aswin1906/github-advisory-2022 huggingface dataset:
Path Traversal in Spring-integration-zip
Advisory: GHSA-vw83-h3mq-3qwj
Aliases: CVE-2021-22114
Published: 2022-03-18T17:40:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Addresses partial fix in CVE-2018-1263. Spring-integration-zip, versions prior to 1.0.4, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Improper Authorization in cobbler
Advisory: GHSA-mcg6-h362-cmq5
Aliases: CVE-2022-0860
Published: 2022-03-11T20:52:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

### Impact

If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places (Web UI, CLI & XMLRPC-API).

The same applies to user accounts with passwords set to be expired.

### Patches

There is a patch for the latest Cobbler `3.3.2` available, however a backport will be done for `3.2.x`.

### Workarounds

- Delete expired accounts which are able to access Cobbler via PAM.
- Use `chage -l <username>` to lock the account. If the account has SSH-Keys attached then remove them completely.

### References

- Originally discovered by @ysf at https://www.huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d/

### How to test if my Cobbler instance is affected?

The following `pytest` test assumes that your PAM setup is correct. In case the added user is not able to login, this test does not make sense to be executed.

```python
def test_pam_login_with_expired_user():
    # Arrange
    # create pam testuser
    test_username = "expired_user"
    test_password = "password"
    test_api = CobblerAPI()
    subprocess_1 = subprocess.run(
        ["perl", "-e", "'print crypt(\"%s\", \"%s\")'" % (test_username, test_password)],
        stdout=subprocess.PIPE
    )
    subprocess.run(["useradd", "-p", subprocess_1.stdout, test_username])
    # change user to be expired
    subprocess.run(["chage", "-E0", test_username])

    # Act
    result = pam.authenticate(test_api, test_username, test_password)

    # Assert - login should fail
    assert not result
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Cobbler repository](https://github.com/cobbler/cobbler/issues/new/choose)
* Ask in the [Gitter/Matrix Chat](https://gitter.im/cobbler/community)
* Email us at [cobbler.project@gmail.com](mailto:cobbler.project@gmail.com)
Prototype Pollution in jquery.cookie
Advisory: GHSA-gcx5-3p5f-f8vp
Aliases: CVE-2022-23395
Published: 2022-03-03T00:00:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

jQuery Cookie 1.4.1 is affected by prototype pollution, which can lead to DOM cross-site scripting (XSS).
RESTEasy 4.5.5.Final in hash flooding
Advisory: GHSA-37g7-8vjj-pjpj
Aliases: CVE-2020-14326
Published: 2022-03-18T17:58:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requests with higher CPU time spent searching and adding the entry. This flaw allows an attacker to cause a denial of service.
Improper Restriction of XML External Entity Reference in com.monitorjbl:xlsx-streamer
Advisory: GHSA-xvm2-9xvc-hx7f
Aliases: CVE-2022-23640
Published: 2022-03-02T21:30:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
Prior to xlsx-streamer 2.1.0, the XML parser that was used did not apply all the necessary settings to prevent XML Entity Expansion issues.

### Patches
Upgrade to version 2.1.0.

### Workarounds
No known workaround.

### References
https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [monitorjbl/excel-streaming-reader](https://github.com/monitorjbl/excel-streaming-reader)
CSRF vulnerability in Jenkins kubernetes-cd Plugin allow capturing credentials
Advisory: GHSA-vq6c-fvxw-p45v
Aliases: CVE-2022-27210
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server
Advisory: GHSA-6cp7-g972-w9m9
Aliases: CVE-2022-24732
Published: 2022-03-07T16:59:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

### Impact

Any configuration on any maddy version <0.5.4 using auth.pam is affected.

No password expiry or account expiry checking is done when authenticating using PAM.

### Patches

Patch is available as part of the 0.5.4 release.

### Workarounds

If /etc/shadow authentication is used, it is possible to replace auth.pam with auth.shadow which is not affected.

It is possible to blacklist expired accounts via existing filtering mechanisms (e.g. auth_map to invalid accounts in storage.imapsql).

### References

* https://github.com/foxcpp/maddy/blob/3412e59a2c92106e194fa69f2f1017c020037c9c/internal/auth/pam/pam.c
* https://linux.die.net/man/3/pam_acct_mgmt

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/foxcpp/maddy
* Email fox.cpp@disroot.org
CSRF vulnerability and missing permission check in Jenkins JiraTestResultReporter Plugin
Advisory: GHSA-vqcx-jw4r-6fp3
Aliases: CVE-2022-28136
Published: 2022-03-30T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
Discoverability of user password hash in Statamic CMS
Advisory: GHSA-qcgx-7p5f-hxvr
Aliases: CVE-2022-24784
Published: 2022-03-29T22:11:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

## Description

It was possible to confirm a single character of a user's password hash (just the hash, not the password) using a specially crafted regular expression filter in the users endpoint of the REST API. Many requests could eventually uncover the entire hash.

The hash would not be in the response, however the presence or absence of a result would confirm if the character was in the right position. It would take a long time since the API has throttling enabled by default.

Additionally, the REST API would need to be enabled, as well as the users endpoint. Both of which are disabled by default.

## Resolution

Filtering by password or password hash has been disabled.

## Credits

We would like to thank Thibaud Kehler for reporting the issue.
URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect
Advisory: GHSA-7p99-3798-f85c
Aliases: CVE-2022-24794
Published: 2022-03-31T22:44:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

### Impact
Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route.

If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitised.

### Am I affected?
You are affected by this vulnerability if you are using the `requiresAuth` middleware on a catch all route or the default `authRequired` option and `express-openid-connect` version `<=2.7.1`.

### How to fix that?
Upgrade to version `>=2.7.2`

### Will this update impact my users?
The fix provided in the patch will not affect your users.
Missing permission check in Jenkins JiraTestResultReporter Plugin
Advisory: GHSA-gc7m-x2cj-3775
Aliases: CVE-2022-28137
Published: 2022-03-30T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins JiraTestResultReporter Plugin 165.v817928553942 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Arbitrary file read vulnerability in Jenkins Tests Selector Plugin
Advisory: GHSA-3r5x-x6xf-m8fv
Aliases: CVE-2022-28160
Published: 2022-03-30T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Tests Selector Plugin 1.3.3 and earlier allows users with Item/Configure permission to read arbitrary files on the Jenkins controller using the Choosing Tests parameter.
Insufficient Session Expiration in Admidio
Advisory: GHSA-mf79-f657-47ww
Aliases: CVE-2022-0991
Published: 2022-03-20T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

Admidio prior to version 4.1.9 is vulnerable to insufficient session expiration. In vulnerable versions, changing the password in one session does not terminate sessions logged in with the old password, which could lead to unauthorized actors maintaining access to an account.
Remote Code Execution in Contao Managed Edition
Advisory: GHSA-rggc-4g3r-j7ff
Aliases: CVE-2022-26265
Published: 2022-03-20T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
SQL Injection in Yeswiki
Advisory: GHSA-xgx2-332h-9x6q
Aliases: CVE-2021-43091
Published: 2022-03-26T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An SQL Injection vlnerability exits in Yeswiki doryphore 20211012 via the email parameter in the registration form. The issue was fixed in Yeswiki version 4.1.0.
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
Advisory: GHSA-32gv-6cf3-wcmq
Published: 2022-03-14T22:45:11Z

### Impact
Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:

Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512
Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514
Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515

A Twisted web server supports HTTP/2 requests if you've installed the [`http2` optional dependency set](https://twistedmatrix.com/documents/19.2.0/installation/howto/optional.html).

### Workarounds
There are no workarounds.

### References
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Twisted's Trac](https://twistedmatrix.com/trac/)
Cross-site Scripting in Pimcore
Advisory: GHSA-xmq3-hgjx-6997
Aliases: CVE-2022-0705
Published: 2022-03-17T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Path traversal in claircore
Advisory: GHSA-mq47-6wwv-v79w
Aliases: CVE-2021-3762
Published: 2022-03-04T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
Twisted SSH client and server deny of service during SSH handshake.
Advisory: GHSA-rv6r-3f5q-9rgx
Aliases: CVE-2022-21716
Published: 2022-03-03T19:02:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

The Twisted SSH client and server implementation naively accepted an infinite amount of data for the  peer's SSH version identifier.

A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as `nc -rv localhost 22 < /dev/zero`.

### Patches

The issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1

A fix is available in Twisted 22.2.0.

### Workarounds

* Limit access to the SSH server only to trusted source IP addresses.
* Connect over SSH only to trusted destination IP addresses.

### References

Reported at https://twistedmatrix.com/trac/ticket/10284
Discussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx

### For more information

Found by vin01
Path traversal and improper access control allows leaking out-of-bound files from Argo CD repo-server
Advisory: GHSA-r9cr-hvjj-496v
Aliases: CVE-2022-24730
Published: 2022-03-24T00:04:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact

All unpatched versions of Argo CD starting with v1.3.0 are vulnerable to a path traversal bug, compounded by an improper access control bug, allowing a malicious user with read-only repository access to leak sensitive files from Argo CD's repo-server.

A malicious Argo CD user who has been granted [`get` access for a repository](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions) containing a Helm chart can craft an API request to the `/api/v1/repositories/{repo_url}/appdetails` endpoint to leak the contents of out-of-bounds files from the repo-server.

The malicious payload would reference an out-of-bounds file, and the contents of that file would be returned as part of the response. Contents from a non-YAML file may be returned as part of an error message. The attacker would have to know or guess the location of the target file.

Sensitive files which could be leaked include files from other Applications' source repositories (potentially decrypted files, if you are using a decryption plugin) or any secrets which have been mounted as files on the repo-server.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.0
* v2.2.6
* v2.1.11

The patches do two things:
 1) prevent path traversal
 2) limit `/api/v1/repositories/{repo_url}/appdetails` access to users who either A) have been granted Application `create` privileges or B) have been granted Application `get` privileges _and_ are requesting details for a `repo_url` that has already been used for the given Application

### Workarounds

The only certain way to avoid the vulnerability is to upgrade. 

To mitigate the problem, you can 
* avoid storing secrets in git
* avoid mounting secrets as files on the repo-server
* avoid decrypting secrets into files on the repo-server
* carefully [limit who has `get` access for repositories](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions)

### References

* [Security documentation for the repo-server component](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#git-helm-repositories)
* [Argo CD RBAC configuration documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#)

### For more information

Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Missing permission checks in Jenkins Release Helper Plugin
Advisory: GHSA-p9gq-76fj-4p4p
Aliases: CVE-2022-27215
Published: 2022-03-16T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Remote Code Execution in Spring Framework
Advisory: GHSA-36p3-wjmg-h94x
Aliases: CVE-2022-22965
Published: 2022-03-31T18:30:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as `Spring4Shell`. 

## Impact

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

These are the prerequisites for the exploit:
- JDK 9 or higher
- Apache Tomcat as the Servlet container
- Packaged as WAR
- `spring-webmvc` or `spring-webflux` dependency

## Patches

- Spring Framework [5.3.18](https://github.com/spring-projects/spring-framework/releases/tag/v5.3.18) and [5.2.20](https://github.com/spring-projects/spring-framework/releases/tag/v5.2.20.RELEASE)
- Spring Boot [2.6.6](https://github.com/spring-projects/spring-boot/releases/tag/v2.6.6) and [2.5.12](https://github.com/spring-projects/spring-boot/releases/tag/v2.5.12)

## Workarounds

For those who are unable to upgrade, leaked reports recommend setting `disallowedFields` on `WebDataBinder` through an `@ControllerAdvice`. This works generally, but as a centrally applied workaround fix, may leave some loopholes, in particular if a controller sets `disallowedFields` locally through its own `@InitBinder` method, which overrides the global setting.

To apply the workaround in a more fail-safe way, applications could extend `RequestMappingHandlerAdapter` to update the `WebDataBinder` at the end after all other initialization. In order to do that, a Spring Boot application can declare a `WebMvcRegistrations` bean (Spring MVC) or a `WebFluxRegistrations` bean (Spring WebFlux).
Shopware guest session is shared between customers
Advisory: GHSA-jp6h-mxhx-pgqh
Aliases: CVE-2022-24745
Published: 2022-03-10T17:28:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

### Impact
Guest sessions are shared between customers when HTTP cache is enabled. Setups with Varnish are not affected by this issue

## Patches

We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds

### Security Plugin
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

### Disable HTTP Cache

Disabling HTTP Cache is also a valid workaround
Stored Cross-site Scripting vulnerability in Jenkins Extended Choice Parameter Plugin
Advisory: GHSA-h2v5-3hpc-85j5
Aliases: CVE-2022-27202
Published: 2022-03-16T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the value and description of extended choice parameters of radio buttons or check boxes type, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Cross-Site Request Forgery in Jenkins P4 Plugin
Advisory: GHSA-3rj3-qp2j-4fj2
Aliases: CVE-2021-21655
Published: 2022-03-18T17:53:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins P4 Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified Perforce server using attacker-specified username and password.

P4 Plugin 1.11.5 requires POST requests for the affected HTTP endpoints.
Cross-site Scripting in ShowDoc
Advisory: GHSA-v8mp-hhjq-h4cj
Aliases: CVE-2022-0965
Published: 2022-03-16T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.ofd` file upload.
Cross site scripting in Shopizer
Advisory: GHSA-p2j7-6g9h-32xh
Aliases: CVE-2022-23059
Published: 2022-03-30T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A Stored Cross Site Scripting (XSS) vulnerability exists in Shopizer versions v2.0.2 through v2.17.0 via the “Manage Images” tab, which allows an attacker to upload a SVG file containing malicious JavaScript code.
Uncontrolled Resource Consumption in jboss-remoting
Advisory: GHSA-p6j8-hgv5-m35g
Aliases: CVE-2020-35510
Published: 2022-03-18T17:58:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in jboss-remoting in versions before 5.0.20.SP1-redhat-00001. A malicious attacker could cause threads to hold up forever in the EJB server by writing a sequence of bytes corresponding to the expected messages of a successful EJB client request, but omitting the ACK messages, or just tamper with jboss-remoting code, deleting the lines that send the ACK message from the EJB client code resulting in a denial of service. The highest threat from this vulnerability is to system availability.
Insufficient Protection against HTTP Request Smuggling in mitmproxy
Advisory: GHSA-gcx2-gvj7-pxv3
Aliases: CVE-2022-24766
Published: 2022-03-22T19:22:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

In mitmproxy 7.0.4 and below, a malicious client or server is able to perform [HTTP request smuggling](https://en.wikipedia.org/wiki/HTTP_request_smuggling) attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

Unless you use mitmproxy to protect an HTTP/1 service, no action is required.


### Patches

The vulnerability has been fixed in mitmproxy 8.0.0 and above.


### Acknowledgements

We thank Zeyu Zhang (@zeyu2001) for responsibly disclosing this vulnerability to the mitmproxy team.


### Timeline

- **2022-03-15**: Received initial report.
- **2022-03-15**: Verified report and confirmed receipt.
- **2022-03-16**: Shared patch with researcher.
- **2022-03-16**: Received confirmation that patch is working.
- **2022-03-19**: Published patched release and advisory.
Improper Neutralization of Special Elements used in a Command ('Command Injection') in Weblate
Advisory: GHSA-3872-f48p-pxqj
Aliases: CVE-2022-23915
Published: 2022-03-04T21:15:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
Weblate didn't correctly sanitize some arguments passed to Git and Mercurial, which allowed changing their behavior in an unintended way.

### Patches

The issues were fixed in the 4.11.1 release. The following commits are addressing it:

* 35d59f1f040541c358cece0a8d4a63183ca919b8
* d83672a3e7415da1490334e2c9431e5da1966842

### Workarounds

Instances in which untrusted users cannot create new components are not affected.

### References
* [SNYK-PYTHON-WEBLATE-2414088](https://security.snyk.io/vuln/SNYK-PYTHON-WEBLATE-2414088)

### For more information
If you have any questions or comments about this advisory:
* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)
* Email us at [care@weblate.org](mailto:care@weblate.org)
Prototype Pollution in simple-plist
Advisory: GHSA-gff7-g5r8-mg8m
Aliases: CVE-2022-26260
Published: 2022-03-23T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
Integer Overflow in microweber
Advisory: GHSA-5fxv-xx5p-g2fv
Aliases: CVE-2022-0968
Published: 2022-03-16T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Microweber is a new generation CMS with drag and drop. The microweber application allows large characters to insert in the input field "first & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The first name & last name input should be limited to 50 characters or max 100 characters
Cross-site Scripting in ShowDoc
Advisory: GHSA-82j4-vr25-x394
Aliases: CVE-2022-0940
Published: 2022-03-15T00:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Temporary Directory Hijacking Vulnerability in Keycloak
Advisory: GHSA-6xp6-fmc8-pmmr
Aliases: CVE-2021-20202
Published: 2022-03-18T17:50:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity.
Server-Side Request Forgery and Open Redirect in AllTube Download
Advisory: GHSA-75p7-527p-w8wp
Aliases: CVE-2022-24739
Published: 2022-03-09T15:17:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

### Impact

On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack or a Server-Side Request Forgery attack (depending on how AllTube is configured).

The impact is mitigated by the fact the SSRF attack is only possible when the `stream` option is enabled in the configuration. (This option is disabled by default.)

### Patches

3.0.3 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

The fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/3d092891044f2685ed66c73c870a021bee319c37/patches/youtube-dl-disable-generic.diff) to youtube-dl to disable its generic extractor. If you are using the version of youtube-dl bundled with 3.0.3, it is already patched.
However, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.

### References

* https://github.com/Rudloff/alltube/commit/8913f27716400dabf4906a5ad690a5238f73496a
* https://github.com/ytdl-org/youtube-dl/issues/30691
Cookie-setting is not restricted based on the public suffix list
Advisory: GHSA-mfjm-vh54-3f96
Published: 2022-03-01T22:13:28Z

### Impact

Responses from domain names whose public domain name suffix contains 1 or more periods (e.g. responses from `example.co.uk`, given its public domain name suffix is `co.uk`) are able to set cookies that are included in requests to any other domain sharing the same domain name suffix.

### Patches

Upgrade to Scrapy 2.6.0, which restricts cookies with their domain set to any of those in the [public suffix list](https://publicsuffix.org/).

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.

### Workarounds

The only workaround for unpatched versions of Scrapy is to [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to a subset that does not include domain names with one of the public domain suffixes affected (those with 1 or more periods).

### References
* https://publicsuffix.org/

### For more information

If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy/scrapy/issues)
* [Email us](mailto:opensource@zyte.com)
Cross Site Request Forgery in intelliants/subrion
Advisory: GHSA-9cc3-5w85-pxvx
Aliases: CVE-2020-18326
Published: 2022-03-05T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross Site Request Forgery (CSRF) vulnerability exists in Intelliants Subrion CMS v4.2.1 via the Members administrator function, which could let a remote unauthenticated malicious user send an authorised request to victim and successfully create an arbitrary administrator user.
Cross-site Scripting in Zenario CMS
Advisory: GHSA-x8wj-cqmp-3wmm
Aliases: CVE-2021-41952
Published: 2022-03-15T00:00:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.
Command Injection in ungit
Advisory: GHSA-hf8c-xr89-vfm5
Aliases: CVE-2022-25766
Published: 2022-03-22T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.
Path Traversal in ImpressCMS
Advisory: GHSA-4q96-9f63-p7jj
Aliases: CVE-2021-26601
Published: 2022-03-29T00:01:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

ImpressCMS before 1.4.3 allows libraries/image-editor/image-edit.php image_temp Directory Traversal.
Integer Overflow or Wraparound in Microweber
Advisory: GHSA-c383-q5vf-hx55
Aliases: CVE-2022-0913
Published: 2022-03-12T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Microweber prior to 1.2.12 is vulnerable to Integer Overflow or Wraparound.
Command Injection vulnerability in asciidoctor-include-ext
Advisory: GHSA-v222-6mr4-qj29
Aliases: CVE-2022-24803
Published: 2022-03-31T23:27:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

### Impact

Applications using [Asciidoctor (Ruby)](https://github.com/asciidoctor/asciidoctor) with [asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext) (prior to version 0.4.0), which render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. ~~This attack is possible even when `allow-uri-read` is disabled!~~ (EDIT: it’s not)


### Patches

The vulnerability has been fixed in commit c7ea001 (and further improved in cbaccf3), which is included in version [0.4.0](https://rubygems.org/gems/asciidoctor-include-ext/versions/0.4.0).

### Workarounds

```rb
require 'asciidoctor/include_ext'

class Asciidoctor::IncludeExt::IncludeProcessor
  # Overrides superclass private method to mitigate Command Injection
  # vulnerability in asciidoctor-include-ext <0.4.0.
  def target_uri?(target)
    target.downcase.start_with?('http://', 'https://') \
      && URI.parse(target).is_a?(URI::HTTP)
  rescue URI::InvalidURIError
    false
  end
end
```

### References

* https://sakurity.com/blog/2015/02/28/openuri.html

### Credits

This vulnerability was discovered by Joern Schneeweisz from the GitLab Security Research Team.


### For more information

See commit message c7ea001.

If you have any questions or comments about this advisory open an issue in [jirutka/asciidoctor-include-ext](https://github.com/jirutka/asciidoctor-include-ext/issues/).
Sudden swap of user auth tokens in Volto
Advisory: GHSA-cfhh-xgwq-5r67
Aliases: CVE-2022-24740
Published: 2022-03-14T22:15:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L

### Impact
Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account and privileges. A proven exploit for this vulnerability does not exist, since the exact requisites for it to happen have not been fully clarified, and the attempts to reproduce it under testing conditions have been unsuccessful, but it still can happen randomly and unintentionally in the wild. 

### Patches
The patch and fix is present in Volto 15.0.0-alpha.0 (or later). See PR: https://github.com/plone/volto/pull/3051.
We recommend upgrading to the final release of Volto 15 as soon as possible if running an affected version.
See the upgrade guide https://6-dev-docs.plone.org/volto/upgrade-guide/index.html#upgrading-to-volto-15-x-x

### Workarounds
It is possible to create a fix by manually upgrading the react-cookie package to 4.1.1 and then overriding all Volto components that use this library as in https://github.com/plone/volto/pull/3051. As this is substantial work, an update to the Volto 15 is recommended. The upgrade steps for going from Volto 14 to Volto 15 are quite easy and do not involve any complexity. Please take a look at the upgrade guide: https://6-dev-docs.plone.org/volto/upgrade-guide/index.html#upgrading-to-volto-15-x-x


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [volto](https://github.com/plone/volto/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Untrusted Search Path in PNPM
Advisory: GHSA-9m87-6fj3-c5xh
Aliases: CVE-2022-26183
Published: 2022-03-23T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

PNPM prior to v6.15.1 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Exposure of Sensitive Information to an Unauthorized Actor in httpie
Advisory: GHSA-9w4w-cpc8-h2fq
Aliases: CVE-2022-24737
Published: 2022-03-07T23:44:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

### Impact
HTTPie have the practical concept of [sessions](https://httpie.io/docs/cli/sessions), which help users to persistently store some of the state that belongs to the outgoing requests and incoming responses on the disk for further usage. As an example, we can make an authenticated request and save it to a [named session](https://httpie.io/docs/cli/named-sessions) called `api`:

```bash
$ http --session api -a user:pass pie.dev/basic-auth/user/pass
```

```json
{
    "authenticated": true,
    "user": "user"
}
```

Since we have now saved the authentication data to that session, we won‘t have to enter it again and again on every invocation. We can simply reference the session, and HTTPie will use the saved state directly from it:

```bash
$ http --session api pie.dev/basic-auth/user/pass
```

```json
{
    "authenticated": true,
    "user": "user"
}
```

One particular use case of these sessions is storing cookies (commonly referred to as a `Cookie Jar`). If a response has a `Set-Cookie`
header, HTTPie will parse it and store the actual cookie in the session. And from that point on, all outgoing requests will attach that cookie (in the form of a `Cookie` header).

This is extremely useful, especially when you are dealing with websites which manage their own state on the client-side through cookies.

```bash
$ http -F --session jar pie.dev/cookies/set/x/y
```

```json
{
    "cookies": {
        "x": "y"
    }
}
```

Before `3.1.0`, HTTPie didn‘t distinguish between cookies and hosts they belonged. This behavior resulted in the exposure of some cookies when there are redirects originating from the actual host to a third party website, e.g:

```bash
$ http -F --session jar pie.dev/redirect-to url==https://httpbin.org/cookies
```

(Pre 3.1.0)
```json
{
    "cookies": {
        "x": "y"
    }
}
```

(Post 3.1.0)
```json
{
    "cookies": {}
}
```

This behavior has been corrected in this release (with taking [RFC 6265 — HTTP State Management Mechanism](https://datatracker.ietf.org/doc/html/rfc6265) into the consideration).

A huge credit goes to [@Glyph](https://github.com/glyph) for disclosing the original vulnerability to us (through [huntr.dev](http://huntr.dev/)).

### Patches
We suggest users to upgrade their HTTPie version to `3.1.0` or higher, and run `httpie cli sessions upgrade` command on their sessions.

### For more information
If you have any questions or comments about this advisory:
* Email us: [`security@httpie.io`](mailto:security@httpie.io)

> Please note that this entry is covered by both [CVE-2022-24737](https://www.cvedetails.com/cve/CVE-2022-24737) and [CVE-2022-0430](https://nvd.nist.gov/vuln/detail/CVE-2022-0430).
Cross-site Scripting in Subrion CMS
Advisory: GHSA-xj7h-g7rh-gjcw
Aliases: CVE-2020-18324
Published: 2022-03-05T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the `q` parameter in the Kickstart template.
Code Injection in PyTorch Lightning
Advisory: GHSA-r5qj-cvf9-p85h
Aliases: CVE-2022-0845
Published: 2022-03-06T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PyTorch Lightning version 1.5.10 and prior is vulnerable to code injection. An attacker could execute commands on the target OS running the operating system by setting the `PL_TRAINER_GPUS` when using the `Trainer` module. A [patch](https://github.com/pytorchlightning/pytorch-lightning/commit/8b7a12c52e52a06408e9231647839ddb4665e8ae) is included in the `1.6.0` release.
SSRF in repository migration
Advisory: GHSA-q347-cg56-pcq4
Published: 2022-03-14T22:57:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

### Impact

The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected.

### Patches

Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

Run Gogs in its own private network.

### References

https://www.huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531/

### For more information

If you have any questions or comments about this advisory, please post on #6754.
Server-side Template Injection in nystudio107/craft-seomatic
Advisory: GHSA-m3xv-x3ph-mq22
Aliases: CVE-2021-44618
Published: 2022-03-12T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic prior to 3.4.12 in src/helpers/UrlHelper.php via the host header.
Password stored in plain text by Jenkins Proxmox Plugin
Advisory: GHSA-w97x-j6rg-55v5
Aliases: CVE-2022-28141
Published: 2022-03-30T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Proxmox Plugin 0.5.0 and earlier stores the Proxmox Datacenter password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
XML Entity Expansion in trytond and proteus
Advisory: GHSA-pm3h-mm62-pwm8
Aliases: CVE-2022-26662
Published: 2022-03-11T00:02:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An XML Entity Expansion (XEE) issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An unauthenticated user can send a crafted XML-RPC message to consume all the resources of the server.
golang.org/x/crypto/ssh Denial of service via crafted Signer
Advisory: GHSA-8c26-wmh5-6g9v
Aliases: CVE-2022-27191
Published: 2022-03-19T00:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
Symfony Http-Kernel has non-constant time comparison in UriSigner
Advisory: GHSA-q8hg-pf8v-cxrv
Aliases: CVE-2019-18887
Published: 2022-03-26T00:22:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

When checking the signature of an URI (an ESI fragment URL for instance), the URISigner did not used a constant time string comparison function, resulting in a potential remote timing attack vulnerability.
Missing permission check in Jenkins Continuous Integration with Toad Edge Plugin
Advisory: GHSA-8hh2-rxm8-7fj8
Aliases: CVE-2022-28147
Published: 2022-03-30T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Type Confusion in ImpressCMS
Advisory: GHSA-m8xh-cqc2-5q6f
Aliases: CVE-2021-26600
Published: 2022-03-29T00:01:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ImpressCMS before 1.4.3 has plugins/preloads/autologin.php type confusion with resultant Authentication Bypass (!= instead of !==).
Cross-site Scripting in Parsedown
Advisory: GHSA-qgpv-86r3-87fh
Aliases: CVE-2018-1000162
Published: 2022-03-30T18:26:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.
saleor Missing Authorization vulnerability
Advisory: GHSA-mcgw-5fhw-3fq8
Aliases: CVE-2022-0932
Published: 2022-03-12T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Missing Authorization in saleor prior to 3.1.2.
Improper Input Validation in GoGo Protobuf
Advisory: GHSA-c3h9-896r-86jm
Aliases: CVE-2021-3121
Published: 2022-03-28T20:28:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.
Cross-site Scripting in jeecg-boot
Advisory: GHSA-q448-6c3m-cxmj
Aliases: CVE-2021-44585
Published: 2022-03-11T00:01:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

jeecg-boot is a code generator. A Cross Site Scripting (XSS) vulnerabilitiy exists in jeecg-boot 3.0 in /jeecg-boot/jmreport/view with a mouseover event.
CSRF vulnerability in Jenkins CloudBees AWS Credentials Plugin
Advisory: GHSA-pv4m-7c68-f4c5
Aliases: CVE-2022-27198
Published: 2022-03-16T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins CloudBees AWS Credentials Plugin 189.v3551d5642995 and earlier allows attackers with Overall/Read permission to connect to an AWS service using an attacker-specified token.
Unrestricted Upload of File with Dangerous Type in microweber
Advisory: GHSA-6vx5-cg2p-7g5v
Aliases: CVE-2022-0912
Published: 2022-03-12T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.12.
Command injection in libvcs and vcspull
Advisory: GHSA-mv2w-4jqc-6fg4
Aliases: CVE-2022-21187
Published: 2022-03-15T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg), the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.
Allocation of Resources Without Limits or Throttling in nvflare
Advisory: GHSA-jx8f-cpx7-fv47
Aliases: CVE-2022-21822
Published: 2022-03-18T23:18:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
NVIDIA FLARE contains a vulnerability in Admin Interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable

All versions before 2.0.16 are affected.

### Patches
The patch will be included in nvflare==2.0.16.

### Workarounds
The changes in commits https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e and https://github.com/NVIDIA/NVFlare/commit/93588b3a0dff9bd4568983071b74d8b420de3a6e  can be applied to any version of the NVIDIA FLARE without any adverse effect.

### Additional information
Issue Found on: 2022.3.3
Issue Found by: Oliver Sellwood (@Nintorac)
SQL Injection in FreeTAKServer-UI
Advisory: GHSA-jr2m-29wj-w9qc
Aliases: CVE-2022-25506
Published: 2022-03-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

FreeTAKServer-UI v1.9.8 was discovered to contain a SQL injection vulnerability via the API endpoint /AuthenticateUser.
Hidden functionality in node-ipc
Advisory: GHSA-8gr3-2gjw-jj7g
Published: 2022-03-16T23:54:33Z

The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions < 9.2.2.
FormField with square brackets in field name skips validation
Advisory: GHSA-7mv4-4xpg-xq44
Aliases: CVE-2020-26138
Published: 2022-03-26T00:14:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

FileField with array notation skips validation

The FileField class is commonly used for file upload in custom code on a Silverstripe website. This field is designed to be used with a single file upload.

PHP allows for submitting multiple values by adding square brackets to the field name. When this is done to a FileField, it will be coerced into allowing multiple files by using this notation. This is not a supported feature, though nothing is done to prevent this.

In this scenario, validation such as limiting allowed extensions is not applied, and the FileField->saveInto() behaviour is not triggered. If custom controller logic is used to process the file uploads, it might implicitly rely on validation to be provided by the Form system, which is not the case.
Use of insecure temporary file in Horovod
Advisory: GHSA-47wv-vhj2-g66m
Aliases: CVE-2022-0315
Published: 2022-03-29T19:18:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

### Impact
The insecure `tempfile.mktemp()` is used when Horovod is run in an LSF job with `jsrun`. In that situation, a jsrun rank file is created with `mktemp`, which could be hijacked by another process to read or manipulate the content.

This issue does not impact the use of MPI, Gloo, Spark or Ray.

### Patches
The problem has been fixed in [b96ecae4](https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41).

### Workarounds
The rank file is not created when `binding_args` are provided in the `Settings` instance.

### References
Please see https://github.com/horovod/horovod/pull/3358 for details.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/horovod/horovod](https://github.com/horovod/horovod/issues/new/choose)