aswin1906/github-advisory-2022 huggingface dataset:
Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop
Advisory: GHSA-q46v-cj5v-hvg6
Aliases: CVE-2012-4449
Published: 2022-05-17T00:22:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Hadoop before 0.23.4, 1.x before 1.0.4, and 2.x before 2.0.2 generate token passwords using a 20-bit secret when Kerberos security features are enabled, which makes it easier for context-dependent attackers to crack secret keys via a brute-force attack.
Apache Tomcat XSS Vulnerabilities in Examples Web Application
Advisory: GHSA-hc39-rjwp-qffq
Aliases: CVE-2007-2449
Published: 2022-05-01T18:03:36Z

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the `;` character, as demonstrated by a URI containing a `snp/snoop.jsp;` sequence.
Uncaught Exception in bignum
Advisory: GHSA-6429-3g3w-6mw5
Aliases: CVE-2022-25324
Published: 2022-05-07T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All versions of the npm package bignum are vulnerable to Denial of Service (DoS) due to a type-check exception in V8. When verifying the type of the second argument to the .powm function, V8 will crash regardless of Node try/catch blocks.
ChakraCore RCE Vulnerability
Advisory: GHSA-788w-269g-j92q
Aliases: CVE-2018-8391
Published: 2022-05-13T01:20:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8354, CVE-2018-8456, CVE-2018-8457, CVE-2018-8459.
Subrion CMS CSRF Vulnerability
Advisory: GHSA-q4h5-g3w8-f9x7
Aliases: CVE-2017-6068
Published: 2022-05-14T01:22:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Subrion CMS 4.0.5 has CSRF in `admin/blocks/add/`. The attacker can create any block, and can optionally insert XSS via the content parameter.
Improper Authorization in Jenkins Alauda Kubernetes Suport Plugin
Advisory: GHSA-7h24-4x4c-69mf
Aliases: CVE-2019-16576
Published: 2022-05-24T17:03:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A missing permission check in Jenkins Alauda Kubernetes Suport Plugin 2.3.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.
Plone Open Redirect Vulnerability
Advisory: GHSA-69vh-662j-v988
Aliases: CVE-2016-7137
Published: 2022-05-14T02:46:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) `%2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions` or (2) `folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions` or the (3) `came_from` parameter to `/login_form`.
Django vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer
Advisory: GHSA-5h2q-4hrp-v9rr
Aliases: CVE-2012-3444
Published: 2022-05-17T05:12:01Z

The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.
Missing permission checks in Jenkins Maven Cascade Release Plugin
Advisory: GHSA-5xv9-gp22-gqm5
Aliases: CVE-2020-2294
Published: 2022-05-24T17:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Maven Cascade Release Plugin 1.3.2 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to start cascade builds and layout builds, and reconfigure the plugin.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-3q84-vrvx-rfvf
Aliases: CVE-2021-21687
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2446 / CVE-2021-21687: `FilePath#untar` does not check permission to create symbolic links when unarchiving a symbolic link.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2446 / CVE-2021-21687: `FilePath#untar` checks permission to create symbolic links when unarchiving a symbolic link.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Subrion CMS RCE Vulnerability
Advisory: GHSA-73xj-v6gc-g5p5
Aliases: CVE-2018-19422
Published: 2022-05-13T01:10:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

`/panel/uploads` in Subrion CMS 4.2.1 allows remote attackers to execute arbitrary PHP code via a .pht or .phar file, because the .htaccess file omits these.
Cross site scripting in publify
Advisory: GHSA-3h7v-wqw7-ff28
Aliases: CVE-2021-25975
Published: 2022-05-24T22:28:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS as a result of an unrestricted file upload. This issue allows a user with “publisher” role to inject malicious JavaScript via the uploaded html file.
Authentication Bypass Using an Alternate Path or Channel in SpringSource Spring Security and Acegi Security
Advisory: GHSA-3295-h9qx-r82x
Aliases: CVE-2010-3700
Published: 2022-05-14T02:43:11Z

VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
Improper Neutralization of Input During Web Page Generation in html5lib
Advisory: GHSA-v9v9-xffq-rwr4
Aliases: CVE-2016-9909
Published: 2022-05-17T02:57:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.
Spree does not properly restrict the use of a hash to provide values for a model's attributes
Advisory: GHSA-7h48-m3rw-vr27
Aliases: CVE-2008-7310
Published: 2022-05-17T05:31:08Z

Spree 0.2.0 does not properly restrict the use of a hash to provide values for a model's attributes, which allows remote attackers to set the Order state value and bypass the intended payment step via a modified URL, related to a "mass assignment" vulnerability.
Out-of-bounds Read in Facebook Hermes
Advisory: GHSA-x4cf-6jr3-3qvp
Aliases: CVE-2020-1915
Published: 2022-05-24T17:32:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
OXID eShop user impersonation vulnerability
Advisory: GHSA-4c39-hj99-5h2r
Aliases: CVE-2015-6926
Published: 2022-05-13T01:12:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The OpenID Single Sign-On authentication functionality in OXID eShop before 4.5.0 allows remote attackers to impersonate users via the email address in a crafted authentication token.
aptdaemon Information Disclosure via Improper Input Validation in Transaction class
Advisory: GHSA-wpmr-q825-x4c6
Aliases: CVE-2020-15703
Published: 2022-05-24T17:32:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root.
Improper input validation in cryptography
Advisory: GHSA-q3cj-2r34-2cwc
Aliases: CVE-2016-9243
Published: 2022-05-17T02:51:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

HKDF in cryptography before 1.5.3 returns an empty byte-string if used with a length less than algorithm.digest_size.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-47h6-hfpv-7phj
Aliases: CVE-2019-8159
Published: 2022-05-24T17:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-mgfr-44wv-hqv6
Aliases: CVE-2019-7938
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify catalog price rules to inject malicious javascript.
WEBrick RCE Vulnerability
Advisory: GHSA-369m-2gv6-mw28
Aliases: CVE-2017-10784
Published: 2022-05-14T02:03:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Basic authentication code in WEBrick library in Ruby before 2.2.8, 2.3.x before 2.3.5, and 2.4.x through 2.4.1 allows remote attackers to inject terminal emulator escape sequences into its log and possibly execute arbitrary commands via a crafted user name.
Improper Input Validation in Datomic
Advisory: GHSA-9pf8-qqhm-7w64
Aliases: CVE-2018-10054
Published: 2022-05-13T01:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code.
Jenkins Subversion Plugin Incorrect Authorization vulnerability
Advisory: GHSA-w9gq-8q35-3jcc
Aliases: CVE-2018-1000111
Published: 2022-05-13T01:48:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An improper authorization vulnerability exists in Jenkins Subversion Plugin version 2.10.2 and earlier in `SubversionStatus.java` and `SubversionRepositoryStatus.java` that allows an attacker with network access to obtain a list of nodes and users. As of version 2.10.3, the class handling requests to /subversion/ no longer extends the class handling requests to the …/search/ sub-path, therefore any such requests will fail.
Cross-site Scripting in JavaMelody
Advisory: GHSA-g66q-grxc-64j3
Aliases: CVE-2018-12432
Published: 2022-05-14T03:10:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.
XML External Entity Reference in Apache Sling
Advisory: GHSA-7g54-vgp6-jj5w
Aliases: CVE-2016-6798
Published: 2022-05-17T02:26:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the input string, which allows for XXE attacks in all scripts which use this method to validate user input, potentially allowing an attacker to read sensitive data on the filesystem, perform same-site-request-forgery (SSRF), port-scanning behind the firewall or DoS the application.
baserCMS Access Control Bypass 
Advisory: GHSA-v9gf-98vr-mgp2
Aliases: CVE-2015-5640
Published: 2022-05-13T01:08:49Z

baserCMS before 3.0.8 allows remote authenticated users to modify arbitrary user settings via a crafted request.
SimpleSAMLphp saml2 incorrect signature validation
Advisory: GHSA-g888-g2pp-82hf
Aliases: CVE-2018-7711
Published: 2022-05-14T03:34:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.
Cobbler subject to Command Injection
Advisory: GHSA-g34c-mg6m-xvxj
Aliases: CVE-2012-2395
Published: 2022-05-17T05:27:39Z

A Command Injection in action_power.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) username or (2) password fields to the power_system method in the xmlrpc API.
Code execution via SVG file upload in tiddlywiki
Advisory: GHSA-cr9c-rhq6-vh53
Aliases: CVE-2022-29351
Published: 2022-05-17T00:01:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG file.
OpenStack Keystone Insufficient token expiration
Advisory: GHSA-w66p-78g4-mr7g
Aliases: CVE-2012-5563
Published: 2022-05-17T01:39:21Z

OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by creating new tokens through token chaining.  NOTE: this issue exists because of a CVE-2012-3426 regression.
Plone Multiple cross-site scripting (XSS) vulnerabilities
Advisory: GHSA-89rq-27xp-vgv7
Aliases: CVE-2013-4190
Published: 2022-05-17T04:49:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Apache Groovy
Advisory: GHSA-qg25-hgjv-cg9q
Aliases: CVE-2015-3253
Published: 2022-05-13T01:25:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.
Exposure of Resource to Wrong Sphere in Liferay Portal
Advisory: GHSA-6xxc-4jc4-7jv3
Aliases: CVE-2021-33330
Published: 2022-05-24T22:28:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Liferay Portal 7.2.0 through 7.3.2, and Liferay DXP 7.2 before fix pack 9, allows access to Cross-origin resource sharing (CORS) protected resources if the user is only authenticated using the portal session authentication, which allows remote attackers to obtain sensitive information including the targeted user’s email address and current CSRF token.
Centreon Sensitive Data Exposure
Advisory: GHSA-rx4j-x3fh-9qwg
Aliases: CVE-2019-17106
Published: 2022-05-24T16:58:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Centreon Web through 2.8.29, disclosure of external components' passwords allows authenticated attackers to move laterally to external components.
Ansible discloses credential information
Advisory: GHSA-5xm4-jmpw-p6j3
Aliases: CVE-2014-4660
Published: 2022-05-17T19:57:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in `sources.list`, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the `deb http://user:pass@server:port/` format.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-3p5r-7cw3-2m67
Aliases: CVE-2013-2071
Published: 2022-05-17T02:44:28Z

java/org/apache/catalina/core/AsyncContextImpl.java in Apache Tomcat 7.x before 7.0.40 does not properly handle the throwing of a RuntimeException in an AsyncListener in an application, which allows context-dependent attackers to obtain sensitive request information intended for other applications in opportunistic circumstances via an application that records the requests that it processes.
Apache Atlas produces Stack trace in error response
Advisory: GHSA-fx92-wh72-8g9q
Aliases: CVE-2017-3154
Published: 2022-05-17T01:17:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Error responses from Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating included stack trace, exposing excessive information.
Jenkins Google Compute Engine Plugin Missing Authorization vulnerability
Advisory: GHSA-v98h-rv7j-hf6j
Aliases: CVE-2019-16547
Published: 2022-05-24T17:01:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment. Google Compute Engine Plugin 4.2.0 requires the appropriate Job/Configure permission to view these metadata.
simplejson before 2.6.1 vulnerable to array index error
Advisory: GHSA-9772-cwx9-r4cj
Aliases: CVE-2014-4616
Published: 2022-05-14T02:05:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.
Improper Restriction of XML External Entity Reference in Openpyxl
Advisory: GHSA-chqf-hx79-gxc6
Aliases: CVE-2017-5992
Published: 2022-05-17T02:58:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:H

Openpyxl 2.4.1 resolves external entities by default, which allows remote attackers to conduct XXE attacks via a crafted .xlsx document.
Buildbot CRLF Injection
Advisory: GHSA-66x7-2r56-fj77
Aliases: CVE-2019-7313
Published: 2022-05-14T01:36:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

`www/resource.py` in Buildbot before 1.8.1 allows CRLF injection in the Location header of `/auth/login` and `/auth/logout` via the redirect parameter. This affects other web sites in the same domain.
Missing hostname validation in Email Extension Plugin
Advisory: GHSA-4qrj-99r6-jfrh
Aliases: CVE-2020-2253
Published: 2022-05-24T17:28:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Email Extension Plugin 2.75 and earlier does not perform hostname validation when connecting to the configured SMTP server. This lack of validation could be abused using a man-in-the-middle attack to intercept these connections.

Email Extension Plugin 2.76 validates the SMTP hostname when connecting via TLS by default. In Email Extension Plugin 2.75 and earlier, administrators can set the Java system property `mail.smtp.ssl.checkserveridentity` to `true` on startup to enable this protection. Alternatively, this protection can be enabled (or disabled in the new version) via the 'Advanced Email Properties' field in the plugin’s configuration in Configure System.

In case of problems, this protection can be disabled again by setting `mail.smtp.ssl.checkserveridentity` to `false` using either method.
Several Zend Products Vulnerable to XXE and XEE attacks
Advisory: GHSA-5wm2-38q5-5rxv
Aliases: CVE-2014-2683
Published: 2022-05-14T00:56:24Z

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to cause a denial of service (CPU consumption) via (1) recursive or (2) circular references in an XML entity definition in an XML DOCTYPE declaration, aka an XML Entity Expansion (XEE) attack.  NOTE: this issue exists because of an incomplete fix for CVE-2012-6532.
Croogo vulnerable to XSS in title field
Advisory: GHSA-wr5c-4f2h-28m6
Aliases: CVE-2019-7169
Published: 2022-05-14T01:38:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored self-XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to `/admin/menus/menus/edit/3`.
Rancher Cross-site Scripting Vulnerability
Advisory: GHSA-6m8r-jh89-rq7h
Aliases: CVE-2021-25313
Published: 2022-05-24T17:43:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rancher allows remote attackers to execute JavaScript via malicious links. This issue affects: SUSE Rancher Rancher versions prior to 2.5.6.
Subversion Plugin stored XSS vulnerability before v2.13.1
Advisory: GHSA-x3pr-fcgm-wjgc
Aliases: CVE-2020-2111
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Subversion Plugin 2.13.0 and earlier does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability. Subversion Plugin 2.13.1 escapes the affected part of the error message.
Missing permission check in Jenkins Active Directory Plugin allows accessing domain health check page
Advisory: GHSA-q6rq-4whr-r879
Aliases: CVE-2020-2302
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Active Directory Plugin 2.19 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to access the domain health check diagnostic page.

Active Directory Plugin 2.20 requires Overall/Administer permission to access the domain health check diagnostic page.
Plone is vulnerable to email spoofing
Advisory: GHSA-f5h9-3hpf-9j8m
Aliases: CVE-2013-4192
Published: 2022-05-17T04:49:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors.
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Advisory: GHSA-hr65-qq6p-87r4
Aliases: CVE-2021-22137
Published: 2022-05-24T19:02:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In Elasticsearch versions before 7.11.2 and 6.8.15 a document disclosure flaw was found when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain cross-cluster search queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
Violation Comments to GitLab Plugin has Insufficiently Protected Credentials
Advisory: GHSA-3p8r-p4q5-mc44
Aliases: CVE-2019-10416
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Violation Comments to GitLab Plugin stored API tokens unencrypted in job `config.xml` files and its global configuration file `org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml` on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Violation Comments to GitLab Plugin now stores these credentials encrypted. Existing jobs need to have their configuration saved for existing plain text credentials to be overwritten.
CSRF vulnerability in Jenkins Maven Cascade Release Plugin
Advisory: GHSA-wfpw-hqjg-58ph
Aliases: CVE-2020-2295
Published: 2022-05-24T17:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Maven Cascade Release Plugin 1.3.2 and earlier allows attackers to start cascade builds and layout builds, and reconfigure the plugin.
Sandbox bypass in ontrack Jenkins Plugin
Advisory: GHSA-qw28-g63m-jxqv
Aliases: CVE-2019-10306
Published: 2022-05-24T16:43:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability in Jenkins ontrack Plugin 3.4 and earlier allowed attackers with control over ontrack DSL definitions to execute arbitrary code on the Jenkins master JVM.
Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin
Advisory: GHSA-ccwp-633j-g29v
Aliases: CVE-2020-2250
Published: 2022-05-24T17:27:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

ReadyAPI Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job `config.xml` files as part of its configuration. These project passwords can be viewed by attackers with Extended Read permission or access to the Jenkins controller file system.

ReadyAPI Functional Testing Plugin 1.4 stores project passwords encrypted once affected job configurations are saved again.
Authentication Bypass in Apache Tomcat
Advisory: GHSA-jgm2-m5cg-f66g
Aliases: CVE-2012-3546
Published: 2022-05-17T00:59:04Z

org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is used, allows remote attackers to bypass security-constraint checks by leveraging a previous setUserPrincipal call and then placing /j_security_check at the end of a URI.
Server-Side Request Forgery in Jenkins
Advisory: GHSA-6mv9-hcx5-7mhh
Aliases: CVE-2018-1000067
Published: 2022-05-13T01:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An improper authorization vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to have Jenkins submit HTTP GET requests and get limited information about the response.
ruby_parser allows local users to overwrite arbitrary files via symlink attack on temporary file with predictable name
Advisory: GHSA-8mvw-22r7-w6fq
Aliases: CVE-2013-0162
Published: 2022-05-05T02:48:30Z

The `diff_pp` function in `lib/gauntlet_rubyparser.rb` in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in `/tmp`.
Incorrect Calculation in moodle
Advisory: GHSA-w37f-pvvx-wcwm
Aliases: CVE-2022-30600
Published: 2022-05-19T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
Apache Tomcat treats single quotes as delimiters in cookies
Advisory: GHSA-qff8-g48j-pwpw
Aliases: CVE-2007-3382
Published: 2022-05-01T18:13:14Z

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (`'`) as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
ChakraCore RCE Vulnerability
Advisory: GHSA-c6mx-gwgr-mfm2
Aliases: CVE-2018-0995
Published: 2022-05-13T01:18:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0980, CVE-2018-0990, CVE-2018-0993, CVE-2018-0994, CVE-2018-1019.
URL Redirection to Untrusted Site ('Open Redirect') in next-auth
Advisory: GHSA-q2mx-j4x2-2h74
Aliases: CVE-2022-29214
Published: 2022-05-24T22:03:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Impact

We found that this vulnerability is present when the developer is implementing an OAuth 1 provider (by extension, it means Twitter, which is the only built-in provider using OAuth 1), but **upgrading** is **still recommended**.

`next-auth` v3 users before version 3.29.3 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. See our [migration guide](https://next-auth.js.org/getting-started/upgrade-v4))

`next-auth` v4 users before version 4.3.3 are impacted.

### Patches

We've released patches for this vulnerability in:
  
- v3 - `3.29.3`
- v4 - `4.3.3`

You can do:

```sh
npm i next-auth@latest
```

or

```sh
yarn add next-auth@latest
```

or

```sh
pnpm add next-auth@latest
```

(This will update to the latest v4 version, but you can change  `latest` to `3` if you want to stay on v3.)

### Workarounds

If you are not able to upgrade for any reason, you can add the following configuration to your `callbacks` option:

```ts
// async redirect(url, baseUrl) { // v3
async redirect({ url, baseUrl }) { // v4
    // Allows relative callback URLs
    if (url.startsWith("/")) return `${baseUrl}${url}`
    // Allows callback URLs on the same origin
    else if (new URL(url).origin === baseUrl) return url
    return baseUrl
}
```

### References

This vulnerability was discovered right after https://github.com/nextauthjs/next-auth/security/advisories/GHSA-f9wg-5f46-cjmw was published and is very similar in nature.

Read more about the `callbacks.redirect` option in the documentation: https://next-auth.js.org/configuration/callbacks#redirect-callback

### For more information

If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability

### Timeline

The issue was reported 2022 April 20th, a response was sent out to the reporter 8 minutes after, and a patch was produced within a few days.
Cross-site Scripting in Jenkins Autocomplete Parameter Plugin
Advisory: GHSA-ppwv-mvqg-q89h
Aliases: CVE-2022-30961
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Autocomplete Parameter Plugin 1.1 and earlier does not escape the name of Dropdown Autocomplete and Auto Complete String parameters on views displaying parameters. This results in stored cross-site scripting (XSS) vulnerabilities exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Cross-site Scripting in ZKEACMS
Advisory: GHSA-hc72-vj3g-5g2g
Aliases: CVE-2022-29362
Published: 2022-05-26T00:01:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-5ppx-rgw2-xg23
Aliases: CVE-2017-1000392
Published: 2022-05-14T01:04:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.
Cross-Site Request Forgery in Spring Framework
Advisory: GHSA-g6hf-f9cq-q7w7
Aliases: CVE-2013-6429
Published: 2022-05-13T01:02:39Z

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.
Cross-site Scripting in Apache ActiveMQ
Advisory: GHSA-rp9p-863f-9c4h
Aliases: CVE-2012-6092
Published: 2022-05-17T03:46:33Z

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js.  NOTE: AMQ-4124 is covered by CVE-2012-6551.
phpMyAdmin XSS Vulnerability
Advisory: GHSA-hmmx-wxh4-9w8w
Aliases: CVE-2016-9857
Published: 2022-05-17T02:36:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
ChakraCore RCE Vulnerability
Advisory: GHSA-xw5f-g937-wgm2
Aliases: CVE-2017-11889
Published: 2022-05-14T04:03:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
OpenStack Keystone Improper Authentication vulnerability
Advisory: GHSA-22q6-wwq7-2jj9
Aliases: CVE-2013-1865
Published: 2022-05-17T04:56:52Z

OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
Ansible unsafe evaluation of some strings
Advisory: GHSA-49m5-2838-q2rv
Aliases: CVE-2014-2686
Published: 2022-05-17T19:57:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Ansible prior to 1.5.4 mishandles the evaluation of some strings.
October CMS XSS
Advisory: GHSA-96mh-7xpr-qcgw
Aliases: CVE-2018-7198
Published: 2022-05-13T01:24:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.
OpenDaylight Controller DoS
Advisory: GHSA-8p5x-w9cv-92hv
Aliases: CVE-2017-1000361
Published: 2022-05-13T01:41:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

DOMRpcImplementationNotAvailableException when sending Port-Status packets to OpenDaylight. Controller launches exceptions and consumes more CPU resources. Component: OpenDaylight is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.
Loop with Unreachable Exit Condition in Apache Thrift
Advisory: GHSA-rj7p-rfgp-852x
Aliases: CVE-2019-0205
Published: 2022-05-24T17:00:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language bindings.
Ansible Arbitrary Code Execution
Advisory: GHSA-4cvm-5776-jx9f
Aliases: CVE-2014-3498
Published: 2022-05-14T02:03:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

User module in ansible before 1.6.6 is vulnerable to command execution. Ansible can get the result of remote command in variable, which may come from untrusted source of input. If the content of variable isn't properly filtered and when attempting to use the variable, it will trigger a function that passes it through jinja 2 template engine that can result into arbitrary command execution. Under certain circumstances, unprivileged user on system that is being managed via ansible can execute code on the managing host under UID of running ansible process.
Password stored in plain text by Jenkins VMware Lab Manager Slaves Plugin
Advisory: GHSA-cg4h-cfjp-h3x2
Aliases: CVE-2020-2319
Published: 2022-05-24T17:33:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins VMware Lab Manager Slaves Plugin 0.2.8 and earlier stores a password unencrypted in the global `config.xml` file on the Jenkins controller, where it can be viewed by users with access to the Jenkins controller file system.
Symfony Host Header Injection
Advisory: GHSA-66p6-7p29-55p9
Aliases: CVE-2018-14774
Published: 2022-05-14T02:20:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

An issue was discovered in HttpKernel in Symfony 2.7.0 through 2.7.48, 2.8.0 through 2.8.43, 3.3.0 through 3.3.17, 3.4.0 through 3.4.13, 4.0.0 through 4.0.13, and 4.1.0 through 4.1.2. When using HttpCache, the values of the X-Forwarded-Host headers are implicitly set as trusted while this should be forbidden, leading to potential host header injection.
Missing Cryptographic Step in OWASP Enterprise Security API for Java
Advisory: GHSA-jcp9-796g-pv9p
Aliases: CVE-2013-5679
Published: 2022-05-17T03:56:06Z

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
Jenkins Subversion Release Manager Plugin vulnerable to cross-site scripting (XSS)
Advisory: GHSA-wc2g-9j98-vcgw
Aliases: CVE-2020-2152
Published: 2022-05-24T17:10:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Subversion Release Manager Plugin 1.2 and earlier does not escape the error message for the Repository URL field form validation. This results in a reflected cross-site scripting vulnerability that can also be exploited similar to a stored cross-site scripting vulnerability by users with Job/Configure permission.
OpenDaylight NULL Pointer Dereference
Advisory: GHSA-gjq3-997p-hg6f
Aliases: CVE-2017-1000360
Published: 2022-05-13T01:41:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

StreamCorruptedException and NullPointerException in OpenDaylight odl-mdsal-xsql. Controller launches exceptions in the console. Component: OpenDaylight odl-mdsal-xsql is vulnerable to this flaw. Version: The tested versions are OpenDaylight 3.3 and 4.0.
Passwords stored in plain text by ElasTest Plugin
Advisory: GHSA-p9rc-x48f-582x
Aliases: CVE-2020-2274
Published: 2022-05-24T17:28:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins ElasTest Plugin 1.2.1 and earlier stores its server password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
Advisory: GHSA-vxhj-3x7p-jxp5
Aliases: CVE-2016-6345
Published: 2022-05-17T03:49:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

RESTEasy allows remote authenticated users to obtain sensitive information by leveraging "insufficient use of random values" in async jobs.
Regular expression denial of service in apache tika
Advisory: GHSA-rpjm-422r-95mh
Aliases: CVE-2022-30126
Published: 2022-05-17T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

In Apache Tika, a regular expression in our StandardsText class, used by the StandardsExtractingContentHandler could lead to a denial of service caused by backtracking on a specially crafted file. This only affects users who are running the StandardsExtractingContentHandler, which is a non-standard handler.

This was originally fixed in 1.28.2 and 2.4.0. While the fix in version 2.4.0 was complete, the fix for the 1.x branch wasn't incorporated until version 1.28.3. Please see GHSA-qw3f-w4pf-jh5f for more information.
Unescaped parameters in the PostgreSQL JDBC driver
Advisory: GHSA-h86w-m5rm-xr33
Aliases: CVE-2012-1618
Published: 2022-05-17T05:20:42Z

Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks.  NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
Redgate SQL Change Automation Plugin stored credentials in plain text
Advisory: GHSA-x23m-8c2h-6wg7
Aliases: CVE-2020-2095
Published: 2022-05-24T17:06:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Redgate SQL Change Automation Plugin 2.0.4 and earlier stores a NuGet API key unencrypted in job config.xml files as part of its configuration. This credential could be viewed by users with Extended Read permission or access to the Jenkins controller file system.

This is due to an incomplete fix of [SECURITY-1598](https://www.jenkins.io/security/advisory/2019-12-17/#SECURITY-1598).

Redgate SQL Change Automation Plugin 2.0.5 now stores the API key encrypted. Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten.
Jenkins Google Kubernetes Engine Plugin vulnerable to Exposure of Resource to Wrong Sphere
Advisory: GHSA-xw4c-9434-3f7p
Aliases: CVE-2019-10365
Published: 2022-05-24T16:51:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Google Kubernetes Engine Plugin created a temporary file named `.kube…config` containing a temporary access token in the project workspace. This allowed the file to be accessed via workspace browsers, or accidentally archived, disclosing the token.

This temporary file is now created outside the regular project workspace.
Path Traversal in Jenkins
Advisory: GHSA-3pr8-rf62-g893
Aliases: CVE-2018-1000406
Published: 2022-05-14T01:04:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

A path traversal vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java that allows attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
Pulp Improper Path Parsing
Advisory: GHSA-574p-6fw4-4hw8
Aliases: CVE-2018-10917
Published: 2022-05-13T01:48:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories.
containernetworking/plugins vulnerable to MitM attacks
Advisory: GHSA-fx6x-h9g4-56f8
Aliases: CVE-2020-10749
Published: 2022-05-24T17:19:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
Pimcore RCE via PHAR upload
Advisory: GHSA-352x-hc2f-fwff
Aliases: CVE-2019-16317
Published: 2022-05-24T16:56:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Pimcore before 5.7.1, an attacker with limited privileges can trigger execution of a .phar file via a `phar://` URL in a filename parameter, because PHAR uploads are not blocked and are reachable within the `phar://../../../../../../../../var/www/html/web/var/assets/` directory, a different vulnerability than CVE-2019-10867 and CVE-2019-16318.
ChakraCore Remote Code Execution Vulnerability
Advisory: GHSA-233h-59m2-qqf2
Aliases: CVE-2020-0970
Published: 2022-05-24T17:14:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0968.