aswin1906/github-advisory-2022 huggingface dataset:
Improper Privilege Management in Elasticsearch
Advisory: GHSA-gfv5-grx2-9jw2
Aliases: CVE-2020-7009
Published: 2022-05-24T17:13:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges.
ChakraCore RCE Vulnerability
Advisory: GHSA-3mv8-x3jj-3j7m
Aliases: CVE-2018-8511
Published: 2022-05-13T01:20:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8505, CVE-2018-8510, CVE-2018-8513.
Matrix Synapse Improper Signature Validation
Advisory: GHSA-fmvh-rvq5-hhjx
Aliases: CVE-2018-16515
Published: 2022-05-13T01:50:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Matrix Synapse before 0.33.3.1 allows remote attackers to spoof events and possibly have unspecified other impacts by leveraging improper transaction and event signature validation.
Kubernetes client-go library logs may disclose credentials to unauthorized users
Advisory: GHSA-jmrx-5g74-6v2f
Aliases: CVE-2019-11250
Published: 2022-05-24T16:55:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The Kubernetes client-go library logs request headers at verbosity levels of 7 or higher. This can disclose credentials to unauthorized users via logs or command output. Kubernetes components (such as kube-apiserver) prior to v1.16.0, which make use of basic or bearer token authentication, and run at high verbosity levels, are affected.
Apache Struts XSS Vulnerability
Advisory: GHSA-2j4q-9fff-236j
Aliases: CVE-2016-2162
Published: 2022-05-17T03:42:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Apache Struts 2.x before 2.3.25 does not sanitize text in the Locale object constructed by I18NInterceptor, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors involving language display.
Client secret transmitted in plain text by Azure AD Plugin
Advisory: GHSA-vvg2-hg3c-mqj3
Aliases: CVE-2020-2119
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Azure AD Plugin stores a client secret in its global configuration.

While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Azure AD Plugin 1.2.0 transmits the client secret in its global configuration encrypted.
Improper Neutralization of Input During Web Page Generation in Apache Tomcat
Advisory: GHSA-3p86-xgrq-m6p6
Aliases: CVE-2011-0013
Published: 2022-05-03T03:25:09Z

Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
Server-Side Request Forgery in Jenkins Git Plugin
Advisory: GHSA-53wf-vqf9-cgf2
Aliases: CVE-2018-1000182
Published: 2022-05-14T03:13:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

A server-side request forgery vulnerability exists in Jenkins Git Plugin 3.9.0 and older in AssemblaWeb.java, GitBlitRepositoryBrowser.java, Gitiles.java, TFS2013GitRepositoryBrowser.java, ViewGitWeb.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL.
MicroPyramid Django-CRM CSRF
Advisory: GHSA-hq4r-47qc-3jhc
Aliases: CVE-2018-16552
Published: 2022-05-13T01:11:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

MicroPyramid Django-CRM 0.2 allows CSRF for `/users/create/`, `/users/##/edit/`, and `/accounts/##/delete/` URIs.
Ansible Improper Input Validation vulnerability
Advisory: GHSA-3xvg-x47j-x75w
Aliases: CVE-2018-10874
Published: 2022-05-13T01:07:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in feedparser
Advisory: GHSA-3mwg-gp5g-fv3q
Aliases: CVE-2009-5065
Published: 2022-05-02T04:00:51Z

Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.
CSRF vulnerability in Mac Plugin
Advisory: GHSA-qcfq-35v7-4fw7
Aliases: CVE-2020-2147
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery vulnerability in Jenkins Mac Plugin 1.1.0 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials.
Missing certificate validation in Apache JMeter
Advisory: GHSA-7v85-6hv2-rwgw
Aliases: CVE-2018-1297
Published: 2022-05-13T01:49:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

When using Distributed Test only (RMI based), Apache JMeter 2.x and 3.x uses an unsecured RMI connection. This could allow an attacker to get Access to JMeterEngine and send unauthorized code.
WeChat Pay Java SDK allows XXE
Advisory: GHSA-gqgv-2gp3-qqp3
Aliases: CVE-2018-13439
Published: 2022-05-14T03:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a merchant notification URL.
Sandbox bypass in Jenkins Pipeline: Groovy Plugin
Advisory: GHSA-r6mc-mrvr-23cr
Aliases: CVE-2019-1003030
Published: 2022-05-13T01:14:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
Node CLI Allows Arbitrary File Overwrite
Advisory: GHSA-3mrp-qhcj-mwv5
Aliases: CVE-2016-1000021
Published: 2022-05-24T17:02:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

An issue exists in node-cli 0.1.0 through 0.11.3 due to predictable temporary file names in lock_file and log_file, which allows an attacker to overwrite files.

This is a duplicate of CVE-2016-10538
XXE vulnerability in Jenkins Mercurial Plugin
Advisory: GHSA-x58r-wxc3-7pqr
Aliases: CVE-2020-2305
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not configure its XML changelog parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 disables external entity resolution for its XML parser.
Incorrect Authorization in Jenkins Mercurial Plugin
Advisory: GHSA-f9cx-789c-w2mr
Aliases: CVE-2018-1000112
Published: 2022-05-13T01:48:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An improper authorization vulnerability exists in Jenkins Mercurial Plugin version 2.2 and earlier in MercurialStatus.java that allows an attacker with network access to obtain a list of nodes and users.
Devise Token Auth vulnerable to Cross-site Scripting
Advisory: GHSA-mvqr-r76c-wm5f
Aliases: CVE-2019-16751
Published: 2022-05-24T16:56:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the `fallback_render` method in the omniauth callbacks controller.
Kubernetes kube-apiserver unauthorized access
Advisory: GHSA-fp37-c92q-4pwq
Aliases: CVE-2019-11247
Published: 2022-05-24T16:55:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

The Kubernetes kube-apiserver mistakenly allows access to a cluster-scoped custom resource if the request is made as if the resource were namespaced. Authorizations for the resource accessed in this manner are enforced using roles and role bindings within the namespace, meaning that a user with access only to a resource in one namespace could create, view update or delete the cluster-scoped resource (according to their namespace role privileges). Kubernetes affected versions include versions prior to 1.13.9, versions prior to 1.14.5, versions prior to 1.15.2, and versions 1.7, 1.8, 1.9, 1.10, 1.11, 1.12.
Undertow vulnerable to Request Smuggling
Advisory: GHSA-rj76-h87p-r3wf
Aliases: CVE-2017-7559
Published: 2022-05-13T01:36:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
sr_freecap for Typo3 RCE Vulnerability
Advisory: GHSA-598p-rv6p-g7qc
Aliases: CVE-2019-16699
Published: 2022-05-24T16:58:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution.
Improper Neutralization of Input During Web Page Generation in Spring Framework
Advisory: GHSA-ff7p-jqjm-v66h
Aliases: CVE-2014-1904
Published: 2022-05-14T01:14:55Z

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
Reflected XSS vulnerability in Jenkins VncViewer Plugin
Advisory: GHSA-2j4h-cjgh-659v
Aliases: CVE-2020-2207
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

VncViewer Plugin 1.7 and earlier does not escape a parameter value in the `checkVncServ` form validation endpoint output.

This results in a reflected cross-site scripting (XSS) vulnerability.

VncViewer Plugin 1.8 escapes the parameter value in the output.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-g378-6fg4-gx3v
Aliases: CVE-2019-8132
Published: 2022-05-24T17:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft malicious payload in the template Name field for Email template in the "Design Configuration" dashboard.
Umbraco CMS vulnerable to stored XSS
Advisory: GHSA-xj94-rgf9-cq37
Aliases: CVE-2017-15279
Published: 2022-05-17T00:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in Umbraco CMS before 7.7.3 allows remote attackers to inject arbitrary web script or HTML via the "page name" (aka nodename) parameter during the creation of a new page, related to `Umbraco.Web.UI/umbraco/dialogs/Publish.aspx.cs` and `Umbraco.Web/umbraco.presentation/umbraco/dialogs/notifications.aspx.cs`.
Bolt CMS Stored XSS
Advisory: GHSA-hqxc-w9vw-3hp5
Aliases: CVE-2017-11127
Published: 2022-05-17T02:27:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a "Content-Type: image/svg+xml" header.
OpenStack Neutron Improper Authentication vulnerability
Advisory: GHSA-72p9-6gc7-q93r
Aliases: CVE-2014-0056
Published: 2022-05-17T04:42:41Z

The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
Moodle XSS Vulnerability
Advisory: GHSA-2hw6-6rgf-726v
Aliases: CVE-2015-5337
Published: 2022-05-13T01:12:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not properly restrict the availability of Flowplayer, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted .swf file.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-969v-mwp3-4mr3
Aliases: CVE-2019-7932
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary PHP code by creating a malicious sitemap file.
HashiCorp Consul vulnerable to Origin Validation Error
Advisory: GHSA-q7fx-wm2p-qfj8
Aliases: CVE-2019-9764
Published: 2022-05-13T01:23:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if `verify_server_hostname` were set to false, even when it is actually set to true. This is fixed in 1.4.4.
Apache Solr Kerberos delegation token functionality flaws
Advisory: GHSA-f553-j2gv-g5r9
Aliases: CVE-2017-9803
Published: 2022-05-14T01:23:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards.
Path Traversal in com.alibaba.oneagent:one-java-agent-plugin
Advisory: GHSA-9hr3-j9mc-xmq2
Aliases: CVE-2022-25842
Published: 2022-05-03T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:L

All versions of package `com.alibaba.oneagent:one-java-agent-plugin` are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. `../../evil.exe`). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine.
Gitaly Insufficient Session Expiration vulnerability
Advisory: GHSA-mmmm-chjf-jmvw
Aliases: CVE-2020-13353
Published: 2022-05-24T17:34:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

When importing repos via URL, one time use git credentials were persisted beyond the expected time window in Gitaly 1.79.0 or above. Affected versions are: >=1.79.0, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.
Loop with Unreachable Exit Condition in Apache POI
Advisory: GHSA-x9mm-6gpf-f749
Aliases: CVE-2014-9527
Published: 2022-05-17T03:00:44Z

HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
bottle.py vulnerable to CRLF Injection
Advisory: GHSA-j6f7-hghw-g437
Aliases: CVE-2016-9964
Published: 2022-05-17T03:05:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

bottle.py is a fast and simple micro-framework for python web-applications. redirect() in bottle.py in bottle 0.12.10 doesn't filter a "\r\n" sequence, which leads to a CRLF attack, as demonstrated by a redirect("233\r\nSet-Cookie: name=salt") call.
ClassLoader manipulation in Apache Struts
Advisory: GHSA-prjv-jj26-wf8h
Aliases: CVE-2014-0112
Published: 2022-05-14T00:54:16Z

ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Sensitive Data Exposure in elFinder
Advisory: GHSA-jcgc-vxqg-85xx
Aliases: CVE-2019-5884
Published: 2022-05-13T01:06:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

`php/elFinder.class.php` in elFinder before 2.1.45 leaks information if PHP's curl extension is enabled and `safe_mode` or `open_basedir` is not set.
undertow Race Condition vulnerability
Advisory: GHSA-mfhv-gwf8-4m88
Aliases: CVE-2021-3597
Published: 2022-05-25T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1, prior to 2.0.36.SP1, prior to 2.2.9.Final and prior to 2.0.39.Final.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-42m6-7xff-9v9m
Aliases: CVE-2017-2607
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins before versions 2.44 and 2.32.2 is vulnerable to a persisted cross-site scripting vulnerability in console notes (SECURITY-382). Jenkins allows plugins to annotate build logs, adding new content or changing the presentation of existing content while the build is running. Malicious Jenkins users, or users with SCM access, could configure jobs or modify build scripts such that they print serialized console notes that perform cross-site scripting attacks on Jenkins users viewing the build logs.
Agent-to-controller access control allowed writing to sensitive directory used by Jenkins Pipeline: Shared Groovy Libraries Plugin
Advisory: GHSA-c5r9-rx53-q3gf
Aliases: CVE-2021-21696
Published: 2022-05-24T19:19:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not limit agent read/write access to the `libs/` directory inside build directories when using the `FilePath` APIs. This directory is used by the Pipeline: Shared Groovy Libraries Plugin to store copies of shared libraries.

This allows attackers in control of agent processes to replace the code of a trusted library with a modified variant, resulting in unsandboxed code execution in the Jenkins controller process.

Jenkins 2.319, LTS 2.303.3 prohibits agent read/write access to the `libs/` directory inside build directories.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using FilePath APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.

It is not easily possible to [customize the file access rules](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) to prohibit access to the `libs/` directory specifically, as built-in rules (granting access to `<BUILDDIR>` contents) would take precedence over a custom rule prohibiting access.
Jenkins AWS CodePipeline Plugin has Insufficiently Protected Credentials
Advisory: GHSA-5gwq-4275-q4qc
Aliases: CVE-2018-1000401
Published: 2022-05-13T01:48:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins project Jenkins AWS CodePipeline Plugin version 0.36 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodePipelineSCM.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.37 and later.
Exposure of Sensitive Information in Jenkins Kubernetes Plugin
Advisory: GHSA-v67x-gpg7-mwv3
Aliases: CVE-2018-1000187
Published: 2022-05-14T03:13:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs.
Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow
Advisory: GHSA-47mp-rq2x-wjf2
Aliases: CVE-2018-1067
Published: 2022-05-13T01:14:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.
Apache Tomcat AJP Connector Information Leak
Advisory: GHSA-qhqv-q4xg-f6g7
Aliases: CVE-2005-3164
Published: 2022-05-01T02:15:08Z

The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
Apache Solr  vulnerable to XML Bomb
Advisory: GHSA-jq2w-w7v2-69q5
Aliases: CVE-2019-12401
Published: 2022-05-24T22:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Solr versions prior to 5.0.0 are vulnerable to an XML resource consumption attack (a.k.a. Lol Bomb) via it?s update handler.?By leveraging XML DOCTYPE and ENTITY type elements, the attacker can create a pattern that will expand when the server parses the XML causing OOMs.
Incorrect Authorization in Jenkins
Advisory: GHSA-r2jf-rc5v-vmpv
Aliases: CVE-2018-1999047
Published: 2022-05-13T01:50:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

A improper authorization vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in UpdateCenter.java that allows attackers to cancel a Jenkins restart scheduled through the update center.
Stored XSS vulnerability in Jenkins Scriptler Plugin
Advisory: GHSA-f9gf-2q87-5m44
Aliases: CVE-2021-21700
Published: 2022-05-24T19:20:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Scriptler Plugin 3.3 and earlier does not escape the name of scripts on the UI when asking to confirm their deletion.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Scriptler scripts.

Scriptler Plugin 3.4 escapes the name of scripts on the UI when asking to confirm their deletion.
Apache MyFaces Vulnerable to Path Traversal
Advisory: GHSA-gjfx-9wx3-j6r7
Aliases: CVE-2011-4367
Published: 2022-05-13T01:24:34Z

Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a `..` (dot dot) in the (1) ln parameter to `faces/javax.faces.resource/web.xml` or (2) the `PATH_INFO` to `faces/javax.faces.resource/`.
Moodle incorrect access control
Advisory: GHSA-f5r8-7h4f-jr9x
Aliases: CVE-2020-25629
Published: 2022-05-24T17:35:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Moodle where users with "Log in as" capability in a course context (typically, course managers) may gain access to some site administration capabilities by "logging in as" a System manager. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. This is fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Shopware XSS Vulnerability
Advisory: GHSA-mvrx-cmqw-2jgj
Aliases: CVE-2017-15374
Published: 2022-05-14T03:49:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Shopware v5.2.5 - v5.3 is vulnerable to cross site scripting in the customer and order section of the content management system backend modules. Remote attackers are able to inject malicious script code into the firstname, lastname, or order input fields to provoke persistent execution in the customer and orders section of the backend. The execution occurs in the administrator backend listing when processing a preview of the customers (kunden) or orders (bestellungen). The injection can be performed interactively via user registration or by manipulation of the order information inputs. The issue can be exploited by low privileged user accounts against higher privileged (admin or moderator) accounts.
Cabot Cross Site Scripting (XSS) vulnerability via Address column
Advisory: GHSA-8q2h-4mq6-396j
Aliases: CVE-2020-25449
Published: 2022-05-24T17:35:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability in Arachnys Cabot up to and including 0.11.12 can be exploited via the Address column.
Joomla! Object Injection Vulnerability
Advisory: GHSA-5m3w-rvvh-8fx6
Aliases: CVE-2019-7743
Published: 2022-05-13T01:22:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for object injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
RCE vulnerability in Jenkins Code Coverage API Plugin
Advisory: GHSA-58pr-hprx-7hg6
Aliases: CVE-2021-21677
Published: 2022-05-24T19:12:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Code Coverage API Plugin 1.4.0 and earlier does not apply [JEP-200 deserialization protection](https://github.com/jenkinsci/jep/tree/master/jep/200) to Java objects it deserializes from disk.

This results in a remote code execution (RCE) vulnerability exploitable by attackers able to control agent processes.

Code Coverage API Plugin 1.4.1 configures its Java object deserialization to only deserialize safe types.
Jenkins Build Environment Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-88qj-3q6h-8m5q
Aliases: CVE-2019-10395
Published: 2022-05-24T16:55:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Build Environment Plugin did not escape values of environment variables shown on its views. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the values of build environment variables, typically users with Job/Configure or Job/Build permission.

Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.

Build Environment Plugin now escapes all variables displayed in its views.
Magento 2 Community Edition Access Control Bypass
Advisory: GHSA-2fhr-f6q6-c4p2
Aliases: CVE-2019-7950
Published: 2022-05-24T16:52:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information.
Moodle sensitive information disclosure
Advisory: GHSA-gw95-48xq-gqf9
Aliases: CVE-2017-12157
Published: 2022-05-17T00:47:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

In Moodle 3.x, various course reports allow teachers to view details about users in the groups they can't access.
October CMS Local File Inclusion
Advisory: GHSA-v7cr-w5v6-6659
Aliases: CVE-2018-1999009
Published: 2022-05-13T01:24:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

October CMS version prior to Build 437 contains a Local File Inclusion vulnerability in [modules/system/traits/ViewMaker.php](https://github.com/octobercms/october/blob/v1.0.436/modules/system/traits/ViewMaker.php#L244) (makeFileContents function) that can result in Sensitive information disclosure and remote code execution. This attack appear to be exploitable remotely if the /backend path is accessible. This vulnerability appears to have been fixed in Build 437.
Exposure of Sensitive Information to an Unauthorized Actor in JBoss Fuse
Advisory: GHSA-h259-3rjg-5qp3
Aliases: CVE-2014-0085
Published: 2022-05-14T02:19:43Z

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.
Django WSGI Header Spoofing Vulnerability
Advisory: GHSA-7qfw-j7hp-v45g
Aliases: CVE-2015-0219
Published: 2022-05-17T03:20:54Z

Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an `_` (underscore) character instead of a `-` (dash) character in an HTTP header, as demonstrated by an `X-Auth_User` header.
ChakraCore RCE Vulnerability
Advisory: GHSA-5439-x5v5-2vhj
Aliases: CVE-2018-0945
Published: 2022-05-13T01:18:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.
alchemist.vim vulnerable to remote code execution
Advisory: GHSA-6x65-vqp7-5r63
Aliases: CVE-2017-1000212
Published: 2022-05-13T01:41:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins SSH Credentials Plugin
Advisory: GHSA-cwcf-5m5w-mq2w
Aliases: CVE-2018-1000601
Published: 2022-05-14T03:07:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A arbitrary file read vulnerability exists in Jenkins SSH Credentials Plugin 1.13 and earlier in BasicSSHUserPrivateKey.java that allows attackers with a Jenkins account and the permission to configure credential bindings to read arbitrary files from the Jenkins master file system.
Drools Improper Input Validation vulnerability allows remote attackers to execute arbitrary code in JBoss EAP
Advisory: GHSA-qvq6-cw53-rmwg
Aliases: CVE-2010-3708
Published: 2022-05-17T05:45:03Z

The serialization implementation in JBoss Drools in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.3 before 4.3.0.CP09 and JBoss Enterprise SOA Platform 4.2 and 4.3 supports the embedding of class files, which allows remote attackers to execute arbitrary code via a crafted static initializer.

The maintainers of JBoss EAP patched the vulnerability by applying a fix from Drools 4.0.7.
Apache OpenMeetings responds to insecure HTTP methods
Advisory: GHSA-2c3p-9j5f-33g3
Aliases: CVE-2017-7685
Published: 2022-05-13T01:47:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Apache OpenMeetings 1.0.0 responds to the following insecure HTTP methods: PUT, DELETE, HEAD, and PATCH.
Yii Framework Cross-site Scripting Vulnerability
Advisory: GHSA-w2xx-jp9f-gp8g
Aliases: CVE-2015-3397
Published: 2022-05-17T03:30:00Z

Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.4 allows remote attackers to inject arbitrary web script or HTML via vectors related to JSON, arrays, and Internet Explorer 6 or 7.
Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML
Advisory: GHSA-78fq-w796-q537
Aliases: CVE-2015-1796
Published: 2022-05-17T03:38:17Z

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.
Eucalyptus Unauthorized Access to CC/NC Log Files
Advisory: GHSA-f5hm-h272-2qwm
Aliases: CVE-2013-4766
Published: 2022-05-17T05:04:27Z

The gather log service in Eucalyptus before 3.3.1 allows remote attackers to read log files via an unspecified request to the (1) Cluster Controller (CC) or (2) Node Controller (NC) component.
Firefly III vulnerable to image-based stored XSS
Advisory: GHSA-pcxq-28f6-m3fm
Aliases: CVE-2019-13647
Published: 2022-05-24T16:50:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-4g38-hrm4-rg94
Aliases: CVE-2021-21686
Published: 2022-05-24T19:19:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2444 / CVE-2021-21686: File path filters do not canonicalize paths, allowing operations to follow symbolic links to outside allowed directories.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2444 / CVE-2021-21686: File path filters canonicalize paths, preventing operations from following symbolic links to outside allowed directories.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Apache Wicket Sensitive Data Exposure
Advisory: GHSA-q7wx-mhx4-jr8q
Aliases: CVE-2014-3526
Published: 2022-05-13T01:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Wicket before 1.5.12, 6.x before 6.17.0, and 7.x before 7.0.0-M3 might allow remote attackers to obtain sensitive information via vectors involving identifiers for storing page markup for temporary user sessions.
Chakra Core Privilege Escalation
Advisory: GHSA-9f2p-wm46-6m5f
Aliases: CVE-2017-11870
Published: 2022-05-17T00:19:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11871, and CVE-2017-11873.
Cross-site Scripting in Jenkins Rundeck Plugin
Advisory: GHSA-4m42-8qfq-h3q9
Aliases: CVE-2022-30956
Published: 2022-05-18T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. Rundeck Plugin 3.6.11 sanitizes URLs submitted in Rundeck webhook payloads.
XXE vulnerability in Jenkins pom2config Plugin
Advisory: GHSA-ppv9-v43c-xqpp
Aliases: CVE-2021-43576
Published: 2022-05-24T19:20:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

pom2config Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Overall/Read and Item/Read permissions to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.
ChakraCore RCE Vulnerability
Advisory: GHSA-h6g3-73h7-chxp
Aliases: CVE-2016-3260
Published: 2022-05-14T02:24:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Tenant and Verifier might not use the same registrar data
Advisory: GHSA-jf66-3q76-h5p5
Aliases: CVE-2022-1053
Published: 2022-05-05T15:59:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote. This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM. A successful attack breaks the entire chain of trust because a not validated AK is used by the verifier. This issue is worse if the validation happens first and then the agent gets added to the verifier because the timing is easier and the verifier does not validate the regcount entry being equal to 1. At this time, there are no known workaround.
Cross-Site Request Forgery in Jenkins Build Failure Analyzer Plugin
Advisory: GHSA-543w-gq76-pw7g
Aliases: CVE-2019-16553
Published: 2022-05-24T17:03:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers to have Jenkins evaluate a computationally expensive regular expression.
Symfony Access Control Vulnerability
Advisory: GHSA-89cp-fvcc-hxh7
Aliases: CVE-2012-6432
Published: 2022-05-17T05:17:45Z

Symfony 2.0.x before 2.0.20, 2.1.x before 2.1.5, and 2.2-dev, when the internal routes configuration is enabled, allows remote attackers to access arbitrary services via vectors involving a URI beginning with a `/_internal` substring.
smalruby and smalruby-editor vulnerable to OS Command Injection
Advisory: GHSA-f489-655r-x6gr
Aliases: CVE-2017-2096
Published: 2022-05-13T01:16:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

smalruby-editor prior to 0.4.1 and smalruby prior to 0.1.11 allows remote attackers to execute arbitrary OS commands via unspecified vectors.
ChakraCore RCE Vulnerability
Advisory: GHSA-j67m-wpv6-pv44
Aliases: CVE-2018-8291
Published: 2022-05-13T01:20:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8296, CVE-2018-8298.
Pebble Templates Improper Input Validation vulnerability
Advisory: GHSA-83m8-7hj8-ff5w
Aliases: CVE-2019-19899
Published: 2022-05-24T22:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pebble Templates prior to 3.1.4 allows attackers to bypass a protection mechanism (intended to block access to instances of java.lang.Class) because getClass is accessible via the public static java.lang.Class `java.lang.Class.forName(java.lang.Module,java.lang.String)` signature.
Use of a Broken or Risky Cryptographic Algorithm in Apache WSS4J
Advisory: GHSA-vjwc-5hfh-2vv5
Aliases: CVE-2015-0226
Published: 2022-05-14T00:55:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.
Improper Certificate Validation in Apache CXF
Advisory: GHSA-hgg6-8x62-m9gf
Aliases: CVE-2017-5653
Published: 2022-05-13T01:09:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

JAX-RS XML Security streaming clients in Apache CXF before 3.1.11 and 3.0.13 do not validate that the service response was signed or encrypted, which allows remote attackers to spoof servers.
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
Advisory: GHSA-f6fm-r26q-p747
Aliases: CVE-2022-30617
Published: 2022-05-20T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin” that has updated one of the author’s blog posts. There are also many other scenarios where such details from other users can leak in the JSON response, either through a direct or indirect relationship. Access to this information enables a user to compromise other users’ accounts by successfully invoking the password reset workflow. In a worst-case scenario, a low-privileged user could get access to a “super admin” account with full control over the Strapi instance, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
Arbitrary file write vulnerability in Jenkins Cobertura Plugin
Advisory: GHSA-m935-chfp-9f63
Aliases: CVE-2020-2139
Published: 2022-05-24T17:10:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An arbitrary file write vulnerability in Jenkins Cobertura Plugin 1.15 and earlier allows attackers able to control the coverage report file contents to overwrite any file on the Jenkins master file system. Cobertura Plugin 1.16 sanitizes the file paths to prevent escape from the base directory.
Magento 2 Community Edition Server-Side Request Forgery vulnerability
Advisory: GHSA-33cj-w75f-49m2
Aliases: CVE-2019-7911
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code.
ChakraCore RCE Vulnerability
Advisory: GHSA-w4mj-xwvw-382f
Aliases: CVE-2016-7190
Published: 2022-05-14T02:22:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3386, CVE-2016-3389, and CVE-2016-7194.
Improper Preservation of Permissions in Apache Struts
Advisory: GHSA-ccp5-gg58-pxfm
Aliases: CVE-2019-0233
Published: 2022-05-24T17:28:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An access permission override in Apache Struts 2.0.0 to 2.5.20 may cause a Denial of Service when performing a file upload.
Symfony Path Disclosure
Advisory: GHSA-x3cf-w64x-4cp2
Aliases: CVE-2018-19789
Published: 2022-05-14T01:04:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form, and when a file upload is submitted to the corresponding field instead of a normal text input, then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.