aswin1906/github-advisory-2022 huggingface dataset:
Apache ORC vulnerable to Uncontrolled Recursion
Advisory: GHSA-mqmp-4mcp-vg8v
Aliases: CVE-2018-8015
Published: 2022-05-13T01:20:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Apache ORC 1.0.0 to 1.4.3 a malformed ORC file can trigger an endlessly recursive function call in the C++ or Java parser. The impact of this bug is most likely denial-of-service against software that uses the ORC file parser. With the C++ parser, the stack overflow might possibly corrupt the stack.
Ansible Remote Code Execution
Advisory: GHSA-qg47-5px9-32g7
Aliases: CVE-2014-4657
Published: 2022-05-17T19:57:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The `safe_eval` function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
Advisory: GHSA-x8q8-4hp5-463w
Aliases: CVE-2015-3337
Published: 2022-05-17T04:12:25Z

Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
OpenTSDB vulnerable to OS Command Injection
Advisory: GHSA-cx2v-jrjc-g54w
Aliases: CVE-2018-12972
Published: 2022-05-13T01:49:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in OpenTSDB 2.3.0. Many parameters to the /q URI can execute commands, including o, key, style, and yrange and y2range and their JSON input.
phpMyAdmin CRLF Injection Vulnerability
Advisory: GHSA-wj42-52pv-wfj2
Aliases: CVE-2005-3621
Published: 2022-05-01T02:19:36Z

CRLF injection vulnerability in phpMyAdmin before 2.6.4-pl4 allows remote attackers to conduct HTTP response splitting attacks via unspecified scripts.
Deserialization of Untrusted Data in Hazelcast
Advisory: GHSA-jv65-pf7v-f7p8
Aliases: CVE-2016-10750
Published: 2022-05-24T16:46:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
Improper Authentication in Jenkins Blue Ocean Plugin
Advisory: GHSA-rm5m-9mx4-g5r7
Aliases: CVE-2017-1000110
Published: 2022-05-13T01:40:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. It did not properly check the current user's authentication and authorization when configuring existing GitHub organization folders. This allowed users with read access to the GitHub organization folder to reconfigure it, including changing the GitHub API endpoint for the organization folder to an attacker-controlled server to obtain the GitHub access token, if the organization folder was initially created using Blue Ocean.
XML external entity vulnerability in Jenkins Nuget Plugin
Advisory: GHSA-p674-hh8x-rv5h
Aliases: CVE-2021-21658
Published: 2022-05-24T19:03:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Nuget Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This XML parser is used for the \"Build on NuGet updates\" feature.

This allows attackers with the ability to control the contents of the `packages.config` file in a workspace to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Nuget Plugin 1.1 disables external entity resolution for its XML parser.
Ansible Code Injection Vulnerability
Advisory: GHSA-66c7-5pwv-mm3j
Aliases: CVE-2014-4678
Published: 2022-05-24T22:01:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.
Cross-Site Request Forgery in Jolokia
Advisory: GHSA-xcxf-7q4p-cj26
Aliases: CVE-2018-10899
Published: 2022-05-24T16:51:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
Cross-site scripting in Elasticsearch
Advisory: GHSA-8699-m855-cwqf
Aliases: CVE-2014-6439
Published: 2022-05-14T02:51:14Z

Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Nokogiri Improperly Handles Unexpected Data Type
Advisory: GHSA-xh29-r2w5-wx8m
Aliases: CVE-2022-29181
Published: 2022-05-23T23:15:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

### Summary

Nokogiri `< v1.13.6` does not type-check all inputs into the XML and HTML4 SAX parsers. For CRuby users, this may allow specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory.

### Severity

The Nokogiri maintainers have evaluated this as **High 8.2** (CVSS3.1).


### Mitigation

CRuby users should upgrade to Nokogiri `>= 1.13.6`.

JRuby users are not affected.


### Workarounds

To avoid this vulnerability in affected applications, ensure the untrusted input is a `String` by calling `#to_s` or equivalent.


### Credit

This vulnerability was responsibly reported by @agustingianni and the Github Security Lab.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
Advisory: GHSA-g48f-ff5h-5f64
Aliases: CVE-2015-1776
Published: 2022-05-17T03:44:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Hadoop 2.6.x encrypts intermediate data generated by a MapReduce job and stores it along with the encryption key in a credentials file on disk when the Intermediate data encryption feature is enabled, which allows local users to obtain sensitive information by reading the file.
Cross-site Scripting in Microweber
Advisory: GHSA-f23x-4gf4-m9ff
Aliases: CVE-2022-1584
Published: 2022-05-05T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Microweber prior to version 1.2.16 is vulnerable to cross-site scripting. This vulnerability allows an attacker to execute JavaScript as the victim.
ChakraCore RCE Vulnerability
Advisory: GHSA-2589-r26x-mh8p
Aliases: CVE-2018-8503
Published: 2022-05-13T01:20:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8505, CVE-2018-8510, CVE-2018-8511, CVE-2018-8513.
Cross-site scripting in Apache Tomcat
Advisory: GHSA-pm78-wxxf-fw98
Aliases: CVE-2006-7196
Published: 2022-05-01T07:45:38Z

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.
XXE vulnerability in Jenkins Valgrind Plugin
Advisory: GHSA-xq2q-8hxc-7jr2
Aliases: CVE-2020-2245
Published: 2022-05-24T17:27:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Valgrind Plugin 0.28 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for the Valgrind plugin parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Silverstripe CMS XSS Vulnerability
Advisory: GHSA-2pw2-qpcp-m47x
Aliases: CVE-2020-9311
Published: 2022-05-24T17:23:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In SilverStripe through 4.5, malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.
Symfony HTTP Foundation web cache poisoning
Advisory: GHSA-8wgj-6wx8-h5hq
Aliases: CVE-2018-14773
Published: 2022-05-13T01:05:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in Http Foundation in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. It arises from support for a (legacy) IIS header that lets users override the path in the request URL via the X-Original-URL or X-Rewrite-URL HTTP request header. These headers are designed for IIS support, but it's not verified that the server is in fact running IIS, which means anybody who can send these requests to an application can trigger this. This affects \Symfony\Component\HttpFoundation\Request::prepareRequestUri() where X-Original-URL and X_REWRITE_URL are both used. The fix drops support for these methods so that they cannot be used as attack vectors such as web cache poisoning.
OpenStack Image Service (Glance) allows remote authenticated users to bypass access restrictions
Advisory: GHSA-q748-mcwg-xmqv
Aliases: CVE-2015-5251
Published: 2022-05-17T04:04:02Z

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the status of their images and bypass access restrictions via the HTTP x-image-meta-status header to images/*.
phpMyAdmin XSS Vulnerability
Advisory: GHSA-vxj6-pm6r-23hq
Aliases: CVE-2018-12581
Published: 2022-05-14T03:08:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in js/designer/move.js in phpMyAdmin before 4.8.2. A Cross-Site Scripting vulnerability has been found where an attacker can use a crafted database name to trigger an XSS attack when that database is referenced from the Designer feature.
Django cross-site request forgery (CSRF) vulnerability
Advisory: GHSA-r5cj-wv24-92p5
Aliases: CVE-2008-3909
Published: 2022-05-02T00:05:00Z

The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and delete or modify data via unspecified requests.
ChakraCore RCE Vulnerability
Advisory: GHSA-ghwq-7v3r-5433
Aliases: CVE-2017-0252
Published: 2022-05-17T02:44:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0223.
Infinispan Rest API Does Not Enforce Auth Constraints
Advisory: GHSA-mvxp-3j62-jqr6
Aliases: CVE-2017-2638
Published: 2022-05-13T01:36:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.
Core dump when loading TFLite models with quantization in TensorFlow
Advisory: GHSA-8wwm-6264-x792
Aliases: CVE-2022-29212
Published: 2022-05-24T22:16:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
Certain TFLite models that were created using TFLite model converter would crash when loaded in the TFLite interpreter. The culprit is that during quantization the scale of values could be greater than 1 but code was always assuming sub-unit scaling.

Thus, since code was calling [`QuantizeMultiplierSmallerThanOneExp`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/lite/kernels/internal/quantization_util.cc#L114-L123), the `TFLITE_CHECK_LT` assertion would trigger and abort the process.

### Patches
We have patched the issue in GitHub commit [a989426ee1346693cc015792f11d715f6944f2b8](https://github.com/tensorflow/tensorflow/commit/a989426ee1346693cc015792f11d715f6944f2b8).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/43661).
Plaintext Storage of Sensitive Information in Laravel Log Viewer before v0.13.0
Advisory: GHSA-63qj-p8gh-5xxx
Aliases: CVE-2018-8947
Published: 2022-05-13T01:53:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

rap2hpoutre Laravel Log Viewer before v0.13.0 relies on Base64 encoding for l, dl, and del requests, which makes it easier for remote attackers to bypass intended access restrictions, as demonstrated by reading arbitrary files via a dl request.
Jenkins Google Compute Engine Plugin Cross-Site Request Forgery vulnerability
Advisory: GHSA-x24m-wr2f-p3vc
Aliases: CVE-2019-16548
Published: 2022-05-24T17:01:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents. Google Compute Engine Plugin 4.2.0 requires POST requests for this API endpoint.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-v99w-jxr4-w6mc
Aliases: CVE-2019-8117
Published: 2022-05-24T17:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticates user can inject arbitrary JavaScript code via product view id specification.
Allocation of Resources Without Limits or Throttling in Spring Framework
Advisory: GHSA-rqph-vqwm-22vc
Aliases: CVE-2022-22971
Published: 2022-05-13T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
Improper Input Validation in Apache Santuario XML Security
Advisory: GHSA-4p4w-6h54-g885
Aliases: CVE-2013-4517
Published: 2022-05-13T01:05:55Z

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.
ChakraCore RCE Vulnerability
Advisory: GHSA-mm5q-x9qg-x4vp
Aliases: CVE-2018-8465
Published: 2022-05-13T01:20:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8367, CVE-2018-8466, CVE-2018-8467.
Path traversal in Jenkins Mercurial Plugin
Advisory: GHSA-5786-3qjg-mr88
Aliases: CVE-2022-30948
Published: 2022-05-18T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SCMs support a number of different URL schemes, including local file system paths (e.g. using file: URLs).

Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well.

This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents
ONOS DoS
Advisory: GHSA-c6p7-vhw7-rc9w
Aliases: CVE-2017-13763
Published: 2022-05-13T01:43:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ONOS versions 1.8.0, 1.9.0, and 1.10.0 do not restrict the amount of memory allocated. The Netty payload size is not limited.
DotNetNuke Vulnerable to XSS in Pass-Through Values
Advisory: GHSA-xr96-7ccp-pg5c
Aliases: CVE-2007-0660
Published: 2022-05-01T17:46:11Z

Cross-site scripting (XSS) vulnerability in the IFrame module before 03.02.01 for DotNetNuke (DNN), caused by improper validation of user-supplied input by an unspecified script. Pass through values were not getting filtered, leaving them vulnerable to XSS.  A remote attacker could exploit this vulnerability using various parameters in a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat
Advisory: GHSA-w3j5-q8f2-3cqq
Aliases: CVE-2016-8745
Published: 2022-05-14T01:10:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processor cache multiple times. This in turn meant that the same Processor could be used for concurrent requests. Sharing a Processor can result in information leakage between requests including, not not limited to, session ID and the response body. The bug was first noticed in 8.5.x onwards where it appears the refactoring of the Connector code for 8.5.x onwards made it more likely that the bug was observed. Initially it was thought that the 8.5.x refactoring introduced the bug but further investigation has shown that the bug is present in all currently supported Tomcat versions.
sinatra does not validate expanded path matches
Advisory: GHSA-qp49-3pvw-x4m5
Aliases: CVE-2022-29970
Published: 2022-05-03T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Sinatra before 2.2.0 does not validate that the expanded path matches public_dir when serving static files.
Silverstripe CMS information disclosure
Advisory: GHSA-gm5x-hpmw-xpxg
Aliases: CVE-2020-6164
Published: 2022-05-24T17:23:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to execution in a CLI context, and is not known to present a vulnerability through web-based access. As a side-effect, this preconfigured path also blocks the creation of other resources on this path (e.g. a page).
Improper Input Validation in Apache Axis2
Advisory: GHSA-23vv-v25h-qwqw
Aliases: CVE-2010-1632
Published: 2022-05-17T02:22:43Z

Apache Axis2 before 1.5.2, as used in IBM WebSphere Application Server (WAS) 7.0 through 7.0.0.12, IBM Feature Pack for Web Services 6.1.0.9 through 6.1.0.32, IBM Feature Pack for Web 2.0 1.0.1.0, Apache Synapse, Apache ODE, Apache Tuscany, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to the Synapse SimpleStockQuoteService.
Restlet is vulnerable to Arbitrary Java Code Execution via crafted XML
Advisory: GHSA-92j2-5r7p-6hjw
Aliases: CVE-2013-4221
Published: 2022-05-17T03:28:12Z

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.
Concrete CMS Potential XSS
Advisory: GHSA-2mvg-c6mg-3q63
Aliases: CVE-2017-7725
Published: 2022-05-13T01:08:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching, if the administrator did not define a "canonical" URL on installation of concrete5 using the "Advanced Options" settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors, potentially an XSS vector.
ChakraCore RCE Vulnerability
Advisory: GHSA-7cc5-cqmx-9v7g
Aliases: CVE-2018-8177
Published: 2022-05-13T01:20:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-0943, CVE-2018-8130, CVE-2018-8133, CVE-2018-8145.
OpenStack Image Service (Glance) allows remote authenticated users to read arbitrary file
Advisory: GHSA-q73f-vjc2-3gqf
Aliases: CVE-2015-5163
Published: 2022-05-17T03:44:51Z

The import task action in OpenStack Image Service (Glance) 2015.1.x before 2015.1.2 (kilo), when using the V2 API, allows remote authenticated users to read arbitrary files via a crafted backing file for a qcow2 image.
EpicEditor XSS Vulnerability
Advisory: GHSA-4wc5-gfgh-4vjx
Aliases: CVE-2017-6589
Published: 2022-05-17T02:56:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document.
linux-cmdline is vulnerable to Prototype Pollution via the constructor
Advisory: GHSA-2c29-wc65-4cx9
Aliases: CVE-2020-7704
Published: 2022-05-24T17:26:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package linux-cmdline is a parser for Linux kernel command line arguments. Versions before 1.0.1 are vulnerable to Prototype Pollution via the constructor.
Jenkins Mattermost Notification Plugin contains unencrypted storage of secret token
Advisory: GHSA-xcj6-4355-2823
Aliases: CVE-2019-10459
Published: 2022-05-24T16:59:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Mattermost Notification Plugin 2.7.0 and earlier stored webhook URLs containing a secret token unencrypted in its global configuration file and job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
Incorrect Authorization in MySQL Connector Java
Advisory: GHSA-w6f2-8wx4-47r5
Aliases: CVE-2021-2471
Published: 2022-05-24T19:18:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).
Improper Access Control in Apache Shiro
Advisory: GHSA-p836-389h-j692
Aliases: CVE-2016-4437
Published: 2022-05-14T02:46:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
ChakraCore RCE Vulnerability
Advisory: GHSA-wjmf-6x7g-xq67
Aliases: CVE-2018-1022
Published: 2022-05-13T01:18:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.
Improper Authentication in Apache CXF
Advisory: GHSA-p5c5-6564-vvr8
Aliases: CVE-2013-0239
Published: 2022-05-05T02:48:38Z

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
Nokogiri vulnerable to DoS while parsing XML entities
Advisory: GHSA-jmhh-w7xp-wg39
Aliases: CVE-2013-6461
Published: 2022-05-05T00:29:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Nokogiri gem 1.5.x and 1.6.x has DoS while parsing XML entities by failing to apply limits
Cross-site Scripting in bootstrap-table
Advisory: GHSA-grw5-g9h2-wpg8
Aliases: CVE-2022-1726
Published: 2022-05-17T00:01:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties.
Non-constant time comparison of inbound TCP agent connection secret
Advisory: GHSA-w7jr-wqw6-54xc
Aliases: CVE-2020-2101
Published: 2022-05-24T17:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison validating the connection secret when an inbound TCP agent connection is initiated. This could potentially allow attackers to use statistical methods to obtain the connection secret.

Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison function for verifying connection secrets.
Credentials stored in plain text by Jenkins Bumblebee HP ALM Plugin
Advisory: GHSA-8v72-qr3h-c6rv
Aliases: CVE-2021-21614
Published: 2022-05-24T17:39:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Bumblebee HP ALM Plugin 4.1.5 and earlier stores credentials unencrypted in its global configuration file `com.agiletestware.bumblebee.BumblebeeGlobalConfig.xml` on the Jenkins controller as part of its configuration.

These credentials can be viewed by users with access to the Jenkins controller file system.

Bumblebee HP ALM Plugin 4.1.6 stores credentials encrypted once its configuration is saved again.
Pimcore Discloses Usernames In Use
Advisory: GHSA-8889-9g3f-73rj
Aliases: CVE-2019-18986
Published: 2022-05-24T17:01:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
Improper Input Validation in Apache Struts
Advisory: GHSA-383p-xqxx-rrmp
Aliases: CVE-2016-3093
Published: 2022-05-17T03:42:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
Dolibarr ERP and CRM Unsafe File Upload Vulnerability
Advisory: GHSA-cwgm-qw8v-hrrg
Aliases: CVE-2017-9840
Published: 2022-05-17T02:39:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.
Electron vulnerable to URL spoofing via PDFium
Advisory: GHSA-6h98-cf9g-vmg2
Aliases: CVE-2017-1000424
Published: 2022-05-13T01:41:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Electron version 1.7.0 - 1.7.5 is vulnerable to a URL Spoofing problem when opening PDFs in PDFium resulting loading arbitrary PDFs that a hacker can control.
Jenkins Project Inheritance Plugin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-xc7q-p3f4-q389
Aliases: CVE-2019-10408
Published: 2022-05-24T16:56:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Project Inheritance Plugin allows the creation of projects based on templates defined in the plugin configuration.

A missing permission check in the HTTP endpoint triggering project creation allowed users with Overall/Read permission to create these projects. Additionally, the HTTP endpoint did not require POST requests, resulting in a CSRF vulnerability.

The HTTP endpoint triggering project creation now requires Item/Create permission and submission of requests via POST.
Jenkins Codefresh Integration Plugin Improper Certificate Validation vulnerability
Advisory: GHSA-862j-cv9p-6hpf
Aliases: CVE-2019-10381
Published: 2022-05-24T16:52:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Codefresh Integration Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM.

As of publication of this advisory, there is no fix.
Remote web-service operation execution in Apache CXF
Advisory: GHSA-55j7-f5wf-43m4
Aliases: CVE-2012-3451
Published: 2022-05-13T01:09:21Z

Apache CXF before 2.4.9, 2.5.x before 2.5.5, and 2.6.x before 2.6.2 allows remote attackers to execute unintended web-service operations by sending a header with a SOAP Action String that is inconsistent with the message body.
XSS in baserCMS before 4.1.4
Advisory: GHSA-fx2m-5m9v-jhgp
Aliases: CVE-2018-18943
Published: 2022-05-14T01:50:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in baserCMS before 4.1.4. In the Register New Category feature of the Upload menu, the category name can be used for XSS via the `data[UploaderCategory][name]` parameter to an `admin/uploader/uploader_categories/edit` URI.
Fix a use-after-free bug in diesels Sqlite backend
Advisory: GHSA-j8q9-5rp9-4mv9
Aliases: CVE-2021-28305
Published: 2022-05-24T17:44:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the diesel crate before 1.4.6 for Rust. There is a use-after-free in the SQLite backend because the semantics of sqlite3_column_name are not followed.
ChakraCore RCE Vulnerability
Advisory: GHSA-f2pg-gcxp-gr2c
Aliases: CVE-2016-3265
Published: 2022-05-14T02:24:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3269.
Weak Password Requirements in UnboundID LDAP SDK
Advisory: GHSA-qwq9-8rpf-8mp7
Aliases: CVE-2018-1000134
Published: 2022-05-13T01:48:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. The issue can result in ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in commit 8471904a02438c03965d21367890276bc25fa5a6.
MODX Revolution Incorrect Access Control vulnerability
Advisory: GHSA-m899-6mh4-mpc5
Aliases: CVE-2018-1000207
Published: 2022-05-13T01:48:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpthumb class that can result in Creating file with custom a filename and content. This attack appear to be exploitable via Web request. This vulnerability appears to have been fixed in commit 06bc94257408f6a575de20ddb955aca505ef6e68.
Improper Neutralization of Input During Web Page Generation in RESTEasy
Advisory: GHSA-r346-rmrg-qpgh
Aliases: CVE-2016-6347
Published: 2022-05-17T02:48:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in the default exception handler in RESTEasy allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Dolibarr ERP and CRM HTML Injection
Advisory: GHSA-3264-65pg-5xm4
Aliases: CVE-2019-17223
Published: 2022-05-24T16:58:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via `user/note.php`.
Kubernetes ingress exposes sensitive information
Advisory: GHSA-p3x5-5xpx-9phm
Aliases: CVE-2018-1002104
Published: 2022-05-24T17:06:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Versions < 1.5 of the Kubernetes ingress default backend, which handles invalid ingress traffic, exposed prometheus metrics publicly.
Fat Free CRM vulnerable to SQL Injection
Advisory: GHSA-9ggp-5rf4-x7q9
Aliases: CVE-2013-7225
Published: 2022-05-17T04:55:27Z

Multiple SQL injection vulnerabilities in `app/controllers/home_controller.rb` in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.
Incorrect Authorization in Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin
Advisory: GHSA-ccxh-j7hg-m5mr
Aliases: CVE-2019-10417
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Jenkins Kubernetes :: Pipeline :: Kubernetes Steps Plugin provides a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
Cross site scripting in SiteServer CMS
Advisory: GHSA-2xwp-7j3p-c78x
Aliases: CVE-2021-42656
Published: 2022-05-25T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.
Pallets Werkzeug cross-site scripting vulnerability
Advisory: GHSA-h2fp-xgx6-xh6f
Aliases: CVE-2016-10516
Published: 2022-05-14T03:46:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message.
ChakraCore RCE Vulnerability
Advisory: GHSA-p349-q795-qj4q
Aliases: CVE-2018-8372
Published: 2022-05-13T01:20:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.
DoS via malicious p2p message in Go Ethereum
Advisory: GHSA-wjxw-gh3m-7pm5
Aliases: CVE-2022-29177
Published: 2022-05-24T20:54:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

A vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. 

### Patches

The following PR addresses the problem: https://github.com/ethereum/go-ethereum/pull/24507

### Workarounds

Aside from applying the PR linked above, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack.

### Credits

This bug was reported by `nrv` via bounty@ethereum.org, who has gracefully requested that the bounty rewards be donated to Médecins sans frontières.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-ccjm-rgm5-rjjh
Aliases: CVE-2019-7880
Published: 2022-05-24T16:52:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to marketing email templates to inject malicious javascript.
phpMyAdmin DoS Vulnerability
Advisory: GHSA-47qr-f86f-3wm4
Aliases: CVE-2017-1000018
Published: 2022-05-14T01:18:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

phpMyAdmin 4.0, 4.4., and 4.6 are vulnerable to a DOS attack in the replication status by using a specially crafted table name
Ruby OpenSSL DoS Vulnerability
Advisory: GHSA-v6rp-3r3v-hf4p
Aliases: CVE-2017-14033
Published: 2022-05-14T02:03:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The decode method in the OpenSSL::ASN1 module in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows attackers to cause a denial of service (interpreter crash) via a crafted string.
Improper Neutralization of Input During Web Page Generation in CKEditor4
Advisory: GHSA-4m44-5j2g-xf64
Aliases: CVE-2020-27193
Published: 2022-05-24T17:34:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web script after persuading a user to copy and paste crafted HTML code into one of editor inputs.
JBossWS vulnerable to uncontrolled recursion
Advisory: GHSA-rj4p-7mm6-gm9j
Aliases: CVE-2011-1483
Published: 2022-05-13T01:39:29Z

DOMUtils.java in org.jboss.ws:jbossws-common does not properly handle recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted request containing an XML document with a DOCTYPE declaration and a large number of nested entity references, a similar issue to CVE-2003-1564.
Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
Advisory: GHSA-8rcq-p4gh-vmj8
Aliases: CVE-2016-0782
Published: 2022-05-14T01:14:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
Improper Input Validation in Apache Commons Email
Advisory: GHSA-p7vm-phxx-g722
Aliases: CVE-2017-9801
Published: 2022-05-17T02:15:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

When a call-site passes a subject for an email that contains line-breaks in Apache Commons Email 1.0 through 1.4, the caller can add arbitrary SMTP headers.
Zend Framework Allows SQL Injection
Advisory: GHSA-xfjq-w3cw-h5fq
Aliases: CVE-2016-4861
Published: 2022-05-14T02:19:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.20 might allow remote attackers to conduct SQL injection attacks by leveraging failure to remove comments from an SQL statement before validation.
Improper Input Validation in Apache Spark
Advisory: GHSA-62g2-m955-v383
Aliases: CVE-2018-11804
Published: 2022-05-14T01:50:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. **Note that this issue does not affect end users of Spark, only developers building Spark from source code.**
Missing SSH host key validation in Mac Plugin
Advisory: GHSA-rv9g-67f7-grq7
Aliases: CVE-2020-2146
Published: 2022-05-24T17:10:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Mac Plugin 1.1.0 and earlier does not use SSH host key validation when connecting to Mac Cloud host launched by the plugin. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.

Mac Plugin 1.2.0 validates SSH host keys when connecting to agents.
Code injection in Apache Struts
Advisory: GHSA-47qp-8v9g-39hp
Aliases: CVE-2013-2251
Published: 2022-05-13T01:14:26Z

The Struts 2 DefaultActionMapper supports a method for short-circuit navigation state changes by prefixing parameters with "action:" or "redirect:", followed by a desired navigational target expression. This mechanism was intended to help with attaching navigational information to buttons within forms.

In Struts 2 before 2.3.15.1 the information following "action:", "redirect:" or "redirectAction:" is not properly sanitized. Since said information will be evaluated as OGNL expression against the value stack, this introduces the possibility to inject server side code.
ChakraCore RCE Vulnerability
Advisory: GHSA-wv44-9w69-w43j
Aliases: CVE-2016-3377
Published: 2022-05-14T02:23:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3350.
Improper Authentication in Apache Axis2
Advisory: GHSA-66rx-gqx3-p98m
Aliases: CVE-2012-5351
Published: 2022-05-13T01:01:04Z

Apache Axis2 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature element, aka a "Signature exclusion attack," a different vulnerability than CVE-2012-4418.
Stored XSS vulnerability in Code Coverage API Plugin
Advisory: GHSA-xg77-xqhq-crpr
Aliases: CVE-2020-2106
Published: 2022-05-24T17:07:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view.

This results in a stored cross-site scripting vulnerability that can be exploited by users able to change the job configuration.

Code Coverage API Plugin 1.1.3 escapes the filename of the coverage report used in its view.
Django Cross-site scripting (XSS) vulnerability
Advisory: GHSA-54qj-48vx-cr9f
Aliases: CVE-2008-2302
Published: 2022-05-01T23:48:43Z

Cross-site scripting (XSS) vulnerability in the login form in the administration application in Django 0.91 before 0.91.2, 0.95 before 0.95.3, and 0.96 before 0.96.2 allows remote attackers to inject arbitrary web script or HTML via the URI of a certain previous request.
ChakraCore information disclosure vulnerability
Advisory: GHSA-h6m7-jphx-f9p5
Aliases: CVE-2017-8659
Published: 2022-05-17T02:13:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka "Scripting Engine Information Disclosure Vulnerability".
Mercurial Directory traversal vulnerability
Advisory: GHSA-v2gw-x5jf-pgwv
Aliases: CVE-2008-2942
Published: 2022-05-01T23:55:06Z

Directory traversal vulnerability in patch.py in Mercurial before 1.0.2 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequences in a patch file.
ChakraCore RCE Vulnerability
Advisory: GHSA-hg36-rmmm-hc5r
Aliases: CVE-2019-0806
Published: 2022-05-13T01:21:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.
Apache Struts Multiple Cross-site Scripting Vulnerabilities
Advisory: GHSA-cmpm-jg8r-fv37
Aliases: CVE-2012-1006
Published: 2022-05-17T01:49:11Z

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to `struts2-showcase/person/editPerson.action`, or the (3) clientName parameter to `struts2-rest-showcase/orders`.
Magento 2 Community Edition Session Fixation Check
Advisory: GHSA-v797-hfv8-v2xm
Aliases: CVE-2019-7849
Published: 2022-05-24T16:52:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules. This impacts Magento 1.x prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2.
JBoss Keycloak CSRF Vulnerability
Advisory: GHSA-xr6q-qqx7-553g
Aliases: CVE-2014-3709
Published: 2022-05-17T00:26:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The `org.keycloak.services.resources.SocialResource.callback` method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
Improper Neutralization of Input During Web Page Generation in Jsoup
Advisory: GHSA-48rh-qgjr-xfj6
Aliases: CVE-2015-6748
Published: 2022-05-13T01:28:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.