aswin1906/github-advisory-2022 huggingface dataset:
Aubio is vulnerable to denial of service via aubio_pitch_set_unit function
Advisory: GHSA-g7g8-mx45-x4c8
Aliases: CVE-2018-14522
Published: 2022-05-14T01:09:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in aubio 0.4.6. A SEGV signal can occur in `aubio_pitch_set_unit` in `pitch/pitch.c`, as demonstrated by aubionotes.
Apache QPID Allows Remote Authentication Bypass
Advisory: GHSA-phw8-fw9g-v3xc
Aliases: CVE-2012-3467
Published: 2022-05-17T01:44:00Z

Apache QPID 0.14, 0.16, and earlier uses a NullAuthenticator mechanism to authenticate catch-up shadow connections to AMQP brokers, which allows remote attackers to bypass authentication.
Jenkins Git Parameter Plugin vulnerable to stored cross-site scripting (XSS)
Advisory: GHSA-fgxc-mxvw-55mv
Aliases: CVE-2020-2113
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Git Parameter Plugin 0.9.11 and earlier does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.
ChakraCore RCE Vulnerability
Advisory: GHSA-pg99-mp4c-75g6
Aliases: CVE-2020-0811
Published: 2022-05-24T17:10:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka Chakra Scripting Engine Memory Corruption Vulnerability. This CVE ID is unique from CVE-2020-0812.
Ruby Openssl Allows Incorrect Value Comparison
Advisory: GHSA-mmrq-6999-72v8
Aliases: CVE-2018-16395
Published: 2022-05-13T01:50:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the OpenSSL library in Ruby when two `OpenSSL::X509::Name` objects are compared using `==`, depending on the ordering, non-equal objects may return true. When the first argument is one character longer than the second, or the second argument contains a character that is one less than a character in the same position of the first argument, the result of `==` will be true. This could be leveraged to create an illegitimate certificate that may be accepted as legitimate and then used in signing or encryption operations.
SQL injection in calibreweb
Advisory: GHSA-8ppf-x4gr-2x7g
Aliases: CVE-2022-30765
Published: 2022-05-17T00:01:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Calibre-Web before 0.6.18 allows user table SQL Injection.
Apache Superset Cross-site Scripting (XSS) vulnerability on the Explore page
Advisory: GHSA-f8vc-f28w-x9c9
Aliases: CVE-2021-32609
Published: 2022-05-24T19:17:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.
Cross-site Scripting in Jenkins Global Variable String Parameter Plugin
Advisory: GHSA-7rjv-q3pp-wc4p
Aliases: CVE-2022-30962
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Global Variable String Parameter Plugin 1.2 and earlier does not escape the name and description of Global Variable String parameters on views displaying parameters. This results in stored cross-site scripting (XSS) vulnerabilities exploitable by attackers with Item/Configure permission.

Exploitation of these vulnerabilities requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
ChakraCore RCE Vulnerability
Advisory: GHSA-8v2h-4jpm-3wfm
Aliases: CVE-2017-8658
Published: 2022-05-17T01:57:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
Plone contains Cross-site Request Forgery
Advisory: GHSA-2q75-f7cp-w86q
Aliases: CVE-2012-5500
Published: 2022-05-17T04:30:18Z

The batch id change script (renameObjectsByPaths.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to change the titles of content items by leveraging a valid CSRF token in a crafted request.
ChakraCore RCE Vulnerability
Advisory: GHSA-6r3x-5gwg-g642
Aliases: CVE-2017-11806
Published: 2022-05-17T00:32:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
SQL injection in helloxz/imgurl
Advisory: GHSA-rrjv-34p5-4c7r
Aliases: CVE-2022-29305
Published: 2022-05-25T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

imgurl v2.31 was discovered to contain a Blind SQL injection vulnerability via /upload/localhost.
CSRF in baserCMS 3.0.10 and earlier
Advisory: GHSA-46vm-rwrf-jrxm
Aliases: CVE-2016-4881
Published: 2022-05-17T02:45:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Server-Side Request Forgery in scout-browser
Advisory: GHSA-g53g-q539-93cv
Aliases: CVE-2022-1592
Published: 2022-05-06T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Pypi package scout-browser (GitHub repository clinical-genomics/scout) prior to v4.52 is vulnerable to server-side request forgery. An attacker could make the application perform arbitrary requests to steal cookies, request access to private areas, or lead to cross-site scripting.
Django Allows Redirect via Data URL
Advisory: GHSA-78vx-ggch-wghm
Aliases: CVE-2012-3442
Published: 2022-05-17T05:12:01Z

The (1) `django.http.HttpResponseRedirect` and (2) `django.http.HttpResponsePermanentRedirect` classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a `data:` URL.
Magento 2 Community Edition Weak Cryptography
Advisory: GHSA-hmch-9947-82rj
Aliases: CVE-2019-8118
Published: 2022-05-24T17:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
ChakraCore RCE Vulnerability
Advisory: GHSA-7724-427r-8rvm
Aliases: CVE-2018-0943
Published: 2022-05-13T01:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8130, CVE-2018-8133, CVE-2018-8145, CVE-2018-8177.
PDFKit Improper Input Validation vulnerability
Advisory: GHSA-39v7-xpq4-8884
Aliases: CVE-2013-1607
Published: 2022-05-05T00:29:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ruby PDFKit gem prior to 0.5.3 has a Code Execution Vulnerability
Cobbler XSS Vulnerability
Advisory: GHSA-q9g5-98pm-w6q7
Aliases: CVE-2018-1000225
Published: 2022-05-14T02:19:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via "network connectivity". Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).
UberFire Framework Improperly Restricts Paths
Advisory: GHSA-6h58-c7r7-g2hw
Aliases: CVE-2014-8114
Published: 2022-05-14T01:10:41Z

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.
Logstash Logs Sensitive Information
Advisory: GHSA-3gg4-6hqg-2vjx
Aliases: CVE-2016-10362
Published: 2022-05-13T01:38:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth credentials.
ChakraCore RCE Vulnerability
Advisory: GHSA-vh9x-fprq-2hhj
Aliases: CVE-2018-0990
Published: 2022-05-13T01:18:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0980, CVE-2018-0993, CVE-2018-0994, CVE-2018-0995, CVE-2018-1019.
Improper Input Validation in Jenkins
Advisory: GHSA-f7f6-xrwc-9c57
Aliases: CVE-2017-1000394
Published: 2022-05-14T01:04:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-fileupload library with the denial-of-service vulnerability known as CVE-2016-3092. The fix for that vulnerability has been backported to the version of the library bundled with Jenkins.
Jenkins jira-ext Plugin stores credentials unencrypted
Advisory: GHSA-chm8-wp3h-f4m3
Aliases: CVE-2019-10302
Published: 2022-05-24T16:43:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins jira-ext Plugin 0.8 and earlier stored credentials unencrypted in its global configuration file `hudson.plugins.jira.JiraProjectProperty.xml` on the Jenkins controller. These credentials could be viewed by users with access to the Jenkins controller file system.

jira-ext Plugin version 0.9 stores credentials encrypted.
ClassLoader manipulation in Apache Struts
Advisory: GHSA-3c5c-xrq4-qhr8
Aliases: CVE-2014-0113
Published: 2022-05-14T00:54:15Z

CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
Showdoc Forced Browsing
Advisory: GHSA-6xx7-cphv-pxgr
Aliases: CVE-2018-19609
Published: 2022-05-14T01:45:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL.
Incorrect permission checks in Jenkins Config File Provider Plugin allow enumerating credentials IDs
Advisory: GHSA-3m3f-2323-64m7
Aliases: CVE-2021-21643
Published: 2022-05-24T17:48:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Config File Provider Plugin 3.7.0 and earlier does not correctly perform permission checks in several HTTP endpoints.

This allows attackers with global Job/Configure permission to enumerate system-scoped credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of system-scoped credentials IDs in Config File Provider Plugin 3.7.1 requires Overall/Administer permission.
Publify vulnerable to cross site scripting
Advisory: GHSA-3hwx-c6cp-q972
Aliases: CVE-2022-1811
Published: 2022-05-24T00:01:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Unrestricted file upload allowed the attacker to manipulate the request and bypass the protection of HTML files using a text file. Stored XSS may be obtained.
Fluentd Escape Sequence Injection Vulnerability
Advisory: GHSA-5jrp-w8fr-mrww
Aliases: CVE-2017-10906
Published: 2022-05-13T01:07:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Escape sequence injection vulnerability in Fluentd versions 0.12.29 through 0.12.40 may allow an attacker to change the terminal UI or execute arbitrary commands on the device via unspecified vectors.
Missing Authorization in Jenkins
Advisory: GHSA-6jfc-mc97-c7wg
Aliases: CVE-2019-10354
Published: 2022-05-24T16:50:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.
Missing permission check in Jenkins Team Foundation Server Plugin allows enumerating credentials IDs
Advisory: GHSA-vg28-9f43-gmh5
Aliases: CVE-2021-21636
Published: 2022-05-24T17:45:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Team Foundation Server Plugin 5.157.1 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

As of publication of this advisory, there is no fix.
ChakraCore RCE Vulnerability
Advisory: GHSA-wc4x-9h9p-9494
Aliases: CVE-2018-0930
Published: 2022-05-13T01:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 1709 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
Donfig Command Injection in collect_yaml method
Advisory: GHSA-3qr5-h7w4-3gx3
Aliases: CVE-2019-7537
Published: 2022-05-14T01:15:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Donfig 0.3.0. There is a vulnerability in the `collect_yaml` method in `config_obj.py`. It can execute arbitrary Python commands, resulting in command execution.
XML injection in Crafter CMS
Advisory: GHSA-p2vm-88rg-wfr2
Aliases: CVE-2017-15683
Published: 2022-05-24T17:34:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

In Crafter CMS Crafter Studio 3.0 prior to 3.0.1 an unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
Relution Enterprise Appstore Publisher Jenkins Plugin contains Cross-Site Request Forgery 
Advisory: GHSA-xjch-wqmw-fgcp
Aliases: CVE-2019-10388
Published: 2022-05-24T16:52:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery vulnerability in Jenkins Relution Enterprise Appstore Publisher Plugin 1.24 and earlier allows attackers to have Jenkins initiate an HTTP connection to an attacker-specified server.
irisnet-crypto RCE Vulnerability
Advisory: GHSA-5fh8-x9xc-hxmc
Aliases: CVE-2019-9115
Published: 2022-05-13T01:08:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In irisnet-crypto before 1.1.7 for IRISnet, the util/utils.js file allows code execution because of unsafe eval usage.
Chakra JIT server Privilege Escalation 
Advisory: GHSA-6c6r-39cv-x5fq
Aliases: CVE-2019-0649
Published: 2022-05-13T01:21:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability exists in Microsoft Chakra JIT server, aka 'Scripting Engine Elevation of Privileges Vulnerability'.
Jenkins buildgraph-view Plugin vulnerable to stored Cross-site Scripting
Advisory: GHSA-4j4g-fp93-qvrw
Aliases: CVE-2019-16562
Published: 2022-05-24T17:03:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored cross-site scripting vulnerability exploitable by users able to change build descriptions.
OS command injection vulnerability in Jenkins Play Framework Plugin
Advisory: GHSA-h5mv-fv98-gqmq
Aliases: CVE-2020-2200
Published: 2022-05-24T17:19:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A form validation endpoint in Play Framework Plugin executes the `play` command to validate a given input file.

Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins controller. This results in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins controller (e.g. through archiving artifacts).
ChakraCore RCE Vulnerability
Advisory: GHSA-63fw-7jgf-5hwv
Aliases: CVE-2020-0711
Published: 2022-05-24T17:08:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.
Jenkins Anchore Container Scanner Plugin vulnerable to Insufficiently Protected Credentials
Advisory: GHSA-jg29-c2qj-wpm3
Aliases: CVE-2019-16542
Published: 2022-05-24T17:01:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system. 

The credential being stored was a service password for the Anchore.io service. As the affected functionality has been deprecated, and the affected Anchore.io service has been shut down in late 2018, the affected feature has been removed.
Jenkins Dependency Graph Viewer Plugin contains Cross-site Scripting
Advisory: GHSA-4wj7-rh5h-5qmr
Aliases: CVE-2019-10349
Published: 2022-05-24T16:50:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.
Origin Validation Error in Apache NiFi 
Advisory: GHSA-jvx9-rj3w-jq99
Aliases: CVE-2017-7667
Published: 2022-05-17T02:40:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache NiFi before 0.7.4 and 1.x before 1.3.0 need to establish the response header telling browsers to only allow framing with the same origin.
Arbitrary code execution in Richfaces
Advisory: GHSA-4j38-wjhf-884r
Aliases: CVE-2018-12533
Published: 2022-05-13T01:19:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.
Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module
Advisory: GHSA-89f3-74m6-g27g
Aliases: CVE-2013-1833
Published: 2022-05-13T01:12:59Z

Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
Jenkins Favorite Plugin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-jqwh-jrpg-5j3h
Aliases: CVE-2017-1000244
Published: 2022-05-14T01:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins Favorite Plugin version 2.2.0 and older is vulnerable to CSRF resulting in data modification.
Missing permission check in Blue Ocean Plugin
Advisory: GHSA-vc7g-4269-f7hw
Aliases: CVE-2020-2255
Published: 2022-05-24T17:28:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

### Updated 2020-09-16
This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it.

### Original Description
Blue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints implementing connection tests.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Blue Ocean Plugin 1.23.3 requires Item/Create permission to perform these connection tests.
Denial of service in ASP.NET Core
Advisory: GHSA-5f2m-466j-3848
Aliases: CVE-2019-0981
Published: 2022-05-24T16:45:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists when .NET Framework or .NET Core improperly handle web requests, aka '.Net Framework and .Net Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0820, CVE-2019-0980.
Observable Discrepancy in Wildfly Elytron
Advisory: GHSA-5499-qjvh-6j7w
Aliases: CVE-2021-3642
Published: 2022-05-24T19:10:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final.
Microweber allows Unrestricted File Upload
Advisory: GHSA-89fp-j8v7-p82h
Aliases: CVE-2020-13241
Published: 2022-05-24T17:18:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Microweber 1.1.18 allows Unrestricted File Upload because `admin/view:modules/load_module:users#edit-user=1` does not verify that the file extension (used with the Add Image option on the Edit User screen) corresponds to an image file.
ChakraCore RCE Vulnerability
Advisory: GHSA-px6p-jxwr-27mc
Aliases: CVE-2017-11805
Published: 2022-05-17T00:32:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Improper Input Validation in Deap
Advisory: GHSA-xg47-r67p-vhv5
Aliases: CVE-2018-3749
Published: 2022-05-14T03:05:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The utilities function in all versions < 1.0.1 of the deap node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-gfcq-wh3g-c6h4
Aliases: CVE-2019-8110
Published: 2022-05-24T17:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage email templates hierarchy to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code.
Missing permission check in Jenkins requests-plugin Plugin allows viewing pending requests
Advisory: GHSA-c4c3-3cgh-vvrh
Aliases: CVE-2021-21674
Published: 2022-05-24T19:06:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

requests-plugin Plugin 2.2.6 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to view the list of pending requests.

requests-plugin Plugin 2.2.7 requires Overall/Administer permission to view the list of pending requests.

The previous sentence originally stated that Overall/Read permission was newly required. This statement was incorrect and has been fixed on 2021-07-05.
CSRF vulnerability in Health Advisor by CloudBees Plugin
Advisory: GHSA-fc92-8r77-9297
Aliases: CVE-2020-2093
Published: 2022-05-24T17:06:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Health Advisor by CloudBees Plugin 3.0 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to send an email with fixed content to an attacker-specified recipient.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

Health Advisor by CloudBees Plugin 3.0.1 requires POST requests and Overall/Administer permission for the affected form validation methods.
Cross-site scripting in Apache Struts
Advisory: GHSA-p3vw-fvwx-qcv5
Aliases: CVE-2006-1548
Published: 2022-05-01T06:50:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Cross-site scripting (XSS) vulnerability in (1) LookupDispatchAction and possibly (2) DispatchAction and (3) ActionDispatcher in Apache Software Foundation (ASF) Struts before 1.2.9 allows remote attackers to inject arbitrary web script or HTML via the parameter name, which is not filtered in the resulting error message.
Improper Input Validation in Apache Struts
Advisory: GHSA-5ggr-mpgw-3mgx
Aliases: CVE-2016-1182
Published: 2022-05-13T01:25:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site scripting (XSS) attacks or cause a denial of service via crafted input, a related issue to CVE-2015-0899.
Jenkins HTML Publisher Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-q829-hrmc-84c8
Aliases: CVE-2019-10432
Published: 2022-05-24T16:57:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins HTML Publisher Plugin prior to version 1.21 did not escape the project and build display names in the HTML report frame, resulting in a cross-site scripting vulnerability exploitable by users able to change those. This issue has been patched in version 1.21
Improper Restriction of XML External Entity Reference in Apache POI
Advisory: GHSA-q56h-jjj6-52mf
Aliases: CVE-2014-3529
Published: 2022-05-17T01:24:40Z

The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Wildfly EJB Client causes DoS
Advisory: GHSA-qcch-9268-59jw
Aliases: CVE-2020-14297
Published: 2022-05-24T17:24:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventually unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-6vx3-hr43-cfrh
Aliases: CVE-2016-0706
Published: 2022-05-14T01:10:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
Pillow command injection
Advisory: GHSA-8m9x-pxwq-j236
Aliases: CVE-2014-3007
Published: 2022-05-17T04:45:39Z

Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.
Cross-Site Request Forgery in Apache Struts
Advisory: GHSA-2rvh-q539-q33v
Aliases: CVE-2012-4386
Published: 2022-05-17T01:42:17Z

The token check mechanism in Apache Struts 2.0.0 through 2.3.4 does not properly validate the token name configuration parameter, which allows remote attackers to perform cross-site request forgery (CSRF) attacks by setting the token name configuration parameter to a session attribute.
Magento 2 Community Edition Information Disclosure
Advisory: GHSA-h522-94xp-2xr6
Aliases: CVE-2019-7929
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request.
Incorrect Resource Transfer Between Spheres in Grails
Advisory: GHSA-pmxf-4v8c-rwr7
Aliases: CVE-2019-12728
Published: 2022-05-24T16:47:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.
Symfony Open Redirect
Advisory: GHSA-7hwc-2cq4-6x2w
Aliases: CVE-2018-11408
Published: 2022-05-14T01:21:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The security handlers in the Security component in Symfony in 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11 have an Open redirect vulnerability when security.http_utils is inlined by a container.  NOTE: this issue exists because of an incomplete fix for CVE-2017-16652.
Improper Input Validation in Apache Tomcat
Advisory: GHSA-qprx-q2r7-3rx6
Aliases: CVE-2014-0096
Published: 2022-05-14T01:10:18Z

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
NodeBB Cross-site Scripting Vulnerability in Markdown Processing
Advisory: GHSA-9g4f-5rpg-4948
Aliases: CVE-2015-3296
Published: 2022-05-17T00:47:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in NodeBB before 0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) javascript: or (2) data: URLs.
Improper handling of multiline messages in node-irc affects matrix-appservice-irc
Advisory: GHSA-37hr-348p-rmf4
Aliases: CVE-2022-29166
Published: 2022-05-23T20:17:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

matrix-appservice-irc provides an IRC bridge for Matrix. The vulnerability in node-irc allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. The vulnerability has been patched in matrix-appservice-irc 0.33.2. In terms of a workaround, users should refrain from replying to messages from untrusted participants in IRC-bridged Matrix rooms.
Gophish vulnerable to Server-Side Request Forgery
Advisory: GHSA-9c9w-9pq7-f35h
Aliases: CVE-2020-24710
Published: 2022-05-24T17:32:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Gophish before 0.11.0 allows SSRF attacks.
XML External Entity Reference in apache jena
Advisory: GHSA-gchv-364h-r896
Aliases: CVE-2022-28890
Published: 2022-05-06T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena version 4.4.0 and prior versions. Apache Jena 4.2.x and 4.3.x do not allow external entities.
Loop with Unreachable Exit Condition in Apache PDFBox
Advisory: GHSA-j2xq-pfff-mvgg
Aliases: CVE-2018-8036
Published: 2022-05-13T01:53:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

In Apache PDFBox 1.8.0 to 1.8.14 and 2.0.0RC1 to 2.0.10, a carefully crafted (or fuzzed) file can trigger an infinite loop which leads to an out of memory exception in Apache PDFBox's AFMParser.
Apache Geode unsafe deserialization in TcpServer
Advisory: GHSA-w395-hpq9-7xwr
Aliases: CVE-2017-15692
Published: 2022-05-14T03:35:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache Geode before v1.4.0, the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator, they may be able to cause remote code execution if certain classes are present on the classpath.
Missing permission check in Perfecto Plugin
Advisory: GHSA-3h2q-m63q-9cf6
Aliases: CVE-2020-2260
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Perfecto Plugin 1.17 and earlier does not perform a permission check in a method implementing a connection test.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL using attacker-specified username and password.

Perfecto Plugin 1.18 requires Overall/Administer permission to perform a connection test.
Bootstrap vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-3wqf-4x89-9g79
Aliases: CVE-2018-14040
Published: 2022-05-13T01:07:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Bootstrap 4.x before 4.1.2, XSS is possible in the collapse data-parent attribute.
Jenkins vSphere Plugin incorrect authorization vulnerability
Advisory: GHSA-48pq-x3vw-4pqf
Aliases: CVE-2018-1000152
Published: 2022-05-13T01:48:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

An improper authorization vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection"). As of version 2.17, these form validation methods require POST requests and appropriate user permissions.
OpenStack Image Registry and Delivery Service (Glance) Improper Input Validation vulnerability
Advisory: GHSA-r7pj-rvwg-vxhr
Aliases: CVE-2014-0162
Published: 2022-05-17T04:42:42Z

The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or modify an image to execute arbitrary commands via a crafted location.
Segfault due to missing support for quantized types
Advisory: GHSA-54ch-gjq5-4976
Aliases: CVE-2022-29205
Published: 2022-05-24T22:12:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
There is a potential for segfault / denial of service in TensorFlow by calling `tf.compat.v1.*` ops which don't yet have support for quantized types (added after migration to TF 2.x):

```python
import numpy as np
import tensorflow as tf

tf.compat.v1.placeholder_with_default(input=np.array([2]),shape=tf.constant(dtype=tf.qint8, value=np.array([1])))
```

In these scenarios, since the kernel is missing, a [`nullptr` value is passed](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/eager/pywrap_tfe_src.cc#L480-L482) to [`ParseDimensionValue`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/eager/pywrap_tfe_src.cc#L296-L320) for the `py_value` argument. Then, this is dereferenced, resulting in segfault.

### Patches
We have patched the issue in GitHub commit [237822b59fc504dda2c564787f5d3ad9c4aa62d9](https://github.com/tensorflow/tensorflow/commit/237822b59fc504dda2c564787f5d3ad9c4aa62d9).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Hong Jin from Singapore Management University.
Pivotal Spring Framework contains unsafe Java deserialization methods
Advisory: GHSA-4wrc-f8pq-fpqp
Aliases: CVE-2016-1000027
Published: 2022-05-24T17:05:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pivotal Spring Framework before 6.0.0 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Maintainers recommend investigating alternative components or a potential mitigating control. Version 4.2.6 and 3.2.17 contain [enhanced documentation](https://github.com/spring-projects/spring-framework/commit/5cbe90b2cd91b866a5a9586e460f311860e11cfa) advising users to take precautions against unsafe Java deserialization, version 5.3.0 [deprecate the impacted classes](https://github.com/spring-projects/spring-framework/issues/25379) and version 6.0.0 [removed it entirely](https://github.com/spring-projects/spring-framework/issues/27422).
Typo3 Cross-Site Scripting in Link Handling
Advisory: GHSA-r6fv-56gp-j3r4
Aliases: CVE-2019-12748
Published: 2022-05-24T22:00:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
Improper Input Validation in Apache Santuario XML Security
Advisory: GHSA-w7cq-j9p9-hm3m
Aliases: CVE-2014-8152
Published: 2022-05-13T01:05:55Z

Apache Santuario XML Security for Java 2.0.x before 2.0.3 allows remote attackers to bypass the streaming XML signature protection mechanism via a crafted XML document.
Django CSRF Protection Bypass
Advisory: GHSA-crhm-qpjc-cm64
Aliases: CVE-2016-7401
Published: 2022-05-14T03:55:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.
Ansible password prompts could expose passwords
Advisory: GHSA-cqmr-rcpr-cxh3
Aliases: CVE-2019-10206
Published: 2022-05-24T17:01:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins Kubernetes Plugin
Advisory: GHSA-fh5w-p2j4-4p8x
Aliases: CVE-2020-2307
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 includes a feature to replace placeholders in pod template and container template fields with environment variable values.

This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables.

Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 disables this feature.
Apache Tika vulnerable to uncontrolled memory consumption
Advisory: GHSA-7qcq-xp2f-56f6
Aliases: CVE-2022-25169
Published: 2022-05-17T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

The BPG parser in versions of Apache Tika before 1.28.2 and 2.4.0 may allocate an unreasonable amount of memory on carefully crafted files.
Jenkins Zephyr for JIRA Test Management Plugin stores credentials in plain text
Advisory: GHSA-m365-98j8-w96w
Aliases: CVE-2020-2154
Published: 2022-05-24T17:10:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Zephyr for JIRA Test Management Plugin 1.5 and earlier stores Jira credentials unencrypted in its global configuration file `com.thed.zephyr.jenkins.reporter.ZfjReporter.xml` on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system.
Uncontrolled Resource Consumption in Undertow
Advisory: GHSA-gjjx-gqm4-wcgm
Aliases: CVE-2018-1114
Published: 2022-05-13T01:33:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.
Credentials stored in plain text by Jenkins White Source Plugin
Advisory: GHSA-v8v2-fhgv-3vq2
Aliases: CVE-2020-2213
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

White Source Plugin prior to version 20.8.1 stores credentials in plain text as part of its global configuration file `org.whitesource.jenkins.pipeline.WhiteSourcePipelineStep.xml` and job config.xml files on the Jenkins controller. These credentials could be viewed by users with Extended Read permission (in the case of job config.xml files) or access to the Jenkins controller file system. Version 20.8.1 contains a patch for the issue.
OpenStack Object Storage (Swift) Sensitive Data Exposure
Advisory: GHSA-q45h-chc8-hvp6
Aliases: CVE-2015-5223
Published: 2022-05-14T03:59:06Z

OpenStack Object Storage (Swift) before 2.4.0 allows attackers to obtain sensitive information via a PUT tempurl and a DLO object manifest that references an object in another container.
Improper Verification of Cryptographic Signature in Nimbus JOSE+JWT
Advisory: GHSA-pfv2-37f7-9m6w
Aliases: CVE-2017-12974
Published: 2022-05-13T01:30:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.
Improper Authentication in pyftpdlib
Advisory: GHSA-9x66-ghqx-8g5r
Aliases: CVE-2007-6737
Published: 2022-05-01T18:45:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

FTPServer.py in pyftpdlib before 0.2.0 does not increment the attempted_logins count for a USER command that specifies an invalid username, which makes it easier for remote attackers to obtain access via a brute-force attack.
Dolibarr ERP and CRM SQLi
Advisory: GHSA-v3m8-7h3p-6j5m
Aliases: CVE-2017-9435
Published: 2022-05-17T02:42:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-9qgf-4fpf-cmh2
Aliases: CVE-2019-10404
Published: 2022-05-24T22:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips, resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked, such as label expressions not matching any idle executors.
Jenkins CodeScan Plugin has Insufficiently Protected Credentials
Advisory: GHSA-jp8r-jh5j-cgwf
Aliases: CVE-2019-10423
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CodeScan Plugin stores an API key unencrypted in its global configuration file `com.villagechief.codescan.jenkins.CodeScanBuilder.xml` on the Jenkins controller. This API key can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.
Ansible Sensitive Files Are Locally Readable
Advisory: GHSA-5g4v-2pc6-4hh4
Aliases: CVE-2014-4658
Published: 2022-05-17T19:57:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.
Moodle Temporary Passwords are Brute Force-able
Advisory: GHSA-9v64-447r-wch6
Aliases: CVE-2014-7845
Published: 2022-05-13T01:12:43Z

The generate_password function in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 does not provide a sufficient number of possible temporary passwords, which allows remote attackers to obtain access via a brute-force attack.
Stored XSS vulnerability in Custom Job Icon Plugin
Advisory: GHSA-wrwq-4f2h-qxj8
Aliases: CVE-2020-2264
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Custom Job Icon Plugin 0.2 and earlier does not escape the job descriptions in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.