aswin1906/github-advisory-2022 huggingface dataset:
Centreon XSS Vulnerability
Advisory: GHSA-8vh5-j6xj-5953
Aliases: CVE-2018-19311
Published: 2022-05-14T00:55:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the `main.php?p=20201` URI, as demonstrated by the "Monitoring > Status Details > Services" screen.
Opencast has Incorrect Permission Assignment
Advisory: GHSA-hx44-c87v-p6xg
Aliases: CVE-2017-1000221
Published: 2022-05-13T01:40:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Opencast 2.2.3 and older if user names overlap, the Opencast search service used for publication to the media modules and players will handle the access control incorrectly so that users only need to match part of the user name used for the access restriction. For example, a user with the role ROLE_USER will have access to recordings published only for ROLE_USER_X.
Wildfly has a memory leak vulnerability
Advisory: GHSA-qx3p-9mmp-4v8h
Aliases: CVE-2020-27822
Published: 2022-05-24T17:35:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an attacker to impact the availability of the server. The highest threat from this vulnerability is to system availability.
Cross-site Scripting in OctoPrint
Advisory: GHSA-h8pc-j334-jjhm
Aliases: CVE-2022-1432
Published: 2022-05-19T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. The Stream URL of octoprint application allowing a xss payload to execute.
External Entity Reference in TwelveMonkeys ImageIO
Advisory: GHSA-pjch-4g28-fxx7
Aliases: CVE-2021-23792
Published: 2022-05-07T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package com.twelvemonkeys.imageio:imageio-metadata before version 3.7.1 is vulnerable to XML External Entity (XXE) Injection due to an insecurely initialized XML parser for reading XMP Metadata. An attacker can exploit this vulnerability if they are able to supply a file (e.g. when an online profile picture is processed) with a malicious XMP segment. If the XMP metadata of the uploaded image is parsed, then the XXE vulnerability is triggered.
Cross-site Scripting in Apache Pluto Chatroom demo
Advisory: GHSA-w47g-4vrc-m3w2
Aliases: CVE-2019-0186
Published: 2022-05-24T16:44:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file
Improper Restriction of XML External Entity Reference in Apache Solr
Advisory: GHSA-6cpj-3g83-q2j4
Aliases: CVE-2012-6612
Published: 2022-05-17T04:50:16Z

The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.
ClassLoader manipulation in Apache Struts
Advisory: GHSA-vrwc-qjmw-5rjm
Aliases: CVE-2014-0094
Published: 2022-05-14T00:54:15Z

The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
Improper Input Validation in Microsoft.NETCore.App
Advisory: GHSA-8884-xcr4-r68p
Aliases: CVE-2017-8585
Published: 2022-05-17T00:19:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Microsoft .NET Framework 4.6, 4.6.1, 4.6.2, and 4.7 allow an attacker to send specially crafted requests to a .NET web application, resulting in denial of service, aka .NET Denial of Service Vulnerability.
Jenkins Assembla Plugin has Insufficiently Protected Credentials
Advisory: GHSA-mhq6-h9m7-wq8c
Aliases: CVE-2019-10420
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Assembla Plugin stores the Assembla password unencrypted in its global configuration file `jenkins.plugin.assembla.AssemblaProjectProperty.xml` on the Jenkins controller. This password can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.
Missing Authorization in Apache Archiva
Advisory: GHSA-5hqc-x78w-3cmw
Aliases: CVE-2022-29405
Published: 2022-05-26T00:01:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

In Apache Archiva, any registered user can reset password for any users. This is fixed in Archiva 2.2.8.
phpMyAdmin XSS Vulnerability
Advisory: GHSA-pw34-qf6c-84fc
Aliases: CVE-2016-2040
Published: 2022-05-14T02:08:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) table name, (2) SET value, (3) search query, or (4) hostname in a Location header.
ovirt-engine Logs Plaintext Passwords To File
Advisory: GHSA-m833-87vf-576c
Aliases: CVE-2017-15113
Published: 2022-05-13T01:37:34Z
Withdrawn: 2023-08-18T21:25:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.
Unsafe entry in Script Security list of approved signatures in Pipeline Remote Loader Plugin
Advisory: GHSA-v558-fhw2-v46w
Aliases: CVE-2019-10328
Published: 2022-05-24T22:00:03Z

Jenkins Pipeline Remote Loader Plugin before 1.5 provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.
CSRF vulnerability in Jenkins Libvirt Agents Plugin
Advisory: GHSA-mm5c-7mpr-99fm
Aliases: CVE-2021-21627
Published: 2022-05-24T17:44:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L

Libvirt Agents Plugin 1.9.0 and earlier does not require POST requests for a form submission endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to stop hypervisor domains.

Libvirt Agents Plugin 1.9.1 requires POST requests for the affected HTTP endpoint.
ChakraCore RCE Vulnerability
Advisory: GHSA-h9wf-mpvf-9jqg
Aliases: CVE-2018-0837
Published: 2022-05-13T01:18:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
Injection in Jolokia agent
Advisory: GHSA-rhqj-4pp8-vvgf
Aliases: CVE-2018-1000130
Published: 2022-05-14T01:27:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.
Improper Validation of Integrity Check Value in Bouncy Castle
Advisory: GHSA-8477-3v39-ggpm
Aliases: CVE-2018-5382
Published: 2022-05-13T01:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself.
CSRF vulnerability in MongoDB Plugin
Advisory: GHSA-j6p9-hm3q-hwmj
Aliases: CVE-2020-2268
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain access to some metadata of any arbitrary files on the Jenkins controller.
ImpressCMS XSS
Advisory: GHSA-g32q-4fhf-cq72
Aliases: CVE-2018-13983
Published: 2022-05-24T16:45:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

ImpressCMS 1.3.10 has XSS via the PATH_INFO to `htdocs/install/index.php`, `htdocs/install/page_langselect.php`, or `htdocs/install/page_modcheck.php`.
Client BlockTokens not checked in Apache Hadoop
Advisory: GHSA-qmh2-h7r6-gm6q
Aliases: CVE-2012-3376
Published: 2022-05-17T02:54:07Z

DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts.
Sandbox bypass vulnerability in Script Security Plugin
Advisory: GHSA-qvhf-3567-pc4v
Aliases: CVE-2020-2135
Published: 2022-05-24T17:10:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Sandbox protection in Script Security Plugin 1.70 and earlier can be circumvented through:\n- Crafted constructor calls and bodies (due to an incomplete fix of [SECURITY-582](https://www.jenkins.io/security/advisory/2017-08-07/#super-constructor-calls))
- Crafted method calls on objects that implement `GroovyInterceptable`

This allows attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM.

Script Security Plugin 1.71 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox. In addition, it also intercepts method calls on objects that implement `GroovyInterceptable` as calls to `GroovyObject#invokeMethod(String, Object)`, which is on the list of dangerous signatures and should not be approved for use in the sandbox.
Apache Struts RCE Vulnerability
Advisory: GHSA-876p-4wgc-75rx
Aliases: CVE-2016-0785
Published: 2022-05-14T00:52:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a `%{}` sequence in a tag attribute, aka forced double OGNL evaluation.
ChakraCore RCE Vulnerability
Advisory: GHSA-f3qw-7p9p-j87f
Aliases: CVE-2018-8555
Published: 2022-05-13T01:20:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8541, CVE-2018-8542, CVE-2018-8543, CVE-2018-8551, CVE-2018-8556, CVE-2018-8557, CVE-2018-8588.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-j3cq-h6vh-gx7f
Aliases: CVE-2021-21689
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2485 / CVE-2021-21689: `FilePath#unzip` and `FilePath#untar` were not subject to any access control.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2485 / CVE-2021-21689: `FilePath#unzip` and `FilePath#untar` are now subject to access control.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Missing XML Validation in Apache CXF
Advisory: GHSA-254q-rp36-v2m8
Aliases: CVE-2013-2160
Published: 2022-05-13T01:09:20Z

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.
SEOmatic for CraftCMS allows Server-Side Template Injection
Advisory: GHSA-6q4j-8pjm-5mgc
Aliases: CVE-2020-9757
Published: 2022-05-24T17:10:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Seomatic component before 3.2.46 for Craft CMS allows Server-Side Template Injection and information disclosure via malformed data to the metacontainers controller.
Magento 2 Community Edition RCE
Advisory: GHSA-vvf9-fxhv-4rgj
Aliases: CVE-2019-7942
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates.
Magento 2 Community Edition XML Injection
Advisory: GHSA-8p5c-f836-m4h7
Aliases: CVE-2019-8158
Published: 2022-05-24T17:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.
Cross-site Scripting in Apache Struts
Advisory: GHSA-vwhv-j36g-5rm8
Aliases: CVE-2015-5169
Published: 2022-05-14T01:57:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script. 

It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.

Struts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher.
Play Framework's Assets controller vulnerable to directory traversal
Advisory: GHSA-v4mq-p756-p4f5
Aliases: CVE-2018-13864
Published: 2022-05-13T01:30:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A directory traversal vulnerability has been found in the Assets controller in Play Framework 2.6.12 through 2.6.15 (fixed in 2.6.16) when running on Windows. It allows a remote attacker to download arbitrary files from the target server via specially crafted HTTP requests.
Potential Cross-site Scripting vulnerability in Hydrogen
Advisory: GHSA-6j22-wv8g-894f
Aliases: CVE-2022-29230
Published: 2022-05-19T20:29:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

### Impact
There is a potential Cross-Site Scripting (XSS) vulnerability where an arbitrary user is able to execute scripts on pages that are built with Hydrogen. This affects all versions of Hydrogen starting from version 0.10.0 to 0.18.0. This vulnerability is exploitable in applications whose hydrating data is user controlled. 

### Patches
All Hydrogen users should upgrade their project to v0.19.0.

### Workarounds
There is no current workaround, and users should update as soon as possible.

Additionally, the Content Security Policy is not an effective mitigation for this vulnerability. 

### References
GitHub: [Hydrogen v0.19.0](https://github.com/Shopify/hydrogen/releases/tag/%40shopify/hydrogen%400.19.0)
Fix PR: https://github.com/Shopify/hydrogen/pull/1272

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Shopify/hydrogen](https://github.com/Shopify/hydrogen/issues/new/choose)
Deserialization of Untrusted Data in Apache Brooklyn
Advisory: GHSA-9cqh-5x6g-wgm9
Aliases: CVE-2016-8744
Published: 2022-05-17T00:36:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the classpath. This could provide an authenticated user with a means to cause the JVM running Brooklyn to load and run Java code without detection by Brooklyn. Such code would have the privileges of the Java process running Brooklyn, including the ability to open files and network connections, and execute system commands. There is known to be a proof-of-concept exploit using this vulnerability.
Scalyr Agent 2 Missing SSL Certificate Validation
Advisory: GHSA-738x-v49g-p6hx
Aliases: CVE-2020-24715
Published: 2022-05-24T17:26:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks a comparison of the hostname to commonName and subjectAltName.
Umbraco CMS vulnerable to stored XSS
Advisory: GHSA-wrrj-r2j4-969w
Aliases: CVE-2018-17256
Published: 2022-05-14T01:44:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Persistent cross-site scripting (XSS) vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content (Blog, Content Page, etc.). The vulnerability is exploited when updating or removing public access of a content.
Cross-site Scripting in Apache NiFi
Advisory: GHSA-g2fm-x3cp-mqw9
Aliases: CVE-2016-8748
Published: 2022-05-14T01:05:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Apache NiFi before 1.0.1 and 1.1.x before 1.1.1, there is a cross-site scripting vulnerability in connection details dialog when accessed by an authorized user. The user supplied text was not being properly handled when added to the DOM.
Jenkins CRX Content Package Deployer Plugin subject to Cross-Site Request Forgery
Advisory: GHSA-62fp-j75q-mqhc
Aliases: CVE-2019-10437
Published: 2022-05-24T16:58:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability in Jenkins CRX Content Package Deployer Plugin prior to 1.9 allowed attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. This issue is patched in version 1.9
Ceilometer Prints Sensitive Configuration Data to Log
Advisory: GHSA-2cvf-r9jm-4qm9
Aliases: CVE-2019-3830
Published: 2022-05-13T01:14:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.
Improper handling of REST API XML deserialization errors in Jenkins
Advisory: GHSA-qv6f-rcv6-6q3x
Aliases: CVE-2021-21604
Published: 2022-05-24T17:39:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins provides XML REST APIs to configure views, jobs, and other items. When deserialization fails because of invalid data, Jenkins 2.274 and earlier, LTS 2.263.1 and earlier stores invalid object references created through these endpoints in the Old Data Monitor. If an administrator discards the old data, some erroneous data submitted to these endpoints may be persisted.

This allows attackers with View/Create, Job/Create, Agent/Create, or their respective */Configure permissions to inject crafted content into Old Data Monitor that results in the instantiation of potentially unsafe objects when discarded by an administrator.\n\nJenkins 2.275, LTS 2.263.2 does not record submissions from users in Old Data Monitor anymore.

In case of problems, the [Java system properties](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.util.RobustReflectionConverter.recordFailuresForAdmins` and `hudson.util.RobustReflectionConverter.recordFailuresForAllAuthentications` can be set to true to record configuration data submissions from administrators or all users, partially or completely disabling this fix.
Deserialization of Untrusted Data in Apache Dubbo
Advisory: GHSA-69wp-3pm3-hxgg
Aliases: CVE-2019-17564
Published: 2022-05-24T17:13:14Z

Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.
Django Cross-site Scripting Vulnerability
Advisory: GHSA-6565-fg86-6jcx
Aliases: CVE-2015-2241
Published: 2022-05-17T03:34:12Z

Cross-site scripting (XSS) vulnerability in the contents function in `admin/helpers.py` in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in `ModelAdmin.readonly_fields`, as demonstrated by an `@property`.
Possible cross-site scripting attack via unsanitized SVG files in FoF Upload
Advisory: GHSA-fm53-mpmp-7qw2
Aliases: CVE-2022-30999
Published: 2022-05-25T22:55:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

### Impact
If FoF Upload is configured to allow the uploading of SVG files (`image/svg+xml`), navigating directly to an SVG file URI could execute arbitrary Javascript code decided by an attacker.

This Javascript code could include the execution of HTTP web requests to Flarum, or any other web service. This could allow data to be leaked by an authenticated Flarum user, or, possibly, for data to be modified maliciously.

### Patches
This has been patched with v1.2.3, which now sanitizes uploaded SVG files.

### Workarounds
Upgrade to `1.2.3` (requires Flarum 1.2 or later), or remove the ability for users to upload SVG files through FoF Upload.

### References
Thank you to Safwat Refaat for the responsible disclosure of this vulnerability.
Jenkins Dynatrace Plugin vulnerable to Insufficiently Protected Credentials
Advisory: GHSA-6xw9-qq9h-cr68
Aliases: CVE-2019-10461
Published: 2022-05-24T16:59:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Dynatrace Application Monitoring Plugin prior to 2.1.4 stores credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.

##NOTE: This plugin is marked as DEPRECATED
bson-objectid contains Improper input validation
Advisory: GHSA-p84x-5xx8-hff9
Aliases: CVE-2019-19729
Published: 2022-05-24T22:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it `detects _bsontype==ObjectID` in the user-input object. As a result, objects in arbitrary forms can bypass formatting if they have a valid bsontype.
Moodle Open Redirect Vulnerability
Advisory: GHSA-5xp2-rv4h-mm2q
Aliases: CVE-2019-10133
Published: 2022-05-24T16:48:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A flaw was found in Moodle before 3.7, 3.6.4, 3.5.6, 3.4.9 and 3.1.18. The form to upload cohorts contained a redirect field, which was not restricted to internal URLs.
Denial of service in ASP.NET Core
Advisory: GHSA-xhfc-gr8f-ffwc
Aliases: CVE-2019-0980
Published: 2022-05-24T16:45:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0981.
Crash in HeaderParser in dicer
Advisory: GHSA-wm7h-9275-46v2
Aliases: CVE-2022-24434
Published: 2022-05-21T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This affects all versions of the package `dicer`. A malicious attacker can send a modified form to the server and crash the Node.js service. A complete denial of service can be achieved by sending the malicious form in a loop.
ChakraCore RCE Vulnerability
Advisory: GHSA-vgxq-xv7f-jxjx
Aliases: CVE-2018-8290
Published: 2022-05-13T01:20:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8280, CVE-2018-8286, CVE-2018-8294.
Smashing Cross-site Scripting vulnerability
Advisory: GHSA-254j-mmc5-qhpx
Aliases: CVE-2021-35440
Published: 2022-05-24T19:06:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using internal URL's for deploying, or cookies that are very permissive) private information may be retrieved by the attacker.
Use of a Broken or Risky Cryptographic Algorithm in XWiki Crypto API
Advisory: GHSA-h8v5-p258-pqf4
Aliases: CVE-2022-29161
Published: 2022-05-24T12:47:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

### Impact
XWiki Crypto API will generate X509 certificates signed by default using SHA1 with RSA, which is not considered safe anymore for use in certificate signatures, due to the risk of collisions with SHA1.
Note that this API is never used in XWiki Standard but it might be used in some extensions of XWiki.

### Patches
The problem has been patched in XWiki version 13.10.6, 14.3.1 and 14.4-rc-1. Since then, the Crypto API will generate X509 certificates signed by default using SHA256 with RSA.

### Workarounds
Administrators are advised to upgrade their XWiki installation to one of the patched versions.
If the upgrade is not possible, it is possible to patch the module xwiki-platform-crypto in a local installation by applying the change exposed in https://github.com/xwiki/xwiki-platform/commit/26728f3f23658288683667a5182a916c7ecefc52 and re-compiling the module.

### References
https://jira.xwiki.org/browse/XWIKI-19676
https://github.com/openssl/openssl/blob/master/CHANGES.md?plain=1#L938
https://github.com/openssl/openssl/issues/16650

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Improper Privilege Management in Neo4j Graph Database
Advisory: GHSA-2w4h-f44w-968f
Aliases: CVE-2021-34802
Published: 2022-05-24T19:09:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A failure in resetting the security context in some transaction actions in Neo4j Graph Database 4.2 could allow authenticated users to execute commands with elevated privileges.
Apache Tomcat Denial of Service vulnerability
Advisory: GHSA-wq2p-q66w-q8gp
Aliases: CVE-2013-4322
Published: 2022-05-14T01:10:35Z

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
Path Traversal in Apache Jetspeed
Advisory: GHSA-w47p-5q88-hj5g
Aliases: CVE-2016-0709
Published: 2022-05-17T03:56:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
CSRF vulnerability in Jenkins Lockable Resources Plugin
Advisory: GHSA-rvww-w62m-hch8
Aliases: CVE-2020-2281
Published: 2022-05-24T17:29:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

Lockable Resources Plugin 2.8 and earlier does not require POST requests for several HTTP endpoints, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to reserve, unreserve, unlock, and reset resources. Lockable Resources Plugin 2.9 requires POST requests for the affected HTTP endpoints.
phpBB allows CSRF
Advisory: GHSA-69q7-hww4-8pjq
Aliases: CVE-2020-5502
Published: 2022-05-24T17:06:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships.
ChakraCore RCE Vulnerability
Advisory: GHSA-vjf9-8wqg-xc7r
Aliases: CVE-2018-8510
Published: 2022-05-13T01:20:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8505, CVE-2018-8511, CVE-2018-8513.
Dolibarr ERP and CRM SQLi
Advisory: GHSA-jh3j-xfv2-f9m9
Aliases: CVE-2019-19209
Published: 2022-05-24T17:11:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.
Spree uses a hardcoded hash value
Advisory: GHSA-g466-57gh-cqfw
Aliases: CVE-2008-7311
Published: 2022-05-17T05:30:58Z

The session cookie store implementation in Spree 0.2.0 uses a hardcoded `config.action_controller_session` hash value (aka secret key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging an application that contains this value within the `config/environment.rb` file.
Integer overflow in BCrypt class in Spring Security
Advisory: GHSA-wx54-3278-m5g4
Aliases: CVE-2022-22976
Published: 2022-05-20T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Spring Security versions 5.5.x prior to 5.5.7, 5.6.x prior to 5.6.4, and earlier unsupported versions contain an integer overflow vulnerability. When using the BCrypt class with the maximum work factor (31), the encoder does not perform any salt rounds, due to an integer overflow error. The default settings are not affected by this CVE. The only in circumstances where the BCryptPasswordEncoder has been configured with the maximum work factor are affected. Due to current limitations in computer hardware, the use of such a high work factor is computationally impractical. You need to be using BCrypt with a work factor of 31 to be impacted.
DCE extension for Typo3 Discloses Environment Information
Advisory: GHSA-v4vm-gj2x-6qhm
Aliases: CVE-2014-8328
Published: 2022-05-17T19:57:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The default configuration in the Dynamic Content Elements (dce) extension before 0.11.5 for TYPO3 allows remote attackers to obtain sensitive installation environment information by reading the update check request.
Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch
Advisory: GHSA-jjq8-vfjq-j6v4
Aliases: CVE-2015-5531
Published: 2022-05-14T02:48:01Z

Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
Improper Neutralization of Input During Web Page Generation in swagger-ui
Advisory: GHSA-h8wp-wgcq-qhrf
Aliases: CVE-2016-1000229
Published: 2022-05-24T17:04:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

swagger-ui has XSS in key names
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-2c79-h2h5-g3fw
Aliases: CVE-2021-21691
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2531 / CVE-2021-21691: Creating symbolic links is possible without the `symlink` permission.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2531 / CVE-2021-21691: Creating symbolic links now correctly checks the `symlink` permission.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Improper Limitation of a Pathname to a Restricted Directory in Jenkins Google OAuth Credentials Plugin
Advisory: GHSA-8qh4-fghr-6fxg
Aliases: CVE-2019-10436
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An arbitrary file read vulnerability in Jenkins Google OAuth Credentials Plugin 0.9 and earlier allowed attackers able to configure jobs and credentials in Jenkins to obtain the contents of any file on the Jenkins master.
Path Traversal in Apache Struts
Advisory: GHSA-44hv-jjx7-qfjg
Aliases: CVE-2016-6795
Published: 2022-05-14T00:54:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be used for path traversal and execution of arbitrary code on server side. This vulnerability is only exploitable when using the Struts 2 Convention plugin in conjunction with Apache Struts.
Arbitrary file read vulnerability in Copy data to workspace Jenkins Plugin
Advisory: GHSA-2f4c-8rp6-fh6q
Aliases: CVE-2020-2275
Published: 2022-05-24T17:28:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Copy data to workspace Plugin 1.0 and earlier does not limit which directories can be copied from the Jenkins controller to job workspaces, allowing attackers with Job/Configure permission to read arbitrary files on the Jenkins controller.
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
Advisory: GHSA-fg9w-cffm-pmh2
Aliases: CVE-2017-4971
Published: 2022-05-13T01:45:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.
Stored Cross-site Scripting in gitea
Advisory: GHSA-ph3w-2843-72mx
Aliases: CVE-2022-1928
Published: 2022-05-30T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9 via unfiltered pdfs
ChakraCore RCE Vulnerability
Advisory: GHSA-xmvg-c4x3-9qwp
Aliases: CVE-2018-0980
Published: 2022-05-13T01:18:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0990, CVE-2018-0993, CVE-2018-0994, CVE-2018-0995, CVE-2018-1019.
CSRF vulnerability in Jenkins Active Directory Plugin
Advisory: GHSA-2wf5-4mf7-vmh3
Aliases: CVE-2020-2303
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Active Directory Plugin 2.19 and earlier does not require POST requests for multiple HTTP endpoints implementing connection and authentication tests, resulting in cross-site request forgery (CSRF) vulnerabilities.

This vulnerability allows attackers to perform connection tests, connecting to attacker-specified or previously configured Active Directory servers using attacker-specified credentials.

Active Directory Plugin 2.20 requires POST requests for the affected HTTP endpoints.
Authlogic Information Exposure vulnerability
Advisory: GHSA-rx7j-mw4c-76g9
Aliases: CVE-2012-6497
Published: 2022-05-14T00:54:20Z

The Authlogic gem for Ruby on Rails prior to version 3.3.0 makes potentially unsafe `find_by_id` method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in `secret_token.rb` in an open-source product.
Incorrect Authorization in Jenkins Git Plugin
Advisory: GHSA-46p2-fwqg-3h6m
Aliases: CVE-2018-1000110
Published: 2022-05-13T01:48:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An improper authorization vulnerability exists in Jenkins Git Plugin version 3.7.0 and earlier in GitStatus.java that allows an attacker with network access to obtain a list of nodes and users.
Silverstripe CMS XSS Vulnerability
Advisory: GHSA-j696-6m57-mcrv
Aliases: CVE-2017-14498
Published: 2022-05-17T00:29:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SilverStripe CMS before 3.6.1 has XSS via an SVG document that is mishandled by (1) the Insert Media option in the content editor or (2) an admin/assets/add pathname, as demonstrated by the admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload URI, aka issue SS-2017-017.
Kubernetes CSI Sidecar Containers Can Allow Unauthorized Data Access
Advisory: GHSA-f4w6-3rh6-6q4q
Aliases: CVE-2019-11255
Published: 2022-05-24T17:02:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Improper input validation in Kubernetes CSI sidecar containers for external-provisioner (<v0.4.3, <v1.0.2, v1.1, <v1.2.2, <v1.3.1), external-snapshotter (<v0.4.2, <v1.0.2, v1.1, <1.2.2), and external-resizer (v0.1, v0.2) could result in unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
`CHECK` failure in depthwise ops via overflows
Advisory: GHSA-mw6j-hh29-h379
Published: 2022-05-25T19:33:50Z

### Impact
The implementation of depthwise ops in TensorFlow is vulnerable to a denial of service via `CHECK`-failure (assertion failure) caused by overflowing the number of elements in a tensor:

```python
import tensorflow as tf

input = tf.constant(1, shape=[1, 4, 4, 3], dtype=tf.float32)
filter_sizes = tf.constant(1879048192, shape=[13], dtype=tf.int32)
out_backprop = tf.constant(1, shape=[1, 4, 4, 3], dtype=tf.float32)
tf.raw_ops.DepthwiseConv2dNativeBackpropFilter(
    input=input, filter_sizes=filter_sizes, out_backprop=out_backprop, strides=[1, 1, 1, 1], padding="SAME")
```
  
This is another instance of [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197).
  
### Patches
We have patched the issue in GitHub commit [3796cc4fcd93ae55812a457abc96dcd55fbb854b](https://github.com/tensorflow/tensorflow/commit/3796cc4fcd93ae55812a457abc96dcd55fbb854b).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Cross-Site Request Forgery in Jenkins Mailer Plugin
Advisory: GHSA-6g57-h38c-q52g
Aliases: CVE-2018-8718
Published: 2022-05-14T01:29:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.
Stored XSS vulnerability in Jenkins Compact Columns Plugin
Advisory: GHSA-x68x-wvm2-hqc8
Aliases: CVE-2020-2195
Published: 2022-05-24T17:19:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips.

This results in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission.

Compact Columns Plugin 1.12 applies the configured markup formatter to the job description shown in tooltips.
Improper Neutralization of CRLF Sequences in Wildfly Undertow
Advisory: GHSA-qcqr-hcjq-whfq
Aliases: CVE-2016-4993
Published: 2022-05-17T00:15:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Zenario CMS vulnerable to CRLF injection 
Advisory: GHSA-5957-5crx-79jx
Aliases: CVE-2015-3154
Published: 2022-05-24T17:07:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CRLF injection vulnerability in Zend\Mail (Zend_Mail) in Zend Framework before 1.12.12, 2.x before 2.3.8, and 2.4.x before 2.4.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.
Nokogiri Implements libxml2 version vulnerable to use-after-free
Advisory: GHSA-v4f8-2847-rwm7
Aliases: CVE-2021-3518
Published: 2022-05-24T19:02:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

There's a flaw in libxml2 in versions before 2.9.11. An attacker who is able to submit a crafted file to be processed by an application linked with libxml2 could trigger a use-after-free. The greatest impact from this flaw is to confidentiality, integrity, and availability.
Code injection in Apache Struts
Advisory: GHSA-j7h6-xr7g-m2c5
Aliases: CVE-2013-4316
Published: 2022-05-17T03:28:23Z

Apache Struts 2.0.0 through 2.3.15.1 enables Dynamic Method Invocation by default, which has unknown impact and attack vectors.
JupyterHub OAuthenticator elevation of privilege
Advisory: GHSA-8x3m-m3x9-54fj
Aliases: CVE-2018-7206
Published: 2022-05-13T01:12:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with GitLab group whitelisting for access control, group membership was not checked correctly, allowing members not in the whitelisted groups to create accounts on the Hub. (Users were not allowed to access other users' accounts, but could create their own accounts on the Hub linked to their GitLab account. GitLab authentication not using gitlab_group_whitelist is unaffected. No other Authenticators are affected.)