aswin1906/github-advisory-2022 huggingface dataset:
Cross-site Scripting in phpmyadmin
Advisory: GHSA-vcwc-6mr9-8m7c
Aliases: CVE-2022-23808
Published: 2022-01-28T22:36:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script, which can allow XSS or HTML injection.
User passwords transmitted in plain text by Jenkins Active Directory Plugin
Advisory: GHSA-c8cc-hj57-vm65
Aliases: CVE-2022-23105
Published: 2022-01-13T00:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Jenkins Active Directory Plugin 2.25 and earlier does not encrypt the transmission of data between the Jenkins controller and Active Directory servers in most configurations.
ANSI escape characters not filtered
Advisory: GHSA-f9jg-8p32-2f55
Aliases: CVE-2021-25743
Published: 2022-01-08T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events.
User enumeration in livehelperchat
Advisory: GHSA-4xww-6h7v-29jg
Aliases: CVE-2022-0083
Published: 2022-01-21T23:37:07Z

livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information. There is an observable discrepancy between errors generated for users that exist and those that do not.
Use of Uninitialized Resource in tectonic_xdv
Advisory: GHSA-qwvx-c8j7-5g75
Aliases: CVE-2021-45703
Published: 2022-01-06T22:09:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation.

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.

The problem was fixed in commit `cdff034` by zero-initializing the buffer before passing it to a user-provided Read implementation.
Remote code injection, Improper Input Validation and Uncontrolled Recursion in Log4j library
Advisory: GHSA-3qpm-h9ch-px3c
Published: 2022-01-06T18:31:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

### Summary
The version used of Log4j, the library used for logging by PowerNukkit, is subject to a remote code execution vulnerability via the ldap JNDI parser.
It's well detailed at [CVE-2021-44228](https://github.com/advisories/GHSA-jfh8-c2jp-5v3q) and  CVE-2021-45105(https://github.com/advisories/GHSA-p6xc-xr62-6r2g).

### Impact
Malicious client code could be used to send messages and cause remote code execution on the server.

### Patches
PowerNukkit `1.5.2.1` is a patch-release that only updates the Log4j version to `2.17.0` and should be used instead of `1.5.2.0`.
All versions prior to `1.5.2.1` are affected and are not patched.

### Workarounds
If you can't upgrade, you can use the `-Dlog4j2.formatMsgNoLookups=true` startup argument as remediation, as this prevents the vulnerability from happening.

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
https://github.com/advisories/GHSA-p6xc-xr62-6r2g

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the PowerNukkit repository](https://github.com/PowerNukkit/PowerNukkit/issues)
Out-of-bounds Write in actix-web
Advisory: GHSA-9qj6-4rfq-vm84
Aliases: CVE-2018-25024
Published: 2022-01-06T22:20:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly coerce an immutable reference into a mutable reference, leading to memory corruption.
Link Following in Iris
Advisory: GHSA-jcxc-rh6w-wf49
Aliases: CVE-2021-23772
Published: 2022-01-06T21:36:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

This affects all versions of package github.com/kataras/iris; all versions of package github.com/kataras/iris/v12. The unsafe handling of file names during upload using UploadFormFiles method may enable attackers to write to arbitrary locations outside the designated target folder.
October/System authenticated file write leads to remote code execution
Advisory: GHSA-wv23-pfj7-2mjj
Aliases: CVE-2021-32649
Published: 2022-01-14T21:08:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

Assuming an attacker with "create, modify and delete website pages" privileges in the backend is able to execute PHP code by running specially crafted Twig code in the template markup.

### Patches

Issue has been patched in Build 473 and v1.1.6

### Workarounds

Apply https://github.com/octobercms/october/commit/167b592eed291ae1563c8fcc5b9b34a03a300f26 to your installation manually if you are unable to upgrade.

### References

Credits to:
• David Miller

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
OS Command Injection in celery
Advisory: GHSA-q4xr-rc97-m4xx
Aliases: CVE-2021-23727
Published: 2022-01-06T22:22:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
orchardcore is vulnerable to Cross-site Scripting
Advisory: GHSA-6w5m-jgc5-8cgc
Aliases: CVE-2022-0159
Published: 2022-01-21T23:57:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Argument Delimiters in a Decompiling Package Process in APKLeaks
Advisory: GHSA-8434-v7xw-8m9x
Aliases: CVE-2021-21386
Published: 2022-01-21T23:03:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

APKLeaks prior to v2.0.4 allows remote authenticated attackers to execute arbitrary OS commands via package name inside the application manifest.

### Impact

An authenticated attacker could include arguments that allow unintended commands or code to be executed, allow sensitive data to be read or modified, or could cause other unintended behavior through malicious package names.


### References

- a966e781499ff6fd4eea66876d7532301b13a382

### For more information

If you have any questions or comments about this advisory:
* Email me at [me@dw1.io](mailto:me@dw1.io)
Allocation of Resources Without Limits or Throttling in Apache Avro
Advisory: GHSA-868x-rg4c-cjqg
Aliases: CVE-2021-43045
Published: 2022-01-08T00:39:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability in the .NET SDK of Apache Avro allows an attacker to allocate excessive resources, potentially causing a denial-of-service attack. This issue affects .NET applications using Apache Avro version 1.10.2 and prior versions. Users should update to version 1.11.0 which addresses this issue.
Server-side request forgery (SSRF) in Apache Batik
Advisory: GHSA-2h63-qp69-fwvw
Aliases: CVE-2020-11987
Published: 2022-01-06T20:35:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the NodePickerPanel. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests.
SQL Injection in dolibarr
Advisory: GHSA-j545-frh3-r9gq
Aliases: CVE-2022-0224
Published: 2022-01-21T23:56:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command.
Stored XSS vulnerability in Jenkins Scriptler Plugin
Advisory: GHSA-p479-rwhp-rwjx
Aliases: CVE-2021-21667
Published: 2022-01-06T18:45:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.

Scriptler Plugin 3.3 escapes parameter names shown in job configuration forms.
Insufficient Session Expiration in shopware
Advisory: GHSA-p523-jrph-qjc6
Aliases: CVE-2022-21652
Published: 2022-01-06T23:49:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

### Impact

Automatically invalidate sessions upon password change

### Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
Uncaught Exception in engine.io
Advisory: GHSA-273r-mgr4-v34f
Aliases: CVE-2022-21676
Published: 2022-01-13T16:14:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

> RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear
>   at Receiver.getInfo (/.../node_modules/ws/lib/receiver.js:176:14)
>   at Receiver.startLoop (/.../node_modules/ws/lib/receiver.js:136:22)
>   at Receiver._write (/.../node_modules/ws/lib/receiver.js:83:10)
>   at writeOrBuffer (internal/streams/writable.js:358:12)

This impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package starting from version `4.0.0`, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).

### Patches

A fix has been released for each major branch:

| Version range | Fixed version |
| --- | --- |
| `engine.io@4.x.x` | `4.1.2` |
| `engine.io@5.x.x` | `5.2.1` |
| `engine.io@6.x.x` | `6.1.1` |

Previous versions (`< 4.0.0`) are not impacted.

For `socket.io` users:

| Version range | `engine.io` version | Needs minor update? |
| --- | --- | --- |
| `socket.io@4.4.x` | `~6.1.0` | -
| `socket.io@4.3.x` | `~6.0.0` | Please upgrade to `socket.io@4.4.x`
| `socket.io@4.2.x` | `~5.2.0` | -
| `socket.io@4.1.x` | `~5.1.1` | Please upgrade to `socket.io@4.4.x`
| `socket.io@4.0.x` | `~5.0.0` | Please upgrade to `socket.io@4.4.x`
| `socket.io@3.1.x` | `~4.1.0` | -
| `socket.io@3.0.x` | `~4.0.0` | Please upgrade to `socket.io@3.1.x` or `socket.io@4.4.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/))

In most cases, running `npm audit fix` should be sufficient. You can also use  `npm update engine.io --depth=9999`.

### Workarounds

There is no known workaround except upgrading to a safe version.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [`engine.io`](https://github.com/socketio/engine.io)

Thanks to Marcus Wejderot from Mevisio for the responsible disclosure.
Drainage of FeeCollector's Block Transaction Fees in cronos
Advisory: GHSA-f854-hpxv-cw9r
Aliases: CVE-2021-43839
Published: 2022-01-06T18:30:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact
In Cronos nodes running versions before v0.6.5, it is possible to take transaction fees from Cosmos SDK's FeeCollector for the current block by sending a custom crafted MsgEthereumTx.

User funds and balances are safe.


### Patches
This problem has been patched in Cronos v0.6.5 on the mempool level.
The next network upgrade with consensus-breaking changes will patch it on the consensus level.

### Workarounds
There are no tested workarounds. All validator node operators are recommended to upgrade to Cronos v0.6.5 at their earliest possible convenience.

### Credits
Thank you to @zb3 for reporting this issue on [Cronos Immunefi Bug Bounty Program](https://immunefi.com/bounty/cronos/), to @cyril-crypto for reproducing the issue and to @yihuang and @thomas-nguy for patching the issue on the CheckTx (mempool) and the DeliverTx (consensus) levels.

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in [crypto-org-chain/cronos](https://github.com/crypto-org-chain/cronos/discussions/new)
* Email us at [chain@crypto.org](mailto:chain@crypto.org)
Prototype Pollution in copy-props
Advisory: GHSA-897m-rjf5-jp39
Aliases: CVE-2020-28503
Published: 2022-01-06T20:35:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

The package copy-props before 2.0.5 are vulnerable to Prototype Pollution via the main functionality.
Access of Resource Using Incompatible Type in Hermes
Advisory: GHSA-7mhc-prgv-r3q4
Aliases: CVE-2021-24044
Published: 2022-01-16T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

By passing invalid javascript code where await and yield were called upon non-async and non-generator getter/setter functions, Hermes would invoke generator functions and error out on invalid await/yield positions. This could result in segmentation fault as a consequence of type confusion error, with a low chance of RCE. This issue affects Hermes versions prior to v0.10.0.
Open redirect in shopware
Advisory: GHSA-c53v-qmrx-93hg
Aliases: CVE-2022-21651
Published: 2022-01-06T23:49:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

### Impact

Arbitrary redirect while using certain URLs 

### Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
Gerapy < 0.9.8 may cause remote code execution
Advisory: GHSA-9w7f-m4j4-j3xw
Aliases: CVE-2021-43857
Published: 2022-01-06T17:36:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

project_configure function exist remote code execute in Gerapy < 0.9.8

### Patches

Patched in version 0.9.8, please install with:

```
pip3 install -U gerapy
```
Cross-site Scripting in pimcore
Advisory: GHSA-pm3v-qxf6-fgxv
Aliases: CVE-2022-0285
Published: 2022-01-21T18:08:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
Out-of-bounds Write and Race Condition in metrics-util
Advisory: GHSA-cwvc-87xq-pc5m
Aliases: CVE-2021-45704
Published: 2022-01-06T22:08:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

In the affected versions of the crate, AtomicBucket<T> unconditionally implements Send/Sync traits. Therefore, users can create a data race to the inner T: !Sync by using the AtomicBucket::data_with() API. Such data races can potentially cause memory corruption or other undefined behavior.

The flaw was fixed in commit 8e6daab by adding appropriate Send/Sync bounds to the Send/Sync impl of struct Block<T> (which is a data type contained inside AtomicBucket<T>).
Cross-site Scripting in Ericsson CodeChecker
Advisory: GHSA-fxmx-pfm2-85m2
Aliases: CVE-2021-44217
Published: 2022-01-21T23:32:32Z

In Ericsson CodeChecker prior to 6.18.2, a Stored Cross-site scripting (XSS) vulnerability in the comments component of the reports viewer allows remote attackers to inject arbitrary web script or HTML via the POST JSON data of the /CodeCheckerService API.
elgg is vulnerable to Cross-site Scripting
Advisory: GHSA-2xw8-j43j-5vxp
Aliases: CVE-2021-4072
Published: 2022-01-06T21:35:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Cross-site Scripting in Apache Pluto
Advisory: GHSA-3qp6-m7hp-jrwf
Aliases: CVE-2021-36739
Published: 2022-01-08T00:46:21Z

The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks.
Stored XSS vulnerability in Jenkins Publish Over SSH Plugin
Advisory: GHSA-fjpm-hf7c-xgc2
Aliases: CVE-2022-23110
Published: 2022-01-13T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Jenkins Publish Over SSH Plugin 1.22 and earlier does not escape the SSH server name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Cross-site Scripting and Open Redirect in Products.CMFPlone
Advisory: GHSA-8w54-22w9-3g8f
Published: 2022-01-28T23:10:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

### Impact
Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish.
The technique is known as cache poisoning.
Any later visitor can get redirected when clicking on a link on this page.
Usually only anonymous users are affected, but this depends on your cache settings.

### Patches
No patch is available for the Products.CMFPlone 4 series.
Versions 5.0 and higher are not affected, but two other packages used by these versions are affected.

`plone.app.contenttypes` has the same problem in all versions, see [advisory](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x).
In Plone 5.0-5.2, the default Products.ATContentTypes version has the same problem. See [advisory](https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh).
Plone 5.2.7 and 6.0.0a3 will be released today and will include these fixes.

For all unpatched versions of the three packages, you can use the following workaround.

### Workaround
Make sure the image_view_fullscreen page is not stored in the cache.
In Plone:

* Login as Manager and go to Site Setup.
* Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable.
* Click on the tab 'Caching operations'.
* Under 'Legacy template mappings' locate the ruleset 'Content item view'.
* From the last column ('Templates')  remove 'image_view_fullscreen'.
* Click on Save.

### Reporter
This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!

### For more information
If you have any questions or comments about this advisory, email us at [security@plone.org](mailto:security@plone.org)
This is also the correct address to use when you want to report a possible vulnerability.
See [our security report policy](https://plone.org/security/report).
Infinite Loop in colors.js
Advisory: GHSA-gh88-3pxp-6fm8
Aliases: CVE-2021-23567
Published: 2022-01-21T23:39:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0
Cross-site Scripting in livehelperchat
Advisory: GHSA-x3g3-jh26-76cf
Aliases: CVE-2022-0375
Published: 2022-01-28T23:06:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

LiveHelperChat is vulnerable to Stored XSS at the Name field in the Admin themes of System configuration.
Regular expression deinal of service (ReDoS) in is-my-json-valid
Advisory: GHSA-4hpf-3wq7-5rpr
Aliases: CVE-2018-1107
Published: 2022-01-06T20:44:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
Path Traversal in Jenkins Warnings Next Generation Plugin
Advisory: GHSA-rvh4-g2rj-hr9c
Aliases: CVE-2022-23107
Published: 2022-01-21T23:38:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Jenkins Warnings Next Generation Plugin prior to 9.10.3, 9.7.1, 9.5.2, and 9.0.2 does not restrict the name of a file when configuring a custom ID.

This allows attackers with Item/Configure permission to write and read specific files with a hard-coded suffix on the Jenkins controller file system.

Warnings Next Generation Plugin 9.10.3, 9.7.1, 9.5.2, and 9.0.2 checks for the presence of prohibited directory separator characters in the custom ID.
RCE in Mingsoft MCMS
Advisory: GHSA-8wq7-hhjj-fpqv
Aliases: CVE-2022-22930
Published: 2022-01-22T00:00:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution (RCE) vulnerability in the Template Management function of MCMS allows attackers to execute arbitrary code via a crafted payload.
In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin.
Advisory: GHSA-mgpf-hhgf-cxg4
Aliases: CVE-2021-45457
Published: 2022-01-08T00:43:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
Unrestricted Upload of File with Dangerous Type in Crater
Advisory: GHSA-728c-42pc-fwxg
Aliases: CVE-2022-0242
Published: 2022-01-21T23:54:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
Use After Free in rusqlite
Advisory: GHSA-g87r-23vw-7f87
Aliases: CVE-2021-45719
Published: 2022-01-06T22:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. update_hook has a use-after-free.
crater is vulnerable to Unrestricted Upload of File with Dangerous Type
Advisory: GHSA-wppj-3pjr-9w79
Aliases: CVE-2021-4080
Published: 2022-01-21T23:55:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

crater is vulnerable to Unrestricted Upload of File with Dangerous Type
icecoder is vulnerable to Cross-site Scripting
Advisory: GHSA-73q9-7pwj-gm46
Aliases: CVE-2021-3862
Published: 2022-01-21T23:46:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Use After Free in rusqlite
Advisory: GHSA-g4g4-3pqw-8m7f
Aliases: CVE-2021-45718
Published: 2022-01-06T22:02:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the rusqlite crate 0.25.x before 0.25.4 and 0.26.x before 0.26.2 for Rust. rollback_hook has a use-after-free.
Password exposure in ShenYu
Advisory: GHSA-7wq4-89xx-g62j
Aliases: CVE-2022-23223
Published: 2022-01-28T22:13:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The HTTP response will disclose the user password. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows retrieving all credentials
Advisory: GHSA-cw68-xmm4-c83r
Aliases: CVE-2022-23117
Published: 2022-01-13T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to retrieve all username/password credentials stored on the Jenkins controller.
Prototype Pollution in realms-shim
Advisory: GHSA-q4j7-v27r-fgcx
Aliases: CVE-2021-23543
Published: 2022-01-13T15:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
Arbitrary expression injection in Pillow
Advisory: GHSA-8vj2-vxx3-667w
Aliases: CVE-2022-22817
Published: 2022-01-12T20:07:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

`PIL.ImageMath.eval` in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method `ImageMath.eval("exec(exit())")`.

While Pillow 9.0.0 restricted top-level builtins available to PIL.ImageMath.eval(), it did not prevent builtins available to lambda expressions. These are now also restricted in 9.0.1.
Allocation of Resources Without Limits or Throttling in ckb
Advisory: GHSA-2969-8hh9-57jc
Aliases: CVE-2021-45699
Published: 2022-01-06T22:09:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the ckb crate before 0.40.0 for Rust. Remote attackers may be able to conduct a 51% attack against the Nervos CKB blockchain by triggering an inability to allocate memory for the misbehavior HashMap.
Mingsoft MCMS SQL injection vulnerability
Advisory: GHSA-qqc2-pv68-q72h
Aliases: CVE-2021-46383
Published: 2022-01-27T00:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mingsoft MCMS contains a SQL injection vulnerability relating to the component `net.mingsoft.mdiy.action.web.DictAction#list`.
The `total_size` function for partial read the length of any `FixVec` is incorrect in molecule.
Advisory: GHSA-6p3c-v8vc-c244
Aliases: CVE-2021-45697
Published: 2022-01-06T22:10:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Anyone who uses total_size(..) function to partial read the length of any FixVec will get an incorrect result, due to an incorrect implementation. This has been resolved in the 0.7.2 release.
Infinite loop causing Denial of Service in colors
Advisory: GHSA-5rqg-jm4f-cqx7
Published: 2022-01-10T17:29:53Z

colors is a library for including colored text in node.js consoles. Between 07 and 09 January 2022, colors versions 1.4.1, 1.4.2, and 1.4.44-liberty-2 were published including malicious code that caused a Denial of Service due to an infinite loop. Software dependent on these versions experienced the printing of randomized characters to console and an infinite loop resulting in unbound system resource consumption.

Users of colors relying on these specific versions should downgrade to version 1.4.0.
XML External Entity Reference in edu.stanford.nlp:stanford-corenlp
Advisory: GHSA-mh83-jcw5-rjh8
Aliases: CVE-2022-0198
Published: 2022-01-14T21:07:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

The TransformXML() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
pimcore is vulnerable to Cross-site Scripting
Advisory: GHSA-v567-q267-phpg
Aliases: CVE-2022-0257
Published: 2022-01-21T23:50:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Deserialization of Untrusted Data in rust-cpuid
Advisory: GHSA-w428-f65r-h4q2
Aliases: CVE-2021-45687
Published: 2022-01-06T22:13:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the raw-cpuid crate before 9.1.1 for Rust. If the serialize feature is used (which is not the the default), a Deserialize operation may lack sufficient validation, leading to memory corruption or a panic.
Insertion of Sensitive Information into Log File in Apache Geode
Advisory: GHSA-mw25-f5r2-hpc6
Aliases: CVE-2021-34797
Published: 2022-01-06T22:23:25Z

Apache Geode versions up to 1.12.4 and 1.13.4 are vulnerable to a log file redaction of sensitive information flaw when using values that begin with characters other than letters or numbers for passwords and security properties with the prefix "sysprop-", "javax.net.ssl", or "security-". This issue is fixed by overhauling the log file redaction in Apache Geode versions 1.12.5, 1.13.5, and 1.14.0.
Missing permission checks in SSH Agent Plugin allow enumerating credentials IDs
Advisory: GHSA-9wxh-jjj5-67cv
Aliases: CVE-2022-20620
Published: 2022-01-13T00:00:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins SSH Agent Plugin prior to 1.23.2 and 1.22.1 does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in SSH Agent Plugin 1.23.2 and 1.22.1 requires the appropriate permissions.
OS Command Injection in node-mpv
Advisory: GHSA-cqr2-xhg6-p268
Aliases: CVE-2020-7632
Published: 2022-01-07T00:20:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
SQL injection in Moodle
Advisory: GHSA-6jhm-4vmx-mr76
Aliases: CVE-2022-0332
Published: 2022-01-28T22:08:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
livehelperchat is vulnerable to Cross-site Scripting
Advisory: GHSA-5r9v-8w62-r26j
Aliases: CVE-2022-0253
Published: 2022-01-21T23:48:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Exposure of Sensitive Information to an Unauthorized Actor in nanoid
Advisory: GHSA-qrpm-p2h7-hrv2
Aliases: CVE-2021-23566
Published: 2022-01-21T23:57:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Command Injection in Apache James
Advisory: GHSA-84wg-rgp8-2hg4
Aliases: CVE-2021-38542
Published: 2022-01-08T00:40:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information.
Missing Authorization in DayByDay CRM
Advisory: GHSA-frxp-xxx8-hrg6
Aliases: CVE-2022-22108
Published: 2022-01-08T00:31:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
SSRF vulnerability in jupyter-server-proxy
Advisory: GHSA-gcv9-6737-pjqw
Aliases: CVE-2022-21697
Published: 2022-01-27T16:24:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

### Impact

**What kind of vulnerability is it?**  Server-Side Request Forgery ( SSRF )

**Who is impacted?** Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled. 

A lack of input validation allowed authenticated clients to proxy requests to other hosts, bypassing the `allowed_hosts` check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity.


### Patches

_Has the problem been patched? What versions should users upgrade to?_

Upgrade to 3.2.1, or apply the patch https://github.com/jupyterhub/jupyter-server-proxy/compare/v3.2.0...v3.2.1.patch

### For more information

If you have any questions or comments about this advisory:

* Open a topic [on our forum](https://discourse.jupyter.org)
* Email the Jupyter security team at [security@ipython.org](mailto:security@ipython.org)
Exposure of Sensitive Information in simple-get
Advisory: GHSA-wpg7-2c88-r8xv
Aliases: CVE-2022-0355
Published: 2022-01-28T22:54:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In versions of simple-get prior to 4.0.1, 3.1.1, and 2.8.2, when fetching a remote url with a cookie location response, headers will be followed, potentially resulting in an exposure of the session cookie to a third party.
Incorrect Permission Assignment for Critical Resource in OnionShare
Advisory: GHSA-h29c-wcm8-883h
Aliases: CVE-2022-21694
Published: 2022-01-21T23:20:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-006
- Vulnerability type: Broken Website Hardening Control
- Threat level: Low

## Description:

The CSP can be turned on or off but not configured for the specific needs of the website.

## Technical description:

The website mode of the application allows to use a hardened CSP, which will block any scripts and external resources. It is not possible to configure this CSP for individual pages and therefore the security enhancement cannot be used for websites using javascript or external resources like fonts or images.

If CSP were configurable, the website creator could harden it accordingly to the needs of the application.

As this issue correlates with the Github issue for exposing the flask application directly (https://github.com/onionshare/ onionshare/issues/1389), it can be assumed that this can be solved by either changing to a well-known webserver, which supports this kind of configuration, or enhancing the status quo by making the CSP a configurable part of each website.

We believe that bundling the nginx or apache webserver would add complexity and dependencies to the application that could result in a larger attack surface - as these packages receive regular security updates. On the other hand it is not recommended to directly expose the flask webserver, due to lack of hardening. This is a trade-off which needs to be evaluated by the Onionshare developers, as multiple features are involved. Ideally the application user could choose between the built-in flask webserver or a system webserver of choice.

## Impact:

As this is a general weakness and not a direct vulnerability in the Onionshare application, the direct impact of this issue is rather low.

## Recommendation:

- Consider offering a configurable webserver choice
- Consider configurable CSP
Use of Hard-coded Credentials in Apache Kylin
Advisory: GHSA-9fj5-jg6f-qg5r
Aliases: CVE-2021-45458
Published: 2022-01-08T00:43:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords. In the encryption algorithm used by this encryption class, the cipher is initialized with a hardcoded key and IV. If users use class PasswordPlaceholderConfigurer to encrypt their password and configure it into kylin's configuration file, there is a risk that the password may be decrypted. This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.
showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
Advisory: GHSA-5mj6-3cmq-fh34
Aliases: CVE-2022-0079
Published: 2022-01-06T22:22:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

showdoc is vulnerable to Generation of Error Message Containing Sensitive Information
Incorrect Authorization in latte/latte
Advisory: GHSA-6pj2-5fqq-xvjc
Aliases: CVE-2021-23803
Published: 2022-01-06T20:56:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This affects the package latte/latte before 2.10.6. There is a way to bypass allowFunctions that will affect the security of the application. When the template is set to allow/disallow the use of certain functions, adding control characters (x00-x08) after the function will bypass these restrictions.
Insufficient Session Expiration in Pterodactyl API
Advisory: GHSA-7v3x-h7r2-34jv
Published: 2022-01-21T18:43:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

### Impact
A vulnerability exists in Pterodactyl Panel `<= 1.6.6` that could allow a malicious attacker that compromises an API key to generate an authenticated user session that is not revoked when the API key is deleted, thus allowing the malicious user to remain logged in as the user the key belonged to.

It is important to note that **a malicious user must first compromise an existing API key for a user to exploit this issue**. It cannot be exploited by chance, and requires a coordinated attack against an individual account using a known API key.

### Patches
This issue has been addressed in the `v1.7.0` release of Pterodactyl Panel.

### Workarounds
Those not wishing to upgrade may apply the change below:

```diff
diff --git a/app/Http/Middleware/Api/AuthenticateKey.php b/app/Http/Middleware/Api/AuthenticateKey.php
index eb25dac6..857bfab2 100644
--- a/app/Http/Middleware/Api/AuthenticateKey.php
+++ b/app/Http/Middleware/Api/AuthenticateKey.php
@@ -70,7 +70,7 @@ class AuthenticateKey
         } else {
             $model = $this->authenticateApiKey($request->bearerToken(), $keyType);

-            $this->auth->guard()->loginUsingId($model->user_id);
+            $this->auth->guard()->onceUsingId($model->user_id);
         }
```

### For more information
If you have any questions or comments about this advisory please reach out to `Tactical Fish#8008` on [Discord](https://discord.gg/pterodactyl) or email `dane@pterodactyl.io`.
Logic error in dolibarr
Advisory: GHSA-8qvx-f5gf-g43v
Aliases: CVE-2022-0174
Published: 2022-01-12T22:54:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The application does not check the input of price number lead to Business Logic error through negative price amount.
Incorrect sanitisation function leads to `XSS` in mermaid
Advisory: GHSA-p3rp-vmj9-gv6v
Aliases: CVE-2021-43861
Published: 2022-01-06T19:45:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

### Impact
Malicious diagrams can contain javascript code that can be run at diagram readers machines.

### Patches
The users should upgrade to version 8.13.8

### Workarounds
You need to upgrade in order to avoid this issue.
Memory flaw in zeroize_derive
Advisory: GHSA-c5hx-w945-j4pq
Aliases: CVE-2021-45706
Published: 2022-01-06T22:08:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the zeroize_derive crate before 1.1.1 for Rust. Dropped memory is not zeroed out for an enum.
Path traversal in Onionshare
Advisory: GHSA-jgm9-xpfj-4fq6
Aliases: CVE-2022-21693
Published: 2022-01-21T23:20:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-013
- Vulnerability type: Improper Hardening
- Threat level: Low

## Description:

The filesystem restriction could be hardened and should only allow for pre-defined subfolders.

## Technical description:

The Flatpak and Snap configurations allow for read-only access on the whole home folder. The relevant lines in the configuration files are `onionshare/snap/snapcraft.yaml#L20` and `onionshare/flatpak/org.onionshare.OnionShare.yaml#L19` , respectively.

The encapsulation of filesystem access via these mechanisms should be restricted to pre-defined folders and not allow for access to (configuration) files outside the Onionshare-specific folders.

Sadly Snap does not allow for further restriction to specific folders and therefore cannot be further hardened. By default both frameworks disallow access to hidden folders and therefore reduce the potential impact.

## Impact:

An adversary with a primitive that allows for filesystem access from the context of the Onionshare process can access sensitive files in the entire user home folder. This could lead to the leaking of sensitive data. Due to the automatic exclusion of hidden folders, the impact is reduced.

## Recommendation:

- Reduce read access in Flatpak configuration.
Improper Authentication in phpmyadmin
Advisory: GHSA-8wf2-3ggj-78q9
Aliases: CVE-2022-23807
Published: 2022-01-28T22:44:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

An issue was discovered in phpMyAdmin 4.9 before 4.9.8 and 5.1 before 5.1.2. A valid user who is already authenticated to phpMyAdmin can manipulate their account to bypass two-factor authentication for future login instances.
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Advisory: GHSA-7vxc-chqj-h83g
Aliases: CVE-2021-4168
Published: 2022-01-06T22:02:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:N

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Improper Restriction of XML External Entity Reference in skylot/jadx
Advisory: GHSA-r8j4-96mx-rjcc
Aliases: CVE-2022-0219
Published: 2022-01-21T18:13:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

skylot/jadx prior to 1.3.2 is vulnerable to Improper Restriction of XML External Entities when a user is tricked into exporting a malicious APK file (via the -e option) containing a crafted AndroidManifest.xml / strings.xml to gradle, leading to possible local file disclosure.
Out-of-bounds Write in actix-web
Advisory: GHSA-fgfm-hqjw-3265
Aliases: CVE-2018-25025
Published: 2022-01-06T22:18:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can unsoundly extend the lifetime of a string, leading to memory corruption.
Improper Input Validation in Parquet-MR
Advisory: GHSA-gc67-crq6-hgh5
Aliases: CVE-2021-41561
Published: 2022-01-06T23:59:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Improper Input Validation vulnerability in Parquet-MR of Apache Parquet allows an attacker to DoS by malicious Parquet files. This issue affects Apache Parquet-MR version 1.9.0 and later versions.
Use of Uninitialized Resource in buffoon.
Advisory: GHSA-v938-qcc9-rwv8
Aliases: CVE-2020-36512
Published: 2022-01-06T22:17:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation.
Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Information disclosure in Django
Advisory: GHSA-8c5j-9r9f-c6w8
Aliases: CVE-2021-45116
Published: 2022-01-12T19:21:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.
Use of Uninitialized Resource in bite.
Advisory: GHSA-v2ch-fc8f-qm33
Aliases: CVE-2020-36511
Published: 2022-01-06T22:16:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the bite crate through 2020-12-31 for Rust. read::BiteReadExpandedExt::read_framed_max may read from uninitialized memory locations.
Race Condition in tokio
Advisory: GHSA-fg7r-2g4j-5cgr
Aliases: CVE-2021-45710
Published: 2022-01-06T22:04:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

If a tokio::sync::oneshot channel is closed (via the oneshot::Receiver::close method), a data race may occur if the oneshot::Sender::send method is called while the corresponding oneshot::Receiver is awaited or calling try_recv.

When these methods are called concurrently on a closed channel, the two halves of the channel can concurrently access a shared memory location, resulting in a data race. This has been observed to cause memory corruption.

Note that the race only occurs when both halves of the channel are used after the Receiver half has called close. Code where close is not used, or where the Receiver is not awaited and try_recv is not called after calling close, is not affected.
Cross-site Scripting in Scratch-Svg-Renderer
Advisory: GHSA-h3vq-wv8j-36gw
Aliases: CVE-2020-27428
Published: 2022-01-08T00:44:33Z

A DOM-based cross-site scripting (XSS) vulnerability in Scratch-Svg-Renderer v0.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted sb3 file.
Unrestricted Upload of File with Dangerous Type in pimcore
Advisory: GHSA-c697-r227-pq6h
Aliases: CVE-2022-0263
Published: 2022-01-21T23:33:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore
Incorrect Permission Assignment for Critical Resource in Jenkins Bitbucket Branch Source Plugin
Advisory: GHSA-w2mh-6xj5-f77f
Aliases: CVE-2022-20618
Published: 2022-01-13T00:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Bitbucket Branch Source Plugin prior to 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read access to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Bitbucket Branch Source Plugin 746.v350d2781c184, 725.vd9f8be0fa250, 2.9.11.2, and 2.9.7.2 requires the appropriate permissions.
Use of Uninitialized Resource in bronzedb-protocol.
Advisory: GHSA-jv2r-jx6q-89jg
Aliases: CVE-2021-45682
Published: 2022-01-06T22:16:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the bronzedb-protocol crate through 2021-01-03 for Rust. ReadKVExt may read from uninitialized memory locations.