 to 3.7.2 and before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed.
Kirby XSS Vulnerability
Advisory: GHSA-275c-v3rc-xghx
Aliases: CVE-2017-16807
Published: 2022-05-14T00:55:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.
Magento 2 Community Edition Insufficient Logging
Advisory: GHSA-fp5m-4mqh-849p
Aliases: CVE-2019-8123
Published: 2022-05-24T17:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. The logging feature required for effective monitoring did not contain sufficent data to effectively track configuration changes.
Improper Access Control in Elasticsearch
Advisory: GHSA-fh5x-4j57-6q5x
Aliases: CVE-2015-4165
Published: 2022-05-14T02:48:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

The snapshot API in Elasticsearch before 1.6.0 when another application exists on the system that can read Lucene files and execute code from them, is accessible by the attacker, and the Java VM on which Elasticsearch is running can write to a location that the other application can read and execute from, allows remote authenticated users to write to and create arbitrary snapshot metadata files, and potentially execute arbitrary code.
Time-of-check Time-of-use (TOCTOU) Race Condition in Jenkins
Advisory: GHSA-qxp6-27gw-99cj
Aliases: CVE-2021-21615
Published: 2022-05-24T17:40:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Due to a time-of-check to time-of-use (TOCTOU) race condition, the file browser for workspaces, archived artifacts, and `$JENKINS_HOME/userContent/` follows symbolic links to locations outside the directory being browsed in Jenkins 2.275 and LTS 2.263.2.

This allows attackers with Job/Workspace permission and the ability to control workspace contents, e.g., with Job/Configure permission or the ability to change SCM contents, to create symbolic links that allow them to access files outside workspaces using the workspace browser.

This issue is caused by an incorrectly applied fix for SECURITY-1452 / CVE-2021-21602 in the [2021-01-13 security advisory](https://www.jenkins.io/security/advisory/2021-01-13/#SECURITY-1452).

Jenkins 2.276, LTS 2.263.3 no longer differentiates the check and the use of symlinks in workspace browsers.
Bottle does not properly limit content-types
Advisory: GHSA-873q-wpqr-xfgw
Aliases: CVE-2014-3137
Published: 2022-05-17T04:19:29Z

Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a `;` (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.
Cross-site Scripting in Apache Jetspeed
Advisory: GHSA-hj2v-85ph-8g48
Aliases: CVE-2016-0712
Published: 2022-05-17T03:56:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal.
Cross-site Scripting in com.erudika:para-core
Advisory: GHSA-phvw-r25p-8xv7
Aliases: CVE-2022-1782
Published: 2022-05-19T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11.
OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
Advisory: GHSA-972c-cfv8-2hq8
Aliases: CVE-2016-0737
Published: 2022-05-17T03:32:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
Missing permission checks in ElasTest Plugin
Advisory: GHSA-mr43-vf8q-q5f2
Aliases: CVE-2020-2272
Published: 2022-05-24T17:28:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Improper Authorization in Apache Xalan-Java
Advisory: GHSA-rc2w-r4jq-7pfx
Aliases: CVE-2014-0107
Published: 2022-05-13T01:05:38Z

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
ChakraCore RCE Vulnerability
Advisory: GHSA-g3m9-qrfj-xw4g
Aliases: CVE-2020-1073
Published: 2022-05-24T17:19:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'.
ChakraCore RCE Vulnerability
Advisory: GHSA-g6mc-8679-ghx9
Aliases: CVE-2020-0713
Published: 2022-05-24T17:08:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0767.
Craft CMS XSS Vulnerability
Advisory: GHSA-9mcw-mwxv-grwj
Aliases: CVE-2017-8384
Published: 2022-05-17T02:46:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.
RDF4J vulnerable to zip slip
Advisory: GHSA-x3cr-x949-h5jv
Aliases: CVE-2018-20227
Published: 2022-05-14T01:42:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

RDF4J prior to 2.5.0 allows Directory Traversal via ../ in an entry in a ZIP archive.
CSRF vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Advisory: GHSA-mwg2-3xpv-5v28
Aliases: CVE-2021-22512
Published: 2022-05-24T17:46:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Micro Focus Application Automation Tools Plugin 6.7 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to attacker-specified URLs using attacker-specified username and password.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Micro Focus Application Automation Tools Plugin 6.8 requires POST requests and Overall/Administer permission for the affected form validation methods.
Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin
Advisory: GHSA-345p-pw5q-g98v
Aliases: CVE-2019-16546
Published: 2022-05-24T17:01:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks. Google Compute Engine Plugin 4.2.0 verifies SSH host keys before executing any commands on agents.
golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer
Advisory: GHSA-4r78-hx75-jjj2
Aliases: CVE-2018-17847
Published: 2022-05-13T01:19:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The html package (aka `x/net/html`) through 2018-09-25 in Go mishandles `<svg><template><desc><t><svg></template>`, leading to a `panic: runtime error` (index out of range) in `(*nodeStack).pop` in node.go, called from `(*parser).clearActiveFormattingElements`, during an `html.Parse` call.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-6qh6-v99h-vh4c
Aliases: CVE-2019-7876
Published: 2022-05-24T16:52:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.
Credentials stored in plain text by Zephyr Enterprise Test Management Plugin
Advisory: GHSA-xv58-gp43-6m76
Aliases: CVE-2020-2145
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Zephyr Enterprise Test Management Plugin 1.9.1 and earlier stores its Zephyr password in plain text in the global configuration file `com.thed.zephyr.jenkins.reporter.ZeeReporter.xml`. This password can be viewed by users with access to the Jenkins controller file system.

Zephyr Enterprise Test Management Plugin 1.10 integrates with [Credentials Plugin](https://plugins.jenkins.io/credentials).
Path Traversal in FileGator
Advisory: GHSA-rrhw-54r8-545q
Aliases: CVE-2022-1850
Published: 2022-05-25T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Path Traversal in FileGator prior to 7.8.0 for non-admin users. Files created with `..\` as part of their name will be interpreted as a path. Users are thus able to add filesystem entries outside the scope of their user to their dashboard and subsequently are able to modify those files.
Pimcore SQLi Vulnerability
Advisory: GHSA-q4hw-c66h-4xqc
Aliases: CVE-2018-14058
Published: 2022-05-14T02:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Pimcore before 5.3.0 allows SQL Injection via the REST web service API.
Argument injection in python-libnmap
Advisory: GHSA-qwqv-j7jr-4hp6
Aliases: CVE-2022-30284
Published: 2022-05-06T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not validate arguments).
Jenkins Azure AD Plugin allows bypassing CSRF protection for any URL
Advisory: GHSA-x77r-7m5w-pqq2
Aliases: CVE-2021-21679
Published: 2022-05-24T19:12:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs. Azure AD Plugin implements this extension point for URLs used by a JavaScript component.

In Azure AD Plugin 179.vf6841393099e and earlier this implementation is too permissive, allowing attackers to craft URLs that would bypass the CSRF protection of any target URL.

This vulnerability was originally introduced in Azure AD Plugin 164.v5b48baa961d2.

Azure AD Plugin 180.v8b1e80e6f242 no longer allows bypassing CSRF protection for URLs used by the JavaScript component. Instead, that component was reconfigured to pass the expected CSRF token.
Moodle Information Disclosure
Advisory: GHSA-w2pj-r8m3-r4jc
Aliases: CVE-2017-7531
Published: 2022-05-13T01:12:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In Moodle 3.3, the course overview block reveals activities in hidden courses.
XXE vulnerability in Jenkins Code Coverage API Plugin
Advisory: GHSA-cmgm-q8hf-p7jc
Aliases: CVE-2020-2172
Published: 2022-05-24T17:13:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Code Coverage API Plugin 1.1.4 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the \"Publish Coverage Report\" post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Code Coverage API Plugin 1.1.5 disables external entity resolution for its XML parser.
SoSReport Predictable Tmp File Names
Advisory: GHSA-3g56-2hh3-35ph
Aliases: CVE-2015-7529
Published: 2022-05-13T01:54:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory, as demonstrated by `sosreport-$hostname-$date.tar` in `/tmp/sosreport-$hostname-$date`.
Improper Neutralization of Input During Web Page Generation in Mojarra
Advisory: GHSA-3m3r-82gc-53mj
Aliases: CVE-2013-5855
Published: 2022-05-14T02:54:24Z

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-crv7-r357-gw3w
Aliases: CVE-2019-8114
Published: 2022-05-24T17:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload.
spree_auth_devise allows remote authenticated users to assign themselves arbitrary roles
Advisory: GHSA-jp57-9j37-5476
Aliases: CVE-2013-2506
Published: 2022-05-17T05:13:40Z

`app/models/spree/user.rb` in spree_auth_devise in Spree 1.1.x before 1.1.6, 1.2.x, and 1.3.x does not perform mass assignment safely when updating a user, which allows remote authenticated users to assign arbitrary roles to themselves.
Elastic APM agent for Python client CGI proxy redirection flaw
Advisory: GHSA-22jh-6gx8-f944
Aliases: CVE-2019-7617
Published: 2022-05-24T16:54:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing.
Generation of Error Message Containing Sensitive Information in Elasticsearch
Advisory: GHSA-q394-h7f5-7f44
Aliases: CVE-2021-22145
Published: 2022-05-24T19:08:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.
Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
Advisory: GHSA-rhcg-rwhx-qj3j
Aliases: CVE-2014-3578
Published: 2022-05-14T00:56:29Z

Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-h3vg-4x76-v28w
Aliases: CVE-2017-14241
Published: 2022-05-17T01:05:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php.
Improper Privilege Management in Azure ms-rest-nodeauth
Advisory: GHSA-qpfw-4m9x-rxx8
Aliases: CVE-2021-28458
Published: 2022-05-24T17:47:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability