aswin1906/github-advisory-2022 huggingface dataset:
Phusion Passenger information disclosure
Advisory: GHSA-cv3f-px9r-54hm
Aliases: CVE-2017-16355
Published: 2022-05-13T01:30:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

In agent/Core/SpawningKit/Spawner.h in Phusion Passenger 5.1.10 (fixed in Passenger Open Source 5.1.11 and Passenger Enterprise 5.1.10), if Passenger is running as root, it is possible to list the contents of arbitrary files on a system by symlinking a file named REVISION from the application root folder to a file of choice and querying passenger-status --show=xml.
Go Ethereum LES protocol implementation vulnerable to Denial of Service
Advisory: GHSA-p5gc-957x-gfw9
Aliases: CVE-2018-12018
Published: 2022-05-14T03:01:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The GetBlockHeadersMsg handler in the LES protocol implementation in Go Ethereum (aka geth) before 1.8.11 may lead to an access violation because of an integer signedness error for the array index, which allows attackers to launch a Denial of Service attack by sending a packet with a -1 query.Skip value. The vulnerable remote node would be crashed by such an attack immediately, aka the EPoD (Ethereum Packet of Death) issue.
Several Zend Products Vulnerable to XXE and XEE attacks
Advisory: GHSA-43xg-87xw-jpv8
Aliases: CVE-2014-2681
Published: 2022-05-14T00:56:24Z

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
LFI in PHP-Proxy 5.1.0
Advisory: GHSA-pc5h-m95g-v6rh
Aliases: CVE-2018-19246
Published: 2022-05-14T01:48:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

PHP-Proxy 5.1.0 allows remote attackers to read local files if the default "pre-installed version" (intended for users who lack shell access to their web server) is used. This occurs because the `aeb067ca0aa9a3193dce3a7264c90187` app_key value from the default config.php is in place, and this value can be easily used to calculate the authorization data needed for local file inclusion.
Legion of the Bouncy Castle Java Cryptography API Bleichenbacher Oracle Vulnerability
Advisory: GHSA-m26p-m559-g5j5
Aliases: CVE-2007-6721
Published: 2022-05-01T18:45:52Z

The Legion of the Bouncy Castle Java Cryptography API before release 1.38, as used in Crypto Provider Package before 1.36, has unknown impact and remote attack vectors related to "a Bleichenbacher vulnerability in simple RSA CMS signatures without signed attributes."
Lack of SSL/TLS certificate and hostname validation in Amazon EC2 Plugin
Advisory: GHSA-c89c-pvm7-33wj
Aliases: CVE-2020-2187
Published: 2022-05-24T17:17:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Amazon EC2 Plugin connects to Windows agents via HTTPS.

Amazon EC2 Plugin 1.50.1 and earlier unconditionally accepts self-signed HTTPS certificates and does not perform hostname validation when connecting to Windows agents. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections to build agents.

Amazon EC2 Plugin 1.50.2 by default no longer accepts self-signed HTTPS certificates and performs hostname validation. A new configuration option allows restoring the previous, unsafe behavior. For more information see [the plugin documentation](https://github.com/jenkinsci/ec2-plugin/#securing-the-connection-to-windows-amis).
ChakraCore RCE Vulnerability
Advisory: GHSA-rm8g-7g54-w6fh
Aliases: CVE-2017-0235
Published: 2022-05-17T02:44:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0236, and CVE-2017-0238.
Improper kubeconfig validation allows arbitrary code execution
Advisory: GHSA-vvmq-fwmg-2gjc
Aliases: CVE-2022-24817
Published: 2022-05-16T18:13:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Flux2 can reconcile the state of a remote cluster when provided with a [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#file-references) with the correct access rights. `Kubeconfig` files can define [commands](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) to be executed to generate on-demand authentication tokens. A malicious user with write access to a Flux source or direct access to the target cluster, could craft a `kubeconfig` to execute arbitrary code inside the controller’s container.

In multi-tenancy deployments this can also lead to privilege escalation if the controller's service account has elevated permissions.

### Impact

Within the affected versions range, one of the permissions set below would be required for the vulnerability to be exploited:
- Direct access to the cluster to create Flux `Kustomization` or `HelmRelease` objects and Kubernetes Secrets.
- Direct access to the cluster to modify existing Kubernetes secrets being used as `kubeconfig` in existing Flux `Kustomization` or `HelmRelease` objects.
- Direct access to the cluster to modify existing Flux `Kustomization` or `HelmRelease` objects and access to create or modify existing Kubernetes secrets.
- Access rights to make changes to a configured Flux Source (i.e. Git repository).

### Patches

This vulnerability was fixed in kustomize-controller [v0.23.0](https://github.com/fluxcd/kustomize-controller/releases/tag/v0.23.0) and helm-controller [v0.19.0](https://github.com/fluxcd/helm-controller/releases/tag/v0.19.0), both included in flux2 [v0.29.0](https://github.com/fluxcd/flux2/releases/tag/v0.29.0). Starting from the fixed versions, both controllers disable the use of command execution from `kubeconfig` files by default, users have to opt-in by adding the flag `--insecure-kubeconfig-exec` to the controller’s command arguments. Users are no longer allowed to refer to files in the controller’s filesystem in the `kubeconfig` files provided for the remote apply feature.

### Workarounds

- The functionality can be disabled via Validating Admission webhooks (e.g. OPA Gatekeeper, Kyverno) by restricting users from being able to set the `spec.kubeConfig` field in Flux `Kustomization` and `HelmRelease` objects.
- Applying restrictive AppArmor and SELinux profiles on the controller’s pod to limit what binaries can be executed.

### Credits

The Flux engineering team found and patched this vulnerability.

### For more information

If you have any questions or comments about this advisory please open an issue in the [flux2 repository](http://github.com/fluxcd/flux2).
TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component
Advisory: GHSA-r8m7-792j-5jvq
Aliases: CVE-2013-7074
Published: 2022-05-17T01:29:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x before 6.0.12, 6.1.x before 6.1.7, and the development versions of 6.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.
Stored XSS in LavaLite 5.8.0
Advisory: GHSA-gjf5-j475-p4g6
Aliases: CVE-2020-36396
Published: 2022-05-24T19:06:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
Improper Authentication in Pivotal Spring-LDAP
Advisory: GHSA-pjqh-2jcc-5j84
Aliases: CVE-2017-8028
Published: 2022-05-13T01:12:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-2x55-mg9r-24f7
Aliases: CVE-2019-7896
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout update.
Improper Access Control in Elasticsearch
Advisory: GHSA-w94p-6mhw-4qxw
Aliases: CVE-2015-1427
Published: 2022-05-14T02:49:44Z

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
`net2` invalidly assumes the memory layout of std::net::SocketAddr
Advisory: GHSA-c79c-gwph-gqfm
Aliases: CVE-2020-35919
Published: 2022-05-24T17:37:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The net2 crate has assumed std::net::SocketAddrV4 and std::net::SocketAddrV6 have the same memory layout as the system C representation sockaddr. It has simply casted the pointers to convert the socket addresses to the system representation. The standard library does not say anything about the memory layout, and this will cause invalid memory access if the standard library changes the implementation. No warnings or errors will be emitted once the change happens.
ChakraCore RCE Vulnerability
Advisory: GHSA-q4qj-2f5m-98gc
Aliases: CVE-2018-8583
Published: 2022-05-13T01:21:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8617, CVE-2018-8618, CVE-2018-8624, CVE-2018-8629.
Apache Geode gfsh query vulnerability
Advisory: GHSA-37m3-qp37-x3c6
Aliases: CVE-2017-9794
Published: 2022-05-17T00:34:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view.
Jenkins iceScrum Plugin vulnerable to Cross-site Request Forgery
Advisory: GHSA-rxvx-9wg5-qpww
Aliases: CVE-2019-10441
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery vulnerability in Jenkins iceScrum Plugin prior to version 1.1.6 allows attackers to connect to an attacker-specified URL using attacker-specified credentials. This issue is patched in version 1.1.6
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-94fc-rxhv-vvf8
Aliases: CVE-2019-7937
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript.
Silverstripe CSRF Protection Bypass via GraphQL
Advisory: GHSA-fx37-56v6-85q6
Aliases: CVE-2019-12437
Published: 2022-05-24T17:09:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In SilverStripe/GraphQL prior to 2.0.5 and 3.1.2, the previous fix for SS-2018-007 does not completely mitigate the risk of CSRF in GraphQL mutations.
ChakraCore RCE Vulnerability
Advisory: GHSA-w6qf-35f2-j6h7
Aliases: CVE-2020-0712
Published: 2022-05-24T17:08:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-0711, CVE-2020-0713, CVE-2020-0767.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-97c3-w9cr-6qc2
Aliases: CVE-2021-21690
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2486 / CVE-2021-21690: Agent processes are able to completely bypass file path filtering by wrapping the file operation in an agent file path.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2486 / CVE-2021-21690: Agent processes are no longer able to completely bypass file path filtering by wrapping the file operation in an agent file path.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Missing permission checks in Jenkins Fortify on Demand Plugin
Advisory: GHSA-fhmf-xf2q-4m8p
Aliases: CVE-2020-2204
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A missing permission check in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.

This form validation method requires appropriate permission in Fortify on Demand Plugin 6.0.0.
Total.js CMS Unauthorized Access
Advisory: GHSA-q3x9-28f7-w8rc
Aliases: CVE-2019-15953
Published: 2022-05-24T16:55:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with limited privileges can get access to a resource that they do not own by calling the associated API. The product correctly manages privileges only for the front-end resource path, not for API requests. This leads to vertical and horizontal privilege escalation.
HashiCorp Vault improper configuration of multi factor authentication
Advisory: GHSA-c5wc-v287-82pc
Aliases: CVE-2022-30689
Published: 2022-05-18T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
Directory traversal in pyftpdlib
Advisory: GHSA-jw88-wxv5-7c4f
Aliases: CVE-2008-7262
Published: 2022-05-17T05:47:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.3.0 allow remote authenticated users to access arbitrary files and directories via vectors involving a symlink in a pathname to a (1) CWD, (2) DELE, (3) STOR, or (4) RETR command.
Improper Limitation of a Pathname to a Restricted Directory in plexus-archiver
Advisory: GHSA-hcxq-x77q-3469
Aliases: CVE-2018-1002200
Published: 2022-05-13T01:35:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

plexus-archiver before 3.6.0 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in an archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Withdrawn Advisory: Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-w8vh-5v64-j3vr
Aliases: CVE-2019-8229
Published: 2022-05-24T17:00:29Z
Withdrawn: 2023-09-28T21:18:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

## Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not affect a package in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references.

## Original Description

In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes can execute arbitrary code through crafted layout updates.
RubyGems does not verify SSL certificate
Advisory: GHSA-5mgj-mvv8-46mw
Aliases: CVE-2012-2126
Published: 2022-05-17T04:54:47Z

RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack.
TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework
Advisory: GHSA-qj69-chjp-g4f5
Aliases: CVE-2013-7078
Published: 2022-05-17T01:29:44Z

Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6, when the Rewritten Property Mapper is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.  NOTE: this might be the same vulnerability as CVE-2013-7072.
springframework-social Cross-Site Request Forgery vulnerability
Advisory: GHSA-w5r6-gx3q-hmxj
Aliases: CVE-2015-5258
Published: 2022-05-13T01:09:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site request forgery (CSRF) vulnerability in springframework-social before 1.1.3.
OpenStack Compute (Nova)'s VMWare driver vulnerable to denial of service
Advisory: GHSA-92hc-c226-32q7
Aliases: CVE-2014-3608
Published: 2022-05-14T01:58:45Z

The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.
Jenkins JIRA Plugin allows users to select and use credentials with System scope
Advisory: GHSA-98m4-m2c3-qxgq
Aliases: CVE-2019-16541
Published: 2022-05-24T17:01:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope. Jira Plugin 3.0.11 defines the appropriate folder context for credential lookup. As a side effect, existing per-folder Jira sites may lose access to already configured System-scoped credentials, as if no credential was specified in the first place.
Improper privilege management in elasticsearch
Advisory: GHSA-c77j-p484-h84m
Aliases: CVE-2020-7019
Published: 2022-05-24T17:26:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Elasticsearch before 7.9.0 and 6.8.12 a field disclosure flaw was found when running a scrolling search with Field Level Security. If a user runs the same query another more privileged user recently ran, the scrolling search can leak fields that should be hidden. This could result in an attacker gaining additional permissions against a restricted index.
Insecure transport protocol in Gradle
Advisory: GHSA-pprq-4488-wgqx
Aliases: CVE-2019-11065
Published: 2022-05-13T01:21:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Gradle versions from 1.4 to 5.3.1 use an insecure HTTP URL to download dependencies when the built-in JavaScript or CoffeeScript Gradle plugins are used. Dependency artifacts could have been maliciously compromised by a MITM attack against the ajax.googleapis.com web site.
OpenStack keystonemiddleware does not verify certificate
Advisory: GHSA-7f2c-vp52-gmfw
Aliases: CVE-2014-7144
Published: 2022-05-17T03:45:51Z

OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (`paste.ini`) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
Maven Extension plugin for Gradle Enterprise vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-vp55-fhxx-vcx8
Aliases: CVE-2020-15777
Published: 2022-05-24T17:26:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. It is vulnerable to, in the worst case, Remote Code Execution, and in the general case, local privilege escalation. Internally, the plugin uses a socket connection to send serialized Java objects that are deserialized by a Java standard library ObjectInputStream. This ObjectInputStream was not restricted to a list of trusted classes, thus allowing an attacker to send a malicious deserialization gadget chain to achieve code execution. The socket was not bound exclusively to localhost. The port this socket is assigned to is randomly selected by the JVM and is not intentionally exposed to the public (either by design or documentation).
Scrapy denial of service vulnerability
Advisory: GHSA-h7wm-ph43-c39p
Aliases: CVE-2017-14158
Published: 2022-05-17T01:16:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scrapy 1.4 allows remote attackers to cause a denial of service (memory consumption) via large files because arbitrarily many files are read into memory, which is especially problematic if the files are then individually written in a separate thread to a slow storage resource, as demonstrated by interaction between dataReceived (in core/downloader/handlers/http11.py) and S3FilesStore.
Cross site scripting via canonical tag in Contao
Advisory: GHSA-m8x6-6r63-qvj2
Aliases: CVE-2022-24899
Published: 2022-05-20T19:54:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

### Impact

Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page (front end).

### Patches

Update to Contao 4.13.3.

### Workarounds

Disable canonical tags in the root page settings.

### References

https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Improper Privilege Management in MySQL Connectors Java
Advisory: GHSA-4vrv-ch96-6h42
Aliases: CVE-2018-3258
Published: 2022-05-13T01:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.12 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Containous Traefik Exposes Password Hashes
Advisory: GHSA-r3fq-cmmw-cpmm
Aliases: CVE-2019-12452
Published: 2022-05-24T16:46:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

types/types.go in Containous Traefik 1.7.x through 1.7.11, when the `--api` flag is used and the API is publicly reachable and exposed without sufficient access control (which is contrary to the API documentation), allows remote authenticated users to discover password hashes by reading the Basic HTTP Authentication or Digest HTTP Authentication section, or discover a key by reading the ClientTLS section. These can be found in the JSON response to a `/api` request.
LibreNMS Information Disclosure
Advisory: GHSA-q5rg-wg7h-73m5
Aliases: CVE-2019-10665
Published: 2022-05-24T16:55:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in LibreNMS through 1.47. The scripts that handle the graphing options (`html/includes/graphs/common.inc.php` and `html/includes/graphs/graphs.inc.php`) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with `mysqli_real_escape_string`, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the `html/graph.php` script. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, file content, denial of service, or writing arbitrary files.
OpenStack Glance Signature Verification Bypass
Advisory: GHSA-wmhw-fvg9-87fc
Aliases: CVE-2015-8234
Published: 2022-05-17T02:52:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

The image signature algorithm in OpenStack Glance 11.0.0 allows remote attackers to bypass the signature verification process via a crafted image, which triggers an MD5 collision.
XXE vulnerability in FitNesse Plugin
Advisory: GHSA-c3cg-mv5w-cvw8
Aliases: CVE-2020-2120
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.

FitNesse Plugin 1.31 disables external entity processing for its XML parser.
ChakraCore RCE Vulnerability
Advisory: GHSA-hh3v-5chw-wgh7
Aliases: CVE-2016-7240
Published: 2022-05-14T02:22:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7242, and CVE-2016-7243.
golang.org/x/net/html Infinite Loop vulnerability
Advisory: GHSA-83g2-8m93-v3w7
Aliases: CVE-2021-33194
Published: 2022-05-24T19:03:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Go through 1.15.12 and 1.16.x through 1.16.4 has a golang.org/x/net/html infinite loop via crafted ParseFragment input.
Improper Access Control in Apache Tomcat
Advisory: GHSA-mv42-px54-87jw
Aliases: CVE-2016-0714
Published: 2022-05-14T01:10:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
Apache Geode OQL method invocation vulnerability
Advisory: GHSA-6m68-3w55-6mx4
Aliases: CVE-2017-9795
Published: 2022-05-14T00:57:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution.
Improper Input Validation in Apache Jackrabbit
Advisory: GHSA-9284-j4c9-779q
Aliases: CVE-2015-1833
Published: 2022-05-14T02:49:30Z

XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
Improper Certificate Validation in MongoDB
Advisory: GHSA-rghw-6px2-fgwc
Aliases: CVE-2021-20328
Published: 2022-05-24T22:28:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Specific versions of the Java driver that support client-side field level encryption (CSFLE) fail to perform correct host name verification on the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Java driver and the KMS service rendering Field Level Encryption ineffective. This issue was discovered during internal testing and affects all versions of the Java driver that support CSFLE. The Java async, Scala, and reactive streams drivers are not impacted. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services originating from applications residing inside the AWS, GCP, and Azure network fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component
Advisory: GHSA-4rpv-g4gq-rh4m
Aliases: CVE-2013-7073
Published: 2022-05-17T03:46:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 does not check permissions, which allows remote authenticated editors to read arbitrary TYPO3 table columns via unspecified parameters.
Radicale is vulnerable to timing oracles and simple bruteforce attacks
Advisory: GHSA-rpv4-63g3-9x23
Aliases: CVE-2017-8342
Published: 2022-05-13T01:27:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Radicale before 1.1.2 and 2.0.0rc1 is prone to timing oracles and simple brute-force attacks when using the htpasswd authentication method.
Parameterized Trigger Plugin fails to check Item/Build permission
Advisory: GHSA-mc22-25r3-2w9w
Aliases: CVE-2017-1000084
Published: 2022-05-13T01:40:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Parameterized Trigger Plugin fails to check Item/Build permission: The Parameterized Trigger Plugin did not check the build authentication it was running as and allowed triggering any other project in Jenkins. The plugin has been adapted to now check for Item/Build permission before triggering a downstream build.
Aimeos Typo3 extension contains Cross-site Scripting vulnerability
Advisory: GHSA-73wv-rgj7-vjj9
Aliases: CVE-2021-28380
Published: 2022-05-24T17:44:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows Cross-site Scripting (XSS) via a backend user account.
nv-websocket-client allows attackers to spoof SSL/TLS servers via an arbitrary valid certificate
Advisory: GHSA-4hxv-95rc-jqg7
Aliases: CVE-2017-1000209
Published: 2022-05-17T00:18:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

The Java WebSocket client nv-websocket-client does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL/TLS servers via an arbitrary valid certificate.
Open Chinese Convert subject to Denial of Service via Out-of-bounds Read
Advisory: GHSA-9qh2-6fxg-9m4g
Aliases: CVE-2018-16982
Published: 2022-05-14T01:55:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Open Chinese Convert (OpenCC) 1.0.5 allows attackers to cause a denial of service (segmentation fault) because BinaryDict::NewFromFile in BinaryDict.cpp may have out-of-bounds keyOffset and valueOffset values via a crafted .ocd file.
Apache Syncope JEXL Code Injection
Advisory: GHSA-r2xf-w5pj-9pw8
Aliases: CVE-2014-0111
Published: 2022-05-14T01:18:38Z

Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."
Missing XML Validation in Apache Xerces2
Advisory: GHSA-7j4h-8wpf-rqfh
Aliases: CVE-2013-4002
Published: 2022-05-13T01:01:06Z

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.
Typo3 XSS Vulnerabilities
Advisory: GHSA-qqh2-h6gw-6x8x
Aliases: CVE-2014-3943
Published: 2022-05-14T04:01:57Z

Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allow remote authenticated editors to inject arbitrary web script or HTML via unknown parameters.
Missing permission check in Jenkins AWS Global Configuration Plugin allows replacing plugin configuration
Advisory: GHSA-7v7g-mh53-89hw
Aliases: CVE-2020-2311
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AWS Global Configuration Plugin 1.5 and earlier does not perform a permission check in an HTTP endpoint processing form submissions.

This allows attackers with Overall/Read permission to replace the global AWS configuration.

AWS Global Configuration Plugin 1.6 properly performs permission checks when processing configuration form submissions.
ChakraCore RCE Vulnerability
Advisory: GHSA-6g23-fww6-rfrj
Aliases: CVE-2018-8354
Published: 2022-05-13T01:20:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8391, CVE-2018-8456, CVE-2018-8457, CVE-2018-8459.
Improper Encoding or Escaping of Output in Apache Superset
Advisory: GHSA-5fp8-c45m-256p
Aliases: CVE-2021-42250
Published: 2022-05-24T19:20:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious content into logs.
Out of bounds memory access in github.com/open-policy-agent/opa
Advisory: GHSA-x7f3-62pm-9p38
Aliases: CVE-2022-28946
Published: 2022-05-20T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue in the component ast/parser.go of Open Policy Agent v0.39.0 causes the application to incorrectly interpret every expression, causing a Denial of Service (DoS) via triggering out-of-range memory access.
Plaintext password storage in Jenkins InfluxDB Plugin
Advisory: GHSA-rv97-r8f7-8wmg
Aliases: CVE-2019-10329
Published: 2022-05-24T22:00:03Z

Jenkins InfluxDB Plugin Prior to 1.22 stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Privilege escalation in easyappointments
Advisory: GHSA-7f62-4887-cfv5
Aliases: CVE-2022-1397
Published: 2022-05-11T00:01:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Easy!Appointments API authorization is checked against the user's existence, without validating the permissions. As a result, a low privileged user (eg. provider) can create a new admin user via the "/api/v1/admins/" endpoint and take over the system. A [patch](https://github.com/alextselegidis/easyappointments/commit/63dbb51decfcc1631c398ecd6d30e3a337845526) is available on the `develop` branch of the repository.
Bookstack Cross-site Scripting vulnerability
Advisory: GHSA-ch37-ch8w-cfrq
Aliases: CVE-2020-26211
Published: 2022-05-24T17:32:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of `javascript:` URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without upgrading, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in BookStack version 0.30.4.
Plone cross site scripting (XSS)
Advisory: GHSA-8mc4-2xrc-g582
Aliases: CVE-2020-7937
Published: 2022-05-24T17:07:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.
Use of Password Hash With Insufficient Computational Effort in Apache Derby
Advisory: GHSA-fh32-35w2-rxcc
Aliases: CVE-2009-4269
Published: 2022-05-02T03:53:13Z

The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
Apache Struts Code injection due to conversion error
Advisory: GHSA-mwrx-hx6x-3hhv
Aliases: CVE-2012-0838
Published: 2022-05-14T01:51:59Z

Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
Tweepy does not verify SSL Certificate 
Advisory: GHSA-pwx5-xg7g-wpc5
Aliases: CVE-2012-5825
Published: 2022-05-17T01:38:35Z

Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library.
Remote Code Execution vulnerability in Jenkins Literate Plugin
Advisory: GHSA-c329-r874-xc7j
Aliases: CVE-2020-2158
Published: 2022-05-24T17:10:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.
Use of NullPointerException Catch to Detect NULL Pointer Dereference in Pymongo
Advisory: GHSA-x33v-f3gp-gw2c
Aliases: CVE-2013-2132
Published: 2022-05-14T02:10:10Z

bson/_cbsonmodule.c in the mongo-python-driver (aka. pymongo) before 2.5.2, as used in MongoDB, allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to decoding of an "invalid DBRef."
Jenkins RapidDeploy Plugin Cross-Site Request Forgery plugin
Advisory: GHSA-922h-8q8g-w7fx
Aliases: CVE-2019-16570
Published: 2022-05-24T17:03:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers to connect to an attacker-specified web server.
phpMyAdmin XSS Vulnerability
Advisory: GHSA-gcvp-cwgw-wx8j
Aliases: CVE-2016-5704
Published: 2022-05-17T02:37:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allows remote attackers to inject arbitrary web script or HTML via vectors involving a comment.
Django denial of service via empty session record creation
Advisory: GHSA-pgxh-wfw4-jx2v
Aliases: CVE-2015-5963
Published: 2022-05-17T00:36:02Z

`contrib.sessions.middleware.SessionMiddleware` in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to `contrib.auth.views.logout`, which triggers the creation of an empty session record.
XSS vulnerability in Jenkins Build Failure Analyzer Plugin
Advisory: GHSA-p5jh-8rxp-wqjj
Aliases: CVE-2020-2244
Published: 2022-05-24T17:27:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Build Failure Analyzer Plugin 1.27.0 and earlier does not escape matching text in a form validation response, resulting in a cross-site scripting (XSS) vulnerability exploitable by attackers able to provide console output for builds used to test build log indications.

Build Failure Analyzer Plugin 1.27.1 escapes matching text in the affected form validation response.
Jenkins Pipeline: Input Step Plugin
Advisory: GHSA-hxpw-7x95-q38m
Aliases: CVE-2017-1000108
Published: 2022-05-17T00:29:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The Pipeline: Input Step Plugin by default allowed users with Item/Read access to a pipeline to interact with the step to provide input. This has been changed, and now requires users to have the Item/Build permission instead.
Uncontrolled Resource Consumption in Apache CXF
Advisory: GHSA-5xf9-3v63-ww6f
Aliases: CVE-2014-0110
Published: 2022-05-13T01:09:20Z

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.
SQL injection in jflyfox jfinal
Advisory: GHSA-595x-hh6c-hfv8
Aliases: CVE-2022-30500
Published: 2022-05-27T00:00:48Z

Jfinal cms 5.1.0 is vulnerable to SQL Injection.
Improper Verification of Source of a Communication Channel in Apache Tomcat
Advisory: GHSA-9hjv-9h75-xmpp
Aliases: CVE-2016-0763
Published: 2022-05-14T01:18:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
XSS vulnerability in Jenkins Subversion Partial Release Manager Plugin
Advisory: GHSA-qmf3-w5jf-cv54
Aliases: CVE-2020-2199
Published: 2022-05-24T17:19:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Subversion Partial Release Manager Plugin 1.0.1 and earlier does not escape the error message for the repository URL field form validation.

This results in a reflected cross-site scripting (XSS) vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure permission.
Improper Certificate Validation in vt-ldap
Advisory: GHSA-273v-g3x4-r3rc
Aliases: CVE-2014-3607
Published: 2022-05-14T03:47:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Moodle sensitive information disclosure
Advisory: GHSA-mmvj-j7hq-rx85
Aliases: CVE-2015-5340
Published: 2022-05-13T01:12:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Moodle through 2.6.11, 2.7.x before 2.7.11, 2.8.x before 2.8.9, and 2.9.x before 2.9.3 does not consider the moodle/badges:viewbadges capability, which allows remote authenticated users to obtain sensitive badge information via a request involving (1) `badges/overview.php` or (2) `badges/view.php`.
point-cli allows local users to obtain sensitive information by listing the process
Advisory: GHSA-mc8m-x6hf-cw2g
Aliases: CVE-2014-4997
Published: 2022-05-14T03:47:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

`lib/commands/setup.rb` in the point-cli gem 0.0.1 for Ruby places credentials on the curl command line, which allows local users to obtain sensitive information by listing the process.