aswin1906/github-advisory-2022 huggingface dataset:
Apache Tomcat Example Application CSRF and XSS Vulnerabilities
Advisory: GHSA-g77g-vjjm-x83j
Aliases: CVE-2007-4724
Published: 2022-05-01T18:26:30Z

Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
Netty denial of service vulnerability
Advisory: GHSA-7vpq-g998-qpv7
Aliases: CVE-2014-0193
Published: 2022-05-13T01:54:02Z

`WebSocket08FrameDecoder` in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a `TextWebSocketFrame` followed by a long stream of `ContinuationWebSocketFrames`.
Improper Input Validation in Apache Kafka
Advisory: GHSA-47w3-66wq-cpxg
Aliases: CVE-2018-17196
Published: 2022-05-24T16:50:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Kafka versions between 0.11.0.0 and 2.1.0, it is possible to manually craft a Produce request which bypasses transaction/idempotent ACL validation. Only authenticated clients with Write permission on the respective topics are able to exploit this vulnerability. Users should upgrade to 2.1.1 or later where this vulnerability has been fixed.
Improper Authentication (empty password) in Jenkins Active Directory Plugin
Advisory: GHSA-8wcw-cw2f-h4g2
Aliases: CVE-2020-2300
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode.

The Windows/ADSI mode does not specifically prohibit use of empty passwords in Active Directory Plugin prior to 2.20 and 2.16.1. If the Active Directory server allows the unauthenticated bind operation, this allows attackers to log in to Jenkins as any user by providing an empty password.

Active Directory Plugin 2.20 and 2.16.1 prohibits the use of an empty password to log in.
Jenkins Libvirt Slaves Plugin vlnerable to Credential Enumeration
Advisory: GHSA-8j3m-j6x6-cp5v
Aliases: CVE-2019-10473
Published: 2022-05-24T16:59:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Libvirt Slaves Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
LibreNMS Arbitrary File Read
Advisory: GHSA-4ccx-wjqp-5fww
Aliases: CVE-2017-16759
Published: 2022-05-13T01:44:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

The installation process in LibreNMS before 2017-08-18 allows remote attackers to read arbitrary files, related to html/install.php.
Kirby XSS Vulnerability
Advisory: GHSA-3gq5-r59m-mmv2
Aliases: CVE-2018-16630
Published: 2022-05-14T01:31:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file.
Prototype Pollution in dset
Advisory: GHSA-23wx-cgxq-vpwx
Aliases: CVE-2022-25645
Published: 2022-05-03T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

All versions of `dset` prior to 3.1.2 are vulnerable to Prototype Pollution via `dset/merge` mode, as the `dset` function checks for prototype pollution by validating if the top-level path contains `__proto__`, `constructor` or `prototype`. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution.
Missing permission checks in Health Advisor by CloudBees Plugin
Advisory: GHSA-h72v-652w-xv64
Aliases: CVE-2020-2094
Published: 2022-05-24T17:06:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Health Advisor by CloudBees Plugin 3.0 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to send an email with fixed content to an attacker-specified recipient.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

Health Advisor by CloudBees Plugin 3.0.1 requires POST requests and Overall/Administer permission for the affected form validation methods.
Apache Ambari SSRF Vulnerability
Advisory: GHSA-9g2j-5685-h44h
Aliases: CVE-2015-1775
Published: 2022-05-17T04:03:11Z

Server-side request forgery (SSRF) vulnerability in the proxy endpoint (`api/v1/proxy`) in Apache Ambari before 2.1.0 allows remote authenticated users to conduct port scans and access unsecured services via a crafted REST call.
SQL injection in SiteServer CMS
Advisory: GHSA-5xr5-v2h7-2w7w
Aliases: CVE-2021-42655
Published: 2022-05-25T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.
ChakraCore RCE Vulnerability
Advisory: GHSA-ggvv-6v25-r49r
Aliases: CVE-2018-8384
Published: 2022-05-13T01:20:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8266, CVE-2018-8380, CVE-2018-8381.
Zope DocumentTemplate package allows unauthenticated write
Advisory: GHSA-j5cc-3h6r-jqh4
Aliases: CVE-2000-0483
Published: 2022-05-03T03:06:42Z

The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify DTMLDocuments or DTMLMethods without authorization.
Secret stored in plain text by Jenkins Slack Upload Plugin
Advisory: GHSA-656g-hf8v-x2rw
Aliases: CVE-2020-2208
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Slack Upload Plugin 1.7 and earlier stores a secret unencrypted in job `config.xml` files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Reflected XSS vulnerability in Jenkins markup formatter preview
Advisory: GHSA-7qf3-c2q8-69m3
Aliases: CVE-2021-21610
Published: 2022-05-24T17:39:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins allows administrators to choose the markup formatter to use for descriptions of jobs, builds, views, etc. displayed in Jenkins. When editing such a description, users can choose to have Jenkins render a formatted preview of the description they entered.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not implement any restrictions for the URL rendering the formatted preview of markup passed as a query parameter. This results in a reflected cross-site scripting (XSS) vulnerability if the configured markup formatter does not prohibit unsafe elements (JavaScript) in markup, like [Anything Goes Formatter Plugin](https://plugins.jenkins.io/anything-goes-formatter/).

Jenkins 2.275, LTS 2.263.2 requires that preview URLs are accessed using POST and sets Content-Security-Policy headers that prevent execution of unsafe elements when the URL is accessed directly.\n\nIn case of problems with this change, these protections can be disabled by setting the [Java system properties](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.markup.MarkupFormatter.previewsAllowGET` to `true` and/or `hudson.markup.MarkupFormatter.previewsSetCSP` to `false`. Doing either is discouraged.
CodeIgniter and Kohana vulnerable to PHP Object Injection
Advisory: GHSA-w9ph-q4h9-rwq6
Aliases: CVE-2014-8684
Published: 2022-05-17T00:47:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-hqfh-p9h7-m6v5
Aliases: CVE-2017-1000509
Published: 2022-05-14T03:41:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.
Ignite Realtime Openfire vulnerable to Server Side Request Forgery 
Advisory: GHSA-mfjw-x4q4-69p9
Aliases: CVE-2019-18394
Published: 2022-05-24T16:59:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests. The issue is fixed in version 4.5.0-beta.
Use of a weak cryptographic algorithm in Gradle
Advisory: GHSA-hhr2-f668-ff2w
Aliases: CVE-2019-16370
Published: 2022-05-24T16:56:18Z

The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.
apollo_upload_server has Denial of Service vulnerability
Advisory: GHSA-w6pv-c757-6rgr
Aliases: CVE-2021-39880
Published: 2022-05-24T19:16:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A Denial Of Service vulnerability in the apollo_upload_server Ruby gem in GitLab CE/EE version 11.11 and above allows an attacker to deny access to all users via specially crafted requests to the apollo_upload_server middleware.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
Advisory: GHSA-895m-ww55-59vw
Aliases: CVE-2016-3086
Published: 2022-05-17T01:08:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-jhvh-mjfg-5m99
Aliases: CVE-2019-7903
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template.
Improper Input Validation in pyftpdlib
Advisory: GHSA-5f3f-pg2c-cxcv
Aliases: CVE-2007-6739
Published: 2022-05-01T18:45:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

FTPServer.py in pyftpdlib before 0.2.0 allows remote attackers to cause a denial of service via a long command.
Plone Filesystem path information leak
Advisory: GHSA-rg52-j87w-pf83
Aliases: CVE-2013-7060
Published: 2022-05-17T04:41:01Z

Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope.
Missing permission checks in Pipeline GitHub Notify Step Plugin allows capturing credentials
Advisory: GHSA-x7rc-5mjg-5pvr
Aliases: CVE-2020-2117
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
OpenNMS Horizon vulnerable to XSS
Advisory: GHSA-9hhc-cc6c-99hh
Aliases: CVE-2021-25934
Published: 2022-05-24T19:03:10Z

In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.7-1 are vulnerable to Stored Cross-Site Scripting, since the function `createRequisitionedNode()` does not perform any validation checks on the input sent to the `node-label` parameter. Due to this flaw an attacker could inject an arbitrary script which will be stored in the database.
XSS in baserCMS
Advisory: GHSA-994g-74gq-5qpr
Aliases: CVE-2018-0570
Published: 2022-05-14T03:06:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting vulnerability in baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Deserialization of Untrusted Data in Spring AMQP
Advisory: GHSA-vqqg-xgv7-cf68
Aliases: CVE-2017-8045
Published: 2022-05-17T00:16:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.
Arbitrary file upload in ShopXO
Advisory: GHSA-86p5-97jr-r598
Aliases: CVE-2021-41938
Published: 2022-05-20T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in ShopXO CMS 2.2.0. After entering the management page, there is an arbitrary file upload vulnerability in three locations.
Sensitive Data Exposure in baserCMS
Advisory: GHSA-w935-p7mg-xc96
Aliases: CVE-2018-0575
Published: 2022-05-14T03:06:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction in mail form to view a file which is uploaded by a site user via unspecified vectors.
Withdrawn Advisory: Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-988g-wfwf-5666
Aliases: CVE-2019-8228
Published: 2022-05-24T17:00:29Z
Withdrawn: 2023-09-27T00:33:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

## Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not affect a package in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references.

## Original Description

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template.
Yii Framework Code Injection
Advisory: GHSA-m2p5-fwp2-qcw2
Aliases: CVE-2018-8074
Published: 2022-05-24T16:56:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Yii 2.x before 2.0.15 allows remote attackers to inject unintended search conditions via a variant of the CVE-2018-7269 attack in conjunction with the Elasticsearch extension.
Plone Unauthorized Access Vulnerability
Advisory: GHSA-qc57-h2f7-p4hx
Aliases: CVE-2017-1000483
Published: 2022-05-13T01:41:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Accessing private content via `str.format` in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.
golang.org/x/net/html NULL Pointer Dereference vulnerability
Advisory: GHSA-5p4h-3377-7w67
Aliases: CVE-2018-17075
Published: 2022-05-13T01:19:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The html package (aka x/net/html) before 2018-07-13 in Go mishandles "in frameset" insertion mode, leading to a "panic: runtime error" for html.Parse of <template><object>, <template><applet>, or <template><marquee>. This is related to HTMLTreeBuilder.cpp in WebKit.
Jenkins Gem Publisher Plugin stores credentials as plaintext
Advisory: GHSA-6pqm-pp65-mc26
Aliases: CVE-2019-10426
Published: 2022-05-24T22:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Gem Publisher Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
component-flatten vulnerable to Prototype Pollution
Advisory: GHSA-g6r3-hhg9-qf58
Aliases: CVE-2019-10794
Published: 2022-05-24T17:09:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

All versions of component-flatten are vulnerable to Prototype Pollution. The a function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.
Silverstripe CMS XSS Vulnerability
Advisory: GHSA-xmjh-wjc5-wg4h
Aliases: CVE-2017-5197
Published: 2022-05-14T01:19:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.
Use of Insufficiently Random Values in Apereo CAS
Advisory: GHSA-g24w-373r-5pxg
Aliases: CVE-2019-10754
Published: 2022-05-24T16:56:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Multiple classes used within Apereo CAS before release 6.1.0-RC5 makes use of apache commons-lang3 RandomStringUtils for token and ID generation which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong.
Django Allows Open Redirects
Advisory: GHSA-vq3h-3q7v-9prw
Aliases: CVE-2014-3730
Published: 2022-05-14T02:09:43Z

The `django.util.http.is_safe_url` function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."
ChakraCore RCE Vulnerability
Advisory: GHSA-25vh-gq6v-hrx5
Aliases: CVE-2018-0979
Published: 2022-05-13T01:18:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0980, CVE-2018-0990, CVE-2018-0993, CVE-2018-0994, CVE-2018-0995, CVE-2018-1019.
Richfaces vulnerable to arbitrary code execution
Advisory: GHSA-j7mw-7crr-658v
Aliases: CVE-2018-14667
Published: 2022-05-13T01:17:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via `org.ajax4jsf.resource.UserResource$UriData`.
ChakraCore RCE Vulnerability
Advisory: GHSA-fmv2-jv3p-6w47
Aliases: CVE-2018-8556
Published: 2022-05-13T01:20:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8541, CVE-2018-8542, CVE-2018-8543, CVE-2018-8551, CVE-2018-8555, CVE-2018-8557, CVE-2018-8588.
Nimbus JOSE+JWT missing overflow check
Advisory: GHSA-2qp9-wg27-9pcv
Aliases: CVE-2017-12972
Published: 2022-05-13T01:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for the same HMAC.
Asset Pipeline Grails Plugin vulnerable to Path Traversal
Advisory: GHSA-w73q-mc9g-j56x
Aliases: CVE-2018-1000817
Published: 2022-05-13T01:48:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Asset Pipeline Grails Plugin Asset-pipeline plugin version Prior to 2.14.1.1, 2.15.1 and 3.0.6 contains a Incorrect Access Control vulnerability in Applications deployed in Jetty that can result in Download .class files and any arbitrary file. This attack appear to be exploitable via Specially crafted GET request containing directory traversal from assets-pipeline context. This vulnerability appears to have been fixed in 2.14.1.1 (for Grails 2.x), 2.15.1 (for Grails 3 and Java 7) and 3.0.6 (for Grails 3 and Java 8).
Jenkins Libvirt Slaves Plugin vlnerable to Cross-Site Request Forgery
Advisory: GHSA-m295-m3x4-3mmc
Aliases: CVE-2019-10471
Published: 2022-05-24T16:59:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability in Jenkins Libvirt Slaves Plugin allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
AlchemyCMS is vulnerable to stored XSS via the /admin/pictures image field
Advisory: GHSA-7mj4-2984-955f
Aliases: CVE-2018-18307
Published: 2022-05-14T01:57:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

A stored XSS vulnerability has been discovered in version 4.1.0 of AlchemyCMS via the /admin/pictures image filename field.
Improper Restriction of XML External Entity Reference in Jelly
Advisory: GHSA-6g33-82gc-3pw5
Aliases: CVE-2017-12621
Published: 2022-05-17T00:34:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

During Jelly (xml) file parsing with Apache Xerces, if a custom doctype entity is declared with a "SYSTEM" entity with a URL and that entity is used in the body of the Jelly file, during parser instantiation the parser will attempt to connect to said URL. This could lead to XML External Entity (XXE) attacks in Apache Commons Jelly before 1.0.1.
Django Vulnerable to Cache Poisoning
Advisory: GHSA-q7q2-qf2q-rw3w
Aliases: CVE-2014-1418
Published: 2022-05-17T03:07:00Z

Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.
ASP.NET Core and Visual Studio Denial of Service Vulnerability
Advisory: GHSA-242j-2gm6-5rwx
Aliases: CVE-2021-1723
Published: 2022-05-24T17:38:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial-of-service vulnerability exists in the way Kestrel parses HTTP/2 requests. The security update addresses the vulnerability by fixing the way the Kestrel parses HTTP/2 requests. Users are advised to upgrade.
Cross-site Scripting in Apache JSPWiki
Advisory: GHSA-p2r4-rpj8-m2p9
Aliases: CVE-2019-12407
Published: 2022-05-24T16:56:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the remember parameter on some of the JSPs, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Numpy missing input validation
Advisory: GHSA-frgw-fgh6-9g52
Aliases: CVE-2017-12852
Published: 2022-05-13T01:42:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.
Wildfly-Core user account mismanagement
Advisory: GHSA-p9xf-3rm3-qh2h
Aliases: CVE-2021-3717
Published: 2022-05-25T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.
Deserialization of Untrusted Data in Jenkins
Advisory: GHSA-28p3-mchr-9frj
Aliases: CVE-2018-1999042
Published: 2022-05-14T01:04:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in XStream2.java that allows attackers to have Jenkins resolve a domain name when deserializing an instance of java.net.URL.
materialize-css vulnerable to cross-site Scripting (XSS) due to improper escape of user input
Advisory: GHSA-7jvx-f994-rfw2
Aliases: CVE-2022-25349
Published: 2022-05-03T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

All versions of package materialize-css are vulnerable to Cross-site Scripting (XSS) due to improper escape of user input (such as &lt;not-a-tag /&gt;) that is being parsed as HTML/JavaScript, and inserted into the Document Object Model (DOM). This vulnerability can be exploited when the user-input is provided to the autocomplete component.
ChakraCore RCE Vulnerability
Advisory: GHSA-gqh4-4r89-pr95
Aliases: CVE-2018-8227
Published: 2022-05-13T01:20:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8229.
Magento 2 Community Edition IDOR Vulnerability
Advisory: GHSA-3pgc-7jf3-5x5g
Aliases: CVE-2019-7890
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.
Laravel Sensitive Data Exposure
Advisory: GHSA-c2v7-j5gq-wcq4
Aliases: CVE-2017-14775
Published: 2022-05-17T00:34:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Laravel before 5.5.10 mishandles the remember_me token verification process because DatabaseUserProvider does not have constant-time token comparison.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-x2fq-gq6c-hp44
Aliases: CVE-2017-7887
Published: 2022-05-17T02:45:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Dolibarr ERP/CRM 4.0.4 has XSS in `doli/societe/list.php` via the sall parameter.
XXE vulnerability in Jenkins Robot Framework Plugin
Advisory: GHSA-m53p-f25q-q6fg
Aliases: CVE-2020-2092
Published: 2022-05-24T17:06:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Robot Framework Plugin 2.0.0 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for the 'Publish Robot Framework' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.

Robot Framework Plugin 2.0.1 disables external entity resolution for its XML parser.
codders-dataset Process Table Local Plaintext Credential Disclosure
Advisory: GHSA-w9vv-fvw8-j6q3
Aliases: CVE-2014-4991
Published: 2022-05-14T03:48:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

`lib/dataset/database/mysql.rb` and `lib/dataset/database/postgresql.rb` in the codders-dataset gem 1.3.2.1 for Ruby both place credentials on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
ccsv Double Free vulnerability
Advisory: GHSA-5gxp-c379-pj42
Aliases: CVE-2017-15364
Published: 2022-05-17T00:29:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

The foreach function in `ext/ccsv.c` in Ccsv 1.1.0 allows remote attackers to cause a denial of service (double free and application crash) or possibly have unspecified other impact via a crafted file.
Password stored in plain text by Jenkins couchdb-statistics Plugin
Advisory: GHSA-jrjr-7rf4-3wqh
Aliases: CVE-2020-2291
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

couchdb-statistics Plugin 0.3 and earlier stores its server password unencrypted in its global configuration file `org.jenkinsci.plugins.couchstats.CouchStatsConfig.xml` on the Jenkins controller as part of its configuration.

This password can be viewed by users with access to the Jenkins controller file system.

couchdb-statistics Plugin 0.4 stores its server password encrypted once its configuration is saved again.
ChakraCore RCE Vulnerability
Advisory: GHSA-ch84-pxpj-7hhm
Aliases: CVE-2018-8283
Published: 2022-05-13T01:20:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296, CVE-2018-8298.
SSL/TLS certificate validation unconditionally disabled by Jenkins Micro Focus Application Automation Tools Plugin
Advisory: GHSA-q296-9j5x-fxf4
Aliases: CVE-2021-22511
Published: 2022-05-24T17:46:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Micro Focus Application Automation Tools Plugin 6.7 and earlier unconditionally disables SSL/TLS certificate validation for connections to Service Virtualization servers.

Micro Focus Application Automation Tools Plugin 6.8 no longer disables SSL/TLS certificate validation unconditionally by default. It provides an option to disable SSL/TLS certification validation for connections to Service Virtualization servers.
Unsafe pyyaml load usage in PyAnyAPI
Advisory: GHSA-vg8g-jpm9-jh8r
Aliases: CVE-2017-16616
Published: 2022-05-13T01:44:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before 0.6.1. A YAML parser can execute arbitrary Python commands resulting in command execution because `load` is used where `safe_load` should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.
Improper Removal of Sensitive Information Before Storage or Transfer in Strapi
Advisory: GHSA-vgj7-895j-gpr6
Aliases: CVE-2022-30618
Published: 2022-05-20T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for API users if content types accessible to the authenticated user contain relationships to API users (from:users-permissions). There are many scenarios in which such details from API users can leak in the JSON response within the admin panel, either through a direct or indirect relationship. Access to this information enables a user to compromise these users’ accounts if the password reset API endpoints have been enabled. In a worst-case scenario, a low-privileged user could get access to a high-privileged API account, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users.
Improper permission checks allow canceling queue items and aborting builds in Jenkins
Advisory: GHSA-q4wp-8c99-69pw
Aliases: CVE-2021-21670
Published: 2022-05-24T19:06:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins 2.299 and earlier, LTS 2.289.1 and earlier allows users to cancel queue items and abort builds of jobs for which they have Item/Cancel permission even when they do not have Item/Read permission.

Jenkins 2.300, LTS 2.289.2 requires that users have Item/Read permission for applicable types in addition to Item/Cancel permission.

As a workaround on earlier versions of Jenkins, do not grant Item/Cancel permission to users who do not have Item/Read permission.
Improper Verification of Cryptographic Signature in Apache Netbeans
Advisory: GHSA-cf8q-j9h3-7237
Aliases: CVE-2019-17561
Published: 2022-05-24T17:12:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The "Apache NetBeans" autoupdate system does not fully validate code signatures. An attacker could modify the downloaded nbm and include additional code. "Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability. NetBeans releases before the Apache transition started may also be affected.
JSON-Patch Out-of-bounds Write vulnerability
Advisory: GHSA-gxhv-3hwf-wjp9
Aliases: CVE-2018-14632
Published: 2022-05-13T01:34:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

An out of bound write can occur when patching an Openshift object using the `oc patch` functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.
ChakraCore remote code execution vulnerability
Advisory: GHSA-rxg4-vw2v-rxm4
Aliases: CVE-2018-8380
Published: 2022-05-13T01:20:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8266, CVE-2018-8381, CVE-2018-8384.
LMDB invalid write 
Advisory: GHSA-r8g9-w4f3-9crm
Aliases: CVE-2019-16226
Published: 2022-05-24T16:55:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in py-lmdb 0.97. `mdb_node_del` does not validate a `memmove` in the case of an unexpected `node->mn_hi`, leading to an invalid write operation.
Plone Privilege Escallation
Advisory: GHSA-cjg3-q24h-9qwf
Aliases: CVE-2020-7938
Published: 2022-05-24T17:07:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.
ReviewBoard and Djblets library are vulnerable to code execution
Advisory: GHSA-58h8-44mg-r43x
Aliases: CVE-2013-4409
Published: 2022-05-05T00:29:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An eval() vulnerability exists in Python Software Foundation Djblets version before 0.6.30 and 0.7.0 before 0.7.19 and Beanbag Review Board before 1.7.15 when parsing JSON requests allowing an attacker to execute arbitrary Python code.
Withdrawn Advisory: kubernetes-nmstate Insecure Privilege Management
Advisory: GHSA-jw82-xjgr-g6f8
Aliases: CVE-2020-1742
Published: 2022-05-24T19:04:13Z
Withdrawn: 2023-08-23T21:44:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

## Withdrawn Advisory
This advisory has been withdrawn. This link is maintained to preserve external references.

## Original Description
An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.
Cleartext Transmission of Sensitive Information in Apache CXF
Advisory: GHSA-v45r-rj5x-hpg2
Aliases: CVE-2014-0035
Published: 2022-05-13T01:09:20Z

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.
MySQL for Node.js Unsafe Options
Advisory: GHSA-f982-mxwc-3mrx
Aliases: CVE-2019-14939
Published: 2022-05-24T16:53:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the mysql (aka mysqljs) module 2.17.1 for Node.js. `The LOAD DATA LOCAL INFILE` option is open by default.
Symfony Session Fixation Vulnerability
Advisory: GHSA-j5jh-hpr4-h332
Aliases: CVE-2015-8124
Published: 2022-05-14T02:47:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

A session fixation vulnerability within the "Remember Me" login feature allows an attacker to impersonate the victim towards the web application if the session id value was previously known to the attacker. This issue has been fixed in Symfony 2.3.35, 2.6.12, and 2.7.7. Note that no fixes are provided for Symfony 2.4 and 2.5 as they are not maintained anymore. Symfony 2.8 and 3.0 haven't been released yet and the fix will be included in their first stable releases.
url_redirect for Typo3 SQLi Vulnerability
Advisory: GHSA-hcpv-xh8q-f3vq
Aliases: CVE-2019-16682
Published: 2022-05-24T16:58:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.
Features file injection vulnerability
Advisory: GHSA-42gq-h7xj-33r4
Aliases: CVE-2013-4318
Published: 2022-05-05T00:29:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

File injection vulnerability in Ruby gem Features 0.3.0 allows remote attackers to inject malicious html in the `/tmp` directory.
Grafana XSS Vulnerability
Advisory: GHSA-x5fh-fvvr-892f
Aliases: CVE-2018-1000816
Published: 2022-05-14T01:42:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..
OpenStack Murano Code Execution
Advisory: GHSA-87r7-q54j-f9qg
Aliases: CVE-2016-4972
Published: 2022-05-17T03:48:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.
Arbitrary file write in Apache Commons Fileupload
Advisory: GHSA-qx6h-9567-5fqw
Aliases: CVE-2013-2186
Published: 2022-05-14T03:52:43Z

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
ChakraCore RCE Vulnerability
Advisory: GHSA-v9jg-m6g5-h3hh
Aliases: CVE-2016-3386
Published: 2022-05-14T02:23:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3389, CVE-2016-7190, and CVE-2016-7194.
CSRF vulnerabilities in Jenkins requests-plugin Plugin
Advisory: GHSA-5frh-wx6v-8m2r
Aliases: CVE-2021-21675
Published: 2022-05-24T19:06:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

requests-plugin Plugin 2.2.12 and earlier does not require POST requests to request and apply changes, resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to create requests and/or have administrators apply pending requests, like renaming or deleting jobs, deleting builds, etc.

requests-plugin Plugin 2.2.13 requires POST requests for the affected HTTP endpoints. This was partially fixed in requests-plugin Plugin 2.2.8 to require POST requests for some of the affected HTTP endpoints, but the endpoint allowing administrators to apply pending requests remained unprotected until 2.2.13.
Async-h1 request smuggling possible with long unread bodies
Advisory: GHSA-c8rq-crxj-mj9m
Aliases: CVE-2020-36202
Published: 2022-05-24T17:40:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in the async-h1 crate before 2.3.0 for Rust. Request smuggling can occur when used behind a reverse proxy.
Improper Authentication in Apache Tomcat
Advisory: GHSA-9xrj-439h-62hg
Aliases: CVE-2012-5886
Published: 2022-05-17T01:38:30Z

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
OpenStack Compute (nova) allows remote authenticated users to cause a denial of service
Advisory: GHSA-mfmj-gwg3-vhw7
Aliases: CVE-2015-3280
Published: 2022-05-14T01:58:45Z

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
Ember.js Cross-site Scripting vulnerability
Advisory: GHSA-8xm3-gm7c-5fjx
Aliases: CVE-2014-0013
Published: 2022-05-14T03:07:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Ember.js 1.0.x before 1.0.1, 1.1.x before 1.1.3, 1.2.x before 1.2.1, 1.3.x before 1.3.1, and 1.4.x before 1.4.0-beta.2 allows remote attackers to conduct cross-site scripting (XSS) attacks by leveraging an application that contains templates whose context is set to a user-supplied primitive value and also contain the `{{this}}` special Handlebars variable.
XXE vulnerability in Jenkins Performance Plugin
Advisory: GHSA-hr8p-76q8-fxwq
Aliases: CVE-2021-21701
Published: 2022-05-24T19:20:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Performance Plugin 3.20 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control workspace contents to have Jenkins parse a crafted XML report file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

As of publication of this advisory, there is no fix.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-cpw3-x7gf-p872
Aliases: CVE-2018-1000169
Published: 2022-05-14T00:55:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An exposure of sensitive information vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in CLICommand.java and ViewOptionHandler.java that allows unauthorized attackers to confirm the existence of agents or views with an attacker-specified name by sending a CLI command to Jenkins.
Apache Solr UpdateRequestHandler for XML resolves XML External Entities
Advisory: GHSA-998j-j6v9-5846
Aliases: CVE-2013-6407
Published: 2022-05-17T04:39:49Z

The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Improper Validation of Certificate with Host Mismatch in Jenkins Mailer Plugin
Advisory: GHSA-6fr3-286q-q3cr
Aliases: CVE-2020-2252
Published: 2022-05-24T17:28:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Jenkins Mailer Plugin prior to 1.32.1, 1.31.1, and 1.29.1 does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

Mailer Plugin 1.32.1, 1.31.1, and 1.29.1 validates the SMTP hostname when connecting via TLS by default. In Mailer Plugin 1.32 and earlier, administrators can set the Java system property mail.smtp.ssl.checkserveridentity to true on startup to enable this protection.

In case of problems, this protection can be disabled again by setting the Java system property mail.smtp.ssl.checkserveridentity to false on startup.
Denial of Service in Apache ActiveMQ
Advisory: GHSA-9wcx-326r-7j7w
Aliases: CVE-2011-4905
Published: 2022-05-17T05:35:59Z

Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.
Sandbox bypass in Script Security Plugin
Advisory: GHSA-xvxq-hq48-xphm
Aliases: CVE-2019-1003029
Published: 2022-05-13T01:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
Craft CMS XSS Vulnerability
Advisory: GHSA-6pvw-hh48-jx7p
Aliases: CVE-2017-9516
Published: 2022-05-17T02:14:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.
Stored XSS vulnerability in ClearCase Release Plugin
Advisory: GHSA-2c84-35rv-6q3f
Aliases: CVE-2020-2270
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins ClearCase Release Plugin 0.3 and earlier does not escape the composite baseline in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Improper Limitation of a Pathname to a Restricted Directory in Spring Framework
Advisory: GHSA-hhm4-hwq6-3c6w
Aliases: CVE-2014-3625
Published: 2022-05-13T01:02:39Z

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
Cross-site Scripting in Apache Struts
Advisory: GHSA-265r-pp83-gww7
Aliases: CVE-2015-2992
Published: 2022-05-24T17:09:44Z

When the Struts2 debug mode is turned on, under certain conditions an arbitrary script may be executed in the 'Problem Report' screen. Also if JSP files are exposed to be accessed directly it's possible to execute an arbitrary script. 

It is generally not advisable to have debug mode switched on outside of the development environment. Debug mode should always be turned off in production setup. Also never expose JSPs files directly and hide them inside WEB-INF folder or define dedicated security constraints to block access to raw JSP files.

Struts >= 2.3.20 is not vulnerable to this attack. We recommend upgrading to Struts 2.3.20 or higher if turning off debug mode is not possible.