aswin1906/github-advisory-2022 huggingface dataset:
.NET Denial of Service Vulnerability
Advisory: GHSA-x459-p2rx-f8ff
Aliases: CVE-2022-21986
Published: 2022-10-21T20:29:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 6.0 and .NET 5.0. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Denial of Service vulnerability exists in .NET 6.0 and .NET 5.0 when the Kestrel web server processes certain HTTP/2 and HTTP/3 requests.

### Affected Software

* Any .NET 6.0 application running on .NET 6.0.1 or lower.
* Any .NET 5.0 application running on .NET 5.0.13 or lower.

### Patches
To fix the issue, please install the latest version of .NET 6.0 or .NET 5.0. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET  SDKs.

* If you're using .NET Core 6.0, you should download and install Runtime 6.0.2 or SDK 6.0.102 (for Visual Studio 2022 v17.1) from https://dotnet.microsoft.com/download/dotnet-core/6.0.

* If you're using .NET 5.0, you should download and install Runtime 5.0.14 or SDK 5.0.114 (for Visual Studio 2019 v16.8) or SDK 5.0.405 (for Visual Studio 2011 v16.11) from https://dotnet.microsoft.com/download/dotnet-core/5.0.


.NET 6.0 and .NET 5.0 updates are also available from Microsoft Update. To access this either type "Check for updates" in your Windows search, or open Settings, choose Update & Security and then click Check for Updates.

#### Other Details

- Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/207
- An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/40072
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-21986
kamadak-exif vulnerable to Infinite loop when parsing PNG files
Advisory: GHSA-px9g-8hgv-jvg2
Aliases: CVE-2021-21235
Published: 2022-10-06T19:53:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

### Impact
Reader::read_from_container can cause an infinite loop when a crafted PNG file is given.

### Patches
Version 0.5.3 includes the fix.

### Workarounds
No workaround is available.
Applications that do not pass files with the PNG signature to Reader::read_from_container are not affected.

### References
* <https://github.com/kamadak/exif-rs/security/advisories/GHSA-px9g-8hgv-jvg2>
* <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21235>

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/kamadak/exif-rs](https://github.com/kamadak/exif-rs)
Twisted vulnerable to NameVirtualHost Host header injection
Advisory: GHSA-vg46-2rrj-3647
Aliases: CVE-2022-39348
Published: 2022-10-26T22:08:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

When the host header does not match a configured host, `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.

Example configuration:
```python
from twisted.web.server import Site
from twisted.web.vhost import NameVirtualHost
from twisted.internet import reactor

resource = NameVirtualHost()
site = Site(resource)
reactor.listenTCP(8080, site)
reactor.run()
```
Output:
```
❯ curl -H"Host:<h1>HELLO THERE</h1>" http://localhost:8080/

<html>
  <head><title>404 - No Such Resource</title></head>
  <body>
    <h1>No Such Resource</h1>
    <p>host b'<h1>hello there</h1>' not in vhost map</p>
  </body>
</html>
```

This vulnerability was introduced in f49041bb67792506d85aeda9cf6157e92f8048f4 and first appeared in the 0.9.4 release.
etcd user credentials are stored in WAL logs in plaintext
Advisory: GHSA-528j-9r78-wffx
Published: 2022-10-06T23:17:24Z

### Vulnerability type
Data Exposure

### Workarounds
The etcd assumes that the on disk files are secure. The possible fixes have been provided, however, it is the responsibility of the etcd users to make sure that the etcd server WAL log files are secure. The [etcd doesn't encrypt key/value data stored on disk drives](https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/security.md#does-etcd-encrypt-data-stored-on-disk-drives).

### Detail
User credentials (login and password) are stored in WAL entries on each user authentication. If the WAL log files are not secure, it can potentially expose sensitive information.

### References
Find out more on this vulnerability in the [security audit report](https://github.com/etcd-io/etcd/blob/master/security/SECURITY_AUDIT.pdf)

### For more information
If you have any questions or comments about this advisory:
* Contact the [etcd security committee](https://github.com/etcd-io/etcd/blob/master/security/security-release-process.md#product-security-committee-psc)
Flask-Security vulnerable to Open Redirect
Advisory: GHSA-cg8c-gc2j-2wf7
Aliases: CVE-2021-23385
Published: 2022-10-07T07:29:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

This affects all versions of package Flask-Security. When using the `get_post_logout_redirect` and `get_post_login_redirect` functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as `\\\evil.com/path`. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using `'autocorrect_location_header=False`.

**Note:** Flask-Security is not maintained anymore.
RCE vulnerability in Pimcore/Mail & Dynamic Text Layout
Advisory: GHSA-5qxq-vgmm-q39m
Aliases: CVE-2022-39365
Published: 2022-10-29T00:29:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
The user controlled twig templates rendering in `Pimcore/Mail` & `ClassDefinition\Layout\Text` is vulnerable to server-side template Injection RCE.

### Patches
Update to version 10.5.9 or apply this patch manually https://github.com/pimcore/pimcore/pull/13347.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/13347.patch manually.

### References
Credits: @nth347 from Viettel Cyber Security
goxmldsig vulnerable to crash on nil-pointer dereference caused by sending malformed XML signatures
Advisory: GHSA-mqqv-chpx-vq25
Aliases: CVE-2020-7711
Published: 2022-10-07T07:17:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This affects all versions of package github.com/russellhaering/goxmldsig prior to 1.1.1. There is a crash on nil-pointer dereference caused by sending malformed XML signatures. This issue is patched in version 1.1.1.
Codeigniter4's Secure or HttpOnly flag set in Config\Cookie is not reflected in Cookies issued
Advisory: GHSA-745p-r637-7vvp
Aliases: CVE-2022-39284
Published: 2022-10-06T20:01:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

### Impact
Setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie()`.

> **Note**
> This vulnerability does not affect session cookies.

The following code does not issue a cookie with the secure flag even if you set `$secure = true` in `Config\Cookie`.

```php
helper('cookie');

$cookie = [
    'name'  => $name,
    'value' => $value,
];
set_cookie($cookie);
// or
$this->response->setCookie($cookie);
```

### Patches
Upgrade to v4.2.7 or later.

### Workarounds
1. Specify the options explicitly.
   ```php
   helper('cookie');

   $cookie = [
       'name'     => $name,
       'value'    => $value,
       'secure'   => true,
       'httponly' => true,
   ];
   set_cookie($cookie);
   // or
   $this->response->setCookie($cookie);
   ```
2. Use Cookie object.
   ```php
   use CodeIgniter\Cookie\Cookie;

   helper('cookie');

   $cookie = new Cookie($name, $value);
   set_cookie($cookie);
   // or
   $this->response->setCookie($cookie);
   ```

### References
- https://codeigniter4.github.io/userguide/helpers/cookie_helper.html#set_cookie
- https://codeigniter4.github.io/userguide/outgoing/response.html#CodeIgniter\HTTP\Response::setCookie

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
mockery is vulnerable to prototype pollution
Advisory: GHSA-gmwp-3pwc-3j3g
Aliases: CVE-2022-37614
Published: 2022-10-12T19:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via the key variable in mockery.js.
Remote denial of service in Hyperledger Fabric Gateway
Advisory: GHSA-qj6r-fhrc-jj5r
Aliases: CVE-2022-36023
Published: 2022-10-13T19:12:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

### Impact
If a gateway client application sends a malformed request to a gateway peer it may crash the peer node.
This fix checks for the malformed gateway request and returns an error to the gateway client.

### Patches
Fixed in v2.4.6.

### Workarounds
None, users must upgrade to v2.4.6.

### References
https://github.com/hyperledger/fabric/releases/tag/v2.4.6

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Fabric](https://github.com/hyperledger/fabric)

### Credits
Thank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.
org.ini4j allows attackers to cause a Denial of Service (DoS) 
Advisory: GHSA-jr6h-r7vg-f9mc
Aliases: CVE-2022-41404
Published: 2022-10-12T12:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue in the fetch() method in the BasicProfile class of org.ini4j before v0.5.4 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus
Advisory: GHSA-xmjj-3c76-5w84
Aliases: CVE-2022-24814
Published: 2022-04-05T18:30:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Impact

Unauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS.

### Patches

This was resolved in https://github.com/directus/directus/pull/12020 which is released in 9.7.0

### Workarounds

You can disable the live embed in the WYSIWYG by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface.

### References

https://github.com/directus/directus/pull/12020

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [directus/directus](https://github.com/directus/directus)
* Email us at [security@directus.io](mailto:security@directus.io)
Incorrect protocol extraction via \r, \n and \t characters
Advisory: GHSA-3vjf-82ff-p4r3
Aliases: CVE-2022-1243
Published: 2022-04-06T00:01:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

\r, \n and \t characters in user-input URLs can potentially lead to incorrect protocol extraction when using npm package urijs prior to version 1.19.11.

This can lead to XSS when the module is used to prevent passing in malicious javascript: links into HTML or Javascript (see following example):
````
const parse = require('urijs')
const express = require('express')
const app = express()
const port = 3000

input = "ja\r\nvascript:alert(1)"
url = parse(input)

console.log(url)

app.get('/', (req, res) => {
 if (url.protocol !== "javascript:") {res.send("<iframe src=\'" + input + "\'>CLICK ME!</iframe>")}
})

app.listen(port, () => {
 console.log(`Example app listening on port ${port}`)
})
````
ejs template injection vulnerability
Advisory: GHSA-phwq-j96m-2c2q
Aliases: CVE-2022-29078
Published: 2022-04-26T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Unauthenticated user can list hidden document from multiple velocity templates in XWiki
Advisory: GHSA-qpp2-2mcp-2wm5
Aliases: CVE-2022-24820
Published: 2022-04-08T22:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact
A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents.

### Patches
The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1.

### Workarounds
There is no known workaround for this problem.

### References
https://jira.xwiki.org/browse/XWIKI-16544

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Dep Group Remote Memory Exhaustion (Denial of Service) in ckb
Advisory: GHSA-j35p-q24r-5367
Published: 2022-04-22T20:23:04Z

### Impact
A remote attacker could exploit this vulnerability to exhaust ckb process memory of an affected node.

### Patches
Upgrade to 0.43.1 or later.

### References
After resolving the outpoints of one dep group, we put the corresponding content into a vec ( https://github.com/nervosnetwork/ckb/blob/v0.42.0/util/types/src/core/cell.rs#L600-L617 ), there is a vulnerability to a memory dos attack because there is no determination of whether the outpoints is duplicated.

PoC:
```
before send dos tx rss:
105700

after rss:
2306932
```

DoS cost: 25.6 KB * 150 + dep_tx out_points capacity ( 36 * 150 * 100 = 540000 ) = 4380000 CKB
Send 50 dos_tx, memory exhausted: (25.6 KB * 150  * 100) * 50 = 19.2 GB
Opened exploitable ports in default docker-compose.yaml in go-ipfs
Advisory: GHSA-fx5p-f64h-93xc
Published: 2022-04-04T21:23:55Z

### Impact

Allows admin API access to the IPFS node.

### Who ?

This affects people running the  [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml) service in an environment where the docker host is directly attached to a public or untrusted IP.  In the vulnerable version, the private API endpoint is publicly forwarded by exposing it as `0.0.0.0:5001` on the host machine.  

If the host machine is hidden behind a firewall or NAT (and the LAN is trusted for NAT), this is not an immediate issue because of the protection from the firewall or NAT.  That said, we still recommend users update to follow security best practices of not putting unnecessary dependency on a working firewall.

### Patches
This issue is in [docker-compose.yaml](https://github.com/ipfs/go-ipfs/blob/master/docker-compose.yaml).  Users need to replace their current `docker-compose.yaml` file with a version `0.12.1` or later.

There is no need to update any of the binaries. Users running previous versions like `0.12.0` or earlier can download the `0.12.1` `docker-compose.yaml` file.  You can replace a vulnerable `docker-compose.yaml` file with a the new one with:

```
curl https://raw.githubusercontent.com/ipfs/go-ipfs/v0.12.1/docker-compose.yaml > docker-compose.yaml
```

### How to test if you are vulnerable
#### Binding check on the host
On the host machine, while IPFS is running, run as root:

```bash
netstat -lnp | grep ":5001"
```

The output will be a list of listeners bound to `:5001`.
You then need to check that those listeners are private and preferably even localhost IPs.
⚠️ If this listener is on `0.0.0.0` or a public IP you are very likely vulnerable.

#### Remote hailing
While IPFS is running, you can try to contact the API from a remote machine. (Replace `1.2.3.4` with your node public IP.  Or if you want to test in an untrusted NAT, then substitute the LAN IP instead.)

```bash
curl -X POST http://1.2.3.4:5001/api/v0/version
```

⚠️ If you see any json outputted (e.g.,  `{"Commit": "<string>","Golang": "<string>","Repo": "<string>","System": "<string>","Version": "<string>"}`), then you are vulnerable.

If it **fails**, then you are safe.

### For more information
If you have any questions or comments about this advisory:
* Please first read https://docs.ipfs.io/reference/http/api/ about best practices
* Ask in [IPFS Discord #ipfs-chatter](https://discord.gg/ipfs)
* Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)
Cross-site Scripting in Pimcore
Advisory: GHSA-xcr3-4qvr-54rh
Aliases: CVE-2022-1351
Published: 2022-04-15T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Pimcore prior to version 10.4 is vulnerable to stored cross-site scripting in Tooltip.
Stored Cross-site Scripting in Jenkins Mask Passwords Plugin
Advisory: GHSA-pjm3-f4vh-3h3h
Aliases: CVE-2022-29043
Published: 2022-04-13T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Mask Passwords Plugin 3.0 and earlier does not escape the name and description of Non-Stored Password parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix.
Improper Restriction of XML External Entity Reference in wutka jox
Advisory: GHSA-fcrx-8829-jpqx
Aliases: CVE-2021-43142
Published: 2022-04-01T00:00:45Z

An XML External Entity (XXE) vulnerability exists in wutka jox 1.16 in the readObject method in JOXSAXBeanInput.
Azure SDK for .NET Information Disclosure Vulnerability.
Advisory: GHSA-whph-446h-6m9v
Aliases: CVE-2022-26907
Published: 2022-04-16T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Azure SDK for .NET Information Disclosure Vulnerability via undisclosed methods relating to lack of sanitization of exception messages.
Promotion names in Jenkins promoted builds Plugin are not validated when using Job DSL
Advisory: GHSA-jmxr-w2jc-qp7w
Aliases: CVE-2022-29049
Published: 2022-04-13T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins promoted builds Plugin provides dedicated support for defining promotions using [Job DSL Plugin](https://plugins.jenkins.io/job-dsl).

promoted builds Plugin 873.v6149db_d64130 and earlier does not validate the names of promotions defined in Job DSL. This allows attackers with Job/Configure permission to create a promotion with an unsafe name. As a result, the promotion name could be used for cross-site scripting (XSS) or to replace other `config.xml` files.

promoted builds Plugin 876.v99d29788b_36b_ and 3.10.1 validates the name of promotions.
Podman publishes a malicious image to public registries
Advisory: GHSA-66vw-v2x9-hw75
Aliases: CVE-2022-1227
Published: 2022-04-30T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
Denial of service in HtmlUnit-Neko
Advisory: GHSA-g9hh-vvx3-v37v
Aliases: CVE-2022-28366
Published: 2022-04-23T00:03:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Certain Neko-related HTML parsers allow a denial of service via crafted Processing Instruction (PI) input that causes excessive heap memory consumption. In particular, this issue exists in HtmlUnit-Neko through 2.26, and is fixed in 2.27. This issue also exists in CyberNeko HTML through 1.9.22 (also affecting OWASP AntiSamy before 1.6.6), but 1.9.22 is the last version of CyberNeko HTML. NOTE: this may be related to CVE-2022-24939.
Server-Side Request Forgery (SSRF) in Shopware
Advisory: GHSA-7gm7-8q8v-9gf2
Aliases: CVE-2022-24871
Published: 2022-04-22T21:04:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

### Impact

The  attacker can abuse the Admin SDK functionality on the server to read or update internal resources.

### Patches

We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds

For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Untrusted users can modify some Pipeline libraries in Jenkins Pipeline: Deprecated Groovy Libraries Plugin
Advisory: GHSA-hh6f-6fp5-gfpv
Aliases: CVE-2022-29047
Published: 2022-04-13T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Multibranch Pipelines by default limit who can change the Pipeline definition from the Jenkinsfile. This is useful for SCMs like GitHub: Jenkins can build content from users without commit access, but who can submit pull requests, without granting them the ability to modify the Pipeline definition. In that case, Jenkins will just use the Pipeline definition in the pull request’s destination branch instead.

In Pipeline: Deprecated Groovy Libraries Plugin 564.ve62a_4eb_b_e039 and earlier the same protection does not apply to uses of the `library` step with a `retriever` argument pointing to a library in the current build’s repository and branch (e.g., `library(…, retriever: legacySCM(scm))`). This allows attackers able to submit pull requests (or equivalent), but not able to commit directly to the configured SCM, to effectively change the Pipeline behavior by changing the library behavior in their pull request, even if the Pipeline is configured to not trust them.

Pipeline: Deprecated Groovy Libraries Plugin 566.vd0a_a_3334a_555 and 2.21.3 aborts library retrieval if the library would be retrieved from the same repository and revision as the current build, and the revision being built is untrusted.
Unrestricted Upload of File with Dangerous Type in WPanel 4
Advisory: GHSA-vhgr-gfx3-fg37
Aliases: CVE-2021-34257
Published: 2022-04-01T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Multiple Remote Code Execution (RCE) vulnerabilities exist in WPanel 4 4.3.1 and below via a malicious PHP file upload to (1) Dashboard's Avatar image, (2) Posts Folder image, (3) Pages Folder image and (4) Gallery Folder image.
Improper Input Validation in GeoServer
Advisory: GHSA-4pm3-f52j-8ggh
Aliases: CVE-2022-24847
Published: 2022-04-22T20:39:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

### Impact
The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism.
In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API.

### Patches
The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 2.19.6.

### Workarounds
Protection can be achieved by making the GUI (``geoserver/web``), the REST configuration (``geoserver/rest``) and the embedded GeoWebCache configuration (``geoserver/gwc/rest``) unreachable from remote hosts, in addition to protecting access to the file system where the GeoServer configuration is stored.
Path Traversal in Caucho Resin
Advisory: GHSA-4w2q-9hp2-vxj5
Aliases: CVE-2021-44138
Published: 2022-04-05T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.
Manipulated inline images can cause Infinite Loop in PyPDF2
Advisory: GHSA-xcjx-m2pj-8g79
Aliases: CVE-2022-24859
Published: 2022-04-22T20:54:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

An attacker who uses this vulnerability can craft a PDF which leads to an infinite loop if the PyPDF2 user wrote the following code:

```python
from PyPDF2 import PdfFileReader, PdfFileWriter
from PyPDF2.pdf import ContentStream

reader = PdfFileReader("malicious.pdf", strict=False)
for page in reader.pages:
    ContentStream(page.getContents(), reader)
```

### Patches

[`PyPDF2==1.27.5`](https://pypi.org/project/PyPDF2) and later are patched.

Credits to [Sebastian Krause](https://github.com/sekrause) for finding ([issue](https://github.com/py-pdf/PyPDF2/issues/329)) and fixing ([PR](https://github.com/py-pdf/PyPDF2/pull/740)) it.
Insecure temporary file usage in SWHKD
Advisory: GHSA-r3r5-jhw6-4634
Aliases: CVE-2022-27818
Published: 2022-04-08T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SWHKD 1.1.5 unsafely uses the /tmp/swhkd.sock pathname. There can be an information leak or denial of service.
Keycloak insufficient session expiration
Advisory: GHSA-cm29-6wx7-p874
Aliases: CVE-2021-3461
Published: 2022-04-03T00:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].
Improper Privilege Management in Mattermost
Advisory: GHSA-qggc-pj29-j27m
Aliases: CVE-2022-1332
Published: 2022-04-14T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents. Per the Mattermost security updates page, versions 6.4.2, 6.3.5, 6.2.5, and 5.37.9 contain patches for this issue
Improper Control of a Resource Through its Lifetime in Mattermost
Advisory: GHSA-fxwj-v664-wv5g
Aliases: CVE-2022-1385
Published: 2022-04-20T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accidentally invited users to join the workspace and access information from the public teams and channels.
Phoenix Arbitrary URL Redirect
Advisory: GHSA-cmfh-8f8r-fj96
Aliases: CVE-2017-1000163
Published: 2022-04-12T21:16:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Phoenix team designed `Phoenix.Controller.redirect/2` to protect against redirects allowing user input to redirect to an external URL where your application code otherwise assumes a local path redirect. This is why the `:to` option is used for “local” URL redirects and why you must pass the `:external` option to intentionally allow external URLs to be redirected to. It has been disclosed that carefully crafted user input may be treated by some browsers as an external URL. An attacker can use this vulnerability to aid in social engineering attacks. The most common use would be to create highly believable phishing attacks. For example, the following user input would pass local URL validation, but be treated by Chrome and Firefox as external URLs: 
`http://localhost:4000/?redirect=/\nexample.com`
Not all browsers are affected, but latest Chrome and Firefox will issue a get request for `example.com` and successfully redirect externally
CSRF vulnerability in Jenkins Subversion Plugin
Advisory: GHSA-m5cw-c64p-77h6
Aliases: CVE-2022-29048
Published: 2022-04-13T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Subversion Plugin 2.15.3 and earlier does not require POST requests for several form validation methods, resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to connect to an attacker-specified URL.
Jakarta Tomcat Denial of Service vulnerability
Advisory: GHSA-w97x-xfxf-f9xj
Aliases: CVE-2003-0045
Published: 2022-04-29T01:25:43Z

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.
YARP Denial of Service Vulnerability
Advisory: GHSA-8xc6-g8xw-h2c4
Aliases: CVE-2022-26924
Published: 2022-04-22T20:23:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

A denial of service vulnerability exists in how YARP processes input.

### Patches

If you're using YARP `1.0.0`, you should update to NuGet package version [`1.0.1`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.0.1).
If you're using YARP `1.1.0-RC.1`, you should update to NuGet package version [`1.1.0-rc.1.22211.2`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.0-rc.1.22211.2).

You can do so by updating the `PackageReference` in your `.csproj` file
```diff
<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="1.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="1.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.1" />
</ItemGroup>
```
or by selecting `1.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)
![image](https://user-images.githubusercontent.com/25307628/162951795-a30f8ed7-77ef-4c4f-920e-58d9e1587ad1.png)

### References

[CVE-2022-26924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924)
Podman's default inheritable capabilities for linux container not empty
Advisory: GHSA-qvf8-p83w-v58j
Aliases: CVE-2022-27649
Published: 2022-04-01T20:52:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

A bug was found in Podman where containers were created with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.
Jakarta Tomcat cross-site scripting (XSS) vulnerability
Advisory: GHSA-5hgm-qm5m-5vmw
Aliases: CVE-2003-0044
Published: 2022-04-29T01:25:44Z

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.
URL Confusion When Scheme Not Supplied in medialize/uri.js
Advisory: GHSA-g694-m8vq-gv9h
Aliases: CVE-2022-1233
Published: 2022-04-05T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Medialize is a Javascript URL mutation library. When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname as null and the path as /www.example.com. Such behaviour is different from that exhibited by browsers, which will parse ///www.example.com as http://www.example.com instead. For example, the following will cause a redirect to http://www.example.com: A fix was released in version 1.19.11.
XML External Entity Reference in detekt
Advisory: GHSA-2cfc-865j-gm4w
Aliases: CVE-2022-0272
Published: 2022-04-22T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
Buffer Overflow in yajl-ruby
Advisory: GHSA-jj47-x69x-mxrm
Aliases: CVE-2022-24795
Published: 2022-04-05T15:55:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

_NOTE: A previous patch, 1.4.2, fixed the heap memory issue, but could still lead to a DoS infinite loop. Please update to version 1.4.3_

The 1.x branch and the 2.x branch of [yajl](https://github.com/lloyd/yajl) contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs.

### Details

The [reallocation logic at yajl_buf.c#L64](https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64) may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk.

These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer.

Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption.

### Impact

We rate this as a moderate severity vulnerability which mostly impacts process availability as we believe exploitation for arbitrary code execution to be unlikely.

### Patches

Patched in yajl-ruby 1.4.3

### Workarounds

Avoid passing large inputs to YAJL

### References
https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [yajl-ruby](https://github.com/brianmario/yajl-ruby/issues)
Cross-site Scripting in snipe-it
Advisory: GHSA-p885-prv3-m4xv
Aliases: CVE-2022-1380
Published: 2022-04-17T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen the user Cookie.
Command injection in simple-git
Advisory: GHSA-28xr-mwxg-3qc8
Aliases: CVE-2022-24066
Published: 2022-04-02T00:00:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

`simple-git` (maintained as [git-js](https://github.com/steveukx/git-js) named repository on GitHub) is a light weight interface for running git commands in any node.js application.The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-2421199) which only patches against the git fetch attack vector. A similar use of the --upload-pack feature of git is also supported for git clone, which the prior fix didn't cover. A fix was released in simple-git@3.5.0.
Missing `is_nil` requirement
Advisory: GHSA-2xxx-fhc8-9qvq
Published: 2022-04-12T19:42:45Z

Ecto will not raise on queries with non-explicit nil comparisons (ie if they aren't checked with `is_nil`).
Stored cross-site scripting in Snipe-IT
Advisory: GHSA-hpx4-xjp7-m4vr
Aliases: CVE-2022-1445
Published: 2022-04-25T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Snipe-IT prior to version 5.4.3 is vulnerable to stored cross-site scripting because the input to the `checked_out_to` parameter is not escaped. The vulnerability is capable of stealing a user's cookie.
Cross-site Scripting in xain
Advisory: GHSA-5chx-gg25-v37m
Aliases: CVE-2018-20302
Published: 2022-04-12T21:17:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

XSS is possible via the use of the order query parameter. An example request
  would look like:
  ```
  http://host/ressources?order=%27><script>alert(1);</script>
  ```
Cross-site Scripting in Microweber
Advisory: GHSA-9w7h-3wwh-6m5q
Aliases: CVE-2022-1439
Published: 2022-04-23T00:03:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Microweber prior to 1.2.15 is vulnerable to reflected cross-site scripting on demo.microweber.org/demo/module/. This allows the execution of arbitrary JavaScript as the attacked user.
Missing input validation can lead to command execution in composer
Advisory: GHSA-x7cr-6qr6-2hh6
Aliases: CVE-2022-24828
Published: 2022-04-22T20:15:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

The Composer method `VcsDriver::getFileContent()` with user-controlled `$file` or `$identifier` arguments is susceptible to an argument injection vulnerability. It can be leveraged to gain arbitrary command execution if the Mercurial or the Git driver are used.

This led to a vulnerability on Packagist.org and Private Packagist, i.e., using the composer.json `readme` field as a vector for injecting parameters into the `$file` argument for the Mercurial driver or via the `$identifier` argument for the Git and Mercurial drivers.

Composer itself can be attacked through branch names by anyone controlling a Git or Mercurial repository, which is explicitly listed by URL in a project's composer.json.

To the best of our knowledge, this was not actively exploited. The vulnerability has been patched on Packagist.org and Private Packagist within a day of the vulnerability report.
Insufficient type validation in pocketmine/pocketmine-mp
Advisory: GHSA-g5rr-p69h-7v3g
Published: 2022-04-22T20:57:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When an inventory interaction is performed (e.g. moving an item around an inventory), the client sends a serialized version of the itemstack to the server, which the server then deserializes and compares against its own copy. If the copies don't match, the transaction is invalid. This involves deserializing item NBT from the client, which allows for bogus data to be provided. Usually, this is harmless, but in this particular case, it could result in crashes on certain types of bad data (e.g. incorrect ListTag type provided for the `CanDestroy` tag). This is fixed in 4.2.9 by commit 5a98b08ee8dc8ff14862cd83d2e4af9d212fefc2. It's non-trivial to workaround this, but can be done by handling `InventoryTransactionPacket` and `PlayerAuthInputPacket` to scrub inbound transaction data of bogus NBT that would cause these crashes.
Unsafe parsing in SWHKD
Advisory: GHSA-h6xw-mghq-7523
Aliases: CVE-2022-27819
Published: 2022-04-08T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H

SWHKD 1.1.5 allows unsafe parsing via the -c option. An information leak might occur but there is a simple denial of service (memory exhaustion) upon an attempt to parse a large or infinite file (such as a block or character device).
Improper authorization in Keycloak
Advisory: GHSA-f32v-vf79-p29q
Aliases: CVE-2022-1466
Published: 2022-04-27T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to add users to the master realm even though no respective permission was granted.
Stored Cross-site Scripting vulnerability in Jenkins Jira Plugin
Advisory: GHSA-m3p3-2gp6-ghq8
Aliases: CVE-2022-29041
Published: 2022-04-13T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Jira Plugin 3.7 and earlier, except 3.6.1, does not escape the name and description of Jira Issue and Jira Release Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix.
Improper Input Validation in httpx
Advisory: GHSA-h8pj-cxx2-jfg2
Aliases: CVE-2021-41945
Published: 2022-04-29T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
Privilege escalation in beego
Advisory: GHSA-2v6v-q994-xvxx
Aliases: CVE-2021-27117
Published: 2022-04-06T00:01:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

beego is an open-source, high-performance web framework for the Go programming language. An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally.
Files or Directories Accessible to External Parties in Adminer
Advisory: GHSA-rxfq-3vpc-vv72
Aliases: CVE-2021-43008
Published: 2022-04-06T00:01:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Improper Access Control in Adminer versions 1.12.0 to 4.6.2 (fixed in version 4.6.3) allows an attacker to achieve Arbitrary File Read on the remote server by requesting the Adminer to connect to a remote MySQL database.
Unrestricted Upload of File with Dangerous Type in Apache Struts2
Advisory: GHSA-8m5q-crqq-6pmf
Aliases: CVE-2012-1592
Published: 2022-04-23T00:40:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files. A patch exists as of version 2.5.22.
Stored XSS in Jenkins CVS Plugin
Advisory: GHSA-ghq2-m3pq-qf3p
Aliases: CVE-2022-29037
Published: 2022-04-13T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins CVS Plugin 2.19 and earlier does not escape the name and description of CVS Symbolic Name parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Improper handling of case sensitivity in Spring Framework
Advisory: GHSA-g5mm-vmx4-3rg7
Aliases: CVE-2022-22968
Published: 2022-04-15T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In Spring Framework versions 5.3.0 - 5.3.18, 5.2.0 - 5.2.20, and older unsupported versions, the patterns for disallowedFields on a DataBinder are case sensitive which means a field is not effectively protected unless it is listed with both upper and lower case for the first character of the field, including upper and lower case for the first character of all nested fields within the property path. Versions 5.3.19 and 5.2.21 contain a patch for this issue.
ballcat-codegen template engine remote code execution injection
Advisory: GHSA-fv3m-xhqw-9m79
Aliases: CVE-2022-24881
Published: 2022-04-27T21:05:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
Ballcat Codegen provides the function of online editing code to generate templates.
In version < 1.0.0.beta.2, since Velocity and freemarker templates are introduced but input verification is not done, attackers can implement remote code execution through malicious code injection of the template engine.

### Patches
The fault is rectified and needs to be upgraded to the latest version.
Cross-site Scripting in fullpage.js
Advisory: GHSA-h3cq-j957-vhxg
Aliases: CVE-2022-1330
Published: 2022-04-13T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

using fullpage.js you can create a anchor tag . But when put href in anchor then it does not sanitize the url which allow for a break in the context of anchor element and can add our new element.
Malfunction of CSRF token validation in Shopware
Advisory: GHSA-pf38-v6qj-j23h
Aliases: CVE-2022-24879
Published: 2022-04-28T21:01:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact
The CSRF tokens were not renewed after login and logout.
An attacker could impersonate the victim if the attacker is able to use the same device as the victim used beforehand.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Struts ParameterInterceptor vulnerability allows remote command execution
Advisory: GHSA-j68f-8h6p-9h5q
Aliases: CVE-2011-3923
Published: 2022-04-22T00:24:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Regular expression in ParametersInterceptor matches `top['foo'](0)` as a valid expression, which OGNL treats as `(top['foo'])(0)` and evaluates the value of 'foo' action parameter as an OGNL expression. This lets malicious users put arbitrary OGNL statements into any String variable exposed by an action and have it evaluated as an OGNL expression and since OGNL statement is in HTTP parameter value attacker can use blacklisted characters (e.g. #) to disable method execution and execute arbitrary methods, bypassing the ParametersInterceptor and OGNL library protections.
SQL injection in pagekit/pagekit
Advisory: GHSA-45hc-r4fj-qj89
Aliases: CVE-2021-44135
Published: 2022-04-02T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pagekit is a modular and lightweight CMS built with Symfony components and Vue.js. The configAction in SettingsController allow user to set the order of comments listing. The allowed options are ASC and DESC. That config then get concatenated directly to the SQL query. Due to the fact that there wasnt any sanitizion before saving that config, it can lead to the SQL Injection vulnerability.
Cross-site Scripting in tableexport.jquery.plugin
Advisory: GHSA-j636-crp3-m584
Aliases: CVE-2022-1291
Published: 2022-04-11T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

There is a cross-site scripting vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. This can result in transmitting cookies to third-party servers and/or sending data from secure sessions to third-party servers.
Logic error in Apache Pinot
Advisory: GHSA-29f8-q7mf-7cqj
Aliases: CVE-2022-23974
Published: 2022-04-06T00:01:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0