aswin1906/github-advisory-2022 huggingface dataset:
Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon
Advisory: GHSA-h5wh-7h2j-h999
Aliases: CVE-2022-27817
Published: 2022-04-15T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L

SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality.
Improper one time password handling in devise-two-factor
Advisory: GHSA-jm35-h8q2-73mp
Aliases: CVE-2021-43177
Published: 2022-04-07T22:09:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.
 
### Patches
This vulnerability has been patched in version 4.0.2 which was released on March 24th, 2022. Individuals using this package are strongly encouraged to upgrade as soon as possible.

### Credit for discovery
Benoit Côté-Jodoin
Michael Nipper - https://github.com/tinfoil/devise-two-factor/issues/106
Reflected XSS on clients-registrations endpoint
Advisory: GHSA-m98g-63qj-fp8j
Published: 2022-04-28T21:01:28Z

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser.

### Acknowledgement

Keycloak would like to thank Quentin TEXIER (Pentester at Opencyber) for reporting this issue.
Expression Language Injection in Apache Struts
Advisory: GHSA-v8j6-6c2r-r27c
Aliases: CVE-2021-31805
Published: 2022-04-13T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.
RubyGems passenger gem allows remote attackers to delete files
Advisory: GHSA-8mw8-j583-vqfg
Aliases: CVE-2012-6135
Published: 2022-04-23T00:40:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

RubyGems passenger 4.0.0 betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process. 

Affects both open source and Enterprise versions (4.0.0.beta1, 4.0.0.beta2).
Relative Path Traversal in afire serve_static
Advisory: GHSA-3227-r97m-8j95
Published: 2022-04-22T20:16:45Z

### Impact
This vulnerability effects the built-in afire serve_static extension allowing paths containing `//....` to bypass the previous path sanitation and request files in higher directories that should not be accessible.

### Patches
The issue has been fixed in [afire 1.1.0](https://crates.io/crates/afire/1.1.0).
If you can, just update to the newest version of afire.

### Workarounds
If you can't update afire you can simply disallow paths containing `/..` with the following middleware.
Make sure this is the last middleware added to the server so it runs first, stopping the bad requests.
```rust
use afire::prelude::*;

struct PathTraversalFix;

impl Middleware for PathTraversalFix {
    fn pre(&self, req: Request) -> MiddleRequest {
        if req.path.replace("\\", "/").contains("/..") {
            return MiddleRequest::Send(
                Response::new()
                    .status(400)
                    .text("Paths containing `..` are not allowed"),
            );
        }

        MiddleRequest::Continue
    }
}
```
```rust
let mut server = Server::new(host, port);
PathTraversalFix.attach(&mut server);
```

### References
You can read about the new changes to afire in 1.1.0 [here](https://connorcode.com/writing/afire/update-3)

### For more information
If you have any questions or comments about this advisory you can email me or message me on discord.
[[https://connorcode.com/contact](https://connorcode.com/contact)]
Arbitrary file upload in Ghost
Advisory: GHSA-fvc6-qjp7-m4g4
Aliases: CVE-2022-27139
Published: 2022-04-13T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file.
Keycloak is vulnerable to IDN homograph attack
Advisory: GHSA-pf38-cw3p-22q9
Aliases: CVE-2021-3424
Published: 2022-04-28T21:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.
Apache Tomcat Denial of Service vulnerability in the Catalina package
Advisory: GHSA-7wj2-48c4-2684
Aliases: CVE-2003-0866
Published: 2022-04-29T01:27:08Z

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.6 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
Arbitrary file access through XML parsing in org.xwiki.commons:xwiki-commons-xml
Advisory: GHSA-m2r5-4w96-qxg5
Aliases: CVE-2022-24898
Published: 2022-04-28T19:31:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

### Impact

It's possible in a script to access any file accessing to the user running XWiki application server with XML External Entity Injection through the XML script service.

For example:

```
{{velocity}}
#set($xml=$services.get('xml'))
#set($xxe_payload = "<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE root[<!ENTITY xxe SYSTEM 'file:///etc/passwd' >]><root><foo>&xxe;</foo></root>")
#set($doc=$xml.parse($xxe_payload))
$xml.serialize($doc)
{{/velocity}}
```

### Patches

The problem has been patched on versions 12.10.10, 13.4.4 and 13.8RC1.

### Workarounds

There's no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

### References

https://jira.xwiki.org/browse/XWIKI-18946

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)
Stored cross site scripting in getgrav/grav
Advisory: GHSA-3p5m-j98p-c698
Aliases: CVE-2022-1173
Published: 2022-04-27T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Stored cross-site scripting in GitHub repository getgrav/grav prior to 1.7.33.
Use after free in Wasmtime
Advisory: GHSA-gwc9-348x-qwv2
Aliases: CVE-2022-24791
Published: 2022-04-01T13:36:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

There is a use after free vulnerability in Wasmtime when both running Wasm that uses `externref`s and enabling [epoch interruption](https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.epoch_interruption) in Wasmtime. If you are not explicitly enabling epoch interruption (it is disabled by default) then you are not affected. If you are explicitly disabling the Wasm reference types proposal (it is enabled by default) then you are also not affected.

The use after free is caused by Cranelift failing to emit stack maps when there are safepoints inside cold blocks. Cold blocks occur when epoch interruption is enabled. Cold blocks are emitted at the end of compiled functions, and change the order blocks are emitted versus defined. This reordering accidentally caused Cranelift to skip emitting some stack maps because it expected to emit the stack maps in block definition order, rather than block emission order. When Wasmtime would eventually collect garbage, it would fail to find live references on the stack because of the missing stack maps, think that they were unreferenced garbage, and therefore reclaim them. Then after the collection ended, the Wasm code could use the reclaimed-too-early references, which is a use after free.

This bug was discovered while extending our fuzz targets for `externref`s and GC in Wasmtime. The updated fuzz target thoroughly exercises these code paths and feature combinations now. We have also added a regression test for this bug. Released versions 0.34.2 and 0.35.2, which fix the vulnerability. We recommend all Wasmtime users upgrade to these patched versions. If upgrading is not an option for you at this time, you can avoid the vulnerability by either disabling the Wasm reference types proposal or by disabling epoch interruption if you were previously enabling it.
ipld/go-codec-dagpb panics when processing certain blocks
Advisory: GHSA-g3vv-g2j5-45f2
Published: 2022-04-08T22:08:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact 
Decoding certain blocks using the go-ipld-prime version of the dag-pb codec (go-codec-dagpb) can cause a panic.  The panic comes from an assumption that the reported link length is accurate, but if the block ends before that reported length then it’s a buffer overread.

### Patches
The issue is fixed in v1.3.1 and above.

Consumers can discover the versions of `go-codec-dagpb` in a module's dependency graph using the following command in the module root:

```go mod graph | grep go-codec-dagpb```

### Workarounds
You can work around this issue without upgrading by recovering panics higher in the call stack of the goroutine that calls the defective code.

### For more information
If you have any questions or comments about this advisory:

* Ask in [IPFS Discord #ipld-chatter](https://discord.gg/ipfs)
* Open an issue in [go-codec-dagpb](https://github.com/ipld/go-codec-dagpb)
Information Exposure in Kubernetes
Advisory: GHSA-mqf3-28j7-3mj6
Aliases: CVE-2015-7528
Published: 2022-04-12T22:40:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Kubernetes before 1.2.0-alpha.5 allows remote attackers to read arbitrary pod logs via a container name.
Cross-site Scripting in Jenkins Credentials Plugin
Advisory: GHSA-rvg5-f5fj-mxvg
Aliases: CVE-2022-29036
Published: 2022-04-13T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
SQL Injection in Pimcore
Advisory: GHSA-mj2c-5mjv-gmmj
Aliases: CVE-2022-1339
Published: 2022-04-14T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Pimcore prior to version 10.3.5 is vulnerable to SQL injection in ElementController.php. This vulnerability causes loss of data confidentiality.
OutOfMemory Exception by specifically crafted processing instruction in NekoHtml Parser
Advisory: GHSA-6jmm-mp6w-4rrg
Aliases: CVE-2022-29546
Published: 2022-04-26T21:14:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
NekoHtml Parser suffers from a denial of service vulnerability on versions 2.60.0 and below. A specifically crafted input regarding the parsing of processing instructions leads to heap memory consumption. Please update to version 2.61.0.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/HtmlUnit/htmlunit-neko](https://github.com/HtmlUnit/htmlunit-neko)
* Email us at [rbri at rbri.de]
Multiple cross-site scripting (XSS) vulnerabilities in Roundup
Advisory: GHSA-5jq3-8437-x35p
Aliases: CVE-2012-6133
Published: 2022-04-23T00:40:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the (1) @ok_message or (2) @error_message parameter to issue*.
Zope allows attackers to modify raw image and file data
Advisory: GHSA-7whr-j8vf-r4wj
Aliases: CVE-2000-1212
Published: 2022-04-30T18:15:07Z

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects.
Keycloak vulnerable to privilege escalation on Token Exchange feature
Advisory: GHSA-75p6-52g3-rqc8
Aliases: CVE-2022-1245
Published: 2022-04-26T21:21:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
SQL injection in net.mingsoft:ms-mcms
Advisory: GHSA-mx3x-rmrh-9wf6
Aliases: CVE-2022-26585
Published: 2022-04-06T00:01:35Z

Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.
Cross-site Scripting in craftcms/cms
Advisory: GHSA-7xj5-fwqr-5378
Aliases: CVE-2022-28378
Published: 2022-04-04T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Craft CMS before 3.7.29 allows cross-site scripting.
HTTP Proxy header vulnerability
Advisory: GHSA-m6ch-gg5f-wxx3
Aliases: CVE-2016-5385
Published: 2022-04-07T13:59:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, as demonstrated by (1) an application that makes a getenv('HTTP_PROXY') call or (2) a CGI configuration of PHP, aka an "httpoxy" issue.
Exposure of SSH credentials in Rancher/Fleet
Advisory: GHSA-wm2r-rp98-8pmh
Published: 2022-04-27T21:09:13Z

### Impact
This vulnerability only affects customers using Fleet for continuous delivery with authenticated Git and/or Helm repositories.

A security vulnerability ([CVE-2022-29810](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29810)) was discovered in `go-getter` library in versions prior to [`v1.5.11`](https://github.com/hashicorp/go-getter/releases/tag/v1.5.11) that exposes SSH private keys in base64 format due to a failure in redacting such information from error messages. The vulnerable version of this library is used in Rancher through Fleet in versions of Fleet prior to [`v0.3.9`](https://github.com/rancher/fleet/releases/tag/v0.3.9). This issue affects Rancher versions 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3.

When Git and/or Helm authentication is configured in [Fleet](https://rancher.com/docs/rancher/v2.6/en/deploy-across-clusters/fleet/) and Fleet is used to deploy a git repo through `Continuous Delivery`, the affected `go-getter` version will expose the configured SSH private key secret if Fleet fails to download the git repo due to a misconfigured URL. The exposed SSH key is logged in base64 format as a query parameter together with the git URL. The credentials can be seen in Rancher UI and in Fleet's deployment pod logs.

### Patches
Patched versions include releases 2.5.13, 2.6.4 and later versions.

### Workarounds
There is not a direct mitigation besides upgrading to the patched Rancher versions. Until you are able to upgrade, limit access in Rancher to trusted users and carefully validate the URLs you are using are correct. Please note that the SSH key might still be compromised in valid URLs if the service goes down or a connection error happens when pulling from the repos.

**Note:** If you believe that SSH keys might have been exposed in your environment, it's highly advised to rotate them.

### Credits
This issue was found and reported by Dagan Henderson from Raft Engineering.

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Jakarta Tomcat Directory Listing vulnerability
Advisory: GHSA-qfw2-wvrw-mvw4
Aliases: CVE-2003-0042
Published: 2022-04-29T01:25:43Z

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
JBoss AS may expose root content if excluded-contexts list is mismatched
Advisory: GHSA-wq8g-hm94-5rqq
Aliases: CVE-2012-1094
Published: 2022-04-23T00:40:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.
Exposure of Sensitive Information to an Unauthorized Actor in DisCatSharp
Advisory: GHSA-frxg-hf44-q765
Aliases: CVE-2022-24849
Published: 2022-04-22T20:39:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

### Impact
Users of versions 9.8.5, 9.8.6, 9.9.0 and previously published prereleases of 10.0.0 who have used either one of the two `RequireDisCatSharpDeveloperAttribute`s or the `BaseDiscordClient.LibraryDeveloperTeam` have potentially had their bot token sent to a web server not affiliated with Discord. This server is owned and operated by DisCatSharp's development team. The tokens were not logged, yet it is still advisable to reset the tokens of potentially affected bots.

### Patches
9.9.1 has been released to patch the issue for the current stable release and the current 10.0.0 prereleases are also no longer affected.

### Workarounds
Remove all uses of the two `RequireDisCatSharpDeveloperAttribute`s and all direct calls to `BaseDiscordClient.LibraryDeveloperTeam`.

### Details
The `HttpClient` responsible for sending requests to the Discord API was erroneously reused to send requests to our website when DisCatSharp's team members were to be fetched.

### For more information
If you have any questions or comments about this advisory:
* Join our [Discord server](https://discord.gg/GGYSywkxwN)
* Email us at [ottero@aitsys.dev](mailto:ottero@aitsys.dev)
Daemon panics when processing certain blocks
Advisory: GHSA-mcq2-w56r-5w2w
Published: 2022-04-08T22:09:23Z

### Impact
go-ipfs nodes with versions 0.10.0, 0.11.0, 0.12.0, or 0.12.1 can crash when trying to traverse certain malformed graphs due to an issue in the go-codec-dagpb dependency.  Vulnerable nodes that work with these malformed graphs may crash leading to denial-of-service risks.

This particularly impacts nodes that download or export data that is controlled by external user input as there is the possibility that a malicious user of those services could (intentionally or unintentionally) cause the node to traverse a malformed graph. Some notable use cases include public gateways and pinning services which fetch data on behalf of users, as well as applications such as IPFS Companion which load data based on a user visiting a website with links to IPFS URLs.

### Patches
Versions v0.11.1 and v0.12.2 both resolve this issue. This should make it easy to upgrade, even if you have not yet performed the v0.12.0 migration.

For those running on forked versions of go-ipfs or who are on v0.10.0 and are having trouble with the v0.11.0 breaking changes, simply updating the version of `go-codec-dagpb` you are using to >=v1.3.2 should resolve the issue.

Any users of libraries within the go-ipfs ecosystem, even if not the go-ipfs package or binary itself, may be affected and should upgrade their dependency on go-codec-dagpb. You can check if your Go module has a dependency on `go-codec-dagpb` by running a command such as `go mod graph | grep go-codec-dagpb` in your module root.

### Workarounds
The best way to workaround this issue is to control exposure to any endpoints that allow for arbitrary IPLD traversals. This primarily includes the HTTP RPC API (https://docs.ipfs.io/reference/http/api ) and the Gateway API.  If you are exposing those APIs, then do so within an environment where only trusted users and applications you control have access to it.  You should be safe as long as your users and applications do not create malformed graphs, which should not happen using standard `go-ipfs` tooling.

If you previously had a more open access environment, then closing off access will only be sufficient if both of the following are true:
* The experimental GraphSync feature is disabled (https://github.com/ipfs/go-ipfs/blob/master/docs/experimental-features.md#graphsync) 
* The only data being accessed is non-malformed data

### References
See also the [go-codec-dagpb security advisory](https://github.com/ipld/go-codec-dagpb/security/advisories/GHSA-g3vv-g2j5-45f2).

### For more information
If you have any questions or comments about this advisory:

* Ask in [IPFS Discord #ipfs-chatter](https://discord.gg/ipfs)
* Open an issue in [go-ipfs](https://github.com/ipld/go-ipfs)
Subrion CMS Cross-site Scripting (XSS) vulnerability in the `contact us` plugin
Advisory: GHSA-jv64-2m3x-6v4q
Aliases: CVE-2021-41948
Published: 2022-04-30T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability exists in the `contact us` plugin for Subrion CMS <= 4.2.1 version via `List of subjects`. This can be exploited by someone with administrative privileges when they log in to the admin panel.
Improper Authentication in moodle
Advisory: GHSA-6q9g-3vfq-q2qj
Aliases: CVE-2022-0985
Published: 2022-04-30T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.
Stored XSS vulnerability in Jenkins Git Parameter Plugin
Advisory: GHSA-fcr6-6cph-vmcm
Aliases: CVE-2022-29040
Published: 2022-04-13T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Git Parameter Plugin 0.9.15 and earlier does not escape the name and description of Git parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Unrestricted Upload of File with Dangerous Type in ButterCMS
Advisory: GHSA-3v5x-qjrp-q2hq
Aliases: CVE-2022-27260
Published: 2022-04-13T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a crafted SVG file.
Improper Removal of Sensitive Information Before Storage or Transfer in irrd
Advisory: GHSA-cqxx-66wh-8pjw
Aliases: CVE-2022-24798
Published: 2022-04-01T13:59:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

IRRd did not always filter password hashes in query responses relating to `mntner` objects and database exports. This may have allowed adversaries to retrieve some of these hashes, perform a brute-force search for the clear-text passphrase, and use these to make unauthorised changes to affected IRR objects. This issue only affected instances that process password hashes, which means it is limited to IRRd instances that serve authoritative databases. IRRd instances operating solely as mirrors of other IRR databases are not affected.

The issue occurred:
* For `mntner` objects where all password hash names (`MD5-PW` and `CRYPT-PW`) were in lower or mixed case in the `auth` attribute. For these objects, hashes remained in the output of all queries of any method and all database exports made with the `export_destination` setting. Fortunately, objects in the common public IRR database virtually all use uppercase hash names which means very few of those objects were affected.
* For any GraphQL queries that queried the `auth` field on `mntner` objects.
* For any GraphQL queries that queried the `objectText` field on the `journal` field on `mntner` objects, if the `nrtm_access_list` setting permitted journal access.

The two GraphQL cases are visible in logs, allowing users to determine whether any existing objects had their hashes exposed.
This has been fixed in IRRd 4.2.3 and the main branch. Versions in the 4.1.x series never were affected. Users of the 4.2.x series are strongly recommended to upgrade. All users running a more recent version from the main branch should update to the latest version. Alternatively, but not recommended, apply the patch manually [for 4.2.x]
Cross-site Scripting in OWASP AntiSamy
Advisory: GHSA-vp37-2f9p-3vr3
Aliases: CVE-2022-29577
Published: 2022-04-23T00:03:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.
Missing authorization in Moodle
Advisory: GHSA-c5hf-mc85-2hx4
Aliases: CVE-2022-0984
Published: 2022-04-30T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
Denial-of-Service when binding invalid parameters in sqlite3
Advisory: GHSA-9qrh-qjmc-5w2p
Aliases: CVE-2022-21227
Published: 2022-04-28T20:25:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions of sqlite3 will experience a fatal error when supplying a specific object in the parameter array. This error causes the application to crash and could not be caught. Users of `sqlite3` v5.0.0, v5.0.1 and v5.0.2 are affected by this. This issue is fixed in v5.0.3. All users are recommended to upgrade to v5.0.3 or later. Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters as a workaround.
Inline DTD allows XML bomb attack
Advisory: GHSA-qpmc-wprv-x746
Aliases: CVE-2019-15160
Published: 2022-04-12T21:31:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The SweetXml (aka sweet_xml) package through 0.6.6 for Erlang and Elixir allows attackers to cause a denial of service (resource consumption) via an XML entity expansion attack with an inline DTD.
Access Control vulnerability in Dolibarr
Advisory: GHSA-xw7v-qrhc-jjg2
Aliases: CVE-2021-37517
Published: 2022-04-01T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.1, in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service.
Insertion of Sensitive Information into Log File in Hashicorp go-getter
Advisory: GHSA-27rq-4943-qcwp
Aliases: CVE-2022-29810
Published: 2022-04-28T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The Hashicorp go-getter library before 1.5.11 could write SSH credentials into its logfile, exposing sensitive credentials to local users able to read the logfile.
Remote Code Execution in Laravel
Advisory: GHSA-86r3-4gq8-xw8q
Aliases: CVE-2021-43503
Published: 2022-04-09T00:00:25Z
Withdrawn: 2022-08-22T16:34:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Withdrawn
This advisory has been withdrawn because it is not a security issue and the CVE has been revoked.

## Original Description
A Remote Code Execution (RCE) vulnerability exists in h laravel 5.8.38 via an unserialize pop chain in (1) __destruct in \Routing\PendingResourceRegistration.php, (2) __cal in Queue\Capsule\Manager.php, and (3) __invoke in mockery\library\Mockery\ClosureWrapper.php.
Apache Tomcat Directory Traversal
Advisory: GHSA-4gr9-99j3-vqxv
Aliases: CVE-2000-1210
Published: 2022-04-30T18:15:08Z

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a `..` (dot dot) in the argument to source.jsp.
Denial of Service in http-swagger
Advisory: GHSA-xg75-q3q5-cqmv
Aliases: CVE-2022-24863
Published: 2022-04-22T20:55:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Allows an attacker to perform a DOS attack consisting of memory exhaustion on the host system.

### Patches
Yes. Please upgrade to v1.2.6.

### Workarounds
A workaround is to restrict the path prefix to the "GET" method. As shown below
```
func main() {
	r := mux.NewRouter()

	r.PathPrefix("/swagger/").Handler(httpSwagger.Handler(
		httpSwagger.URL("http://localhost:1323/swagger/doc.json"), //The url pointing to API definition
		httpSwagger.DeepLinking(true),
		httpSwagger.DocExpansion("none"),
		httpSwagger.DomID("#swagger-ui"),
	)).Methods(http.MethodGet)
```

### References
Reporter dongguangli from https://www.huoxian.cn/ company

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http-swagger](https://github.com/swaggo/http-swagger/issues)
go.etcd.io/etcd Authentication Bypass
Advisory: GHSA-h6xx-pmxh-3wgp
Aliases: CVE-2018-16886
Published: 2022-04-12T22:41:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.
CSRF vulnerability in Jenkins Publish Over FTP Plugin
Advisory: GHSA-6w39-qhmq-g8cp
Aliases: CVE-2022-29050
Published: 2022-04-13T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over FTP Plugin 1.16 and earlier allows attackers to connect to an FTP server using attacker-specified credentials.
Server side request forgery in gibbon
Advisory: GHSA-vx9g-377x-xwxq
Aliases: CVE-2022-27311
Published: 2022-04-26T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gibbon v3.4.3 and below allows attackers to execute a Server-Side Request Forgery (SSRF) via a crafted URL. This issue has been resolved in version 3.4.4
Cross-site Scripting in vditor
Advisory: GHSA-689x-x68p-fph3
Aliases: CVE-2022-0350
Published: 2022-04-01T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
SQL injection in blazer
Advisory: GHSA-qf9q-q4hh-qph3
Aliases: CVE-2022-29498
Published: 2022-04-22T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Blazer before 2.6.0 allows SQL Injection. In certain circumstances, an attacker could get a user to run a query they would not have normally run.
Insecure default value for CORS configuration
Advisory: GHSA-g27j-74fp-xfpr
Aliases: CVE-2022-26969
Published: 2022-04-05T18:31:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

The default value for the `CORS_ENABLED` and `CORS_ORIGIN` configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.

### Patches

The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0

### Workarounds

Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [directus/directus](https://github.com/directus/directus)
* Email us at [security@directus.io](mailto:security@directus.io)
Remote code injection in dompdf/dompdf
Advisory: GHSA-x752-qjv4-c4hc
Aliases: CVE-2022-28368
Published: 2022-04-04T00:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Dompdf is an HTML to PDF converter. Dompdf before 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input file).
SQL Injection in elide-datastore-aggregation
Advisory: GHSA-8xpj-9j9g-fc9r
Aliases: CVE-2022-24827
Published: 2022-04-08T22:43:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
When leveraging the following together:

- Elide Aggregation Data Store for Analytic Queries
- Parameterized Columns (A column that requires a client provided parameter)
- A parameterized column of type TEXT

There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection.  A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns.  This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters.

### Patches
A [fix](https://github.com/yahoo/elide/pull/2581) is provided in [Elide 6.1.4](https://github.com/yahoo/elide/releases/tag/6.1.4).

### Workarounds
The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted).   Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameterized columns.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [elide](https://github.com/yahoo/elide)
* Contact us in [Discord](https://discord.com/invite/3vh8ac57cc)
Arbitrary filesystem write access from velocity.
Advisory: GHSA-cvx5-m8vg-vxgc
Aliases: CVE-2022-24897
Published: 2022-04-28T21:16:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

The velocity scripts is not properly sandboxed against using the Java File API to perform read or write operations on the filesystem. Now writing an attacking script in velocity requires the Script rights in XWiki so not all users can use it, and it also requires finding an XWiki API which returns a File. 

### Patches
The problem has been patched on versions 12.6.7, 12.10.3 and 13.0RC1.

### Workarounds
There's no easy workaround for fixing this vulnerability other than upgrading and being careful when giving Script rights.

### References
https://jira.xwiki.org/browse/XWIKI-5168

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [XWiki Security mailing-list](mailto:security@xwiki.org)
PrestaShop XSS Vulnerability
Advisory: GHSA-j33m-2537-86jm
Aliases: CVE-2012-20001
Published: 2022-04-23T00:40:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

PrestaShop before 1.5.2.0 allows XSS via the `<object data='data:text/html` substring in the message field.
SQL Injection in Django
Advisory: GHSA-w24h-v9qh-8gxj
Aliases: CVE-2022-28347
Published: 2022-04-13T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SQL injection issue was discovered in `QuerySet.explain()` in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the `**options` argument, and placing the injection payload in an option name.
Unrestricted Upload of File with Dangerous Type in Payload
Advisory: GHSA-w8xh-93qh-35vw
Aliases: CVE-2022-27952
Published: 2022-04-13T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
Path Traversal in Grunt
Advisory: GHSA-j383-35pm-c5h4
Aliases: CVE-2022-0436
Published: 2022-04-13T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Grunt prior to version 1.5.2 is vulnerable to path traversal.
Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds Plugin
Advisory: GHSA-v98r-gjgc-m9pf
Aliases: CVE-2022-29045
Published: 2022-04-13T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins promoted builds Plugin 873.v6149db_d64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of these vulnerabilities requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix.
Exposure of Resource to Wrong Sphere in Simple-Wayland-HotKey-Daemon
Advisory: GHSA-x446-3xhq-5xfp
Aliases: CVE-2022-27814
Published: 2022-04-15T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SWHKD 1.1.5 allows arbitrary file-existence tests via the -c option.
Zope DTML implementation Improper Authentication
Advisory: GHSA-wcwp-r3fj-mm3p
Aliases: CVE-2000-0062
Published: 2022-04-30T18:12:54Z

The DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.
Command injection in git-interface
Advisory: GHSA-qffw-8wg7-h665
Aliases: CVE-2022-1440
Published: 2022-04-23T00:03:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability exists in git-interface in the GitHub repository yarkeev/git-interface prior to 2.1.2. If both the git remote and destination directory are provided by user input, then the use of an `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
Stored Cross-site Scripting in Jenkins Node and Label parameter Plugin
Advisory: GHSA-pv7p-c7cp-vrh3
Aliases: CVE-2022-29044
Published: 2022-04-13T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Node and Label parameter Plugin 1.10.3 and earlier does not escape the name and description of Node and Label parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix.
Hashicorp Consul HTTP health check endpoints returning an HTTP redirect may be abused as SSRF vector
Advisory: GHSA-q6h7-4qgw-2j9p
Aliases: CVE-2022-29153
Published: 2022-04-20T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A vulnerability was identified in Consul and Consul Enterprise (“Consul”) such that HTTP health check endpoints returning an HTTP redirect may be abused as a vector for server-side request forgery (SSRF). This vulnerability, CVE-2022-29153, was fixed in Consul 1.9.17, 1.10.10, and 1.11.5.
Improper Certificate Validation in node-sass affects eZ Platform
Advisory: GHSA-6v6p-g8cg-2hgg
Published: 2022-04-01T12:56:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects ezsystems/ezplatform and ezsystems/ezplatform-page-builder.
Sensitive Auth & Cookie data stored in Jupyter server logs
Advisory: GHSA-m87f-39q9-6f55
Aliases: CVE-2022-24758
Published: 2022-04-05T17:47:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.

Upgrade to notebook version 6.4.10

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: @3coins for reporting. Thank you!
Object state limitation has no effect
Advisory: GHSA-5x4f-7xgq-r42x
Published: 2022-04-29T15:39:18Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload
Advisory: GHSA-pxpf-v376-7xx5
Aliases: CVE-2022-25854
Published: 2022-04-30T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the cross-site scripting (XSS) payload.
Use of Externally-Controlled Format String in consoleme
Advisory: GHSA-74w3-2r77-fw5h
Aliases: CVE-2022-27177
Published: 2022-04-03T00:00:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2
Missing permission checks in Jenkins Publish Over FTP Plugin
Advisory: GHSA-5pv7-hx9m-8jh3
Aliases: CVE-2022-29051
Published: 2022-04-13T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Missing permission checks in Jenkins Publish Over FTP Plugin prior to 1.17 allow attackers with Overall/Read permission to connect to an FTP server using attacker-specified credentials.
Improper Access Control in snipe/snipe-it
Advisory: GHSA-p2vw-f87c-q597
Aliases: CVE-2022-1511
Published: 2022-04-29T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Snipe-IT prior to 5.4.4 is vulnerable to Missing Authorization.
Cross-site scripting in markdown2 for python
Advisory: GHSA-72cx-5ff9-4hhc
Aliases: CVE-2009-3724
Published: 2022-04-21T01:54:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues.
Null Byte Injection in Plug.Static
Advisory: GHSA-2q6v-32mr-8p8x
Aliases: CVE-2017-1000052
Published: 2022-04-12T21:20:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Plug.Static is used for serving static assets, and is vulnerable to null
  byte injection. If file upload functionality is provided, this can allow
  users to bypass filetype restrictions.
  We recommend all applications that provide file upload functionality and
  serve those uploaded files locally with Plug.Static to upgrade immediately
  or include the fix below. If uploaded files are rather stored and served
  from S3 or any other cloud storage, you are not affected.
SQL injection in apache-superset
Advisory: GHSA-wh73-hpcg-v32j
Aliases: CVE-2022-27479
Published: 2022-04-14T00:00:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
Improper Certificate Validation
Advisory: GHSA-7mfr-774f-w5r9
Aliases: CVE-2017-11770
Published: 2022-04-12T00:07:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly parsing certificate data. A denial of service vulnerability exists when .NET Core improperly handles parsing certificate data, aka ".NET CORE Denial Of Service Vulnerability".
SQL Injection in Pimcore
Advisory: GHSA-6gm7-j668-w6h9
Aliases: CVE-2022-1219
Published: 2022-04-09T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Pimcore prior to version 10.3.5 is vulnerable SQL injection in RecyclebinController.php. This vulnerability affects data confidentiality.
Zope does not properly restrict access to the getRoles method
Advisory: GHSA-9cmq-pj6p-hgwf
Aliases: CVE-2000-0725
Published: 2022-04-30T18:14:11Z

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.