aswin1906/github-advisory-2022 huggingface dataset:
Improper Restriction of XML External Entity Reference in Apache OpenNLP
Advisory: GHSA-h22x-hm8g-rxpg
Aliases: CVE-2017-12620
Published: 2022-05-17T00:29:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

When loading models or dictionaries that contain XML it is possible to perform an XXE attack, since Apache OpenNLP is a library, this only affects applications that load models or dictionaries from untrusted sources. The versions 1.5.0 to 1.5.3, 1.6.0, 1.7.0 to 1.7.2, 1.8.0 to 1.8.1 of Apache OpenNLP are affected.
phpMyAdmin Multiple Cross-site Scripting Vulnerabilities in the Database Structure page
Advisory: GHSA-r3pq-mp8v-cp33
Aliases: CVE-2012-4345
Published: 2022-05-17T05:12:26Z

Multiple cross-site scripting (XSS) vulnerabilities in the Database Structure page in phpMyAdmin 3.4.x before 3.4.11.1 and 3.5.x before 3.5.2.2 allow remote authenticated users to inject arbitrary web script or HTML via (1) a crafted table name during table creation, or a (2) Empty link or (3) Drop link for a crafted table name.
Improper Restriction of XML External Entity Reference in Stanford CoreNLP
Advisory: GHSA-5h9g-8xcv-qjq9
Aliases: CVE-2021-3878
Published: 2022-05-24T19:17:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

corenlp is vulnerable to Improper Restriction of XML External Entity Reference
XML Injection in Apache Solr
Advisory: GHSA-45w3-2hvv-pfxq
Aliases: CVE-2013-6408
Published: 2022-05-17T04:39:49Z

The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.
Jenkins Azure Event Grid Build Notifier Plugin has Insufficiently Protected Credentials
Advisory: GHSA-826h-fxff-hpqf
Aliases: CVE-2019-10421
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Azure Event Grid Build Notifier Plugin stores the Azure Event Grid secret key unencrypted in job `config.xml` files on the Jenkins controller. This key can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.
Magento 2 Community Edition CSRF Vulnerability
Advisory: GHSA-wmrg-w9vg-7jqx
Aliases: CVE-2019-7865
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration.
Kubernetes DoS Vulnerability
Advisory: GHSA-q4rr-64r9-fwgf
Aliases: CVE-2019-1002100
Published: 2022-05-13T01:21:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server.
Path Traversal in OWASP Dependency-Check
Advisory: GHSA-hcwx-7q5v-vc67
Aliases: CVE-2018-12036
Published: 2022-05-14T03:12:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.
Jenkins Resource Disposer Plugin allows attacker to stop tracking specified resource
Advisory: GHSA-63jg-5wv6-7ghv
Aliases: CVE-2018-1999037
Published: 2022-05-14T02:45:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

A data modification vulnerability exists in Jenkins Resource Disposer Plugin 0.11 and earlier in AsyncResourceDisposer.java that allows attackers to stop tracking a specified resource. Additionally, this API endpoint did not require POST requests, resulting in a CSRF vulnerability. As of version 0.12, this API endpoint requires POST requests and Overall/Administer permissions.
Improper Neutralization of Input During Web Page Generation in Direct Web Remoting
Advisory: GHSA-q5v2-2v66-6hwm
Aliases: CVE-2014-5326
Published: 2022-05-17T04:21:06Z

Cross-site scripting (XSS) vulnerability in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Advisory: GHSA-fxqr-px2m-fvc2
Aliases: CVE-2014-3662
Published: 2022-05-17T03:53:35Z

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to enumerate user names via vectors related to login attempts.
Cross-site request forgery vulnerability in Jenkins Nomad Plugin
Advisory: GHSA-5q63-jvc9-qphv
Aliases: CVE-2019-1003092
Published: 2022-05-13T01:25:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A cross-site request forgery vulnerability in Jenkins Nomad Plugin in the NomadCloud.DescriptorImpl#doTestConnection form validation method allows attackers to initiate a connection to an attacker-specified server.
Stored XSS vulnerability in Radiator View Plugin
Advisory: GHSA-7vp5-xf5q-fxjq
Aliases: CVE-2020-2263
Published: 2022-05-24T17:28:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Radiator View Plugin 1.29 and earlier does not escape the full name of the jobs in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
Type confusion leading to `CHECK`-failure based denial of service in TensorFlow
Advisory: GHSA-f4rr-5m7v-wxcw
Aliases: CVE-2022-29209
Published: 2022-05-24T22:14:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The [macros that TensorFlow uses for writing assertions (e.g., `CHECK_LT`, `CHECK_GT`, etc.)](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/platform/default/logging.h) have an incorrect logic when comparing `size_t` and `int` values. Due to type conversion rules, several of the macros would trigger incorrectly.

### Patches
We have patched the issue in GitHub commit [b917181c29b50cb83399ba41f4d938dc369109a1](https://github.com/tensorflow/tensorflow/commit/b917181c29b50cb83399ba41f4d938dc369109a1) (merging GitHub PR [#55730](https://github.com/tensorflow/tensorflow/pull/55730)).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/55530).
Passwords stored in plain text by Harvest SCM Plugin
Advisory: GHSA-qj7p-9hgf-x8j7
Aliases: CVE-2020-2131
Published: 2022-05-24T17:08:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Harvest SCM Plugin 0.5.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Missing Authorization in Jenkins Kubernetes Plugin
Advisory: GHSA-rr6j-37cv-c7x7
Aliases: CVE-2020-2308
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to list global pod template names.

Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 requires Overall/Administer permission to list global pod template names.
ChakraCore RCE Vulnerability
Advisory: GHSA-4f5g-j7wg-7w8j
Aliases: CVE-2016-7201
Published: 2022-05-14T02:22:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
PHP Code Injection by malicious block or filename in Smarty
Advisory: GHSA-634x-pc3q-cf4c
Aliases: CVE-2022-29221
Published: 2022-05-25T20:15:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
Template authors could inject php code by choosing a malicous {block} name or {include} file name. Sites that cannot fully trust template authors should update asap.

### Patches
Please upgrade to the most recent version of Smarty v3 or v4.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the Smarty repo](https://github.com/smarty-php/smarty)
Dolibarr ERP and CRM contain XSS Vulnerabilities
Advisory: GHSA-jh5p-wpg2-8rgv
Aliases: CVE-2016-1912
Published: 2022-05-17T03:59:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the (1) lastname, (2) firstname, (3) email, (4) job, or (5) signature parameter to htdocs/user/card.php.
CSV-Safe improperly filters special characters potentially leading to CSV injection
Advisory: GHSA-f55g-x8qq-2569
Aliases: CVE-2022-28481
Published: 2022-05-03T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CSV-Safe gem < 3.0.0 doesn't filter out special characters which could trigger CSV Injection.
XXE vulnerability in Jenkins URLTrigger Plugin
Advisory: GHSA-34j5-c4cv-mmg5
Aliases: CVE-2021-21659
Published: 2022-05-24T19:03:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Job/Configure permission or otherwise able to control the contents of an URL to an XML document being examined for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.

URLTrigger Plugin 0.49 disables external entity resolution for its XML parser.
Gitea XSS Vulnerability
Advisory: GHSA-5rh7-6gfj-mc87
Aliases: CVE-2019-1010261
Published: 2022-05-24T16:50:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Gitea 1.7.0 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Attacker is able to have victim execute arbitrary JS in browser. The component is: go-get URL generation - PR to fix: https://github.com/go-gitea/gitea/pull/5905. The attack vector is: victim must open a specifically crafted URL. The fixed version is: 1.7.1 and later.
Deserialization of Untrusted Data in Jenkins
Advisory: GHSA-4466-8jm4-448p
Aliases: CVE-2017-1000355
Published: 2022-05-14T03:44:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an XStream: Java crash when trying to instantiate void/Void.
Plone is vulnerable to Information Exposure when generating zip archives
Advisory: GHSA-grwx-4p5v-9g2g
Aliases: CVE-2013-4191
Published: 2022-05-17T04:49:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
Uncontrolled Resource Consumption in Apache ZooKeeper
Advisory: GHSA-7cwj-j333-x7f7
Aliases: CVE-2017-5637
Published: 2022-05-13T01:08:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests. Apache ZooKeeper thru version 3.4.9 and 3.5.2 suffer from this issue, fixed in 3.4.10, 3.5.3, and later.
Improper Input Validation in pip
Advisory: GHSA-g3p5-fjj9-h8gj
Aliases: CVE-2013-1629
Published: 2022-05-13T01:11:25Z

pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
Stored XSS vulnerability in Jenkins Matrix Authorization Strategy Plugin
Advisory: GHSA-vr6v-wjfw-rxcr
Aliases: CVE-2020-2226
Published: 2022-05-24T17:23:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Matrix Authorization Strategy Plugin 2.6.1 and earlier does not escape user names shown in the permission table. This results in a stored cross-site scripting (XSS) vulnerability. When using project-based matrix authorization, this vulnerability can be exploited by a user with Job/Configure or Agent/Configure permission, otherwise by users with Overall/Administer permission.

Matrix Authorization Strategy Plugin 2.6.2 escapes user names in the permission table.
Ansible Exposes Sensitive Information
Advisory: GHSA-5rrg-rr89-x9mv
Aliases: CVE-2021-20228
Published: 2022-05-25T19:22:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the `no_log` feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality.
XSS vulnerability in Jenkins TICS Plugin
Advisory: GHSA-xmw5-45v9-pxqx
Aliases: CVE-2021-21613
Published: 2022-05-24T17:39:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

TICS Plugin 2020.3.0.6 and earlier does not escape TICS service responses.

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to control TICS service response content.

TICS Plugin 2020.3.0.7 escapes TICS service responses, or strips HTML out, as appropriate.
CSRF vulnerability in Jenkins CVS Plugin
Advisory: GHSA-63mw-hp3h-gc77
Aliases: CVE-2020-2184
Published: 2022-05-24T17:17:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVS Plugin 2.15 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows attackers to create and manipulate tags, and to connect to an attacker-specified URL.

CVS Plugin 2.16 now requires POST requests for the affected HTTP endpoints.
Improper Neutralization of Input During Web Page Generation in Spring Framework
Advisory: GHSA-xjrf-8x4f-43h4
Aliases: CVE-2013-6430
Published: 2022-05-05T00:29:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.
ChakraCore RCE Vulnerability
Advisory: GHSA-h9h7-4jfm-3fxr
Aliases: CVE-2018-0872
Published: 2022-05-13T01:18:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
CSRF vulnerability in Jenkins Shared Objects Plugin
Advisory: GHSA-2v9x-gpq4-8gg2
Aliases: CVE-2020-2296
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Shared Objects Plugin 0.44 and earlier allows attackers to configure shared objects.
Apache Tomcat allows remote attackers to read JSP source files
Advisory: GHSA-qrcx-p4rr-g48h
Aliases: CVE-2005-4836
Published: 2022-05-01T02:31:23Z

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
Jenkins GitHub Branch Source Plugin vulnerable to Server-Side Request Forgery
Advisory: GHSA-9cfq-v2hm-c3xr
Aliases: CVE-2018-1000185
Published: 2022-05-14T03:13:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A server-side request forgery vulnerability exists in Jenkins GitHub Branch Source Plugin 2.3.4 and older in Endpoint.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. Additionally, this form validation method did not require POST requests, resulting in a CSRF vulnerability. As of version 23.5, this form validation method requires POST requests and the Overall/Administer permission.
Cleartext Transmission of Sensitive Information in Apache MINA
Advisory: GHSA-5h29-qq92-wj7f
Aliases: CVE-2019-0231
Published: 2022-05-24T16:57:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.
ChakraCore RCE Vulnerability
Advisory: GHSA-jgj7-hq9p-rqmg
Aliases: CVE-2018-8390
Published: 2022-05-13T01:20:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389.
ShopXO RCE Vulnerability
Advisory: GHSA-xx77-w6p5-xvmj
Aliases: CVE-2021-27817
Published: 2022-05-24T17:44:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix.
Secrets are not masked by Jenkins Credentials Binding Plugin in builds without build steps
Advisory: GHSA-43j2-r4v3-m8jp
Aliases: CVE-2020-2181
Published: 2022-05-24T17:17:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Credentials Binding Plugin 1.22 and earlier does not mask (i.e., replace with asterisks) secrets in the build log when the build contains no build steps.

Credentials Binding Plugin 1.23 now masks secrets when the build contains no build steps.
Exposure of Resource to Wrong Sphere in Spring Cloud OpenFeign
Advisory: GHSA-pf94-6v2v-cm3j
Aliases: CVE-2021-22044
Published: 2022-05-24T19:19:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Spring Cloud OpenFeign 3.0.0 to 3.0.4, 2.2.0.RELEASE to 2.2.9.RELEASE, and older unsupported versions, applications using type-level `@RequestMapping`annotations over Feign client interfaces, can be involuntarily exposing endpoints corresponding to `@RequestMapping`-annotated interface methods.
ChakraCore RCE Vulnerability
Advisory: GHSA-2mmc-5phj-4wjj
Aliases: CVE-2019-0810
Published: 2022-05-13T01:21:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.
ChakraCore RCE Vulnerability
Advisory: GHSA-f8f9-q5hg-9c7q
Aliases: CVE-2017-11801
Published: 2022-05-17T00:32:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
PHP JOSE Library by Gree Inc. Uses a Broken or Risky Cryptographic Algorithm
Advisory: GHSA-xm5f-hc9r-76f3
Aliases: CVE-2016-5431
Published: 2022-05-24T16:52:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The PHP JOSE Library by Gree Inc. prior to 2.2.1 is vulnerable to key confusion/algorithm substitution in the JWS component resulting in bypassing the signature verification via crafted tokens.
Improper Link Resolution Before File Access in logilab-commons
Advisory: GHSA-rr52-wg7f-8875
Aliases: CVE-2014-1838
Published: 2022-05-14T02:09:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-common before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.
Exposure of Resource to Wrong Sphere in Apache Tomcat
Advisory: GHSA-3vx3-xf6q-r5xp
Aliases: CVE-2017-5648
Published: 2022-05-13T01:25:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.
Silverstripe CMS malicious file upload enables script execution
Advisory: GHSA-h77w-655f-6j3m
Aliases: CVE-2020-9309
Published: 2022-05-24T17:23:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for example HTML code in a TXT file). When these files are stored as protected or draft files, the MIME detection can cause browsers to execute the file contents. Uploads stored as protected or draft files are allowed by default for authorised users only, but can also be enabled through custom logic as well as modules such as silverstripe/userforms. Sites using the previously optional silverstripe/mimevalidator module can configure MIME whitelists rather than extension whitelists, and hence prevent this issue. Sites on the Common Web Platform (CWP) use this module by default, and are not affected.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-m3v2-r236-5xgq
Aliases: CVE-2019-7862
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
Advisory: GHSA-xh5x-j8jf-pcpx
Aliases: CVE-2014-0099
Published: 2022-05-14T01:10:18Z

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
Matrix Sydent mishandles emails
Advisory: GHSA-q9h8-gpw5-c95c
Aliases: CVE-2019-11340
Published: 2022-05-24T16:43:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring.
Passwords transmitted in plain text by Jenkins Stash Branch Parameter Plugin
Advisory: GHSA-3f82-v3qw-53q7
Aliases: CVE-2020-2210
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Stash Branch Parameter Plugin stores Stash API passwords in its global configuration file `org.jenkinsci.plugins.StashBranchParameter.StashBranchParameterDefinition.xml` on the Jenkins controller as part of its configuration.

While the password is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Stash Branch Parameter Plugin 0.3.0 and earlier. This can result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

This only affects Jenkins before 2.236, including 2.235.x LTS, as Jenkins 2.236 introduces a security hardening that transparently encrypts and decrypts data used for a Jenkins password form field.
Joomla! XSS in Default Templates
Advisory: GHSA-v84j-vh7x-g7j6
Aliases: CVE-2019-16725
Published: 2022-05-24T16:56:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Joomla! 3.x before 3.9.12, inadequate escaping allowed XSS attacks using the logo parameter of the default templates.
Buffer overflow in wasm3
Advisory: GHSA-77fq-4xf5-hph4
Aliases: CVE-2022-28990
Published: 2022-05-21T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-667q-vj58-rj88
Aliases: CVE-2018-1999046
Published: 2022-05-14T01:04:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A exposure of sensitive information vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in Computer.java that allows attackers With Overall/Read permission to access the connection log for any agent.
Improper Restriction of XML External Entity Reference in Stanford CoreNLP
Advisory: GHSA-8gf7-w3cp-gfh3
Aliases: CVE-2021-3869
Published: 2022-05-24T19:18:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Django denial of service via file upload naming
Advisory: GHSA-296w-6qhq-gf92
Aliases: CVE-2014-0481
Published: 2022-05-14T02:05:08Z

The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.
Stored XSS vulnerability in Jenkins 'keep forever' badge icon
Advisory: GHSA-864v-5q2g-fr64
Aliases: CVE-2020-2222
Published: 2022-05-24T17:23:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the job name in the 'Keep this build forever' badge tooltip. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure job names.

As job names do not generally support the character set needed for XSS, this is believed to be difficult to exploit in common configurations.

Jenkins 2.245, LTS 2.235.2 escapes the job name in the 'Keep this build forever' badge tooltip.
Magento 2 Community Edition Arbitrary File Deletion
Advisory: GHSA-2cg3-w597-rjfv
Aliases: CVE-2019-8107
Published: 2022-05-24T17:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with export data transfer privileges can craft a request to perform arbitrary file deletion.
RCE in baserCMS before 4.1.4
Advisory: GHSA-rjc2-x53r-6c9r
Aliases: CVE-2018-18942
Published: 2022-05-13T01:19:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

In baserCMS before 4.1.4, `lib\Baser\Model\ThemeConfig.php` allows remote attackers to execute arbitrary PHP code via the `admin/theme_configs/form data[ThemeConfig][logo]` parameter.
Improper Input Validation in Spring AMQP
Advisory: GHSA-hrp3-8p5w-27gv
Aliases: CVE-2016-2173
Published: 2022-05-13T01:26:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

org.springframework.core.serializer.DefaultDeserializer in Spring AMQP before 1.5.5 allows remote attackers to execute arbitrary code.
Nokogiri contains libxml Out-of-bounds Write vulnerability
Advisory: GHSA-jw9f-hh49-cvp9
Aliases: CVE-2021-3517
Published: 2022-05-24T19:02:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

There is a flaw in the xml entity encoding functionality of libxml2 in versions before 2.9.11. An attacker who is able to supply a crafted file to be processed by an application linked with the affected functionality of libxml2 could trigger an out-of-bounds read. The most likely impact of this flaw is to application availability, with some potential impact to confidentiality and integrity if an attacker is able to use memory information to further exploit the application.

Nokogiri prior to version 1.11.4 used a vulnerable version of libxml2. Nokogiri 1.11.4 updated libxml2 to version 2.9.11 to address this and other vulnerabilities in libxml2.
Improper Privilege Management in X-Pack 
Advisory: GHSA-m728-qvxh-xfjq
Aliases: CVE-2017-8446
Published: 2022-05-13T01:36:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Reporting feature in X-Pack in versions prior to 5.5.2 and standalone Reporting plugin versions versions prior to 2.4.6 had an impersonation vulnerability. A user with the reporting_user role could execute a report with the permissions of another reporting user, possibly gaining access to sensitive data.
ThinkPHP SQLi Vulnerability
Advisory: GHSA-j7g8-3qqg-8cvm
Aliases: CVE-2018-18546
Published: 2022-05-14T01:53:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ThinkPHP 3.2.4 has SQL Injection via the order parameter because the `Library/Think/Db/Driver.class.php` parseOrder function mishandles the key variable.
User Plugin for October CSS Allows XSS
Advisory: GHSA-x5jc-34xf-c24q
Aliases: CVE-2018-10366
Published: 2022-05-14T03:21:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.
Cross-site Scripting In Apache Brooklyn
Advisory: GHSA-j3g9-3fvv-gqfp
Aliases: CVE-2017-3165
Published: 2022-05-17T00:47:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to be a proof-of-concept exploit using this vulnerability.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-m9hr-259f-2v23
Aliases: CVE-2021-21688
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2484 / CVE-2021-21688: `FilePath#reading(FileVisitor)` does not reject any operations, allowing users to have unrestricted read access using certain operations (creating archives, `#copyRecursiveTo`).

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2484 / CVE-2021-21688: `FilePath#reading(FileVisitor)` correctly rejects operations if they operate on files outside allowed directories.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
ChakraCore RCE Vulnerability
Advisory: GHSA-5hxp-3237-j2hp
Aliases: CVE-2018-8139
Published: 2022-05-13T01:20:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137.
Improper Limitation of a Pathname to a Restricted Directory in Jenkins
Advisory: GHSA-qr42-82qj-mw65
Aliases: CVE-2019-10352
Published: 2022-05-24T16:50:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

A path traversal vulnerability in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier in core/src/main/java/hudson/model/FileParameterValue.java allowed attackers with Job/Configure permission to define a file parameter with a file name outside the intended directory, resulting in an arbitrary file write on the Jenkins master when scheduling a build.
Missing validation results in undefined behavior in `QuantizedConv2D`
Advisory: GHSA-pqhm-4wvf-2jg8
Aliases: CVE-2022-29201
Published: 2022-05-24T22:10:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.QuantizedConv2D`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/quantized_conv_ops.cc) does not fully validate the input arguments:

```python
import tensorflow as tf

input = tf.constant(1, shape=[1, 2, 3, 3], dtype=tf.quint8)
filter = tf.constant(1, shape=[1, 2, 3, 3], dtype=tf.quint8)

# bad args
min_input = tf.constant([], shape=[0], dtype=tf.float32)
max_input = tf.constant(0, shape=[], dtype=tf.float32)
min_filter = tf.constant(0, shape=[], dtype=tf.float32)
max_filter = tf.constant(0, shape=[], dtype=tf.float32)

tf.raw_ops.QuantizedConv2D(
  input=input,
  filter=filter,
  min_input=min_input,
  max_input=max_input,
  min_filter=min_filter,
  max_filter=max_filter, 
  strides=[1, 1, 1, 1],
  padding="SAME")
```

In this case, references get bound to `nullptr` for each argument that is empty (in the example, all arguments in the `bad args` section).

### Patches
We have patched the issue in GitHub commit [0f0b080ecde4d3dfec158d6f60da34d5e31693c4](https://github.com/tensorflow/tensorflow/commit/0f0b080ecde4d3dfec158d6f60da34d5e31693c4).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Directory LDAP API
Advisory: GHSA-cx3q-cv6w-mx4h
Aliases: CVE-2015-3250
Published: 2022-05-17T00:51:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
Loop with Unreachable Exit Condition in Apache CXF
Advisory: GHSA-gw5j-77f9-v2g2
Aliases: CVE-2014-3584
Published: 2022-05-13T01:09:20Z

The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.
slub_events for Typo3 Arbitrary File Upload
Advisory: GHSA-5pww-3mfc-g8vr
Aliases: CVE-2019-16700
Published: 2022-05-24T16:58:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below, this results in Remote Code Execution. In versions later than 1.2.2, this can result in Denial of Service, since the web space can be filled up with arbitrary files.
ChakraCore RCE Vulnerability
Advisory: GHSA-mmfq-r3rg-8r7w
Aliases: CVE-2016-7202
Published: 2022-05-14T02:22:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," as demonstrated by the Chakra JavaScript engine, a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
Improper Output Neutralization for Logs in Spring Framework
Advisory: GHSA-rfmp-97jj-h8m6
Aliases: CVE-2021-22096
Published: 2022-05-24T19:19:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.
Plone Metadata Disclosure
Advisory: GHSA-6w93-4c4p-xv2x
Aliases: CVE-2012-5492
Published: 2022-05-17T04:32:24Z

`uid_catalog.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to obtain metadata about hidden objects via a crafted URL.
Memory usage graphs accessible to anyone with Overall/Read
Advisory: GHSA-r78q-qgx6-64pp
Aliases: CVE-2020-2104
Published: 2022-05-24T17:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins includes a feature that shows a JVM memory usage chart for the Jenkins controller.

Access to the chart in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier requires no permissions beyond the general Overall/Read, allowing users who are not administrators to view JVM memory usage data.

Jenkins 2.219, LTS 2.204.2 now requires Overall/Administer permissions to view the JVM memory usage chart.
`OCSP_basic_verify` may incorrectly verify the response signing certificate
Advisory: GHSA-mfm6-r9g2-q4r7
Aliases: CVE-2022-1343
Published: 2022-05-04T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
ChakraCore RCE Vulnerability
Advisory: GHSA-3hqw-mg9x-r2vr
Aliases: CVE-2018-8513
Published: 2022-05-13T01:20:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8505, CVE-2018-8510, CVE-2018-8511.
Play Framework Inadequate Encryption Strength vulnerability
Advisory: GHSA-442g-gcg6-mhm4
Aliases: CVE-2019-17598
Published: 2022-05-24T22:01:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in Lightbend Play Framework 2.5.x through 2.6.23. When configured to make requests using an authenticated HTTP proxy, play-ws may sometimes, typically under high load, when connecting to a target host using https, expose the proxy credentials to the target host.
RCE vulnerability in SCM Filter Jervis Plugin
Advisory: GHSA-4hhq-j3xw-wj89
Aliases: CVE-2020-2189
Published: 2022-05-24T17:17:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to configure jobs with the filter, or control the contents of a previously configured job’s SCM repository.

SCM Filter Jervis Plugin 0.3 configures its YAML parser to only instantiate safe types.
Path traversal vulnerability on Windows in Jenkins
Advisory: GHSA-4pw5-r58h-fv24
Aliases: CVE-2021-21683
Published: 2022-05-24T19:16:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The file browser for workspaces, archived artifacts, and `userContent/` in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier may interpret some paths to files as absolute on Windows.

This results in a path traversal vulnerability allowing attackers with Overall/Read permission (Windows controller) or Job/Workspace permission (Windows agents) to obtain the contents of arbitrary files.\n\nThe file browser in Jenkins 2.315, LTS 2.303.2 refuses to serve files that would be considered absolute paths.
HashiCorp go-getter unsafe downloads could lead to asymmetric resource exhaustion
Advisory: GHSA-28r2-q6m8-9hpx
Aliases: CVE-2022-30323
Published: 2022-05-26T00:01:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Asymmetric resource exhaustion could occur when go-getter processed malicious HTTP responses.
Pi Cross-site Scripting vulnerability
Advisory: GHSA-9v3w-m552-m6ff
Aliases: CVE-2017-7251
Published: 2022-05-13T01:06:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A Cross-Site Scripting (XSS) was discovered in pi-engine/pi 2.5.0. The vulnerability exists due to insufficient filtration of user-supplied data (preview) passed to the `pi-develop/www/script/editor/markitup/preview/markdown.php` URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Users with Overall/Read access can enumerate credential IDs in Pipeline GitHub Notify Step Plugin
Advisory: GHSA-8p4m-62gp-33j4
Aliases: CVE-2020-2118
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Pipeline GitHub Notify Step Plugin 1.0.4 and earlier provides a list of applicable credential IDs to allow users configuring the plugin to select the one to use.

This functionality does not correctly check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Pipeline GitHub Notify Step Plugin 1.0.5 requires the permission to configure a project.
ChakraCore RCE Vulnerability
Advisory: GHSA-6v8r-83v3-rmrf
Aliases: CVE-2018-0936
Published: 2022-05-13T01:18:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Windows 10 1709 allow remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, and CVE-2018-0937.
Improper Certificate Validation in Apache Qpid Proton
Advisory: GHSA-5h6x-m52p-23ph
Aliases: CVE-2019-0223
Published: 2022-05-24T16:44:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS *even when configured to verify the peer certificate* while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.