aswin1906/github-advisory-2022 huggingface dataset:
Deserialization of Untrusted Data in com.bstek.ureport:ureport2-console
Advisory: GHSA-w39x-chvm-pj3c
Aliases: CVE-2022-25767
Published: 2022-05-03T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database server, causing arbitrary file read and deserialization of local gadgets.
Pion DTLS Header reconstruction method can be thrown into an infinite loop
Advisory: GHSA-cm8f-h6j3-p25c
Aliases: CVE-2022-29190
Published: 2022-05-24T22:05:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
An attacker can send packets that will send Pion DTLS into an infinite loop when processing.

### Patches
Upgrade to Pion DTLS v2.1.4

### Workarounds
No workarounds available, upgrade to Pion DTLS v2.1.4

### References
Thank you to [Juho Nurminen](https://github.com/jupenur) and the Mattermost team for discovering and reporting this. 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Pion DTLS](http://github.com/pion/dtls)
* Email us at [team@pion.ly](mailto:team@pion.ly)
ChakraCore RCE Vulnerability
Advisory: GHSA-h8jq-5737-hpcf
Aliases: CVE-2018-8355
Published: 2022-05-13T01:20:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-8353, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.
Stored XSS vulnerability in Jenkins Valgrind Plugin
Advisory: GHSA-9hcr-66cj-r9hp
Aliases: CVE-2020-2246
Published: 2022-05-24T17:27:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Valgrind Plugin 0.28 and earlier does not escape content in Valgrind XML reports, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control Valgrind XML report contents.
ChakraCore RCE Vulnerability
Advisory: GHSA-g549-jfg6-98ch
Aliases: CVE-2018-0994
Published: 2022-05-13T01:18:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0980, CVE-2018-0990, CVE-2018-0993, CVE-2018-0995, CVE-2018-1019.
XML External Entity Reference in RESTEasy
Advisory: GHSA-pc54-pchm-xcw6
Aliases: CVE-2014-7839
Published: 2022-05-17T04:13:50Z

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.
Improper Input Validation in JGroups
Advisory: GHSA-rc7h-x6cq-988q
Aliases: CVE-2016-2141
Published: 2022-05-13T01:03:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

JGroups before 4.0 does not require the proper headers for the ENCRYPT and AUTH protocols from nodes joining the cluster, which allows remote attackers to bypass security restrictions and send and receive messages within the cluster via unspecified vectors. Fixes for this issue have been backported to versions 3.6.10.Final and 3.2.16.Final.
Password stored in plain text by Jenkins Nomad Plugin
Advisory: GHSA-5c2c-cvg6-ghjm
Aliases: CVE-2021-21681
Published: 2022-05-24T19:12:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Nomad Plugin 0.7.4 and earlier stores the passwords to authenticate against the Docker registry unencrypted in the global `config.xml` file on the Jenkins controller as part of its worker templates configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

Nomad Plugin 0.7.5 stores the Docker passwords encrypted. This change is effective after Jenkins restarts.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-v222-w2mw-xjc6
Aliases: CVE-2017-2609
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

jenkins before versions 2.44, 2.32.2 is vulnerable to an information disclosure vulnerability in search suggestions (SECURITY-385). The autocomplete feature on the search box discloses the names of the views in its suggestions, including the ones for which the current user does not have access to.
Missing Authentication for Critical Function in Apache Cassandra
Advisory: GHSA-52gq-7j6c-xw6x
Aliases: CVE-2018-8016
Published: 2022-05-13T01:53:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.
web2py remote code execution via hardcoded encryption key in session.connect function
Advisory: GHSA-q2rq-qgcf-m22w
Aliases: CVE-2016-3953
Published: 2022-05-14T00:57:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the `session.connect` function.
Missing permissions check in Jenkins Core
Advisory: GHSA-59fm-6x3q-q3q5
Aliases: CVE-2016-3725
Published: 2022-05-14T03:57:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins before 2.3 and LTS before 1.651.2 allows remote authenticated users to trigger updating of update site metadata by leveraging a missing permissions check. NOTE: this issue can be combined with DNS cache poisoning to cause a denial of service (service disruption).
Salt improper handling of tmp files
Advisory: GHSA-92pw-mff9-jqgm
Aliases: CVE-2015-1838
Published: 2022-05-17T02:49:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

`modules/serverdensity_device.py` in SaltStack before 2014.7.4 does not properly handle files in `/tmp`.
Incorrect Authorization in Apache Tomcat
Advisory: GHSA-q6x7-f33r-3wxx
Aliases: CVE-2016-6797
Published: 2022-05-13T01:02:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.
Typo3 XSS Vulnerability
Advisory: GHSA-56f9-5563-m2h7
Aliases: CVE-2015-8755
Published: 2022-05-17T03:59:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.
Insufficiently Protected Credentials in Jenkins Pipeline SCM API for Blue Ocean Plugin
Advisory: GHSA-g74w-93cp-5p3p
Aliases: CVE-2022-30952
Published: 2022-05-18T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

When pipelines are created using the pipeline creation wizard in Blue Ocean, the credentials used are stored in the per-user credentials store of the user creating the pipeline. To allow pipelines to use this credential to scan repositories and checkout from SCM, the Blue Ocean Credentials Provider allows pipelines to access a specific credential from the per-user credentials store in Pipeline SCM API for Blue Ocean Plugin 1.25.3 and earlier.

As a result, attackers with Job/Configure permission can rewrite job configurations in a way that lets them access and capture any attacker-specified credential from any user’s private credentials store.

Pipeline SCM API for Blue Ocean Plugin 1.25.4 deprecates the Blue Ocean Credentials Provider and disables it by default. As a result, all jobs initially set up using the Blue Ocean pipeline creation wizard and configured to use the credential specified at that time will no longer be able to access the credential, resulting in failures to scan repositories, checkout from SCM, etc. unless the repository is public and can be accessed without credentials.

This also applies to newly created pipelines after Pipeline SCM API for Blue Ocean Plugin has been updated to 1.25.4.

Administrators should reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store. See [this help page on cloudbees.com](https://cloudbees.com/r/blue-ocean-credentials-removal) to learn more.

To re-enable the Blue Ocean Credentials Provider, set the Java system property `io.jenkins.blueocean.rest.impl.pipeline.credential.BlueOceanCredentialsProvider.enabled` to `true`. Doing so is discouraged, as that will restore the unsafe behavior.

While Credentials Plugin provides the _Configure Credential Providers_ UI to enable or disable certain credentials providers, enabling the Blue Ocean Credentials Provider there is not enough in Pipeline SCM API for Blue Ocean Plugin 1.25.4. Both the UI and system property need to enable the Blue Ocean Credentials Provider.

Administrators not immediately able to update Blue Ocean are advised to disable the Blue Ocean Credentials Provider through the UI at _Manage Jenkins_ » _Configure Credential Providers_ and to reconfigure affected pipelines to use a credential from the Jenkins credential store or a folder credential store.
Signed to Unsigned Conversion Error in Facebook Hermes
Advisory: GHSA-gmpm-xp43-f7g6
Aliases: CVE-2020-1913
Published: 2022-05-24T17:27:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

An Integer signedness error in the JavaScript Interpreter in Facebook Hermes prior to commit 2c7af7ec481ceffd0d14ce2d7c045e475fd71dc6 allows attackers to cause a denial of service attack or a potential RCE via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Sylabs Singularity Improper Input Validation
Advisory: GHSA-p83v-8vmr-qfv9
Aliases: CVE-2018-19295
Published: 2022-05-14T01:39:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Sylabs Singularity 2.4 to 2.6 allows local users to conduct Improper Input Validation attacks.
ChakraCore Privilege Escalation
Advisory: GHSA-c79v-2rjq-965m
Aliases: CVE-2017-11767
Published: 2022-05-13T01:42:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
Plone Code Injection vulnerability
Advisory: GHSA-7hxc-mwx7-5hmc
Aliases: CVE-2012-5485
Published: 2022-05-17T04:31:32Z

`registerConfiglet.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.
Incorrect Default Permissions in Apache Commons FileUpload
Advisory: GHSA-vm69-474v-7q2w
Aliases: CVE-2013-0248
Published: 2022-05-05T02:48:41Z

The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
Jenkins Google Play Android Publisher Plugin allows attacker to obtain credential IDs
Advisory: GHSA-rvx4-gg8w-qw24
Aliases: CVE-2018-1000109
Published: 2022-05-13T01:48:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

An improper authorization vulnerability exists in Jenkins Google Play Android Publisher Plugin version 1.6 and earlier in `GooglePlayBuildStepDescriptor.java` that allow an attacker to obtain credential IDs. As of version 1.7, enumeration of credentials IDs and validation of specified credentials in this plugin requires the permissions to have the ExtendedRead permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed.
Statamic framework Incorrect Permission Assignment 
Advisory: GHSA-5m64-9hq5-5pf2
Aliases: CVE-2017-11422
Published: 2022-05-13T01:12:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Statamic framework before 2.6.0 does not correctly check a session's permissions when the methods from a user's class are called. Problematic methods include reset password, create new account, create new role, etc.
Deserialization of Untrusted Data in Apache Tomcat
Advisory: GHSA-v6c7-8qx5-8gmp
Aliases: CVE-2013-2185
Published: 2022-05-17T03:47:51Z

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  

NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue. Regardless the tomcat maintainers have altered the behavior of this method in version 7.0.39.
Unrestricted File Upload vulnerability in Firefly III
Advisory: GHSA-5gq7-826w-8282
Aliases: CVE-2021-3846
Published: 2022-05-24T19:18:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type
Privilege Issues in jailed
Advisory: GHSA-77m7-9wvw-87fx
Aliases: CVE-2022-23923
Published: 2022-05-03T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.
ChakraCore information disclosure vulnerability
Advisory: GHSA-93c7-2942-3h47
Aliases: CVE-2018-8315
Published: 2022-05-14T02:03:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

An information disclosure vulnerability exists when the browser scripting engine improperly handle object types, aka "Microsoft Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10.
Jenkins Git Parameter Plugin vulnerable to Stored cross-site scripting (XSS)
Advisory: GHSA-hw26-fw67-qxm9
Aliases: CVE-2020-2112
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
Denial of Service in Apache Tomcat
Advisory: GHSA-8h2q-qm9x-55jc
Aliases: CVE-2012-0022
Published: 2022-05-04T00:27:43Z

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.
Typo3 Cross-Site Scripting in Flash component (ELTS)
Advisory: GHSA-qvhv-pwww-53jj
Aliases: CVE-2020-8091
Published: 2022-05-24T17:07:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 included a vulnerable external component, which could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system.
Froala WYSIWYG Editor XSS Vulnerability
Advisory: GHSA-qrhq-x7xh-2784
Aliases: CVE-2020-26523
Published: 2022-05-24T17:30:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Froala Editor before 3.2.2 allows XSS via pasted content.
Server side object manipulation in Apache Struts
Advisory: GHSA-x5fc-pgpx-59j5
Aliases: CVE-2010-1870
Published: 2022-05-13T01:14:26Z

OGNL provides, among other features, extensive expression evaluation capabilities. This vulnerability allows a malicious user to bypass the '#'-usage protection built into the ParametersInterceptor, thus being able to manipulate server side context objects. This behavior was already addressed in [S2-003](https://cwiki.apache.org/confluence/display/WW/S2-003), but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially.
JFinal Java Deserialization Vulnerability
Advisory: GHSA-h3j8-fr5q-8rfr
Aliases: CVE-2021-31649
Published: 2022-05-24T19:06:05Z

In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis which can lead to remote code execution
ChakraCore RCE via Out-of-bounds write
Advisory: GHSA-v8jw-x9wq-hw4v
Aliases: CVE-2019-1052
Published: 2022-05-24T22:00:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051.
Django DNS Rebinding Vulnerability
Advisory: GHSA-3f2c-jm6v-cr35
Aliases: CVE-2016-9014
Published: 2022-05-17T00:27:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.
Magento 2 Community Edition Path Traversal Vulnerability
Advisory: GHSA-hqhf-8jgc-h5hx
Aliases: CVE-2019-7859
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-87r3-4gc8-f897
Aliases: CVE-2019-19210
Published: 2022-05-24T17:11:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.
Pion/DLTS Accepts Client Certificates Without CertificateVerify
Advisory: GHSA-w45j-f832-hxvh
Aliases: CVE-2022-29222
Published: 2022-05-25T19:26:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact
A DTLS Client could provide a Certificate that it doesn't posses the private key for and Pion DTLS wouldn't reject it. 

This issue affects users that are using Client certificates only. The connection itself is still secure. The Certificate provided by clients can't be trusted when using a Pion DTLS server prior to v2.1.5

### Patches
Upgrade to Pion DTLS v2.1.5

### Workarounds
No workarounds available, upgrade to Pion DTLS v2.1.5

### References
Thank you to [Juho Nurminen](https://github.com/jupenur) and the Mattermost team for discovering and reporting this. 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Pion DTLS](http://github.com/pion/dtls)
* Email us at [team@pion.ly](mailto:team@pion.ly)
Feehi CMS arbitrary file upload vulnerability
Advisory: GHSA-65x8-9vgm-5fg5
Aliases: CVE-2020-22643
Published: 2022-05-24T17:40:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Feehi CMS 2.1.0-beta is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution. After an administrator logs in, open the administrator image upload page to potentially upload malicious files.
Nuclide Improper Input Validation
Advisory: GHSA-r83x-wj75-v89r
Aliases: CVE-2018-6333
Published: 2022-05-13T01:32:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The hhvm-attach deep link handler in Nuclide did not properly sanitize the provided hostname parameter when rendering. As a result, a malicious URL could be used to render HTML and other content inside of the editor's context, which could potentially be chained to lead to code execution. This issue affected Nuclide prior to v0.290.0.
Katello SQL Injection vulnerabilities
Advisory: GHSA-527r-mfmj-prqf
Aliases: CVE-2016-3072
Published: 2022-05-14T01:09:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Multiple SQL injection vulnerabilities in the scoped_search function in app/controllers/katello/api/v2/api_controller.rb in Katello allow remote authenticated users to execute arbitrary SQL commands via the (1) sort_by or (2) sort_order parameter.
Improper Neutralization of Input During Web Page Generation in Apache Solr
Advisory: GHSA-v6gf-x8fp-532v
Aliases: CVE-2015-8797
Published: 2022-05-17T03:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in webapp/web/js/scripts/plugins.js in the stats page in the Admin UI in Apache Solr before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via the entry parameter to a plugins/cache URI.
Incorrect Authorization in microweber
Advisory: GHSA-73rp-q4rx-5grc
Aliases: CVE-2022-1631
Published: 2022-05-10T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker’s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee’s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account.
Improper Access Control in Apache Derby
Advisory: GHSA-xprw-xvvm-vqmv
Aliases: CVE-2010-2232
Published: 2022-05-17T00:29:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In Apache Derby 10.1.2.1, 10.2.2.0, 10.3.1.4, and 10.4.1.3, Export processing may allow an attacker to overwrite an existing file.
Cross-site Scripting in Apache Atlas 
Advisory: GHSA-frqh-x6r7-h6mq
Aliases: CVE-2017-3153
Published: 2022-05-17T01:17:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.
Cross-Site Request Forgery in Apache Struts
Advisory: GHSA-h4v9-jf2r-9h6m
Aliases: CVE-2014-7809
Published: 2022-05-14T02:50:59Z

Apache Struts 2.0.0 through 2.3.x before 2.3.20 uses predictable <s:token/> values, which allows remote attackers to bypass the CSRF protection mechanism.
XML External Entity Reference in Jenkins FindBugs Plugin
Advisory: GHSA-pr9h-g7p7-rrqh
Aliases: CVE-2018-1000011
Published: 2022-05-14T03:46:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins FindBugs Plugin 4.71 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Missing permission check in XebiaLabs XL Deploy Plugin allows capturing credentials
Advisory: GHSA-jm4g-8rvq-v87j
Aliases: CVE-2021-21664
Published: 2022-05-24T19:04:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

An incorrect permission check in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers with Generic Create permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.
Traefik Missing Authentication
Advisory: GHSA-2cjc-rgmp-x649
Aliases: CVE-2018-15598
Published: 2022-05-13T01:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Containous Traefik 1.6.x before 1.6.6, when `--api` is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
Camaleon CMS vulnerable to Server-Side Request Forgery
Advisory: GHSA-vx6p-q4gj-x6xx
Aliases: CVE-2021-25972
Published: 2022-05-24T19:18:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

In Camaleon CMS, versions 2.1.2.0 through 2.6.0, are vulnerable to Server-Side Request Forgery (SSRF) in the media upload feature, which allows admin users to fetch media files from external URLs but fails to validate URLs referencing to localhost or other internal servers. This allows attackers to read files stored in the internal server.
Moodle XSS Vulnerability
Advisory: GHSA-7mfw-g8x4-rq2w
Aliases: CVE-2017-12156
Published: 2022-05-17T00:51:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Moodle 3.x has XSS in the contact form on the "non-respondents" page in non-anonymous feedback.
Django is vulnerable to Denial of Service attack in formset 
Advisory: GHSA-g8xg-jgj6-49r3
Aliases: CVE-2013-0306
Published: 2022-05-05T02:48:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.
Malicious HTML+XHR Artifact Privilege Escalation in Argo Workflows
Advisory: GHSA-cmv8-6362-r5w9
Aliases: CVE-2022-29164
Published: 2022-05-23T20:16:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.

* The attacker creates a workflow that produces a HTML artifact that contains a HTML file that contains a script which uses XHR calls to interact with the Argo Server API.
* The attacker emails the deep-link to the artifact to their victim. The victim opens the link, the script starts running.

As the script has access to the Argo Server API (as the victim), so may do the following (if the victim may):

* Read information about the victim’s workflows.
* Create or delete workflows.

Notes:

* The attacker must be an insider: they must have access to the same cluster as the victim and must already be able to run their own workflows. 
* The attacker must have an understanding of the victim’s system. They won’t be able to repeatedly probe due to the social engineering  aspect.
* The attacker is likely leave an audit trail.

We have seen no evidence of this in the wild. While the impact is high, it is very hard to exploit. 

We urge all users to upgrade to the fixed versions. Disabling the Argo Server is the only known workaround. Note version 2.12 has been out of support for sometime. No fix is currently planned.
curl FTP path confusion leads to NIL byte out of bounds write
Advisory: GHSA-674j-7m97-j2p9
Aliases: CVE-2018-1000120
Published: 2022-05-14T00:58:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

curl can be coerced into writing a zero byte out of bounds.

This bug can trigger when curl is told to work on an FTP URL, with the setting to only issue a single CWD command (--ftp-method singlecwd or the libcurl alternative [CURLOPT_FTP_FILEMETHOD](https://curl.se/libcurl/c/CURLOPT_FTP_FILEMETHOD.html)).

curl then URL-decodes the given path, calls strlen() on the result and deducts the length of the file name part to find the end of the directory within the buffer. It then writes a zero byte on that index, in a buffer allocated on the heap.

If the directory part of the URL contains a `%00` sequence, the directory length might end up shorter than the file name path, making the calculation `size_t index = directory_len - filepart_len` end up with a huge index variable for where the zero byte gets stored: `heap_buffer[index] = 0`. On several architectures that huge index will wrap and work as a negative value, thus overwriting memory before the intended heap buffer.

By using different file part lengths and putting the string `%00` in different places in the URL, an attacker that can control what paths a curl-using application uses can write that zero byte on different indexes.
Improper Access Control in pyftpdlib
Advisory: GHSA-h4g7-8m7r-87r9
Aliases: CVE-2009-5012
Published: 2022-05-02T04:00:26Z

ftpserver.py in pyftpdlib before 0.5.2 does not require the l permission for the MLST command, which allows remote authenticated users to bypass intended access restrictions and list the root directory via an FTP session.
DotNetNuke Default Machine Key Exposure
Advisory: GHSA-grw3-hjjm-5cjm
Aliases: CVE-2008-6540
Published: 2022-05-14T02:38:47Z

DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-47wc-p5cp-w7pw
Aliases: CVE-2019-10405
Published: 2022-05-24T22:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
Improper Restriction of XML External Entity Reference in Apache ActiveMQ
Advisory: GHSA-4vhf-2hv7-8mrx
Aliases: CVE-2014-3600
Published: 2022-05-14T01:14:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
Authentication Bypass in Apache Tomcat
Advisory: GHSA-q9xf-jwr4-v445
Aliases: CVE-2011-1184
Published: 2022-05-14T01:17:02Z

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
Improper Input Validation in Jenkins
Advisory: GHSA-qf38-f2fr-q4x9
Aliases: CVE-2018-1999002
Published: 2022-05-13T01:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
Insufficient Verification of Data Authenticity in Async Http Client
Advisory: GHSA-8h53-fjgg-g42g
Aliases: CVE-2013-7397
Published: 2022-05-13T01:12:18Z

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.
IPython vulnerable to cross site request forgery (CSRF)
Advisory: GHSA-7fc2-rm35-2pp7
Aliases: CVE-2015-5607
Published: 2022-05-17T00:35:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

IPython (Interactive Python) is a command shell. Cross-site request forgery in the REST API is possible in in IPython 2 and 3. Versions 2.4.1 and 3.2.3 contain patches.
http before 0.13.3 vulnerable to header injection
Advisory: GHSA-4rgh-jx4f-qfcq
Aliases: CVE-2020-35669
Published: 2022-05-24T17:37:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in the http package before 0.13.3 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request via HTTP header injection. This issue has been addressed in commit abb2bb182 by validating request methods.
Access of Resource Using Incompatible Type in Facebook Hermes
Advisory: GHSA-f5x2-xv93-4p23
Aliases: CVE-2020-1911
Published: 2022-05-24T17:27:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A type confusion vulnerability when resolving properties of JavaScript objects with specially-crafted prototype chains in Facebook Hermes prior to commit fe52854cdf6725c2eaa9e125995da76e6ceb27da allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Insufficient Session Expiration in Jenkins
Advisory: GHSA-742j-jcfr-23w3
Aliases: CVE-2019-1003049
Published: 2022-05-13T01:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.
Spring Framework Inefficient Regular Expression Complexity
Advisory: GHSA-wjjr-h4wh-w6vv
Aliases: CVE-2009-1190
Published: 2022-05-02T03:22:35Z

Algorithmic complexity vulnerability in the java.util.regex.Pattern.compile method in Sun Java Development Kit (JDK) before 1.6, when used with spring.jar in SpringSource Spring Framework 1.1.0 through 2.5.6 and 3.0.0.M1 through 3.0.0.M2 and dm Server 1.0.0 through 1.0.2, allows remote attackers to cause a denial of service (CPU consumption) via serializable data with a long regex string containing multiple optional groups, a related issue to CVE-2004-2540.
Moodle XSS Vulnerability
Advisory: GHSA-wm4w-8vc6-2j4h
Aliases: CVE-2019-3810
Published: 2022-05-13T01:05:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The /userpix/ page did not escape users' full names, which are included as text when hovering over profile images. Note this page is not linked to by default and its access is restricted.
Cross-site Scripting in Graylog
Advisory: GHSA-435g-r2m8-gjvm
Aliases: CVE-2018-11651
Published: 2022-05-14T03:15:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Graylog before v2.4.4 has an XSS security issue with unescaped text in dashboard names, related to components/dashboard/Dashboard.jsx, components/dashboard/EditDashboardModal.jsx, and pages/ShowDashboardPage.jsx.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat
Advisory: GHSA-8wch-9gcg-v2pr
Aliases: CVE-2009-2902
Published: 2022-05-02T03:39:48Z

Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
ChakraCore RCE Vulnerability
Advisory: GHSA-67f9-qmg7-fmcq
Aliases: CVE-2018-0874
Published: 2022-05-13T01:18:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
ChakraCore RCE Vulnerability
Advisory: GHSA-f7p4-fmmh-4p8x
Aliases: CVE-2016-3390
Published: 2022-05-14T02:23:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript engine, aka "Scripting Engine Memory Corruption Vulnerability."
TYPO3 Open redirect vulnerability in the Access tracking mechanism 
Advisory: GHSA-7gxq-5qqc-v3fc
Aliases: CVE-2013-1843
Published: 2022-05-17T05:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-c45w-p293-7cv6
Aliases: CVE-2019-7945
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to modify currency symbols can inject malicious javascript.
dhowden tag panic due to out-of-bounds read
Advisory: GHSA-27mh-3343-6hg5
Aliases: CVE-2020-29244
Published: 2022-05-24T17:37:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
Rack-Cache caches sensitive headers
Advisory: GHSA-hrp6-w4v2-8737
Aliases: CVE-2012-2671
Published: 2022-05-17T05:05:40Z

The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.
Aubio Divide-By-Zero DoS vulnerability in new_aubio_source_wavread function
Advisory: GHSA-vcwx-8mqh-2557
Aliases: CVE-2017-17054
Published: 2022-05-17T00:14:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

In aubio 0.4.6, a divide-by-zero error exists in the function `new_aubio_source_wavread()` in source_wavread.c, which may lead to DoS when playing a crafted audio file.
Aubio is vulnerable to out of bound read when samplerate > 50kHz
Advisory: GHSA-3x58-8qmv-wqw5
Aliases: CVE-2018-14523
Published: 2022-05-13T01:49:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in aubio 0.4.6. A buffer over-read can occur in `new_aubio_pitchyinfft` in `pitch/pitchyinfft.c` when the samplerate of the input file is larger than 50kHz.
Stored XSS vulnerability in Description Column Plugin
Advisory: GHSA-qxrx-m6v6-m767
Aliases: CVE-2020-2266
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Description Column Plugin 1.3 and earlier does not escape the job description in the column tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Session fixation vulnerability in Jenkins
Advisory: GHSA-4wr9-2xc6-jmg5
Aliases: CVE-2021-21671
Published: 2022-05-24T19:06:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier does not invalidate the existing session on login. This allows attackers to use social engineering techniques to gain administrator access to Jenkins.

This vulnerability was introduced in Jenkins 2.266 and LTS 2.277.1.

Jenkins 2.300, LTS 2.289.2 invalidates the existing session on login.

In case of problems, administrators can choose a different implementation by setting the [Java system property `hudson.security.SecurityRealm.sessionFixationProtectionMode`](https://www.jenkins.io/doc/book/managing/system-properties/#hudson-security-securityrealm-sessionfixationprotectionmode) to `2`, or disable the fix entirely by setting that system property to `0`.
Apache Tomcat Does Not Properly Handle Empty Requests
Advisory: GHSA-qrj4-rmqg-4hcp
Aliases: CVE-2007-6286
Published: 2022-05-01T18:41:17Z

Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
insert_slice_clone can double drop if Clone panics.
Advisory: GHSA-68p4-pjpf-xwcq
Aliases: CVE-2021-26954
Published: 2022-05-24T17:41:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected versions of this crate used ptr::copy when inserting into the middle of a Vec. When ownership was temporarily duplicated during this copy, it calls the clone method of a user provided element.

This issue can result in an element being double-freed if the clone call panics.

Commit `20cb73d` fixed this issue by adding a set_len(0) call before operating on the vector to avoid dropping the elements during a panic.
Apache TomEE console vulnerable to Cross-site Scripting
Advisory: GHSA-fg44-w3fr-hgxv
Aliases: CVE-2018-8031
Published: 2022-05-14T01:30:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This issue can be mitigated by removing the application after TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upgrading to TomEE 7.0.5. This issue is resolved in this commit: b8bbf50c23ce97dd64f3a5d77f78f84e47579863.
Deserialization of Untrusted Data in Groovy
Advisory: GHSA-xphj-m9cc-8fmq
Aliases: CVE-2016-6814
Published: 2022-05-13T01:25:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.
GeoServer allows SSRF via the option for setting a proxy host
Advisory: GHSA-rr33-j5p5-ppf8
Aliases: CVE-2021-40822
Published: 2022-05-03T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.
PharStreamWrapper for Typo3 unsafe deserialization vulnerability
Advisory: GHSA-3hxw-g85p-qgxm
Aliases: CVE-2019-11830
Published: 2022-05-24T16:45:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stub parsing, which allows attackers to bypass a deserialization protection mechanism.
Stored XSS vulnerability in Pipeline Maven Integration Plugin via unescaped display name
Advisory: GHSA-hq2h-9mc3-h6w2
Aliases: CVE-2020-2256
Published: 2022-05-24T17:28:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Pipeline Maven Integration Plugin 3.9.2 and earlier does not escape the upstream job’s display name shown as part of a build cause.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Pipeline Maven Integration Plugin 3.9.3 escapes upstream job names in build causes.
RubyGems Deserialization of Untrusted Data vulnerability
Advisory: GHSA-qj2w-mw2r-pv39
Aliases: CVE-2018-1000074
Published: 2022-05-14T01:01:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack requires the victim to run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability is fixed in 2.7.6.
Deserialization of Untrusted Data in Beaker
Advisory: GHSA-3cwm-7jmm-774w
Aliases: CVE-2013-7489
Published: 2022-05-05T00:29:41Z

The Beaker library through 1.11.0 for Python is affected by deserialization of untrusted data, which could lead to arbitrary code execution.