aswin1906/github-advisory-2022 huggingface dataset:
fastify-bearer-auth vulnerable to Timing Attack Vector
Advisory: GHSA-376v-xgjx-7mfr
Aliases: CVE-2022-31142
Published: 2022-07-15T19:14:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact

fastify-bearer-auth does not securely use crypto.timingSafeEqual. A malicious attacker could estimate the length of one valid bearer token. According to the corresponding RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack.

All versions of fastify-bearer-auth are also affected.

### Patches

We released:

* v8.0.1 with a fix for the Fastify v4 line
* v7.0.2 with a fix for the Fastify v3 line

### Workarounds

There are no workarounds. Update your dependencies.

### References

https://hackerone.com/reports/1633287

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/fastify/fastify-bearer-auth](https://github.com/fastify/fastify-bearer-auth)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Password stored in plain text by Jenkins RQM Plugin
Advisory: GHSA-m59q-vgq9-75cr
Aliases: CVE-2022-34809
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

RQM Plugin 2.8 and earlier stores a password unencrypted in its global configuration file `net.praqma.jenkins.rqm.RqmBuilder.xml` on the Jenkins controller as part of its configuration.

This password can be viewed by users with access to the Jenkins controller file system.
Missing permission checks in Jenkins XebiaLabs XL Release Plugin allow enumerating credentials IDs
Advisory: GHSA-7c8f-m389-4xjc
Aliases: CVE-2022-34779
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

XebiaLabs XL Release Plugin 22.0.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in XebiaLabs XL Release Plugin 22.0.1 requires Overall/Administer permission.
Missing Authorization in Jenkins Failed Job Deactivator Plugin
Advisory: GHSA-hcjr-6jq3-392p
Aliases: CVE-2022-34818
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier does not perform permission checks in several views and HTTP endpoints, allowing attackers with Overall/Read permission to disable jobs.
Temporary Directory Hijacking to Local Privilege Escalation Vulnerability in org.springframework.boot:spring-boot
Advisory: GHSA-cm59-pr5q-cw85
Aliases: CVE-2022-27772
Published: 2022-07-11T20:59:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

spring-boot versions prior to version `v2.2.11.RELEASE` was vulnerable to temporary directory hijacking. This vulnerability impacted the `org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir` method.

The vulnerable method is used to create a work directory for embedded web servers such as Tomcat and Jetty. The directory contains configuration files, JSP/class files, etc. If a local attacker got the permission to write in this directory, they could completely take over the application (ie. local privilege escalation).

#### Impact Location

This vulnerability impacted the following source location:

```java
	/**
	 * Return the absolute temp dir for given web server.
	 * @param prefix server name
	 * @return the temp dir for given server.
	 */
	protected final File createTempDir(String prefix) {
		try {
			File tempDir = File.createTempFile(prefix + ".", "." + getPort());
			tempDir.delete();
			tempDir.mkdir();
			tempDir.deleteOnExit();
			return tempDir;
		}
```
\- https://github.com/spring-projects/spring-boot/blob/ce70e7d768977242a8ea6f93188388f273be5851/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/AbstractConfigurableWebServerFactory.java#L165-L177

This vulnerability exists because `File.mkdir` returns `false` when it fails to create a directory, it does not throw an exception. As such, the following race condition exists:

```java
File tmpDir =File.createTempFile(prefix + ".", "." + getPort()); // Attacker knows the full path of the file that will be generated
// delete the file that was created
tmpDir.delete(); // Attacker sees file is deleted and begins a race to create their own directory before Jetty.
// and make a directory of the same name
// SECURITY VULNERABILITY: Race Condition! - Attacker beats java code and now owns this directory
tmpDir.mkdirs(); // This method returns 'false' because it was unable to create the directory. No exception is thrown.
// Attacker can write any new files to this directory that they wish.
// Attacker can read any files created by this process.
```

### Prerequisites

This vulnerability impacts Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.

### Patches

This vulnerability was inadvertently fixed as a part of this patch: https://github.com/spring-projects/spring-boot/commit/667ccdae84822072f9ea1a27ed5c77964c71002d

This vulnerability is patched in versions `v2.2.11.RELEASE` or later.

### Workarounds

Setting the `java.io.tmpdir` system environment variable to a directory that is exclusively owned by the executing user will fix this vulnerability for all operating systems.
Jenkins Matrix Reloaded Plugin vulnerable to CSRF
Advisory: GHSA-4v5c-5v6c-37pj
Aliases: CVE-2022-34789
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not require POST requests for an HTTP endpoint, resulting in a cross-site request forgery (CSRF) vulnerability. This vulnerability allows attackers to rebuild previous matrix builds.
XML External Entity Reference in Jenkins Recipe Plugin
Advisory: GHSA-rm23-6mwv-8q9q
Aliases: CVE-2022-34793
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Jenkins Recipe Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Feehi CMS arbitrary code execution via crafted PHP file
Advisory: GHSA-jxg9-2ch7-f552
Aliases: CVE-2022-34971
Published: 2022-07-28T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP file.
Apache MXNet vulnerable to potential denial-of-service by excessive resource consumption
Advisory: GHSA-xxj3-55p6-xg3h
Aliases: CVE-2022-24294
Published: 2022-07-25T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator name that would cause the regular expression evaluation to use excessive resources to attempt a match. This issue affects Apache MXNet versions prior to 1.9.1.
UnsafeAccessor 1.4.0 until 1.7.0 has no security checking for UnsafeAccess.getInstance()
Advisory: GHSA-cr6p-23cf-w9g9
Aliases: CVE-2022-31139
Published: 2022-07-12T22:15:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

### Overview

Affected versions have no limit to using unsafe-accessor. Can be ignored if `SecurityCheck.AccessLimiter` not setup

### Details

If UA was loaded as a named module, the internal data of UA will be protected by JVM and others can only access UA via UA's standard api.
Main application can setup `SecurityCheck.AccessLimiter` for UA to limit accesses to UA.
Untrusted code can access UA without lmitation in affected versions even UA was loaded as a named module.

### References

[The commit to fix](https://github.com/Karlatemp/UnsafeAccessor/commit/4ef83000184e8f13239a1ea2847ee401d81585fd)
Missing permission checks in Jenkins XebiaLabs XL Release Plugin allow capturing credentials
Advisory: GHSA-2588-cx6w-6vm6
Aliases: CVE-2022-34781
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Missing permission checks in Jenkins XebiaLabs XL Release Plugin 22.0.0 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. XebiaLabs XL Release Plugin 22.0.1 requires Overall/Administer permission for the affected form validation methods.
Scrapy before v2.6.2 and v1.8.3 vulnerable to one proxy sending credentials to another
Advisory: GHSA-9x8m-2xpf-crp3
Published: 2022-07-29T22:26:57Z

### Impact

When the [built-in HTTP proxy downloader middleware](https://docs.scrapy.org/en/2.6/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpproxy) processes a request with `proxy` metadata, and that `proxy` metadata includes proxy credentials, the built-in HTTP proxy downloader middleware sets the `Proxy-Authentication` header, but only if that header is not already set.

There are third-party proxy-rotation downloader middlewares that set different `proxy` metadata every time they process a request.

Because of request retries and redirects, the same request can be processed by downloader middlewares more than once, including both the built-in HTTP proxy downloader middleware and any third-party proxy-rotation downloader middleware.

These third-party proxy-rotation downloader middlewares could change the `proxy` metadata of a request to a new value, but fail to remove the `Proxy-Authentication` header from the previous value of the `proxy` metadata, causing the credentials of one proxy to be leaked to a different proxy.

If you rotate proxies from different proxy providers, and any of those proxies requires credentials, you are affected, unless you are handling proxy rotation as described under **Workarounds** below. If you use a third-party downloader middleware for proxy rotation, the same applies to that downloader middleware, and installing a patched version of Scrapy may not be enough; patching that downloader middlware may be necessary as well.

### Patches

Upgrade to Scrapy 2.6.2.

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.2 is not an option, you may upgrade to Scrapy 1.8.3 instead.

### Workarounds

If you cannot upgrade, make sure that any code that changes the value of the `proxy` request meta also removes the `Proxy-Authorization` header from the request if present.

### For more information

If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy/scrapy/issues)
* [Email us](mailto:opensource@zyte.com)
node-import `params` argument can be controlled by users without any sanitization
Advisory: GHSA-pc62-cq5x-3j5g
Aliases: CVE-2020-7678
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This affects all versions of package node-import. The `params` argument of module function can be controlled by users without any sanitization. This is then provided to the “eval” function located in line 79 in the index file `index.js`.
Out-of-bounds Read can lead to client side denial of service
Advisory: GHSA-m7gr-5w5g-36jf
Aliases: CVE-2022-34037
Published: 2022-07-23T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) on the client side via a crafted URI.

According to the maintainer, the bug only affects the client side of the request and cannot cause a denial of service on the server.
automattic/mongoose vulnerable to Prototype pollution via Schema.path
Advisory: GHSA-f825-f98c-gj3g
Aliases: CVE-2022-2564
Published: 2022-07-29T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The `Schema.path()` function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.
Cleartext Transmission of Sensitive Information in Jenkins OpsGenie Plugin
Advisory: GHSA-7r65-pjgv-h2h9
Aliases: CVE-2022-34804
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins OpsGenie Plugin 1.9 and earlier transmits API keys in plain text as part of the global Jenkins configuration form and job configuration forms, potentially resulting in their exposure.
Duplicate Advisory GHSA-hrgx-p36p-89q4
Advisory: GHSA-qv6h-pcf2-2w3g
Aliases: CVE-2022-36408
Published: 2022-07-23T00:00:16Z
Withdrawn: 2022-08-05T18:57:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Duplicate Advisory

This advisory is a duplicate of GHSA-hrgx-p36p-89q4. This link is maintained to preserve external references.

## Original Description

PrestaShop 1.6.0.10 through 1.7.x before 1.7.8.2 allows remote attackers to execute arbitrary code, aka a "previously unknown vulnerability chain" related to SQL injection, as exploited in the wild in July 2022.
KubeEdge CloudCore Router memory exhaustion vulnerability
Advisory: GHSA-qpx3-9565-5xwm
Aliases: CVE-2022-31078
Published: 2022-07-11T21:04:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

### Impact
The CloudCore Router does not impose a limit on the size of responses to requests made by the REST handler. An attacker could use this weakness to make a request that will return an HTTP response with a large body and cause DoS of CloudCore. In the HTTP Handler API, the rest handler makes a request to a pre-specified handle. The handle will return an HTTP response that is then read into memory. The consequence of the exhaustion is that CloudCore will be in a denial of service.
Only an authenticated user of the cloud can make an attack. It will be affected only when users enable `router` module in the config file `cloudcore.yaml` as below.
```
modules:
  ...
  router:
    enable: true
```

### Patches
This bug has been fixed in Kubeedge 1.11.1, 1.10.2, 1.9.4. Users should update to these versions to resolve the issue.

### Workarounds
Disable the router module in the config file `cloudcore.yaml`.

### References
NA

### Credits
Thanks David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [kubeedge security policy](https://github.com/kubeedge/kubeedge/security/policy) during a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [KubeEdge repo](https://github.com/kubeedge/kubeedge/issues/new/choose)
* To make a vulnerability report, email your vulnerability to the private [cncf-kubeedge-security@lists.cncf.io](mailto:cncf-kubeedge-security@lists.cncf.io) list with the security details and the details expected for [KubeEdge bug reports](https://github.com/kubeedge/kubeedge/blob/master/.github/ISSUE_TEMPLATE/bug-report.md).
Cross-Site Request Forgery in Jenkins Failed Job Deactivator Plugin
Advisory: GHSA-cp6q-836q-gmj3
Aliases: CVE-2022-34817
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Failed Job Deactivator Plugin 1.2.1 and earlier allows attackers to disable jobs. This CSRF vulnerability is only exploitable in Jenkins 2.286 and earlier, LTS 2.277.1 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.277/#upgrading-to-jenkins-lts-2-277-2).
Missing Authorization in Jenkins build-metrics Plugin
Advisory: GHSA-qv56-j8fg-39h6
Aliases: CVE-2022-34785
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins build-metrics Plugin 1.3 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to obtain information about jobs otherwise inaccessible to them.
Plaintext Storage of a Password in Jenkins Elasticsearch Query Plugin
Advisory: GHSA-h5h5-m2mc-j2pv
Aliases: CVE-2022-34807
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Elasticsearch Query Plugin 1.2 and earlier stores a password unencrypted in its global configuration file `org.jenkinsci.plugins.elasticsearchquery.ElasticsearchQueryBuilder.xml` on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Plaintext Storage of a Password in Jenkins Build Notifications Plugin
Advisory: GHSA-v3r8-6vfj-pppf
Aliases: CVE-2022-34800
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Build Notifications Plugin 1.5.0 and earlier stores multiple tokens unencrypted in its global configuration files on the Jenkins controller as part of its configuration:- Pushover Application Token in `tools.devnull.jenkins.plugins.buildnotifications.PushoverNotifier.xml`\n- Slack Bot Token in `tools.devnull.jenkins.plugins.buildnotifications.SlackNotifier.xml`\n- Telegram Bot Token in `tools.devnull.jenkins.plugins.buildnotifications.TelegramNotifier.xml`
jQuery UI vulnerable to XSS when refreshing a checkboxradio with an HTML-like initial text label
Advisory: GHSA-h6gj-6jjq-h8g9
Aliases: CVE-2022-31160
Published: 2022-07-18T17:07:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Impact
Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents considered as the input label. If you call `.checkboxradio( "refresh" )` on such a widget and the initial HTML contained encoded HTML entities, they will erroneously get decoded. This can lead to potentially executing JavaScript code.

For example, starting with the following initial secure HTML:
```html
<label>
	<input id="test-input">
	&lt;img src=x onerror="alert(1)"&gt;
</label>
```
and calling:
```js
$( "#test-input" ).checkboxradio();
$( "#test-input" ).checkboxradio( "refresh" );
```
will turn the initial HTML into:
```html
<label>
	<!-- some jQuery UI elements -->
	<input id="test-input">
	<img src=x onerror="alert(1)">
</label>
```
and the alert will get executed.

### Patches
The bug has been patched in jQuery UI 1.13.2.

### Workarounds
To remediate the issue, if you can change the initial HTML, you can wrap all the non-input contents of the `label` in a `span`:
```html
<label>
	<input id="test-input">
	<span>&lt;img src=x onerror="alert(1)"&gt;</span>
</label>
```

### References
https://blog.jqueryui.com/2022/07/jquery-ui-1-13-2-released/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc). If you don't find an answer, open a new issue.
Ganga allows absolute path traversal
Advisory: GHSA-7488-6x3r-23w5
Aliases: CVE-2022-31507
Published: 2022-07-13T15:43:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask `send_file` function is used unsafely.
Jenkins Compuware ISPW Operations Plugin does not perform permission checks in several HTTP endpoints
Advisory: GHSA-cp5r-xqjr-84gm
Aliases: CVE-2022-36898
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Compuware ISPW Operations Plugin 1.0.8 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
Stored XSS vulnerability in Jenkins Maven Metadata Plugin for Jenkins CI server plugin
Advisory: GHSA-8294-mv9c-7m5h
Aliases: CVE-2022-36905
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters. This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli
Advisory: GHSA-8mjr-jr5h-q2xr
Aliases: CVE-2022-31153
Published: 2022-07-15T18:17:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
This vulnerability affects all accounts (vanilla and ethereum flavors) in the [v0.2.0 release of OpenZeppelin Contracts for Cairo](https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.0), which are not whitelisted on StarkNet mainnet, so only goerli deployments of v0.2.0 accounts are affected.

This faulty behavior is not observed in [StarkNet's testing framework](https://github.com/starkware-libs/cairo-lang/blob/master/src/starkware/starknet/testing/starknet.py), so don't rely on it passing to detect this issue on custom accounts.

### Patches
This bug has been patched in [v0.2.1](https://github.com/OpenZeppelin/cairo-contracts/releases/tag/v0.2.1).

### References
The issue is detailed in https://github.com/OpenZeppelin/cairo-contracts/issues/386.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Contracts for Cairo repo](https://github.com/OpenZeppelin/cairo-contracts/issues/new/choose)
* Email us at [security@openzeppelin.com](mailto:security@openzeppelin.com)
Code injection in Apache Commons Configuration
Advisory: GHSA-xj57-8qj4-c4m6
Aliases: CVE-2022-33980
Published: 2022-07-07T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
Unrestricted Upload of File with Dangerous Type in MCMS
Advisory: GHSA-4828-473v-37gh
Aliases: CVE-2022-31943
Published: 2022-07-02T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MCMS v5.2.8 was discovered to contain an arbitrary file upload vulnerability.
Missing Authorization in Jenkins XPath Configuration Viewer Plugin
Advisory: GHSA-qm37-c4w6-h9v9
Aliases: CVE-2022-34811
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

XPath Configuration Viewer Plugin 1.1.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to access the XPath Configuration Viewer page. Given appropriate XPath expressions, this page grants access to job configuration XML data to every user with Item/Read permission. The encrypted values of secrets stored in the job configuration are not redacted, as they would be by the config.xml API for users without Item/Configure permission.
Atlantis Events vulnerable to Timing Attack
Advisory: GHSA-jxqv-jcvh-7gr4
Aliases: CVE-2022-24912
Published: 2022-07-30T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The package github.com/runatlantis/atlantis/server/controllers/events before 0.19.7 is vulnerable to Timing Attack in the webhook event validator code, which does not use a constant-time comparison function to validate the webhook secret. It can allow an attacker to recover this secret as an attacker and then forge webhook events.
Passwords stored in plain text by Jenkins hpe-network-virtualization plugin
Advisory: GHSA-36j8-f33j-vjwq
Aliases: CVE-2022-34816
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

hpe-network-virtualization Plugin 1.0 stores passwords unencrypted in its global configuration file `org.jenkinsci.plugins.nvemulation.plugin.NvEmulationBuilder.xml` on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.
Gollum Cross-site Scripting vulnerability via filename parameter to New Page dialog
Advisory: GHSA-fj2w-qmjp-3rjm
Aliases: CVE-2020-35305
Published: 2022-07-16T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog.
Cross-Site Request Forgery in Jenkins Request Rename Or Delete Plugin
Advisory: GHSA-qq85-8g89-r5rc
Aliases: CVE-2022-34815
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier allows attackers to accept pending requests, thereby renaming or deleting jobs.
Wasmtime vulnerable to Use After Free with `externref`s
Advisory: GHSA-5fhj-g3p3-pq9g
Aliases: CVE-2022-31146
Published: 2022-07-20T22:47:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

There is a bug in Wasmtime's code generator, Cranelift, where functions using reference types may be incorrectly missing metadata required for runtime garbage collection (GC). This means that if a GC happens at runtime then the collector will mistakenly think some Wasm stack frames do not have live references to garbage collected values and therefore reclaim and deallocate them. The function can then subsequently continue to use the values, leading later to use-after-free bugs. This bug was introduced in Cranelift's migration to the `regalloc2` register allocator in the Wasmtime 0.37.0 release on 2022-05-20. This bug has been patched and users should upgrade to Wasmtime version 0.38.2.

Mitigations for this issue can be achieved by doing one of:

* Disabling the reference types proposal by passing `false` to [`wasmtime::Config::wasm_reference_types`](https://docs.rs/wasmtime/0.38.0/wasmtime/struct.Config.html#method.wasm_reference_types).
* Downgrading to Wasmtime 0.36.0 or prior.
grunt-util-property 0.0.2 function call can add/modify properties of Object.prototype using a __proto__ payload
Advisory: GHSA-4hq8-jgr8-mw9j
Aliases: CVE-2020-7641
Published: 2022-07-18T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

This affects all versions of package grunt-util-property. The function call could be tricked into adding or modifying properties of `Object.prototype` using a `__proto__` payload.
Known vulnerable to code execution via SVG file in v1.3.1
Advisory: GHSA-5jgj-h9wp-53fr
Aliases: CVE-2022-32115
Published: 2022-07-09T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue in the isSVG() function of Known v1.3.1 allows attackers to execute arbitrary code via a crafted SVG file.

The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.
Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted
Advisory: GHSA-2qh6-hhvv-m2ww
Aliases: CVE-2022-36901
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file `jenkins.plugins.http_request.HttpRequest.xml` on the Jenkins controller as part of its configuration when using (deprecated) Basic/Digest Authentication. These passwords can be viewed by users with access to the Jenkins controller file system.
markdown-it-toc Cross-site Scripting due to title of generated toc and contents of header not being escaped
Advisory: GHSA-wfvx-fx73-3rfj
Aliases: CVE-2020-28455
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.
Cross-site Scripting in microweber
Advisory: GHSA-5pg2-qg87-vmj7
Aliases: CVE-2022-2280
Published: 2022-07-02T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
Known vulnerable to account takeover via host header injection attack in v1.3.1
Advisory: GHSA-p757-4v3p-j74f
Aliases: CVE-2022-33011
Published: 2022-07-09T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Known v1.3.1 was discovered to allow attackers to perform an account takeover via a host header injection attack.

The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.
js-ini Prorotype Pollution when malicious INI files submitted to an application that parses it with `parse`
Advisory: GHSA-m939-vrfp-9v8p
Aliases: CVE-2020-28461
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This affects the package js-ini before 1.3.0. If an attacker submits a malicious INI file to an application that parses it with `parse` , they will pollute the prototype on the application. This can be exploited further depending on the context.
CSRF vulnerability in Jenkins Google Cloud Backup Plugin
Advisory: GHSA-m485-79jq-cxx7
Aliases: CVE-2022-36916
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Google Cloud Backup Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint.

Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
WASM3 segmentation fault
Advisory: GHSA-gq4p-4hxv-5rg9
Aliases: CVE-2022-34529
Published: 2022-07-28T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

WASM3 v0.5.0 was discovered to contain a segmentation fault via the component `Compile_Memory_CopyFill`.
Tooxie Shiva 0.10.0 allows absolute path traversal because Flask send_file function used unsafely
Advisory: GHSA-qp72-96p2-g644
Aliases: CVE-2022-31558
Published: 2022-07-12T00:00:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Cross-site Scripting in Jenkins eXtreme Feedback Panel Plugin
Advisory: GHSA-w257-f7qj-4vrq
Aliases: CVE-2022-34790
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins eXtreme Feedback Panel Plugin 2.0.1 and earlier does not escape the job names used in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
KubeEdge Cloud Stream and Edge Stream DoS from large stream message
Advisory: GHSA-wrcr-x4qj-j543
Aliases: CVE-2022-31079
Published: 2022-07-11T21:05:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

### Impact
The Cloud Stream server and the Edge Stream server reads the entire message into memory without imposing a limit on the size of this message. An attacker can exploit this by sending a large message to exhaust memory and cause a DoS. The Cloud Stream server and the Edge Stream server are under DoS attack in this case. The consequence of the exhaustion is that the CloudCore and EdgeCore will be in a denial of service.
Only an authenticated user can cause this issue. It will be affected only when users enable cloudStream module in the config file cloudcore.yaml and enable edgeStream module in the config file edgecore.yaml as below.
cloudcore.yaml:
```
modules:
  ...
  cloudStream:
    enable: true
```
edgecore.yaml:
```
modules:
  ...
  edgeStream:
    enable: true
```

### Patches
This bug has been fixed in Kubeedge 1.11.1, 1.10.2, 1.9.4. Users should update to these versions to resolve the issue.

### Workarounds
Disable cloudStream module in the config file cloudcore.yaml and disable edgeStream module in the config file edgecore.yaml, restart process cloudcore and edgecore after modification.

### References
NA

### Credits
Thanks David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [kubeedge security policy](https://github.com/kubeedge/kubeedge/security/policy) during a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [KubeEdge repo](https://github.com/kubeedge/kubeedge/issues/new/choose)
* To make a vulnerability report, email your vulnerability to the private [cncf-kubeedge-security@lists.cncf.io](mailto:cncf-kubeedge-security@lists.cncf.io) list with the security details and the details expected for [KubeEdge bug reports](https://github.com/kubeedge/kubeedge/blob/master/.github/ISSUE_TEMPLATE/bug-report.md).
ffmpeg-sdk vulnerable to OS Command Injection
Advisory: GHSA-rwvf-c3wm-qm6w
Aliases: CVE-2020-28435
Published: 2022-07-26T00:01:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
Cross-site Scripting in Jenkins GitLab Plugin
Advisory: GHSA-f655-xhvm-cwp4
Aliases: CVE-2022-34777
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. GitLab Plugin 1.5.35 does not show user-provided fields in the build cause of webhook-triggered builds.

GitLab Plugin 1.5.35 does not show user-provided fields in the build cause of webhook-triggered builds.
PrestaShop eval injection possible if shop vulnerable to SQL injection
Advisory: GHSA-hrgx-p36p-89q4
Aliases: CVE-2022-31181
Published: 2022-07-29T22:27:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
Eval injection possible if the shop is vulnerable to an SQL injection.

### Patches
The problem is fixed in version 1.7.8.7

### Workarounds
Delete the MySQL Smarty cache feature by removing these lines in the file `config/smarty.config.inc.php` lines 43-46 (PrestaShop 1.7) or 40-43 (PrestaShop 1.6):
```php
if (Configuration::get('PS_SMARTY_CACHING_TYPE') == 'mysql') {
    include _PS_CLASS_DIR_.'Smarty/SmartyCacheResourceMysql.php';
    $smarty->caching_type = 'mysql';
}
```
Apache Druid before 0.23.0 vulnerable to clickjacking
Advisory: GHSA-pgq7-jcj5-xx6h
Aliases: CVE-2022-28889
Published: 2022-07-08T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.
Insufficient user input in Apache Jetspeed-2
Advisory: GHSA-h975-r69h-4w9p
Aliases: CVE-2022-32533
Published: 2022-07-07T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

** UNSUPPORTED WHEN ASSIGNED ** Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue.
Joplin is vulnerable to arbitrary code execution
Advisory: GHSA-ww2v-frv5-pj5x
Aliases: CVE-2022-35131
Published: 2022-07-26T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
Jenkins Deployer Framework Plugin vulnerable to Path Traversal
Advisory: GHSA-hgp9-2c4w-x9mh
Aliases: CVE-2022-36890
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the name of files in methods implementing form validation, allowing attackers with Item/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
DoS in KubeEdge's Websocket Client in package Viaduct
Advisory: GHSA-6wvc-6pww-qr4r
Aliases: CVE-2022-31080
Published: 2022-07-11T21:06:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

### Impact
A large response received by the viaduct WSClient can cause a DoS from memory exhaustion. The entire body of the response is being read into memory which could allow an attacker to send a request that returns a response with a large body.
The consequence of the exhaustion is that the process which invokes a WSClient will be in a denial of service. It will be affected If users which are authenticated to the edge side and connect from the edge side to `cloudhub` through WebSocket protocol.

### Patches
This bug has been fixed in Kubeedge 1.11.1, 1.10.2, 1.9.4. Users should update to these versions to resolve the issue.

### Workarounds
At the time of writing, no workaround exists.

### References
NA

### Credits
Thanks David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [kubeedge security policy](https://github.com/kubeedge/kubeedge/security/policy) during a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [KubeEdge repo](https://github.com/kubeedge/kubeedge/issues/new/choose)
* To make a vulnerability report, email your vulnerability to the private [cncf-kubeedge-security@lists.cncf.io](mailto:cncf-kubeedge-security@lists.cncf.io) list with the security details and the details expected for [KubeEdge bug reports](https://github.com/kubeedge/kubeedge/blob/master/.github/ISSUE_TEMPLATE/bug-report.md).
Plaintext Storage of a Password in Jenkins RocketChat Notifier Plugin
Advisory: GHSA-pgp9-x83g-v8x8
Aliases: CVE-2022-34802
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins RocketChat Notifier Plugin 1.5.2 and earlier stores the login password and webhook token unencrypted in its global configuration file `RocketChatNotifier.xml` on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Jenkins Google Login Plugin 1.0 and 1.1 allows anonymous users to authenticate through client-side request modification
Advisory: GHSA-p487-39h9-hm84
Aliases: CVE-2015-5298
Published: 2022-07-08T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.
October CMS upload process vulnerable to RCE via Race Condition
Advisory: GHSA-8v7h-cpc2-r8jp
Aliases: CVE-2022-24800
Published: 2022-07-13T21:42:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

This advisory affects plugins that expose the `October\Rain\Database\Attach\File::fromData` as a public interface. This vulnerability does not affect vanilla installations of October CMS since this method is not exposed or used by the system internally or externally.

When the developer allows the user to specify their own filename in the `fromData` method, an unauthenticated user can perform remote code execution (RCE) by exploiting a race condition in the temporary storage directory.

### Patches

The issue has been patched in Build 476 (v1.0.476) and v1.1.12 and v2.2.15.

### Workarounds

Apply https://github.com/octobercms/library/commit/fe569f3babf3f593be2b1e0a4ae0283506127a83 to your installation manually if unable to upgrade to Build 476 (v1.0.476) or v1.1.12 or v2.2.15.

### References

Credits to:
- DucNT, HungTD and GiangVQ from RedTeam@VNG Security Response Center.

### For more information

If you have any questions or comments about this advisory:
- Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Cross-site Scripting in Jenkins Rich Text Publisher Plugin
Advisory: GHSA-2v6r-jf2g-j5q5
Aliases: CVE-2022-34786
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Rich Text Publisher Plugin 1.4 and earlier does not escape the HTML message set by its post-build step, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure jobs.
Incorrect handling of invalid surrogate pair characters
Advisory: GHSA-wpqr-jcpx-745r
Aliases: CVE-2022-31116
Published: 2022-07-05T21:06:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
_What kind of vulnerability is it? Who is impacted?_

Anyone parsing JSON from an untrusted source is vulnerable.

JSON strings that contain escaped surrogate characters not part of a proper surrogate pair were decoded incorrectly. Besides corrupting strings, this allowed for potential key confusion and value overwriting in dictionaries.

Examples:

```python
# An unpaired high surrogate character is ignored.
>>> ujson.loads(r'"\uD800"')
''
>>> ujson.loads(r'"\uD800hello"')
'hello'

# An unpaired low surrogate character is preserved.
>>> ujson.loads(r'"\uDC00"')
'\udc00'

# A pair of surrogates with additional non surrogate characters pair up in spite of being invalid.
>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'foo bar𐀀'
```

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Users should upgrade to UltraJSON 5.4.0.

From version 5.4.0, UltraJSON decodes lone surrogates in the same way as the standard library's `json` module does, preserving them in the parsed output:

```python3
>>> ujson.loads(r'"\uD800"')
'\ud800'
>>> ujson.loads(r'"\uD800hello"')
'\ud800hello'
>>> ujson.loads(r'"\uDC00"')
'\udc00'
>>> ujson.loads(r'"\uD800foo bar\uDC00"')
'\ud800foo bar\udc00'
```

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Short of switching to an entirely different JSON library, there are no safe alternatives to upgrading.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [UltraJSON](http://github.com/ultrajson/ultrajson/issues)
Jenkins Openstack Heat Plugin does not perform permission checks in methods implementing form validation
Advisory: GHSA-mr38-g7q2-x79p
Aliases: CVE-2022-36913
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Openstack Heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Token stored in plain text by Jenkins Cisco Spark Plugin
Advisory: GHSA-wppp-xqfv-6cm7
Aliases: CVE-2022-34808
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Cisco Spark Plugin 1.1.1 and earlier stores bearer tokens unencrypted in its global configuration file `org.jenkinsci.plugins.spark.SparkNotifier.xml` on the Jenkins controller as part of its configuration. These bearer tokens can be viewed by users with access to the Jenkins controller file system.
Fava time and filter parameters vulnerable to reflected XSS before v1.22
Advisory: GHSA-xrf4-39fm-j5f2
Aliases: CVE-2022-2514
Published: 2022-07-26T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected cross-site scripting due to the lack of escaping of error messages which contained the parameters in verbatim.
Valinor error messages leading to potential data exfiltration before v0.12.0
Advisory: GHSA-5pgm-3j3g-2rc7
Aliases: CVE-2022-31140
Published: 2022-07-12T22:15:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

```php
<?php

namespace My\App;

use CuyZ\Valinor\Mapper\MappingError;
use CuyZ\Valinor\Mapper\Tree\Node;
use CuyZ\Valinor\Mapper\Tree\NodeTraverser;
use CuyZ\Valinor\MapperBuilder;

require_once __DIR__ . '/Valinor/vendor/autoload.php';

final class Money
{
    private function __construct(public readonly string $amount)
    {
    }

    public static function fromString(string $money): self
    {
        if (1 !== \preg_match('/^\d+ [A-Z]{3}$/', $money)) {
            throw new \InvalidArgumentException(\sprintf('Given "%s" is not a recognized monetary amount', $money));
        }
        
        return new self($money);
    }
}

class Foo
{
    public function __construct(
        private readonly Money $a,
        private readonly Money $b,
        private readonly Money $c,
    ) {}
}

$mapper = (new MapperBuilder())
    ->registerConstructor([Money::class, 'fromString'])
    ->mapper();

try {
    var_dump($mapper->map(Foo::class, [
        'a' => 'HAHA',
        'b' => '100 EUR',
        'c' => 'USD 100'
    ]));
} catch (MappingError $e) {
    $messages = (new NodeTraverser(function (Node $node) {
        foreach ($node->messages() as $message) {
            var_dump([
                '$message',
                $message->path(),
                $message->body()
            ]);
        }
        return '';
    }))->traverse($e->node());

    iterator_to_array($messages);
}
```

Now, this is quite innocent: it produces following output:

```
❯ php value-object-conversion.php
array(3) {
  [0]=>
  string(8) "$message"
  [1]=>
  string(1) "a"
  [2]=>
  string(48) "Given "HAHA" is not a recognized monetary amount"
}
array(3) {
  [0]=>
  string(8) "$message"
  [1]=>
  string(1) "c"
  [2]=>
  string(51) "Given "USD 100" is not a recognized monetary amount"
}
```

The problem is that nowhere I told valinor that it could use `Throwable#getMessage()`.

This is a problem with cases where you get:

 * an SQL exception showing an SQL snippet
 * a DB connection exception showing DB ip address/username/password
 * a timeout detail / out of memory detail (exploring DDoS possibilities)

This allows for potential data exfiltration, DDoS, enumeration attacks, etc.