aswin1906/github-advisory-2022 huggingface dataset:
gopkg.in/yaml.v3 Denial of Service
Advisory: GHSA-hp87-p4gw-j4gq
Aliases: CVE-2022-28948
Published: 2022-05-20T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue in the Unmarshal function in Go-Yaml v3 can cause a program to panic when attempting to deserialize invalid input.
Incorrect Calculation in solana_rbpf
Advisory: GHSA-9qmm-4mfr-r3wj
Aliases: CVE-2022-23066
Published: 2022-05-10T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

In Solana rBPF versions 0.2.26 and 0.2.27 are affected by Incorrect Calculation which is caused by improper implementation of sdiv instruction. This can lead to the wrong execution path, resulting in huge loss in specific cases. For example, the result of a sdiv instruction may decide whether to transfer tokens or not. The vulnerability affects both integrity and may cause serious availability problems.
October CMS File Upload Vulnerability
Advisory: GHSA-8vh6-8w76-v6m3
Aliases: CVE-2017-1000194
Published: 2022-05-13T01:24:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality resulting in site compromise and possibly other applications on the server.
Cross-site scripting (XSS) vulnerability in CakePHP
Advisory: GHSA-vc29-mvwv-wpcq
Aliases: CVE-2006-4067
Published: 2022-05-01T07:15:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

Cross-site scripting (XSS) vulnerability in cake/libs/error.php in CakePHP before 1.1.7.3363 allows remote attackers to inject arbitrary web script or HTML via the URL, which is reflected back in a 404 (\"Not Found\") error page. NOTE: some of these details are obtained from third party information.
Always-Incorrect Control Flow Implementation in Facebook Hermes
Advisory: GHSA-327c-qx3v-h673
Aliases: CVE-2020-1914
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A logic vulnerability when handling the SaveGeneratorLong instruction in Facebook Hermes prior to commit b2021df620824627f5a8c96615edbd1eb7fdddfc allows attackers to potentially read out of bounds or theoretically execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Improper Access Control in Apache Derby
Advisory: GHSA-42xw-p62x-hwcf
Aliases: CVE-2018-1313
Published: 2022-05-13T01:02:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.
Django XSS Vulnerability
Advisory: GHSA-pw27-w7w4-9qc7
Aliases: CVE-2016-2512
Published: 2022-05-17T01:09:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

The `utils.http.is_safe_url function` in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by `http://mysite.example.com\@attacker.com`.
DOMPDF Remote Code Execution
Advisory: GHSA-jjwj-w3gc-gcw4
Aliases: CVE-2014-5013
Published: 2022-05-17T19:57:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

DOMPDF before 0.6.2 allows remote code execution, a related issue to CVE-2014-2383.
Keycloak Improper Bruteforce Detection
Advisory: GHSA-85v8-vx4w-q684
Aliases: CVE-2018-14657
Published: 2022-05-13T01:12:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.
phpMyAdmin XSS Vulnerability
Advisory: GHSA-j8mx-x32r-5rf4
Aliases: CVE-2016-9856
Published: 2022-05-17T02:36:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An XSS issue was discovered in phpMyAdmin because of an improper fix for CVE-2016-2559 in PMASA-2016-10. This issue is resolved by using a copy of a hash to avoid a race condition. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
ChakraCore RCE Vulnerability
Advisory: GHSA-w4qx-vw2w-q566
Aliases: CVE-2018-8243
Published: 2022-05-13T01:20:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8267.
Credentials transmitted in plain text by Backlog Plugin
Advisory: GHSA-p68c-xg89-2g5r
Aliases: CVE-2020-2153
Published: 2022-05-24T17:10:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Backlog Plugin stores credentials in job `config.xml` files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Backlog Plugin 2.4 and earlier. These credentials could be viewed by users with Extended Read permission.
Helm Unsafe Link Following
Advisory: GHSA-p5pc-m4q7-7qm9
Aliases: CVE-2019-18658
Published: 2022-05-24T22:01:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as `/etc/passwd`, or to execute a denial of service (DoS) via a special file such as /dev/urandom, via symlinks. No version of Tiller is known to be impacted. This is a client-only issue.
Missing Authorization in Apache ZooKeeper
Advisory: GHSA-ccqf-c5hq-77mp
Aliases: CVE-2018-8012
Published: 2022-05-13T01:05:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.
OpenNMS Horizon RCE via Unsafe Deserialization
Advisory: GHSA-853f-x27w-8r74
Aliases: CVE-2020-12760
Published: 2022-05-24T17:17:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in OpenNMS Horizon before 26.0.1, and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization), leading to remote code execution for any authenticated channel user regardless of its assigned permissions.
Apache Flex BlazeDS unsafe deserialization
Advisory: GHSA-w8v7-prhw-xjpw
Aliases: CVE-2017-5641
Published: 2022-05-13T01:02:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other, unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.
Aubio is vulnerable to a NULL pointer dereference
Advisory: GHSA-45h5-cqqw-9rjw
Aliases: CVE-2017-17554
Published: 2022-05-14T03:07:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A NULL pointer dereference (DoS) Vulnerability was found in the function `aubio_source_avcodec_readframe` in io/source_avcodec.c of aubio, which may lead to DoS when playing a crafted audio file.
Craft CMS XSS Vulnerability
Advisory: GHSA-xv5f-2997-qhrq
Aliases: CVE-2017-8052
Published: 2022-05-17T02:48:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Craft CMS before 2.6.2974 allows XSS attacks.
Ignite Realtime Openfire allows Cross-site Scripting
Advisory: GHSA-h2mq-p9r5-wh94
Aliases: CVE-2019-20525
Published: 2022-05-24T17:11:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter. This issue was fixed in version 4.4.2.
Exposure of Sensitive Information to an Unauthorized Actor Jenkins Script Security Plugin
Advisory: GHSA-r9jf-hf9x-7hrv
Aliases: CVE-2017-1000505
Published: 2022-05-14T03:45:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Jenkins Script Security Plugin version 1.36 and earlier, users with the ability to configure sandboxed Groovy scripts are able to use a type coercion feature in Groovy to create new `File` objects from strings. This allowed reading arbitrary files on the Jenkins master file system. Such a type coercion is now subject to sandbox protection and considered to be a call to the `new File(String)` constructor for the purpose of in-process script approval.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-2xcm-h7vv-g8m9
Aliases: CVE-2020-2163
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier improperly processes HTML content of list view column headers, resulting in a stored XSS vulnerability exploitable by users able to control column headers.
Improper Link Resolution Before File Access in Suds
Advisory: GHSA-vpqp-hx68-p2wx
Aliases: CVE-2013-2217
Published: 2022-05-14T01:08:23Z

cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.
Stored XSS vulnerability in Jenkins Git Parameter Plugin
Advisory: GHSA-j7q2-c6r4-x2jw
Aliases: CVE-2020-2238
Published: 2022-05-24T17:27:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Git Parameter Plugin 0.9.12 and earlier does not escape the repository field on the 'Build with Parameters' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Git Parameter Plugin 0.9.13 escapes the repository field on the 'Build with Parameters' page.
TYPO3 SQL injection vulnerability in the Extbase Framework
Advisory: GHSA-m64j-j252-jxmr
Aliases: CVE-2013-1842
Published: 2022-05-17T05:08:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
Magento 2 Community Edition SSRF vulnerability
Advisory: GHSA-hvcp-jvx5-4pmp
Aliases: CVE-2019-7923
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code.
fs-git command injection vulnerability
Advisory: GHSA-wp3j-gv53-4pg8
Aliases: CVE-2017-1000451
Published: 2022-05-13T01:41:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec, however, the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across all methods that use it and call exec.
Golang Facebook Thrift servers vulnerable to denial of service
Advisory: GHSA-w3r9-r9w7-8h48
Aliases: CVE-2019-11939
Published: 2022-05-24T17:11:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Golang Facebook Thrift servers would not error upon receiving messages declaring containers of sizes larger than the payload. As a result, malicious clients could send short messages which would result in a large memory allocation, potentially leading to denial of service. This issue affects Facebook Thrift prior to v2020.03.16.00.

### Specific Go Packages Affected
github.com/facebook/fbthrift/thrift/lib/go/thrift
phpMyAdmin Unsafe Fetching of Javascript Code
Advisory: GHSA-xpxp-v33m-5jp9
Aliases: CVE-2012-5368
Published: 2022-05-17T05:16:32Z

phpMyAdmin 3.5.x before 3.5.3 uses JavaScript code that is obtained through an HTTP session to phpmyadmin.net without SSL, which allows man-in-the-middle attackers to conduct cross-site scripting (XSS) attacks by modifying this code.
XSS in PHP-Proxy-App through v3.0
Advisory: GHSA-cghj-w42g-hqmr
Aliases: CVE-2018-19785
Published: 2022-05-14T01:45:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

PHP-Proxy-App through 3.0 has Cross-Site Scripting (XSS) via the URL field in index.php.
ZendXml and Zend Framework contain XXE and XEE Vulnerabilities
Advisory: GHSA-xp8p-9rq5-4wgv
Aliases: CVE-2015-5161
Published: 2022-05-17T03:16:37Z

The `Zend_Xml_Security::scan` in ZendXml before 1.0.1 and Zend Framework before 1.12.14, 2.x before 2.4.6, and 2.5.x before 2.5.2, when running under PHP-FPM in a threaded environment, allows remote attackers to bypass security checks and conduct XML external entity (XXE) and XML entity expansion (XEE) attacks via multibyte encoded characters.
Jenkins elOyente Plugin has Insufficiently Protected Credentials
Advisory: GHSA-jv62-6xvc-ccwh
Aliases: CVE-2019-10424
Published: 2022-05-24T16:56:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

elOyente Plugin stores a password unencrypted in its global configuration file `com.technicolor.eloyente.ElOyente.xm`l on the Jenkins controller. This password can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.
Puppet Improper Access Control
Advisory: GHSA-pqj5-7r86-64fv
Aliases: CVE-2016-2785
Published: 2022-05-13T01:06:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
Jenkins Cross-Site Scripting vulnerability in help icons
Advisory: GHSA-hvmc-7g2x-r3p9
Aliases: CVE-2020-2229
Published: 2022-05-24T17:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons. Tooltip values can be contributed by plugins, some of which use user-specified values.\n\nThis results in a stored cross-site scripting (XSS) vulnerability.\n\nJenkins 2.252, LTS 2.235.4 escapes the tooltip content of help icons.
Improper Authentication in Apache CXF
Advisory: GHSA-vjpc-vf4f-82qg
Aliases: CVE-2012-2378
Published: 2022-05-13T01:09:22Z

Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
Craft CMS Unauthorized View
Advisory: GHSA-7qq6-fgpw-xw45
Aliases: CVE-2017-8383
Published: 2022-05-13T01:47:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Craft CMS before 2.6.2976 does not properly restrict viewing the contents of files in the `craft/app/` folder.
ChakraCore RCE Vulnerability
Advisory: GHSA-fhc8-h6hr-h9mq
Aliases: CVE-2020-0767
Published: 2022-05-24T17:08:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713.
Golang/crypto message forgery vulnerability
Advisory: GHSA-x3jr-pf6g-c48f
Aliases: CVE-2019-11841
Published: 2022-05-24T16:46:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

A message-forgery issue was discovered in crypto/openpgp/clearsign/clearsign.go in supplementary Go cryptography libraries 2019-03-25. According to the OpenPGP Message Format specification in RFC 4880 chapter 7, a cleartext signed message can contain one or more optional "Hash" Armor Headers. The "Hash" Armor Header specifies the message digest algorithm(s) used for the signature. However, the Go clearsign package ignores the value of this header, which allows an attacker to spoof it. Consequently, an attacker can lead a victim to believe the signature was generated using a different message digest algorithm than what was actually used. Moreover, since the library skips Armor Header parsing in general, an attacker can not only embed arbitrary Armor Headers, but also prepend arbitrary text to cleartext messages without invalidating the signatures.
Missing validation causes denial of service via `UnsortedSegmentJoin`
Advisory: GHSA-hrg5-737c-2p56
Aliases: CVE-2022-29197
Published: 2022-05-24T22:08:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.UnsortedSegmentJoin`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/unsorted_segment_join_op.cc#L92-L95) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

tf.raw_ops.UnsortedSegmentJoin(
  inputs=tf.constant("this", shape=[12], dtype=tf.string),
  segment_ids=tf.constant(0, shape=[12], dtype=tf.int64),
  num_segments=tf.constant(0, shape=[12], dtype=tf.int64))
``` 
  
The code assumes `num_segments` is a scalar but there is no validation for this before accessing its value:

```cc
const Tensor& num_segments_tensor = context->input(2);
OP_REQUIRES(context, num_segments_tensor.NumElements() != 0,
            errors::InvalidArgument("Number of segments cannot be empty."));
auto num_segments = num_segments_tensor.scalar<NUM_SEGMENTS_TYPE>()();
``` 

### Patches
We have patched the issue in GitHub commit [13d38a07ce9143e044aa737cfd7bb759d0e9b400](https://github.com/tensorflow/tensorflow/commit/13d38a07ce9143e044aa737cfd7bb759d0e9b400).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
AttesterSlashing number overflow
Advisory: GHSA-cvj7-5f3c-9vg9
Aliases: CVE-2022-29219
Published: 2022-05-24T22:21:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

Possible consensus split given maliciously-crafted `AttesterSlashing` or `ProposerSlashing` being included on-chain.

Since we represent `uint64` values as native javascript `number`s, there is an issue when those variables with large (greater than 2^53) `uint64` values are included on chain. In those cases, Lodestar may view _valid_ `AttesterSlashing` or `ProposerSlashing` as _invalid_, due to rounding errors in large `number` values. This causes a consensus split, where Lodestar nodes are forked away from the main network.

Similarly Lodestar may consider _invalid_ `ProposerSlashing` as _valid_, thus including in proposed blocks that will be considered invalid by the network.

### Patches

https://github.com/ChainSafe/lodestar/pull/3977

### Workarounds

Use `BigInt` to represent `Slot` and `Epoch` values in `AttesterSlashing` and `ProposerSlashing` objects. `BigInt` is too slow to be used in all `Slot` and `Epoch` cases, so we will carefully use `BigInt` just where necessary for consensus.
Wildfly Unsafe Deserialization Vulnerability
Advisory: GHSA-vrmw-2xhq-hrmp
Aliases: CVE-2020-10740
Published: 2022-05-24T17:21:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.
Keycloak Unauthenticated Access
Advisory: GHSA-8prc-58j4-m55q
Aliases: CVE-2019-14832
Published: 2022-05-24T16:58:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in the Keycloak REST API before version 8.0.0, implemented in Keycloak before 7.0.1 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.
RCE vulnerability in Jenkins Pipeline: AWS Steps Plugin
Advisory: GHSA-w598-25hm-jqx3
Aliases: CVE-2020-2166
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Pipeline: AWS Steps Plugin’s build steps.

Pipeline: AWS Steps Plugin 1.41 configures its YAML parser to only instantiate safe types.
oauth2orize-fprm XSS vulnerability
Advisory: GHSA-p77r-c6m3-gj2r
Aliases: CVE-2018-11647
Published: 2022-05-14T03:09:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.
Apache NiFi JMS Deserialization issue
Advisory: GHSA-p76j-5v6v-6c22
Aliases: CVE-2018-1310
Published: 2022-05-14T03:16:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Moodle  Authenticated Spelling Binary Remote Code Execution
Advisory: GHSA-wxqg-fg7v-mmc6
Aliases: CVE-2013-3630
Published: 2022-05-13T01:05:39Z

Moodle through 2.5.2 allows remote authenticated administrators to execute arbitrary programs by configuring the aspell pathname and then triggering a spell-check operation within the TinyMCE editor.
Path Traversal in io.hawt:project
Advisory: GHSA-9g8w-pjpr-prr4
Aliases: CVE-2017-2594
Published: 2022-05-13T01:36:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

hawtio before versions 2.0-beta-1, 2.0-beta-2, 2.0-m1, 2.0-m2, 2.0-m3, and 1.5 are vulnerable to a path traversal that leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root.
Django Middleware Enables Session Hijacking
Advisory: GHSA-625g-gx8c-xcmg
Aliases: CVE-2014-0482
Published: 2022-05-14T02:09:22Z

The `contrib.auth.middleware.RemoteUserMiddleware` middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the `contrib.auth.backends.RemoteUserBackend` backend, allows remote authenticated users to hijack web sessions via vectors related to the `REMOTE_USER` header.
Smokescreen SSRF via deny list bypass (square brackets)
Advisory: GHSA-qwrf-gfpj-qvj6
Aliases: CVE-2022-29188
Published: 2022-05-24T22:04:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

### Impact
The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure.

Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by surrounding the hostname with square brackets (e.g. `[example.com]`). 

### Recommendation
Upgrade Smokescreen to version 0.0.4 or later.

### Acknowledgements
Thanks to [Axel Chong](https://github.com/haxatron) for reporting the issue.

### For more information
Email us at security@stripe.com
Exposure of Sensitive Information in Jenkins Core
Advisory: GHSA-8572-5jrg-mx52
Aliases: CVE-2016-3723
Published: 2022-05-14T03:57:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with read access to obtain sensitive plugin installation information by leveraging missing permissions checks in unspecified XML/JSON API endpoints.
Erlang Solutions MongooseIM vulnerable to denial of service (DoS) via crafted XMPP stream
Advisory: GHSA-5v5w-44w6-q5hv
Aliases: CVE-2014-2829
Published: 2022-05-17T04:47:27Z

Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
web2py exposure of sensitive information
Advisory: GHSA-jr83-vr4j-mp6p
Aliases: CVE-2016-3954
Published: 2022-05-14T00:57:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.  NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957.
Jenkins Kubernetes CI/CD Plugin vulnerable to Improper Authorization
Advisory: GHSA-hch9-6qrj-5f49
Aliases: CVE-2019-10469
Published: 2022-05-24T16:59:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

## Note: Jenkins has suspended distribution of this plugin.
.NET Core & .NET Framework Denial of Service Vulnerability
Advisory: GHSA-3w5p-jhp5-c29q
Aliases: CVE-2020-1108
Published: 2022-05-24T17:18:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'.
Cross-Site Request Forgery in OWASP CSRFGuard
Advisory: GHSA-jx66-5ww9-m6q4
Aliases: CVE-2021-28490
Published: 2022-05-24T19:11:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In OWASP CSRFGuard through 3.1.0, CSRF can occur because the CSRF cookie may be retrieved by using only a session token.
Moodle sensitive information disclosure
Advisory: GHSA-r9pc-g29w-f86j
Aliases: CVE-2016-2190
Published: 2022-05-13T01:12:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Moodle through 2.6.11, 2.7.x before 2.7.13, 2.8.x before 2.8.11, 2.9.x before 2.9.5, and 3.0.x before 3.0.3 does not properly restrict links, which allows remote attackers to obtain sensitive URL information by reading a Referer log.
Improper Access Control in Apache Hadoop
Advisory: GHSA-7q56-mp4c-gggg
Aliases: CVE-2016-5393
Published: 2022-05-17T03:35:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a remote user who can authenticate with the HDFS NameNode can possibly run arbitrary commands with the same privileges as the HDFS service.
Possible information disclosure inside TreeGrid component with default data provider
Advisory: GHSA-qfr3-323w-qv27
Aliases: CVE-2022-29567
Published: 2022-05-25T22:40:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

### Description

The default configuration of a TreeGrid component uses Object::toString as a key on the client-side and server communication in Vaadin 14.8.5 through 14.8.9, 22.0.6 through 22.0.14, 23.0.0.beta2 through 23.0.8 and 23.1.0.alpha1 through 23.1.0.alpha4, resulting in potential information disclosure of values that should not be available on the client-side.
Moodle SSRF Vulnerability
Advisory: GHSA-vjxx-54vw-q59f
Aliases: CVE-2019-6970
Published: 2022-05-14T01:17:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

The `edit_blog.php` script allows a registered user to add external RSS feed resources. It was identified that this feature could be abused to be used as a SSRF attack vector by adding a malicious URL/TCP PORT in order to target internal network or an internet hosted server, bypassing firewall rules, IP filtering and more.

This kind of vulnerability is then called “blind” because of no response available on Moodle web site, enforcing attacker to exploit it using a “time based” approach.
Plone XSS
Advisory: GHSA-22jm-p2vv-j2hc
Aliases: CVE-2016-7136
Published: 2022-05-14T02:46:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request.
VladTheEnterprising allows local users to obtain sensitive information by reading MySQL root password from temporary file
Advisory: GHSA-86cf-g34f-7462
Aliases: CVE-2014-4995
Published: 2022-05-14T03:48:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Race condition in `lib/vlad/dba/mysql.rb` in the VladTheEnterprising gem 0.2 for Ruby allows local users to obtain sensitive information by reading the MySQL root password from a temporary file before it is removed.
Croogo vulnerable to XSS in title field
Advisory: GHSA-36pq-cjh9-fv46
Aliases: CVE-2019-7170
Published: 2022-05-14T01:38:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored-self XSS exists in Croogo allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies.
Cross site scripting in Jenkins Selection tasks Plugin
Advisory: GHSA-mw4r-5mfc-m5vc
Aliases: CVE-2022-30967
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Selection tasks Plugin 1.0 and earlier does not escape the name and description of Script Selection task variable parameters on views displaying parameters. This results in stored cross-site scripting (XSS) vulnerabilities exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Magento 2 Community Edition Information Leak
Advisory: GHSA-5j25-5hjr-w7m2
Aliases: CVE-2019-7951
Published: 2022-05-24T16:52:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP requests.
Cheetah Path Search Order Hijacking
Advisory: GHSA-vxf2-7rc3-pxmx
Aliases: CVE-2005-1632
Published: 2022-05-01T02:00:38Z

Cheetah 0.9.15 and 0.9.16 searches the `/tmp` directory for modules before using the paths in the `PYTHONPATH` variable, which allows local users to execute arbitrary code via a malicious module in `/tmp/`.
Incorrect Privilege Assignment in Jenkins Script Security Plugin
Advisory: GHSA-p56j-x44h-g66j
Aliases: CVE-2019-10355
Published: 2022-05-24T16:51:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.
Jenkins CollabNet Plugin man in the middle vulnerability
Advisory: GHSA-m8x2-4gc8-9v3r
Aliases: CVE-2018-1000605
Published: 2022-05-14T02:56:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

A man in the middle vulnerability exists in Jenkins CollabNet Plugin 2.0.4 and earlier in CollabNetApp.java, CollabNetPlugin.java, CNFormFieldValidator.java that allows attackers to impersonate any service that Jenkins connects to. CollabNet Plugin 2.0.5 and newer no longer does that. It instead requires users to opt in to disabling SSL/TLS certificate validation by setting the system property hudson.plugins.collabnet.CollabNetPlugin.skipSslValidation to true. This feature applies to connections by this plugin only.
RPLY Predictable Tmpfile Names Allows Cache Spoofing
Advisory: GHSA-9gcf-pq99-rjw3
Aliases: CVE-2014-1604
Published: 2022-05-17T01:27:10Z

The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.
ChakraCore RCE Vulnerability
Advisory: GHSA-9qpf-v72j-j9qh
Aliases: CVE-2017-11909
Published: 2022-05-14T01:06:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
October CMS XSS
Advisory: GHSA-3p6c-9xhm-8x7h
Aliases: CVE-2017-1000193
Published: 2022-05-13T01:24:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

October CMS build 412 is vulnerable to stored XSS in brand logo image name resulting in JavaScript code execution in the victim's browser.
Missing permission checks in Jenkins Chaos Monkey Plugin
Advisory: GHSA-hx53-635r-vmv8
Aliases: CVE-2020-2323
Published: 2022-05-24T17:35:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Chaos Monkey Plugin 0.4 and earlier does not perform permission checks in an HTTP endpoint.

This allows attackers with Overall/Read permission to access the Chaos Monkey page and to see the history of actions.

Chaos Monkey Plugin 0.4.1 requires Overall/Administer permission to access the Chaos Monkey page and to see the history of actions.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-g78x-xmv8-23xp
Aliases: CVE-2017-1000399
Published: 2022-05-14T01:04:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /queue/item/(ID)/api showed information about tasks in the queue (typically builds waiting to start). This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API endpoint is now only available for tasks that the current user has access to.
Improper Input Validation in Drools and jBPM
Advisory: GHSA-6qx9-rf9g-7jmr
Aliases: CVE-2014-8125
Published: 2022-05-17T04:12:57Z

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.
Athenz vulnerable to Open Redirect
Advisory: GHSA-9hg5-7hwc-v434
Aliases: CVE-2019-6035
Published: 2022-05-24T17:05:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Open redirect vulnerability in Athenz v1.8.24 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-3mxq-v9rw-m6x9
Aliases: CVE-2019-7944
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.
Remote Code Execution in Apache Struts
Advisory: GHSA-pvm9-288c-v5wq
Aliases: CVE-2016-3082
Published: 2022-05-17T03:42:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

XSLTResult allows for the location of a stylesheet being passed as a request parameter. In some circumstances this can be used to inject remotely executable code.
Improper Authentication in Apache Qpid
Advisory: GHSA-mrgh-6x42-x6xf
Aliases: CVE-2012-4446
Published: 2022-05-17T05:13:24Z

The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
Script security sandbox bypass in Matrix Project Plugin
Advisory: GHSA-qxf8-8837-hq7w
Aliases: CVE-2019-1003031
Published: 2022-05-13T01:15:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
Improper Limitation of a Pathname to a Restricted Directory in JCraft JSch
Advisory: GHSA-q446-82vq-w674
Aliases: CVE-2016-5725
Published: 2022-05-13T01:09:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
Puppet uses predictable filenames, allowing arbitrary file overwrite
Advisory: GHSA-c4mc-49hq-q275
Aliases: CVE-2012-1906
Published: 2022-05-14T00:56:45Z

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.
Logstash Logs Sensitive Information
Advisory: GHSA-vcmm-ppqx-95ch
Aliases: CVE-2016-1000221
Published: 2022-05-14T00:58:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Logstash prior to version 2.3.4, Elasticsearch Output plugin would log to file HTTP authorization headers which could contain sensitive information.
Shopware RCE Vulnerability
Advisory: GHSA-cj2f-96jq-phpp
Aliases: CVE-2016-3109
Published: 2022-05-14T02:46:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The `backend/Login/load/` script in Shopware before 5.1.5 allows remote attackers to execute arbitrary code.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-9wr9-fw9v-8fgr
Aliases: CVE-2019-8141
Published: 2022-05-24T17:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative privileges (system level import) can execute arbitrary code through a Phar deserialization vulnerability in the import functionality.
Undefined behavior when users supply invalid resource handles
Advisory: GHSA-5wpj-c6f7-24x8
Aliases: CVE-2022-29207
Published: 2022-05-24T22:13:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
Multiple TensorFlow operations misbehave in eager mode when the resource handle provided to them is invalid:

```python
import tensorflow as tf

tf.raw_ops.QueueIsClosedV2(handle=[])
```

```python
import tensorflow as tf

tf.summary.flush(writer=())
```
  
In graph mode, it would have been impossible to perform these API calls, but migration to TF 2.x eager mode opened up this vulnerability. If the resource handle is empty, then a reference is bound to a null pointer inside TensorFlow codebase (various codepaths). This is undefined behavior.

### Patches
We have patched the issue in GitHub commit [a5b89cd68c02329d793356bda85d079e9e69b4e7](https://github.com/tensorflow/tensorflow/commit/a5b89cd68c02329d793356bda85d079e9e69b4e7) and GitHub commit [dbdd98c37bc25249e8f288bd30d01e118a7b4498](https://github.com/tensorflow/tensorflow/commit/dbdd98c37bc25249e8f288bd30d01e118a7b4498).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Hong Jin from Singapore Management University.
Path Traversal in Eclipse Mojarra
Advisory: GHSA-43q7-q5vp-3g68
Aliases: CVE-2018-14371
Published: 2022-05-14T02:59:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
Exposure of Sensitive Information in Apache Pluto
Advisory: GHSA-v49x-8hvm-q347
Aliases: CVE-2018-1306
Published: 2022-05-14T01:29:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.
Missing permission check in Jenkins Cloud Statistics Plugin
Advisory: GHSA-xv69-6rf3-w5g2
Aliases: CVE-2021-21631
Published: 2022-05-24T17:45:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Cloud Statistics Plugin 0.26 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission and knowledge of random activity IDs to view related provisioning exception error messages.

Cloud Statistics Plugin 0.27 requires Overall/Administer permission to access provisioning exception error messages.
Auth0-ASPNET and Auth0-ASPNET-Owin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-mmhr-3jr7-qj2p
Aliases: CVE-2018-15121
Published: 2022-05-14T02:01:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in Auth0 auth0-aspnet and auth0-aspnet-owin. Affected packages do not use or validate the state parameter of the OAuth 2.0 and OpenID Connect protocols. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
SOAPpy vulnerable to XML External Entity attacks
Advisory: GHSA-52wr-3vww-rmpq
Aliases: CVE-2014-3242
Published: 2022-05-17T04:44:24Z

SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Magento 2 Community Edition Cryptographic Flaw
Advisory: GHSA-c2gg-rrhc-fvvg
Aliases: CVE-2019-7886
Published: 2022-05-24T16:52:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts.
MAGMI plugin for Magento Server Directory Traversal
Advisory: GHSA-c252-xc8v-mqmm
Aliases: CVE-2015-2067
Published: 2022-05-13T01:25:27Z

Directory traversal vulnerability in web/ajax_pluginconf.php in the MAGMI (aka Magento Mass Importer) plugin for Magento Server allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter.
Wildfly Authorization Misconfiguration
Advisory: GHSA-82v2-f875-73g9
Aliases: CVE-2019-14838
Published: 2022-05-24T16:58:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-mw5w-cf76-73m8
Aliases: CVE-2019-7895
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.