aswin1906/github-advisory-2022 huggingface dataset:
`Read` on uninitialized memory may cause UB (fn preamble_skipcount())
Advisory: GHSA-r67p-m7g9-gxw6
Published: 2022-06-16T23:51:58Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation (within `fn preamble_skipcount()`).

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
`BinaryArray` does not perform bound checks on reading values and offsets
Advisory: GHSA-r7cj-wmwv-hfw5
Published: 2022-06-16T23:40:50Z

`BinaryArray` performs insufficient validation on creation, which allows out-of-bounds reads in safe code.
OS Command Injection in cookiecutter
Advisory: GHSA-f4q6-9qm4-h8j4
Aliases: CVE-2022-24065
Published: 2022-06-09T23:48:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package cookiecutter before 2.1.1 is vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Weak private key generation in SSH.NET
Advisory: GHSA-72p8-v4hg-v45p
Aliases: CVE-2022-29245
Published: 2022-06-01T19:50:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

During an **X25519** key exchange, the client’s private is generated with [**System.Random**](https://docs.microsoft.com/en-us/dotnet/api/system.random):

```cs
var rnd = new Random();
_privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
rnd.NextBytes(_privateKey);
```

Source: [KeyExchangeECCurve25519.cs](https://github.com/sshnet/SSH.NET/blob/bc99ada7da3f05f50d9379f2644941d91d5bf05a/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs#L51)  
Source commit: https://github.com/sshnet/SSH.NET/commit/b58a11c0da55da1f5bad46faad2e9b71b7cb35b3

[**System.Random**](https://docs.microsoft.com/en-us/dotnet/api/system.random) is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes.

### Impact
When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with
a weak random number generator whose seed can be bruteforced. This allows an attacker able to eavesdrop the
communications to decrypt them.

### Workarounds
To ensure you're not affected by this vulnerability, you can disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms by invoking the following method before a connection is established:
```cs
private static void RemoveUnsecureKEX(BaseClient client)
{
    client.ConnectionInfo.KeyExchangeAlgorithms.Remove("curve25519-sha256");
    client.ConnectionInfo.KeyExchangeAlgorithms.Remove("curve25519-sha256@libssh.org");
}
```

### Thanks

This issue was initially reported by **Siemens AG, Digital Industries**, shortly followed by @yaumn-synacktiv.
`MsQueue` `push`/`pop` use the wrong orderings
Advisory: GHSA-rwf4-gx62-rqfw
Published: 2022-06-08T22:28:27Z

Affected versions of this crate use orderings which are too weak to support this data structure.
It is likely this has caused memory corruption in the wild: <https://github.com/crossbeam-rs/crossbeam/issues/97#issuecomment-412785919>.
Compromised child renderer processes could obtain IPC access without nodeIntegrationInSubFrames being enabled
Advisory: GHSA-mq8j-3h7h-p8g7
Aliases: CVE-2022-29247
Published: 2022-06-16T23:14:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N

### Impact
This vulnerability allows a renderer with JS execution to obtain access to a new renderer process with `nodeIntegrationInSubFrames` enabled which in turn allows effective access to `ipcRenderer`.

Please note the misleadingly named `nodeIntegrationInSubFrames` option does not implicitly grant Node.js access rather it depends on the existing `sandbox` setting.  If your application is sandboxed then `nodeIntegrationInSubFrames` just gives access to the sandboxed renderer APIs (which includes `ipcRenderer`).

If your application then additionally exposes IPC messages without IPC `senderFrame` validation that perform privileged actions or return confidential data this access to `ipcRenderer` can in turn compromise your application / user even with the sandbox enabled.

### Patches
This has been patched and the following Electron versions contain the fix:

* `18.0.0-beta.6`
* `17.2.0`
* `16.2.6`
* `15.5.5`

### Workarounds
Ensure that all IPC message handlers appropriately validate `senderFrame` as per our [security tutorial here](https://github.com/electron/electron/blob/main/docs/tutorial/security.md#17-validate-the-sender-of-all-ipc-messages).

### For more information

If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
Dev error stack trace leaking into prod in Play Framework
Advisory: GHSA-p9p4-97g9-wcrh
Aliases: CVE-2022-31023
Published: 2022-06-03T22:19:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact

Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by configuring its `DefaultHttpErrorHandler` to do so based on the application mode. In its Scala API Play also provides a static object `DefaultHttpErrorHandler` that is configured to always show verbose errors. This is used as a default value in some Play APIs, so it is possible to inadvertently use this version in production. It is also possible to improperly configure the `DefaultHttpErrorHandler` object instance as the injected error handler.  Both of these situations could result in verbose errors displaying to users in a production application, which could expose sensitive information from the application.

In particular the constructor for `CORSFilter` and `apply` method for `CORSActionBuilder` use the static object `DefaultHttpErrorHandler` as a default value.

### Patches

This is patched in Play Framework 2.8.16. The `DefaultHttpErrorHandler` object has been changed to use the prod-mode behavior, and `DevHttpErrorHandler` has been introduced for the dev-mode behavior.

### Workarounds

When constructing a `CORSFilter` or `CORSActionBuilder`, ensure that a properly-configured error handler is passed. Generally this should be done by using the `HttpErrorHandler` instance provided through dependency injection or through Play's `BuiltInComponents`. Ensure that your application is not using the `DefaultHttpErrorHandler` static object in any code that may be run in production.

### References
https://www.playframework.com/documentation/2.8.x/ScalaErrorHandling#Supplying-a-custom-error-handler
https://www.playframework.com/documentation/2.8.x/JavaErrorHandling#Supplying-a-custom-error-handler

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [playframework/playframework](https://github.com/playframework/playframework/)
* Email us at [example email address](mailto:example@example.com)
Multiple evaluation of contract address in call in vyper
Advisory: GHSA-4v9q-cgpw-cf38
Aliases: CVE-2022-29255
Published: 2022-06-06T21:23:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact
when a calling an external contract with no return value, the contract address could be evaluated twice. this is usually only an efficiency problem, but if evaluation of the contract address has side effects, it could result in double evaluation of the side effects.

in the following example, `Foo(msg.sender).bar()` is the contract address for the following call (to `.foo()`), and could get evaluated twice

```vyper
interface Foo:
    def foo(): nonpayable
    def bar() -> address: nonpayable

@external
def do_stuff():
    Foo(Foo(msg.sender).bar()).foo()
```

### Patches
6b4d8ff185de071252feaa1c319712b2d6577f8d

### Workarounds
assign contract addresses to variables. the above example would change to
```vyper
@external
def do_stuff():
    t: Foo = Foo(msg.sender).bar()
    t.foo()
```

### References

### For more information
Cross-site Scripting in Jenkins ontrack Jenkins Plugin
Advisory: GHSA-6882-385p-hhhw
Aliases: CVE-2022-34192
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins ontrack Jenkins Plugin 4.0.0 and earlier does not escape the name of Ontrack: Multi Parameter choice, Ontrack: Parameter choice, and Ontrack: SingleParameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Failure to strip the Cookie header on change in host or HTTP downgrade
Advisory: GHSA-f2wf-25xc-69c9
Aliases: CVE-2022-31042
Published: 2022-06-09T23:47:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact

`Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there.

### Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4.

### Workarounds

An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together.

### References

* [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx)

### For more information

If you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy).
Miscomputed sha2 results when using AVX2 backend
Advisory: GHSA-xpww-g9jx-hp8r
Published: 2022-06-17T00:19:35Z

The v0.9.7 release of the `sha2` crate introduced a new AVX2-accelerated
backend which was automatically enabled for all x86/x86_64 CPUs where AVX2
support was autodetected at runtime.

This backend was buggy and would miscompute results for long messages
(i.e. messages spanning multiple SHA blocks).

The crate has since been yanked, but any users who upgraded to v0.9.7 should
immediately upgrade to v0.9.8 and recompute any hashes which were previously
computed by v0.9.7.
golang.org/x/sys/unix has Incorrect privilege reporting in syscall
Advisory: GHSA-p782-xgp4-8hr8
Aliases: CVE-2022-29526
Published: 2022-06-24T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Go before 1.17.10 and 1.18.x before 1.18.2 has Incorrect Privilege Reporting in syscall. When called with a non-zero flags parameter, the Faccessat function could incorrectly report that a file is accessible.
Unsafe yaml deserialization in NVFlare
Advisory: GHSA-hrf3-622q-8366
Aliases: CVE-2022-31605
Published: 2022-06-22T21:22:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
NVFLARE contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

All versions before 2.1.2 are affected.
CVSS Score = 9.8
[AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.gov%2Fvuln-metrics%2Fcvss%2Fv3-calculator%3Fvector%3DAV%3AN%2FAC%3AL%2FPR%3AN%2FUI%3AN%2FS%3AU%2FC%3AH%2FI%3AH%2FA%3AH&data=05%7C01%7Cchesterc%40nvidia.com%7Ce9600bde16854b0b380008da4fc544f7%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C637910005925574215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5kBrXEmAbqp8R31JCH%2FG95MUly72UPVihnBwiRFmvBY%3D&reserved=0)


### Patches

The patch will be included in nvflare==2.1.2


### Workarounds
Change yaml.load() to yaml.safe_load()

### Additional information
Issue Found by: Oliver Sellwood (@Nintorac)
Cross-site Scripting in Jenkins Maven Metadata Plugin
Advisory: GHSA-5247-whvj-83qw
Aliases: CVE-2022-34190
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.1 and earlier does not escape the name and description of List maven artifact versions parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Command injection in google-it
Advisory: GHSA-7xhv-mpjw-422f
Aliases: CVE-2021-34083
Published: 2022-06-03T00:00:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially exposing the server to RCE.
Authentication bypass vulnerability in Apple Game Center auth adapter 
Advisory: GHSA-rh9j-f5f8-rvgc
Aliases: CVE-2022-31083
Published: 2022-06-17T22:09:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

### Impact
The certificate in Apple Game Center auth adapter not validated. As a result, authentication could potentially be bypassed by making a fake certificate accessible via certain Apple domains and providing the URL to that certificate in an authData object.

### Patches
To prevent this, a new `rootCertificateUrl` property is introduced to the Parse Server Apple Game Center auth adapter which takes the URL to the root certificate of Apple's Game Center authentication certificate. If no value is set, the `rootCertificateUrl` property defaults to the URL of the [current root certificate](https://developer.apple.com/news/?id=stttq465) as of May 27, 2022.

Keep in mind that the root certificate can change at any time (expected to be announced by Apple) and that it is the developer's responsibility to keep the root certificate URL up-to-date when using the Parse Server Apple Game Center auth adapter.

### Workarounds
None.

### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc
- https://developer.apple.com/news/?id=stttq465
- https://github.com/parse-community/parse-server

### More information
* For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org) or [community chat](http://chat.parseplatform.org)
* Report other vulnerabilities at [report.parseplatform.org](https://report.parseplatform.org)
Type confusion if __private_get_type_id__ is overriden
Advisory: GHSA-jq66-xh47-j9f3
Aliases: CVE-2020-25575
Published: 2022-06-16T23:06:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the failure crate through 0.1.5 for Rust. It has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Cross site scripting in intelliants/subrion
Advisory: GHSA-jvq4-cgfw-jgf4
Aliases: CVE-2021-41502
Published: 2022-06-12T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in Subrion CMS v4.2.1 There is a stored cross-site scripting (XSS) vulnerability that can execute malicious JavaScript code by modifying the name of the uploaded image, closing the html tag, or adding the onerror attribute.
User passwords stored in plain text by Jenkins EasyQA Plugin
Advisory: GHSA-xcp5-j5fj-3xp6
Aliases: CVE-2022-34202
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EasyQA Plugin 1.0 and earlier stores user passwords unencrypted in its global configuration file `EasyQAPluginProperties.xml` on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.
A malicious coder can get unsound access to TCell or TLCell memory
Advisory: GHSA-9c9f-7x9p-4wqp
Published: 2022-06-17T00:16:11Z

This is impossible to do by accident, but by carefully constructing
marker types to be covariant, a malicious coder can cheat the
singleton check in `TCellOwner` and `TLCellOwner`, giving unsound
access to cell memory.  This could take the form of getting two
mutable references to the same memory, or a mutable reference and an
immutable reference.

The fix is for the crate to internally force the marker type to be
invariant.  This blocks the conversion between covariant types which
Rust normally allows.
Deserialization of Untrusted Data in topthink/framework
Advisory: GHSA-g377-x8rg-c9mf
Aliases: CVE-2022-33107
Published: 2022-06-30T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ThinkPHP v6.0.12 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\AbstractCache.php. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
Unpublished, protected files can be published via shortcode
Advisory: GHSA-v68g-62v9-39w5
Aliases: CVE-2022-29858
Published: 2022-06-29T22:40:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content. Draft protected images can be published by changing an existing image shortcode on website content to match the ID of the draft protected image and then publishing the website content.
Cross-site Scripting in Jenkins Repository Connector Plugin
Advisory: GHSA-438w-rjj9-5fjf
Aliases: CVE-2022-34195
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Repository Connector Plugin 2.2.0 and earlier does not escape the name and description of Maven Repository Artifact parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
TiDB authentication bypass vulnerability
Advisory: GHSA-4whx-7p29-mq22
Aliases: CVE-2022-31011
Published: 2022-06-06T21:22:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access.
Only users using TiDB 5.3.0 are affected by this vulnerability.

### Patches
Please upgrade to TiDB 5.3.1 or higher version

### Workarounds
You can also mitigate risks by taking the following measures.
Option 1: Turn off SEM (Security Enhanced Mode).
Option 2: Disable local login for non-root accounts and ensure that the same IP cannot be logged in as root or normal user at the same time.

### References
https://en.pingcap.com/download/

### For more information
If you have any questions or comments about this advisory:
* Email us at security@tidb.io
Insertion of Sensitive Information into Log File in typo3/cms-core
Advisory: GHSA-fh99-4pgr-8j99
Aliases: CVE-2022-31047
Published: 2022-06-17T20:55:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)

### Problem
It has been discovered that system internal credentials or keys (e.g. database credentials) have been logged as plaintext in exception handlers, when logging the complete exception stack trace.

### Solution
Update to TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

### Credits
Thanks to Marco Huber who reported this issue and to TYPO3 security member Torben Hansen who fixed the issue.

### References
* [TYPO3-CORE-SA-2022-002](https://typo3.org/security/advisory/typo3-core-sa-2022-002)
Missing Role Based Access Control for the REST handlers in bleve/http package
Advisory: GHSA-9w9f-6mg8-jp7w
Aliases: CVE-2022-31022
Published: 2022-06-03T22:17:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

### Impact
_What kind of vulnerability is it? Who is impacted?_

Bleve includes HTTP utilities under bleve/http package, that are used by its sample application. 
(https://github.com/blevesearch/bleve-explorer)
These HTTP methods paves way for exploitation of a node’s filesystem where the bleve index resides, 
if the user has used bleve’s own HTTP (bleve/http) handlers for exposing the access to the indexes. 
For instance, the CreateIndexHandler (http/index_create.go) and DeleteIndexHandler (http/index_delete.go) 
enable an attacker to create a bleve index (directory structure) anywhere where the user running the server 
has the write permissions and to delete recursively any directory owned by the same user account.
 
Users who have used the bleve/http package for exposing access to bleve index without the explicit 
handling for the Role Based Access Controls(RBAC) of the index assets would be impacted.


### Patches
_Has the problem been patched? What versions should users upgrade to?_

**No**. The http package is purely intended to be used for demonstration purposes. 
And bleve is never designed to be handling the RBACs or it was ever advertised to be used in that way. 
Hence the collaborators of this project have decided to stay away from adding any authentication or 
authorization to bleve project at the moment.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

The bleve/http package is mainly for demonstration purposes and it lacks exhaustive validation of the user 
inputs as well as any authentication and authorization measures. 
So it is recommended to not use that in production use cases.

### For more information
If you have any questions or comments about this advisory:
* Open an issue [here](https://github.com/blevesearch/bleve/issues).
* Email us at [mailto:security@couchbase.com, fts-team@couchbase.com].
Insufficient Session Expiration in TYPO3's Admin Tool
Advisory: GHSA-wwjw-r3gj-39fq
Aliases: CVE-2022-31050
Published: 2022-06-17T20:57:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L/E:F/RL:O/RC:C` (5.6)

### Problem
Admin Tool sessions initiated via the TYPO3 backend user interface have not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit.

### Solution
Update to TYPO3 versions 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

### Credits
Thanks to Kien Hoang who reported this issue and to TYPO3 framework merger Ralf Zimmermann and TYPO3 security member Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2022-005](https://typo3.org/security/advisory/typo3-core-sa-2022-005)
Cross-site Scripting in NukeViet CMS
Advisory: GHSA-pm37-5j5m-6cvw
Aliases: CVE-2022-30874
Published: 2022-06-22T00:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.
Arbitrary file write vulnerability in Jenkins Pipeline: Input Step Plugin
Advisory: GHSA-29q6-p2cg-4v23
Aliases: CVE-2022-34177
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Pipeline: Input Step Plugin 448.v37cea_9a_10a_70 and earlier allows Pipeline authors to specify `file` parameters for Pipeline `input` steps even though they are unsupported. Although the uploaded file is not copied to the workspace, Jenkins archives the file on the controller as part of build metadata using the parameter name without sanitization as a relative path inside a build-related directory.

This allows attackers able to configure Pipelines to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.

Pipeline: Input Step Plugin 449.v77f0e8b_845c4 prohibits use of `file` parameters for Pipeline `input` steps. Attempts to use them will fail Pipeline execution.
OS Command Injection in gogs
Advisory: GHSA-56j7-2pm8-rgmx
Aliases: CVE-2021-32546
Published: 2022-06-02T20:52:23Z

### Impact

The malicious user is able to update a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.

### Patches

Repository file updates are prohibited to its `.git` directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.

### Workarounds

N/A

### References

N/A

### For more information

If you have any questions or comments about this advisory, please post on #6555.
Cross site scripting in facturascripts
Advisory: GHSA-h6wm-mr85-4h9g
Aliases: CVE-2022-2066
Published: 2022-06-14T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A Cross-site Scripting (XSS) vulnerability exists in the fsNick parameter in facturascripts prior to version 2022.06
Command injection in librenms
Advisory: GHSA-23f2-vgr6-fwv7
Aliases: CVE-2022-29712
Published: 2022-06-03T00:01:06Z

LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters.
Unsoundness in `dashmap` references
Advisory: GHSA-mpg5-fvwp-42m2
Published: 2022-06-16T23:52:24Z

Reference returned by some methods of `Ref` (and similar types) may outlive the `Ref` and escape the lock.
This causes undefined behavior and may result in a segfault.

More information in [`dashmap#167`](https://github.com/xacrimon/dashmap/issues/167) issue.
Privilege escalation in Hashicorp Nomad
Advisory: GHSA-526x-rm7j-v389
Aliases: CVE-2022-30324
Published: 2022-06-03T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

HashiCorp Nomad and Nomad Enterprise version 0.2.0 up to 1.3.0 were impacted by go-getter vulnerabilities enabling privilege escalation through the artifact stanza in submitted jobs onto the client agent host. Fixed in 1.1.14, 1.2.8, and 1.3.1.
Weave GitOps leaked cluster credentials into logs on connection errors
Advisory: GHSA-xggc-qprg-x6mw
Aliases: CVE-2022-31098
Published: 2022-06-23T17:40:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

### Impact
A vulnerability in the logging of Weave GitOps could allow an authenticated remote attacker to view sensitive cluster configurations, aka KubeConfg, of registered Kubernetes clusters, including the service account tokens in plain text from Weave GitOps's pod logs on the management cluster. An unauthorized remote attacker can also view these sensitive configurations from external log storage if enabled by the management cluster.

This vulnerability is due to the client factory dumping cluster configurations and their service account tokens when the cluster manager tries to connect to an API server of a registered cluster, and a connection error occurs. An attacker could exploit this vulnerability by either accessing logs of a pod of Weave GitOps, or from external log storage and obtaining all cluster configurations of registered clusters.

A successful exploit could allow the attacker to use those cluster configurations to manage the registered Kubernetes clusters.

### Patches
This vulnerability has been fixed by commit 567356f471353fb5c676c77f5abc2a04631d50ca. Users should upgrade to Weave GitOps core version >= v0.8.1-rc.6 released on 31/05/2022.

### Workarounds
There is no workaround for this vulnerability.

### References
Disclosed by Stefan Prodan, Principal Engineer, Weaveworks.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Weave GitOps repository](https://github.com/weaveworks/weave-gitops)
* Email us at [support@weave.works](mailto:support@weave.works)
`array!` macro is unsound in presence of traits that implement methods it calls internally
Advisory: GHSA-83gg-pwxf-jr89
Published: 2022-06-16T23:40:19Z

Affected versions of this crate called some methods using auto-ref. The affected code looked like this.

```rust
let mut arr = $crate::__core::mem::MaybeUninit::uninit();
let mut vec = $crate::__ArrayVec::<T>::new(arr.as_mut_ptr() as *mut T);
```

In this case, the problem is that `as_mut_ptr` is a method of `&mut MaybeUninit`, not `MaybeUninit`. This made it possible for traits to hijack the method calls in order to cause unsoundness.

```rust
trait AsMutPtr<T> {
    fn as_mut_ptr(&self) -> *mut T;
}
impl<T> AsMutPtr<T> for std::mem::MaybeUninit<T> {
    fn as_mut_ptr(&self) -> *mut T {
        std::ptr::null_mut()
    }
}
array![0; 1];
```

The flaw was corrected by explicitly referencing variables in macro body in order to avoid auto-ref.
Invalid file request can crash server
Advisory: GHSA-xw6g-jjvf-wwf9
Aliases: CVE-2022-31089
Published: 2022-06-20T22:25:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.

### Patches
To prevent this, invalid requests are now properly handled.

### Workarounds
None

### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9
- https://github.com/parse-community/parse-server

### For more information
- For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org/) or [community chat](http://chat.parseplatform.org/)
- Report other vulnerabilities at [report.parseplatform.org](https://report.parseplatform.org/)
Server-Side Request Forgery in Jodd HTTP
Advisory: GHSA-pp3c-cf6j-m3ff
Aliases: CVE-2022-29631
Published: 2022-06-07T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Jodd HTTP v6.0.9 was discovered to contain multiple CLRF injection vulnerabilities via the components jodd.http.HttpRequest#set and `jodd.http.HttpRequest#send. These vulnerabilities allow attackers to execute Server-Side Request Forgery (SSRF) via a crafted TCP payload.
Potential Authorization Header Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy
Advisory: GHSA-j562-c3cw-3p5g
Aliases: CVE-2022-31069
Published: 2022-06-17T21:39:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

The nestjs-proxy library did not have a way to control when Authorization headers should should be forwarded for specific backend services configured by the application developer. This could have resulted in sensitive information such as OAuth bearer access tokens being inadvertently exposed to such services that should not see them.

A new feature has been introduced in the patched version of nestjs-proxy that allows application developers to opt out of forwarding the Authorization headers on a per service basis using the `forwardToken` config setting. Developers are advised to review the README for this library on Github or NPM for further details on how this configuration can be applied.

### Patches
- This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`.
- Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Please update your package.json file to use `@finastra/nestjs-proxy` instead.

### References
- https://github.com/Finastra/finastra-nodejs-libs/pull/231
- https://github.com/Finastra/finastra-nodejs-libs/blob/master/libs/proxy/README.md
Code Injection in SEOmatic
Advisory: GHSA-g7xr-v82w-qggq
Aliases: CVE-2021-41749
Published: 2022-06-13T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side Template Injection, allowing for remote code execution.
Withdrawn: Denial of Service in aiohttp
Advisory: GHSA-rwqr-c348-m5wr
Aliases: CVE-2022-33124
Published: 2022-06-24T00:00:31Z
Withdrawn: 2022-06-28T16:39:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

## Withdrawn
This advisory has been withdrawn because the maintainers of aiohttp and multiple third parties disputed the validity of the issue. There is not sufficient evidence for the claims in the original report.

## Original Description
aiohttp v3.8.1 was discovered to contain an invalid IPv6 URL which can lead to a Denial of Service (DoS).
Cross-Site Request Forgery in Jenkins Convertigo Mobile Platform Plugin
Advisory: GHSA-24h8-cpqm-qmf3
Aliases: CVE-2022-34200
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier allows attackers to connect to an attacker-specified URL.
Cross-site Scripting vulnerability in Jenkins
Advisory: GHSA-7f84-p6r5-jr6q
Aliases: CVE-2022-34171
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Since Jenkins 2.321 and LTS 2.332.1, the HTML output generated for new symbol-based SVG icons includes the `title` attribute of `l:ionicon` until Jenkins 2.334 and `alt` attribute of `l:icon` since Jenkins 2.335 without further escaping.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the `title` attribute of `l:ionicon` (Jenkins LTS 2.332.4) and `alt` attribute of `l:icon` (Jenkins 2.356 and LTS 2.346.1) are escaped in the generated HTML output.
Cross-site Scripting in Jenkins Sauce OnDemand Plugin
Advisory: GHSA-cqhr-q835-62gm
Aliases: CVE-2022-34197
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Sauce OnDemand Plugin 1.204 and earlier does not escape the name and description of Sauce Labs Browsers parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
CSRF allows attacker to finalize/unfinalize order adjustments in solidus_backend
Advisory: GHSA-8639-qx56-r428
Aliases: CVE-2022-31000
Published: 2022-06-01T20:26:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

### Impact
CSRF vulnerability allowing attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer.

Reproduction steps:
- Take an order's number.
- Log in as an administrator.
- Visit that order's adjustments section (_Orders -> {Click on number} -> Adjustments_) and check that its adjustments are finalized (closed padlock under the **State** column).
- On another tab, visit `{your_site_url}/admin/orders/{order_number}/adjustments/unfinalize`.
- Notice how the adjustments are unfinalized (open padlock), even if the previous was a `GET` request which could have been linked from any other site.
- Visit `{your_site_url}/admin/orders/{order_number}/adjustments/finalize`.
- Notice how the adjustments are again finalized.

That happened because both routes were handled as `GET` requests, which are skipped by Rails anti-forgery protection.

### Patches
Users should upgrade to solidus_backend v3.1.6, v3.0.6, or v2.11.16, depending on the major and minor versions in use.

### References
- [Rails CSRF protection](https://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection.html).

### For more information
If you have any questions or comments about this advisory:

- Open an [issue](https://github.com/solidusio/solidus/issues) or a [discussion](https://github.com/solidusio/solidus/discussions) in Solidus.
- Email us at [security@solidus.io](mailto:security@soliidus.io)
- Contact the core team on [Slack](http://slack.solidus.io/)
Cross-site Scripting in Jenkins Package Version Plugin
Advisory: GHSA-gpw4-7mcw-m8vx
Aliases: CVE-2022-34193
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Package Version Plugin 1.0.1 and earlier does not escape the name of Package version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Code injection in MCMS
Advisory: GHSA-6xj9-hpq3-w3qw
Aliases: CVE-2022-30506
Published: 2022-06-03T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
Cross site scripting in Elefant CMS
Advisory: GHSA-4453-g295-24mh
Aliases: CVE-2017-20060
Published: 2022-06-21T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting (Persistent). It is possible to initiate the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
Delegate functions are missing `Send` bound
Advisory: GHSA-x4mq-m75f-mx8m
Published: 2022-06-17T00:30:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of this crate did not require event handlers to have `Send` bound despite there being no guarantee of them being called on any particular thread, which can potentially lead to data races and undefined behavior.

The flaw was corrected in commit [afe3252](https://github.com/microsoft/windows-rs/commit/afe32525c22209aa8f632a0f4ad607863b51796a) by adding `Send` bounds.
Phoenix-ws source code and data in extensions folder is publicly available
Advisory: GHSA-c8f7-x2g7-7fxj
Published: 2022-06-02T14:23:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
All of the source code, files, and folders in `phoenix_files/extensions/` are available to end users through a simple HTTP GET request.

### Patches
The issue has been patched. The users of version 1.0.6 and above are not effected.
Improper Authorization in Apache Shiro
Advisory: GHSA-4cf5-xmhp-3xj7
Aliases: CVE-2022-32532
Published: 2022-06-30T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Shiro before 1.9.1, A RegexRequestMatcher can be misconfigured to be bypassed on some servlet containers. Applications using RegExPatternMatcher with `.` in the regular expression are possibly vulnerable to an authorization bypass.
Out-of-bounds Read in fast-string-search
Advisory: GHSA-hmqg-p8f8-3qrw
Aliases: CVE-2022-25872
Published: 2022-06-18T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

All versions of package fast-string-search are vulnerable to Out-of-bounds Read due to incorrect memory freeing and length calculation for any non-string input as the source. This allows the attacker to read previously allocated memory.
Cross-site Scripting in krayin/laravel-crm
Advisory: GHSA-v829-j9rr-85v9
Aliases: CVE-2021-41924
Published: 2022-06-22T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Webkul krayin crm before 1.2.2 is vulnerable to Cross Site Scripting (XSS).
Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core
Advisory: GHSA-6fp8-cxc9-4fr9
Aliases: CVE-2022-29866
Published: 2022-06-17T21:44:23Z

A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to trigger a stack overflow exception in a server that exposes an HTTPS endpoint.
Cross-site Scripting in Jenkins Readonly Parameter Plugin
Advisory: GHSA-fcqr-gh8w-wm8f
Aliases: CVE-2022-34194
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Readonly Parameter Plugin 1.0.0 and earlier does not escape the name and description of Readonly String and Readonly Text parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Insufficient Session Expiration in NocoDB
Advisory: GHSA-6293-2vg2-pmp5
Aliases: CVE-2022-2064
Published: 2022-06-14T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.9.
Channel creates zero value of any type
Advisory: GHSA-9g55-pg62-m8hh
Published: 2022-06-16T23:49:25Z

Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`.
This is unsound e.g. if `T` is a reference type (which must be non-null).
 
The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.
Code injection in concrete CMS
Advisory: GHSA-6xc4-7fmm-65q2
Aliases: CVE-2022-21829
Published: 2022-06-25T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.