aswin1906/github-advisory-2022 huggingface dataset:
Shopware Insecure Deserialization Vulnerability
Advisory: GHSA-rf8f-hqjv-986p
Aliases: CVE-2019-12799
Published: 2022-05-24T16:48:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In createInstanceFromNamedArguments in Shopware through 5.6.x, a crafted web request can trigger a PHP object instantiation vulnerability, which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.
CSRF vulnerability in Jenkins Config File Provider Plugin allows deleting configuration files
Advisory: GHSA-998m-f2x3-jjq4
Aliases: CVE-2021-21644
Published: 2022-05-24T17:48:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Config File Provider Plugin 3.7.0 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to delete configuration files corresponding to an attacker-specified ID.

This is due to an incomplete fix of [SECURITY-938](https://www.jenkins.io/security/advisory/2018-09-25/#SECURITY-938).

Config File Provider Plugin 3.7.1 requires POST requests for the affected HTTP endpoint.
Cross-site Scripting in Jenkins Core
Advisory: GHSA-x3rc-cxv7-6xp6
Aliases: CVE-2017-17383
Published: 2022-05-14T04:04:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form, as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin, aka SECURITY-624.
dhowden tag panic due to out-of-bounds read
Advisory: GHSA-9wm7-rc47-g56m
Aliases: CVE-2020-29243
Published: 2022-05-24T17:37:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via `readAPICFrame` due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
OpenStack Swift Discloses Secret URLs to Timing Attack
Advisory: GHSA-cf9m-q836-vf26
Aliases: CVE-2014-0006
Published: 2022-05-17T04:50:15Z

The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.
Publify Incorrect Authorization
Advisory: GHSA-79m3-q3wh-c3qm
Aliases: CVE-2022-0574
Published: 2022-05-17T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Improper Access Control in GitHub repository publify/publify prior to 9.2.8. Anonymous users can't view but can leave comments on an article in draft mode.
Snipe-IT XSS Vulnerability 
Advisory: GHSA-fx98-8w93-4mxr
Aliases: CVE-2019-10118
Published: 2022-05-14T01:14:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user's last name in the API.
direct_mail for Typo3 sensitive data exposure
Advisory: GHSA-j2w4-45qm-r674
Aliases: CVE-2019-16698
Published: 2022-05-24T16:58:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.
Asciidoctor Infinite Loop vulnerability
Advisory: GHSA-qc9p-mjxm-j2wj
Aliases: CVE-2018-18385
Published: 2022-05-13T01:50:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Asciidoctor in versions < 1.5.8 allows remote attackers to cause a denial of service (infinite loop). The loop was caused by the fact that `Parser.next_block` was not exhausting all the lines in the reader as the while loop expected it would. This was happening because the regular expression that detects any list was not agreeing with the regular expression that detects a specific list type. So the line kept getting pushed back onto the reader, hence causing the loop.
Improper Certificate Validation in apache HttpClient
Advisory: GHSA-3832-9276-x7gf
Aliases: CVE-2012-5783
Published: 2022-05-13T01:10:34Z

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Stored XSS vulnerability in Jenkins Build With Parameters Plugin
Advisory: GHSA-xjrg-6fv9-6rjg
Aliases: CVE-2021-21628
Published: 2022-05-24T17:45:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Build With Parameters Plugin 1.5.1 escapes parameter names and descriptions.
GraniteDS Insecure Deserialization
Advisory: GHSA-vx9j-rvmj-jc32
Aliases: CVE-2017-3200
Published: 2022-05-13T01:28:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The ability to exploit this vulnerability depends on the availability of classes in the class path that make use of deserialization. A remote attacker with the ability to spoof or control information may be able to send serialized Java objects with pre-set properties that result in arbitrary code execution when deserialized.
Stored XSS vulnerability in Jenkins Sonargraph Integration Plugin
Advisory: GHSA-f799-hfg3-48jp
Aliases: CVE-2020-2201
Published: 2022-05-24T17:22:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Sonargraph Integration Plugin 3.0.0 and earlier does not escape the file path for the Log file field form validation.

This results in a stored cross-site scripting (XSS) vulnerability that can be exploited by users with Job/Configure permission.

Sonargraph Integration Plugin 3.0.1 escapes the affected part of the error message.
Python Swift client is vulnerable to Missing SSL Certificate Check
Advisory: GHSA-p3xv-97g8-4wmj
Aliases: CVE-2013-6396
Published: 2022-05-17T04:52:37Z

The OpenStack Python client library for Swift (python-swiftclient) from 1.0 before 2.0.2 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-vx2g-f45p-j674
Aliases: CVE-2019-7867
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to manage orders and order status.
karo Metacharacter Handling Remote Command Execution
Advisory: GHSA-qfwq-chf4-jvwg
Aliases: CVE-2014-10075
Published: 2022-05-14T01:49:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The karo gem through 2.5.2 for Ruby allows Remote command injection via the host field.

A flaw in `db.rb` is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands.

In particular lines 76 and 95 (as of `2014-06-01`) pass unsanitized user supplied input to the command line. 

```
73-      host = "{@configuration["user"]}@{@configuration["host"]}"
74-      cmd  = "ssh #{host} cat {server_db_config_file}"
75-
76:      server_db_config_output = `{cmd}`
79-
--
89- def drop_and_create_local_database(local_db_config)
90-      command = case local_db_config["adapter"]
91-      when "mysql2"
93-      when "postgresql"
95-          dropdb -h #{local_db_config["host"]} -U #{local_db_config["username"]} --if-exists #{local_db_config["database"]}
```

If this gem is used in the context of a rails application malicious input could lead to remote command injection. As of version 2.5.2 the affected code lines have not changed.
XXE vulnerability in Jenkins Liquibase Runner Plugin
Advisory: GHSA-xx7g-f287-f9fq
Aliases: CVE-2020-2284
Published: 2022-05-24T17:29:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Liquibase Runner Plugin 1.4.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to provide Liquibase changesets evaluated by the plugin to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Liquibase Runner Plugin 1.4.7 no longer parses Liquibase changesets.
Improper Link Resolution Before File Access in pip
Advisory: GHSA-4gv5-qhvr-36vv
Aliases: CVE-2013-1888
Published: 2022-05-13T01:11:25Z

pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
Insecure Default Initialization of Resource in Pivotal Spring Web Flow
Advisory: GHSA-q4v9-qjmw-j7vf
Aliases: CVE-2017-8039
Published: 2022-05-13T01:47:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in Pivotal Spring Web Flow through 2.4.5. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. NOTE: this issue exists because of an incomplete fix for CVE-2017-4971.
Improper Encoding or Escaping of Output in Jenkins Configuration as Code Plugin
Advisory: GHSA-5r6p-p9r6-r326
Aliases: CVE-2019-10362
Published: 2022-05-24T16:51:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Jenkins Configuration as Code Plugin 1.24 and earlier did not escape values resulting in variable interpolation during configuration import when exporting, allowing attackers with permission to change Jenkins system configuration to obtain the values of environment variables.
Zenario CMS vulnerable to CSRF 
Advisory: GHSA-22cq-xxr9-jrrv
Aliases: CVE-2018-18420
Published: 2022-05-14T01:53:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery (CSRF) vulnerability was discovered in the 8.3 version of Zenario Content Management System via the `admin/organizer.ajax.php?path=zenario__content%2Fpanels%2Fcontent` URI.
ReDoS via crafted JSON input in GJSON
Advisory: GHSA-c9gm-7rfj-8w5h
Aliases: CVE-2021-42248
Published: 2022-05-25T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

GJSON <= 1.9.2 allows attackers to cause a redos via crafted JSON input.
Mortbay Jetty vulnerable to Cross-site scripting
Advisory: GHSA-8h77-9vh5-hw5g
Aliases: CVE-2007-5613
Published: 2022-05-01T18:35:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Cross-site scripting (XSS) vulnerability in Dump Servlet in Mortbay Jetty before 6.1.6rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters and cookies.
Observable Discrepancy in BouncyCastle
Advisory: GHSA-wrwf-pmmj-w989
Aliases: CVE-2017-13098
Published: 2022-05-13T01:14:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE (Java Cryptography Extension) for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application. This vulnerability is referred to as "ROBOT."
Improper Certificate Validation in Apache Netbeans
Advisory: GHSA-7c2m-vwxw-5qww
Aliases: CVE-2019-17560
Published: 2022-05-24T22:28:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. NetBeans releases before the Apache transition started may also be affected.
jquery-plugin-query-object contains prototype pollution vulnerability
Advisory: GHSA-q9xg-h756-8689
Aliases: CVE-2021-20083
Published: 2022-05-24T17:48:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicious user to inject properties into Object.prototype.
Command injection in workspace-tools
Advisory: GHSA-5875-m6jq-vf78
Aliases: CVE-2022-25865
Published: 2022-05-14T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package workspace-tools before 0.18.4 is vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
XML External Entity Reference in Apache Cayenne
Advisory: GHSA-85hw-w436-c725
Aliases: CVE-2018-11758
Published: 2022-05-14T02:02:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a malicious XML file, the attacker will be able to instruct the XML parser built into CayenneModeler to transfer files from a local machine to a remote machine controlled by the attacker. The cause of the issue is XML parser processing XML External Entity (XXE) declarations included in XML. The vulnerability is addressed in Cayenne by disabling XXE processing in all operations that require XML parsing.
Sup Code Injection vulnerability
Advisory: GHSA-5f2p-6vjv-2q2m
Aliases: CVE-2013-4478
Published: 2022-05-17T04:56:46Z

Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.
Jenkins PegDown Formatter Plugin has Cross-site Scripting vulnerability
Advisory: GHSA-922h-x9qv-2274
Aliases: CVE-2019-10374
Published: 2022-05-24T16:52:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

PegDown Formatter Plugin uses the PegDown library to implement support for rendering Markdown formatted descriptions in Jenkins. It advertises disabling of HTML to prevent cross-site scripting (XSS) as a feature.

PegDown Formatter Plugin does not prevent the use of `javascript:` scheme in URLs for links. This results in an XSS vulnerability exploitable by users able to configure entities with descriptions or similar properties that are rendered by the configured markup formatter.

As of publication of this advisory, there is no fix.
Passwords transmitted in plain text by Jenkins Artifactory Plugin
Advisory: GHSA-xqf6-5grh-6223
Aliases: CVE-2020-2165
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Jenkins Artifactory Plugin 3.6.0 and earlier stores Artifactory server passwords in its global configuration file `org.jfrog.hudson.ArtifactoryBuilder.xml` on the Jenkins controller as part of its configuration.

While the password is stored encrypted on disk since Artifactory Plugin 3.6.0, it is transmitted in plain text as part of the configuration form by Artifactory Plugin 3.6.0 and earlier. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Artifactory Plugin 3.6.1 transmits the password in its global configuration encrypted.
Session Fixation in ipsilon
Advisory: GHSA-376m-3rm2-9jm6
Aliases: CVE-2016-8638
Published: 2022-05-14T03:55:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users.  This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
Denial of service in Apache Struts
Advisory: GHSA-hrgc-54mv-58gv
Aliases: CVE-2012-4387
Published: 2022-05-17T01:42:17Z

Apache Struts 2.0.0 through 2.3.4 allows remote attackers to cause a denial of service (CPU consumption) via a long parameter name, which is processed as an OGNL expression.
ChakraCore RCE Vulnerability
Advisory: GHSA-v3xp-3wpq-rvhp
Aliases: CVE-2018-0860
Published: 2022-05-13T01:18:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0861, and CVE-2018-0866.
Incorrect Default Permissions in JetBrains Kotlin
Advisory: GHSA-cqj8-47ch-rvvq
Aliases: CVE-2020-29582
Published: 2022-05-24T17:40:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions.
Deserialization of Untrusted Data in NancyFX Nancy
Advisory: GHSA-mx3q-j2g2-5qxq
Aliases: CVE-2017-9785
Published: 2022-05-17T02:26:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.
Pion/DTLS contains buffer for inbound DTLS fragments with no limit
Advisory: GHSA-cx94-mrg9-rq4j
Aliases: CVE-2022-29189
Published: 2022-05-24T22:04:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact
A buffer that was used for inbound network traffic had no upper limit. Pion DTLS would buffer all network traffic from the remote user until the handshake completes or times out. An attacker could exploit this to cause excessive memory usage.

### Patches
Upgrade to Pion DTLS v2.1.4

### Workarounds
No workarounds available, upgrade to Pion DTLS v2.1.4

### References
Thank you to [Juho Nurminen](https://github.com/jupenur) and the Mattermost team for discovering and reporting this. 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Pion DTLS](http://github.com/pion/dtls)
* Email us at [team@pion.ly](mailto:team@pion.ly)
Improper Neutralization of CRLF Sequences in dio
Advisory: GHSA-jwpw-q68h-r678
Published: 2022-05-24T17:47:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The dio package prior to 5.0.0 for Dart allows CRLF injection if the attacker controls the HTTP method string, a different vulnerability than CVE-2020-35669.
ChakraCore RCE Vulnerability
Advisory: GHSA-p94c-r74j-43qg
Aliases: CVE-2016-3350
Published: 2022-05-14T02:23:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3377.
Improper Neutralization of Input During Web Page Generation in Jenkins Script Security Plugin
Advisory: GHSA-q87g-7mp5-765q
Aliases: CVE-2020-2190
Published: 2022-05-24T17:19:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Script Security Plugin 1.72 and earlier does not correctly escape pending or approved classpath entries on the In-process Script Approval page, resulting in a stored cross-site scripting vulnerability.
Apache Sling JCR ContentLoader XmlReader Arbitrary File Load
Advisory: GHSA-wjp3-4xcq-598p
Aliases: CVE-2012-3353
Published: 2022-05-14T03:46:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Apache Sling JCR ContentLoader 2.1.4 XmlReader used in the Sling JCR content loader module makes it possible to import arbitrary files in the content repository, including local files, causing potential information leaks. Users should upgrade to version 2.1.6 of the JCR ContentLoader
Improper Input Validation in Jenkins Script Security Plugin
Advisory: GHSA-qvmf-36h5-3f5v
Aliases: CVE-2020-2110
Published: 2022-05-24T17:08:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Sandbox protection in Jenkins Script Security Plugin 1.69 and earlier could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside of other annotations.
OctoPrint API Error Messages vulnerable to XSS
Advisory: GHSA-vcx4-fpmp-mvv6
Aliases: CVE-2021-32561
Published: 2022-05-24T19:02:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.
ChakraCore RCE Vulnerability
Advisory: GHSA-h5hw-qrrw-vfxg
Aliases: CVE-2018-0954
Published: 2022-05-13T01:18:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.
OS Command Injection in Jenkins
Advisory: GHSA-j472-mcq2-95p6
Aliases: CVE-2017-1000393
Published: 2022-05-14T01:04:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins 2.73.1 and earlier, 2.83 and earlier users with permission to create or configure agents in Jenkins could configure a launch method called 'Launch agent via execution of command on master'. This allowed them to run arbitrary shell commands on the master node whenever the agent was supposed to be launched. Configuration of this launch method now requires the Run Scripts permission typically only granted to administrators.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-87w9-x2c3-hrjj
Aliases: CVE-2013-4590
Published: 2022-05-14T01:10:35Z

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
LibreNMS SQL Injection
Advisory: GHSA-4fwh-r866-pvh9
Aliases: CVE-2018-20678
Published: 2022-05-14T01:14:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

LibreNMS through 1.47 allows SQL injection via the html/ajax_table.php sort[hostname] parameter, exploitable by authenticated users during a search.
Directory Traversal in Studio 42 elFinder
Advisory: GHSA-44p8-c3wv-f28r
Aliases: CVE-2018-9110
Published: 2022-05-13T01:06:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in `elFinder.class.php` with the `zipdl()` function that can allow a remote attacker to download files accessible by the web server process and delete files owned by the account running the web server process. NOTE: this issue exists because of an incomplete fix for CVE-2018-9109.
RubyGems Cross-site Scripting vulnerability
Advisory: GHSA-87qx-g5wg-mwmj
Aliases: CVE-2018-1000078
Published: 2022-05-14T01:01:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack requires the victim to browse to a malicious gem on a vulnerable gem server. This vulnerability is fixed in 2.7.6.
mixlib-archive Path Traversal vulnerability
Advisory: GHSA-98wx-cw86-c97x
Aliases: CVE-2017-1000026
Published: 2022-05-13T01:10:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable to a directory traversal attack allowing attackers to overwrite arbitrary files by using `..` in tar archive entries
Home Assistant Frontend XSS Vulnerability
Advisory: GHSA-7wfq-wmx2-3wr4
Aliases: CVE-2017-16782
Published: 2022-05-17T00:20:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS.
Node Connect Reflected Cross-Site Scripting in Sencha Labs Connect middleware
Advisory: GHSA-6w62-83g6-rfhj
Aliases: CVE-2013-7371
Published: 2022-05-05T00:29:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

node-connect before 2.8.2 has cross site scripting in Sencha Labs Connect middleware (vulnerability due to incomplete fix for CVE-2013-7370)

### Overview
Connect is a stack of middleware that is executed in order in each request.

The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".

Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.


### Example:
```
~ curl "localhost:3000" -d "_method=<script src=http://nodesecurity.io/xss.js></script>"
Cannot <SCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS></SCRIPT> /
```

### Recommendation

Update to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.

### Credit:
Sergio Arcos
CardGate Payments plugin for WooCommerce does not validate request origin
Advisory: GHSA-5pq5-9phv-q5j3
Aliases: CVE-2020-8819
Published: 2022-05-24T17:09:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

An issue was discovered in the CardGate Payments plugin through 3.1.15 for WooCommerce. Lack of origin authentication in the IPN callback processing function in cardgate/cardgate.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
omniauth-weibo-oauth2 included a code-execution backdoor inserted by a third party
Advisory: GHSA-vr22-43gj-rx3f
Aliases: CVE-2019-17268
Published: 2022-05-24T17:08:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.
Jenkins SaltStack Plugin allows attackers to capture credentials with a known credentials ID stored in Jenkins
Advisory: GHSA-cqp4-cv7h-7jp5
Aliases: CVE-2018-1999027
Published: 2022-05-14T01:09:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

An exposure of sensitive information vulnerability exists in Jenkins SaltStack Plugin 3.1.6 and earlier in SaltAPIBuilder.java, SaltAPIStep.java. SaltStack Plugin did not perform permission checks on methods implementing form validation. This allowed users with Overall/Read access to Jenkins to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins, and to cause Jenkins to submit HTTP requests to attacker-specified URLs. Additionally, these form validation methods did not require POST requests, resulting in a CSRF vulnerability. As of version 3.1.7, these form validation methods require POST requests and Overall/Administer permissions.
Robocode Arbitrary Code Execution
Advisory: GHSA-xh22-fw58-56pp
Aliases: CVE-2007-6382
Published: 2022-05-01T18:42:25Z

The Event Dispatch Thread in Robocode before 1.5.1 allows remote attackers to execute arbitrary Java code by using a robot to invoke the `SwingUtilities.invokeLater` method.
Jenkins Wall Display Plugin Cross-site Scripting vulnerability
Advisory: GHSA-hc34-f55m-rh3m
Aliases: CVE-2019-10376
Published: 2022-05-24T16:52:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Wall Display Master Project Plugin does not properly escape the `customTheme` query parameter, resulting in a reflected cross-site scripting vulnerability.

As of publication of this advisory, there is no fix.
Inadequate Encryption Strength in Apache CXF
Advisory: GHSA-7v5v-9v8r-w864
Aliases: CVE-2012-5575
Published: 2022-05-13T01:09:21Z

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
Improper input validation in Mort Bay Jetty
Advisory: GHSA-6jxp-7g74-2rc3
Aliases: CVE-2009-4611
Published: 2022-05-02T03:56:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator, related to (1) a string value in the Age parameter to the default URI for the Cookie Dump Servlet in test-jetty-webapp/src/main/java/com/acme/CookieDump.java under cookie/, (2) an alphabetic value in the A parameter to jsp/expr.jsp, or (3) an alphabetic value in the Content-Length HTTP header to an arbitrary application.
Jenkins HipChat Plugin allows credential capture due to incorrect authorization
Advisory: GHSA-w3f7-2qfw-348x
Aliases: CVE-2018-1000418
Published: 2022-05-13T01:18:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to send test notifications to an attacker-specified HipChat server with attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. As of version 2.2.1, this form validation method requires POST requests and Overall/Administer permissions.
CSRF vulnerability in Jenkins Database Plugin
Advisory: GHSA-jf9j-hx2j-m9xh
Aliases: CVE-2020-2240
Published: 2022-05-24T17:27:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Database Plugin 1.6 and earlier does not require POST requests for the database console, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to execute arbitrary SQL scripts.

Database Plugin 1.7 removes the database console.
RubyGems Regular Expression Denial of Service vulnerability
Advisory: GHSA-9j7m-rjqx-48vh
Aliases: CVE-2013-4287
Published: 2022-05-14T01:08:27Z

Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in `lib/rubygems/version.rb` in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.
Secret stored in plain text by Jenkins Parameterized Remote Trigger Plugin
Advisory: GHSA-wphq-j78p-fhgp
Aliases: CVE-2020-2239
Published: 2022-05-24T17:27:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Parameterized Remote Trigger Plugin 3.1.3 and earlier stores a secret unencrypted in its global configuration file `org.jenkinsci.plugins.ParameterizedRemoteTrigger.RemoteBuildConfiguration.xml` on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.

Parameterized Remote Trigger Plugin 3.1.4 stores the secret encrypted once its configuration is saved again.
Magento 2 Community Edition Unsafe File Upload
Advisory: GHSA-j837-vm6w-6qcv
Aliases: CVE-2019-7861
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Insufficient server-side validation of user input could allow an attacker to bypass file upload restrictions in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Denial of service in ASP.NET Core
Advisory: GHSA-23cv-jh4v-vffm
Aliases: CVE-2020-0602
Published: 2022-05-24T17:06:16Z

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
Arbitrary file read in ginadmin
Advisory: GHSA-5824-6jfv-xr3r
Aliases: CVE-2022-30428
Published: 2022-05-26T00:01:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. A [patch](https://github.com/gphper/ginadmin/commit/726109f01ad23523715f36f7d272958064666a30) is available on the `master` branch of the repository.
RCE vulnerability in ElasticBox Jenkins Kubernetes CI/CD Plugin
Advisory: GHSA-9r3h-wm3x-v245
Aliases: CVE-2020-2211
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to ElasticBox Jenkins Kubernetes CI/CD Plugin’s build step.
Missing permission checks in Jenkins Config File Provider Plugin allow enumerating configuration file IDs
Advisory: GHSA-2959-fj73-hm8p
Aliases: CVE-2021-21645
Published: 2022-05-24T17:48:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Config File Provider Plugin 3.7.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate configuration file IDs.

An enumeration of configuration file IDs in Config File Provider Plugin 3.7.1 requires the appropriate permissions.
phpBB Server-Side Request Forgery Vulnerability
Advisory: GHSA-jhm9-h84h-rw83
Aliases: CVE-2020-8226
Published: 2022-05-24T17:26:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

A vulnerability exists in phpBB <v3.2.10 and <v3.3.1 which allowed remote image dimensions check to be used to SSRF.
Stored XSS vulnerability in Jenkins upstream cause
Advisory: GHSA-g4j6-m3m3-crw8
Aliases: CVE-2020-2221
Published: 2022-05-24T17:23:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the upstream job's display name shown as part of a build cause, resulting in a stored cross-site scripting vulnerability.

Jenkins 2.245, LTS 2.235.2 escapes the job display name.
Stored XSS vulnerability in Jenkins Deployer Framework Plugin
Advisory: GHSA-cfvw-84vq-43mx
Aliases: CVE-2020-2227
Published: 2022-05-24T17:23:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Deployer Framework Plugin is a framework plugin allowing other plugins to provide a way to deploy artifacts. Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to provide the location.

The exploitability of this vulnerability depends on the specific implementation using Deployer Framework Plugin. The Jenkins security team is not aware of any exploitable implementation.

Deployer Framework Plugin 1.3 escapes the URL.
Insecure cookie sharing in Hawtio
Advisory: GHSA-m4j5-hgqq-5jf2
Aliases: CVE-2017-2589
Published: 2022-05-13T01:36:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
Missing Cryptographic Step in cassproject
Advisory: GHSA-7qcx-4p32-qcmx
Aliases: CVE-2022-29229
Published: 2022-05-25T19:34:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

### Impact
CaSS Library, (npm:cassproject) has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, which uses a method that expects e2e cryptographic security of authorization credentials.

### Patches
The issue has been patched in 1.5.8, however, the vulnerable accounts are only resecured when the user next logs in using standalone authentication, as the data required to resecure the account is not available to the server.

### Workarounds
The issue may be mitigated by using SSO or client side certificates to log in. Please note that SSO and client side certificate authentication does not have this expectation of no-knowledge credential access, and cryptographic keys are available to the server administrator.

### References
There are no references at this time.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CaSS Project Github](https://github.com/cassproject/CASS/issues)
* Email us at [the CaSS Project](mailto:cass@eduworks.com)
Matrix Synapse Security Filtering Flaw
Advisory: GHSA-v8wm-g9f2-xjv4
Aliases: CVE-2018-12291
Published: 2022-05-13T01:49:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The `on_get_missing_events` function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly.
Jenkins subject to Cross-site Scripting
Advisory: GHSA-q5f8-fxrx-pw6f
Aliases: CVE-2013-0328
Published: 2022-05-05T02:48:48Z

Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Directory Traversal in pyftpdlib
Advisory: GHSA-f8wg-36r9-7f4q
Aliases: CVE-2007-6736
Published: 2022-05-01T18:45:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Python FTP server library provides a high-level portable interface to easily write very efficient, scalable and asynchronous FTP servers with Python. Multiple directory traversal vulnerabilities in FTPServer.py in pyftpdlib before 0.2.0 allow remote authenticated users to access arbitrary files and directories via a .. (dot dot) in a (1) LIST, (2) STOR, or (3) RETR command.
Jenkins Subversion Plugin Cross-Site Request Forgery vulnerability
Advisory: GHSA-hrwc-pqfm-g6qf
Aliases: CVE-2017-1000085
Published: 2022-05-17T00:29:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Subversion Plugin connects to a user-specified Subversion repository as part of form validation (e.g. to retrieve a list of tags). This functionality improperly checked permissions, allowing any user with Item/Build permission (but not Item/Configure) to connect to any web server or Subversion server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery attacks. As of version 2.9, this functionality properly checks permissions and is only available via POST.
Dolibarr ERP and CRM contain Cross-site Scripting Vulnerability
Advisory: GHSA-6fw8-vf2x-4wpm
Aliases: CVE-2015-3935
Published: 2022-05-17T03:29:57Z

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search (`search_nom`) field to (1) `htdocs/societe/societe.php` or (2) `htdocs/societe/admin/societe.php`.
CSRF vulnerability in Jenkins Sounds Plugin allow OS command execution
Advisory: GHSA-x37x-3fw2-5qw2
Aliases: CVE-2020-2098
Published: 2022-05-24T17:06:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins.
Improper Neutralization of Special Elements used in a Command in FitNesse Wiki
Advisory: GHSA-mpx3-mx2p-9gv3
Aliases: CVE-2014-1216
Published: 2022-05-17T04:46:05Z

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.
OpenStack Keystone Improper Authentication vulnerability
Advisory: GHSA-mf98-r2gf-2x3w
Aliases: CVE-2012-4456
Published: 2022-05-14T01:58:49Z

The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services.
Injection in Apache NiFi
Advisory: GHSA-jrcc-7jf5-3pxg
Aliases: CVE-2017-5636
Published: 2022-05-17T00:26:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, the proxy chain serialization/deserialization is vulnerable to an injection attack where a carefully crafted username could impersonate another user and gain their permissions on a replicated request to another node.
Incorrect default pattern in Jenkins Audit Trail Plugin
Advisory: GHSA-7v9p-34r2-q668
Aliases: CVE-2020-2288
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Audit Trail Plugin uses regular expressions to match requested URLs whose dispatch should be logged.

In Audit Trail Plugin 3.6 and earlier, the default regular expression pattern could be bypassed in many cases by adding a suffix to the URL that would be ignored during request handling.

Audit Trail Plugin 3.7 changes the default regular expression pattern so that it allows for arbitrary suffixes. It automatically will replace previous default patterns with the new, more complete default pattern.

Additionally, an administrative monitor is shown if a user-specified pattern is found to be bypassable through crafted URLs and form validation was improved to recognize patterns that would not match requests with arbitrary suffixes.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-pgxv-h967-fw2q
Aliases: CVE-2018-1999005
Published: 2022-05-13T01:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in BuildTimelineWidget.java, BuildTimelineWidget/control.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
Agent-to-controller security bypass in Jenkins Squash TM Publisher (Squash4Jenkins) Plugin allows writing arbitrary files
Advisory: GHSA-h648-gj34-5x4r
Aliases: CVE-2021-43578
Published: 2022-05-24T19:20:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Jenkins Squash TM Publisher (Squash4Jenkins) Plugin 1.0.0 and earlier implements an agent-to-controller message that does not implement any validation of its input, allowing attackers able to control agent processes to replace arbitrary files on the Jenkins controller file system with an attacker-controlled JSON string.
Passwords stored in plain text by Jenkins Artifactory Plugin
Advisory: GHSA-4q47-ph87-fq4f
Aliases: CVE-2020-2164
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Artifactory Plugin 3.5.0 and earlier stores its Artifactory server password in plain text in the global configuration file `org.jfrog.hudson.ArtifactoryBuilder.xml`. This password can be viewed by users with access to the Jenkins controller file system.

Artifactory Plugin 3.6.0 now stores the Artifactory server password encrypted. This change is effective once the global configuration is saved the next time.
Cezerin Unauthorized Acces
Advisory: GHSA-6pq6-crw9-522h
Aliases: CVE-2019-18608
Published: 2022-05-24T17:00:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or shipping fee) by adding additional attributes to user-input during the PUT `/ajax/cart` operation for a checkout, because of `getValidDocumentForUpdate` in `api/server/services/orders/orders.js`.
ChakraCore RCE Vulnerability
Advisory: GHSA-vr4j-gj8q-m89v
Aliases: CVE-2016-7189
Published: 2022-05-14T02:22:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Remote Code Execution Vulnerability."