aswin1906/github-advisory-2022 huggingface dataset:
Cross-site Scripting in the Flamingo theme manager
Advisory: GHSA-vmhh-xh3g-j992
Aliases: CVE-2022-29251
Published: 2022-05-25T22:40:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

### Impact
We found a possible XSS vector in the `FlamingoThemesCode.WebHomeSheet` wiki page related to the "newThemeName" form field.

### Patches

The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3.

### Workarounds
The easiest workaround is to edit the wiki page `FlamingoThemesCode.WebHomeSheet` (with wiki editor) and change the line

```
<input type="hidden" name="newThemeName" id="newThemeName" value="$request.newThemeName" />
```

into

```
<input type="hidden" name="newThemeName" id="newThemeName" value="$escapetool.xml($request.newThemeName)" />
```

### References
  * https://jira.xwiki.org/browse/XWIKI-19294
  * https://github.com/xwiki/xwiki-platform/commit/bd935320bee3c27cf7548351b1d0f935f116d437

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security mailing list](mailto:security@xwiki.org)
OpenTSDB Cross-site Scripting vulnerability
Advisory: GHSA-86vm-8m4p-6263
Aliases: CVE-2018-13003
Published: 2022-05-14T03:06:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter `type` to the /suggest URI.
open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution
Advisory: GHSA-7m2w-9gw7-c3xp
Aliases: CVE-2015-3649
Published: 2022-05-13T01:13:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a metafile is created.
ChakraCore RCE Vulnerability
Advisory: GHSA-6x4f-5v4h-r29j
Aliases: CVE-2019-0567
Published: 2022-05-13T01:21:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0568.
Race Condition in Jenkins
Advisory: GHSA-r5x3-2446-hrp7
Aliases: CVE-2017-1000503
Published: 2022-05-14T03:45:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A race condition during Jenkins 2.81 through 2.94 (inclusive); 2.89.1 startup could result in the wrong order of execution of commands during initialization. This could in rare cases result in failure to initialize the setup wizard on the first startup. This resulted in multiple security-related settings not being set to their usual strict default.
Jenkins Alauda DevOps Pipeline Plugin vulnerable to cross-site request forgery
Advisory: GHSA-pv4c-rj4h-gr9m
Aliases: CVE-2019-16573
Published: 2022-05-24T17:03:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline Plugin 2.3.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
ClassLoader manipulation in Apache Struts
Advisory: GHSA-hmhq-382q-mp56
Aliases: CVE-2014-0116
Published: 2022-05-14T00:54:14Z

CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
Stored XSS vulnerability in computer-queue-plugin Plugin
Advisory: GHSA-qg66-xv7v-m834
Aliases: CVE-2020-2259
Published: 2022-05-24T17:28:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

computer-queue-plugin Plugin 1.5 and earlier does not escape the agent name in tooltips.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.

computer-queue-plugin Plugin 1.6 escapes the agent name in tooltips.
Apache Geronimo JMX Remoting functionality allows remote code execution in 3.x before v3.0.1
Advisory: GHSA-v64w-96p6-fx7w
Aliases: CVE-2013-1777
Published: 2022-05-17T04:48:11Z

The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
Magento 2 Community Edition Insufficient Logging
Advisory: GHSA-x5q5-6wvf-2fpq
Aliases: CVE-2019-8124
Published: 2022-05-24T17:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Failure to track admin actions related to design configuration could lead to repudiation attacks.
Apache OpenMeetings has Inadequate Encryption Strength
Advisory: GHSA-cqm6-hrgq-6869
Aliases: CVE-2017-7673
Published: 2022-05-13T01:47:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, captcha is not used in registration and forget password dialogs and auth forms missing brute force protection.
Plone Improper Access Control Vulnerability
Advisory: GHSA-jjvw-3h9j-p7jf
Aliases: CVE-2013-4197
Published: 2022-05-17T04:49:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-gjjm-4x3g-3h33
Aliases: CVE-2019-8139
Published: 2022-05-24T17:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary Javascript code into the dynamic block when invoking page builder on a product.
Symfony Incorrect Access Control
Advisory: GHSA-qmqw-mpqp-mr54
Aliases: CVE-2015-4050
Published: 2022-05-17T03:11:51Z

FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the `_controller` attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to `/_fragment`.

This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.
baserCMS Cross-site Scripting vulnerability
Advisory: GHSA-mxfv-c8p8-qw5h
Aliases: CVE-2016-4880
Published: 2022-05-17T02:45:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
Cosenary Instagram-PHP-API contains reflected XSS vulnerability
Advisory: GHSA-gcv6-2v9c-rj48
Aliases: CVE-2019-14470
Published: 2022-05-24T16:55:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

cosenary Instagram-PHP-API (aka Instagram PHP API V2), used in the UserPro plugin through 4.9.32 for WordPress, is vulnerable to cross-site scripting via the [example/success.php](https://github.com/cosenary/Instagram-PHP-API/blob/master/example/success.php#L36
) error_description parameter.

Vulnerable code:

```php
    if (isset($_GET['error'])) {
        echo 'An error occurred: ' . $_GET['error_description'];
    }
```

Proof-of-Concept:

`https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>`
Improper Input Validation in Jenkins
Advisory: GHSA-h8c5-c92g-jq6x
Aliases: CVE-2017-1000401
Published: 2022-05-14T01:04:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

The Jenkins 2.73.1 and earlier, 2.83 and earlier default form control for passwords and other secrets, <f:password/>, supports form validation (e.g. for API keys). The form validation AJAX requests were sent via GET, which could result in secrets being logged to a HTTP access log in non-default configurations of Jenkins, and made available to users with access to these log files. Form validation for <f:password/> is now always sent via POST, which is typically not logged.
Dolibarr Cross-Site Request Forgery Vulnerability
Advisory: GHSA-m66x-wm27-xxpc
Aliases: CVE-2020-11825
Published: 2022-05-24T17:15:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In Dolibarr 10.0.6, forms are protected with a Cross-Site Request Forgery (CSRF) token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
Improper Restriction of XML External Entity Reference Jenkins Token Macro Plugin
Advisory: GHSA-g6h2-4x64-c59x
Aliases: CVE-2019-10337
Published: 2022-05-24T16:47:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An XML external entities (XXE) vulnerability in Jenkins Token Macro Plugin 2.7 and earlier allowed attackers able to control a the content of the input file for the "XML" macro to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat
Advisory: GHSA-698c-2x4j-g9gq
Aliases: CVE-2016-6817
Published: 2022-05-14T01:10:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.
Apache Derby exposes user and password attributes
Advisory: GHSA-rp7r-79rm-2758
Aliases: CVE-2005-4849
Published: 2022-05-01T02:31:27Z

Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
XML External Entity Reference in Jenkins Storable Configs Plugin
Advisory: GHSA-wqmp-2p5r-rhfv
Aliases: CVE-2022-30971
Published: 2022-05-18T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Jenkins Storable Configs Plugin 1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Item/Configure permission to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
DotNetNuke (DNN) Cross-site scripting (XSS) vulnerability via the __dnnVariable parameter
Advisory: GHSA-rvrj-j7cc-236p
Aliases: CVE-2013-4649
Published: 2022-05-17T01:33:02Z

Cross-site scripting (XSS) vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to inject arbitrary web script or HTML via the __dnnVariable parameter to the default URI.
Denial of Service Vulnerability in Rack Multipart Parsing
Advisory: GHSA-hxqx-xwvh-44m2
Aliases: CVE-2022-30122
Published: 2022-05-27T16:36:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

There is a possible denial of service vulnerability in the multipart parsing component of Rack.  This vulnerability has been assigned the CVE identifier CVE-2022-30122.

Versions Affected:  >= 1.2
Not affected:       < 1.2
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted multipart POST requests can cause Rack's multipart parser to take much longer than expected, leading to a possible denial of service vulnerability.

Impacted code will use Rack's multipart parser to parse multipart posts.  This includes directly using the multipart parser like this:

```
params = Rack::Multipart.parse_multipart(env)
```

But it also includes reading POST data from a Rack request object like this:

```
p request.POST # read POST data
p request.params # reads both query params and POST data
```

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Workarounds
There are no feasible workarounds for this issue.
Publify exposes article metadata
Advisory: GHSA-5jm7-g527-m694
Aliases: CVE-2022-1553
Published: 2022-05-17T00:01:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.
Session Fixation in Apache CXF
Advisory: GHSA-v936-x3j5-c76j
Aliases: CVE-2017-5656
Published: 2022-05-13T01:09:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.
ChakraCore RCE Vulnerability
Advisory: GHSA-5ppx-g65v-4vfv
Aliases: CVE-2016-3296
Published: 2022-05-14T02:23:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Camaleon CMS Stored Cross-site Scripting vulnerability
Advisory: GHSA-x78v-4fvj-rg9j
Aliases: CVE-2021-25969
Published: 2022-05-24T22:33:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious comment.
Rancher Access Control Vulnerability
Advisory: GHSA-w3x4-9854-95x8
Aliases: CVE-2017-7297
Published: 2022-05-13T01:02:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.
Simditor XSS Vulnerability
Advisory: GHSA-p9wj-wrrm-84m5
Aliases: CVE-2018-6464
Published: 2022-05-13T01:28:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Simditor v2.3.11 allows XSS via crafted use of `svg/onload=alert` in a TEXTAREA element, as demonstrated by Firefox 54.0.1.
ke_search for Typo3 XSS Vulnerability
Advisory: GHSA-gg48-mpp8-cgqc
Aliases: CVE-2020-15517
Published: 2022-05-24T17:22:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The ke_search (aka Faceted Search) extension through 2.8.2, and 3.x through 3.1.3, for TYPO3 allows XSS.
Cross-Site Request Forgery in Jenkins Autocomplete Parameter Plugin
Advisory: GHSA-7c3v-2jjv-hq3c
Aliases: CVE-2022-30969
Published: 2022-05-18T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A cross-site request forgery (CSRF) vulnerability in Jenkins Autocomplete Parameter Plugin 1.1 and earlier allows attackers to execute arbitrary code without sandbox protection if the victim is an administrator.
Cross-site Scripting in Jenkins Multiselect parameter Plugin
Advisory: GHSA-h3v9-46pp-h33w
Aliases: CVE-2022-30964
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Multiselect parameter Plugin 1.3 and earlier does not escape the name and description of Multiselect parameters on views displaying parameters. This results in stored cross-site scripting (XSS) vulnerabilities exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
ChakraCore Remote code execution Vulnerability
Advisory: GHSA-2xrc-27mc-638q
Aliases: CVE-2018-8624
Published: 2022-05-13T01:21:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8617, CVE-2018-8618, CVE-2018-8629.
Password stored in plain text by Applatix Plugin
Advisory: GHSA-54m9-h7qp-fwvg
Aliases: CVE-2020-2133
Published: 2022-05-24T17:08:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Applatix Plugin 1.1 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Jenkins Dynatrace Plugin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-x546-xrx3-hjx4
Aliases: CVE-2019-10462
Published: 2022-05-24T16:59:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

A cross-site request forgery vulnerability in Jenkins Dynatrace Application Monitoring Plugin prior to 2.1.4 allows attackers to connect to an attacker-specified URL using attacker-specified credentials.

##NOTE: This plugin is marked as DEPRECATED
Incorrect Default Permissions in Supervisor
Advisory: GHSA-x7c8-4x3h-874w
Aliases: CVE-2017-11610
Published: 2022-05-13T01:42:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Stored XSS in LavaLite 5.2.4
Advisory: GHSA-h7vh-6gmm-g7h9
Aliases: CVE-2017-1000467
Published: 2022-05-14T03:49:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code.
External Control of Assumed-Immutable Web Parameter in moodle
Advisory: GHSA-x6gm-qqwp-76gr
Aliases: CVE-2022-30597
Published: 2022-05-19T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
CSRF vulnerability in Jenkins Build With Parameters Plugin
Advisory: GHSA-w24g-24qg-v4w2
Aliases: CVE-2021-21629
Published: 2022-05-24T17:45:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Build With Parameters Plugin 1.5 and earlier does not require POST requests for its form submission endpoint, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to build a project with attacker-specified parameters. Build With Parameters Plugin 1.5.1 requires POST requests for the affected HTTP endpoint.
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
Advisory: GHSA-hhx8-cr55-qcxx
Aliases: CVE-2019-9644
Published: 2022-05-14T01:10:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages, though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.
Craft CMS XSS Vulnerability
Advisory: GHSA-f3xr-q258-h7m9
Aliases: CVE-2019-17496
Published: 2022-05-24T16:58:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.
Uncontrolled Resource Consumption in Apache CXF
Advisory: GHSA-5wqf-h3r3-gxvh
Aliases: CVE-2014-0109
Published: 2022-05-13T01:09:20Z

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.
Jenkins GitHub Pull Request Builder Plugin allows attacker with local file system access to obtain GitHub credentials
Advisory: GHSA-hr74-2j5v-ghfv
Aliases: CVE-2018-1000142
Published: 2022-05-14T03:23:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials. Since 1.40.0, the plugin no longer stores serialized objects containing the credential on disk. Builds started before the plugin was updated to 1.40.0 will retain the encoded credentials on disk. We strongly recommend revoking old GitHub credentials used in Jenkins. We’re providing a script for use in the Script Console that will attempt to remove old stored credentials from build.xml files.
Exposure of Sensitive Information in Apache Tomcat
Advisory: GHSA-cww4-vj5r-rx57
Aliases: CVE-2007-5333
Published: 2022-05-01T18:32:19Z

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs
Advisory: GHSA-jwr9-h4jm-c9ch
Aliases: CVE-2021-21625
Published: 2022-05-24T17:44:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed:

- [Amazon Elastic Container Service (ECS) / Fargate](https://plugins.jenkins.io/amazon-ecs)
- [AWS Parameter Store Build Wrapper](https://plugins.jenkins.io/aws-parameter-store)
- [AWS SAM](https://plugins.jenkins.io/aws-sam)\n\nFurther plugins may use this helper method as well without performing a permission check themselves.

Credentials IDs obtained this way can be used as part of an attack to capture the credentials using another vulnerability.

CloudBees AWS Credentials Plugin 1.28.1 performs permission checks in the helper method for HTTP endpoints.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post
Advisory: GHSA-m27m-628v-xxp2
Aliases: CVE-2016-0956
Published: 2022-05-14T02:47:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.
Puppet Privilege Escallation
Advisory: GHSA-77hg-g8cc-5r37
Aliases: CVE-2012-1053
Published: 2022-05-14T00:56:44Z

The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.
Exposure of sensitive information vulnerability
Advisory: GHSA-68qx-whxm-h4c4
Aliases: CVE-2018-1999041
Published: 2022-05-14T02:57:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An exposure of sensitive information vulnerability exists in Jenkins Tinfoil Security Plugin 1.6.1 and earlier in TinfoilScanRecorder.java that allows attackers with file system access to the Jenkins master to obtain the API secret key stored in this plugin's configuration.
Cross-site Scripting in wicket-jquery-ui
Advisory: GHSA-pwpc-hqq2-hx2x
Aliases: CVE-2017-15719
Published: 2022-05-14T00:58:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Wicket jQuery UI 6.28.0 and earlier, 7.9.1 and earlier, and 8.0.0-M8 and earlier, a security issue has been discovered in the WYSIWYG editor that allows an attacker to submit arbitrary JS code to WYSIWYG editor.
ChakraCore RCE Vulnerability
Advisory: GHSA-p9qf-56xw-h2vj
Aliases: CVE-2018-8617
Published: 2022-05-13T01:21:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8618, CVE-2018-8624, CVE-2018-8629.
Special top object can be used to access Struts' internals
Advisory: GHSA-4qgj-9mvg-3929
Aliases: CVE-2015-5209
Published: 2022-05-14T03:15:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

ValueStack defines special top object which represents root of execution context. It can be used to manipulate Struts' internals or can be used to affect container's settings. Applying better regex which includes pattern to exclude request parameters trying to use top object. This issue was patched in Struts 2.3.24.1.
Incomplete validation in signal ops leads to crashes in TensorFlow
Advisory: GHSA-5889-7v45-q28m
Aliases: CVE-2022-29213
Published: 2022-05-24T22:16:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The `tf.compat.v1.signal.rfft2d` and `tf.compat.v1.signal.rfft3d` lack input validation and under certain condition can result in crashes (due to `CHECK`-failures).

### Patches 
We have patched the issue in GitHub commit [0a8a781e597b18ead006d19b7d23d0a369e9ad73](https://github.com/tensorflow/tensorflow/commit/0a8a781e597b18ead006d19b7d23d0a369e9ad73) (merging GitHub PR [#55274](https://github.com/tensorflow/tensorflow/pull/55274)).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/55263).
Dolibarr ERP and CRM Code Injection
Advisory: GHSA-jwg3-v9xm-v6q9
Aliases: CVE-2019-11201
Published: 2022-05-24T16:51:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
Cross site scripting in Jenkins Mission Control Plugin
Advisory: GHSA-9523-474x-5h36
Aliases: CVE-2019-16563
Published: 2022-05-24T17:03:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.
Jenkins Cross-Site Request Forgery vulnerability
Advisory: GHSA-rqhg-cxfr-8xqw
Aliases: CVE-2013-0327
Published: 2022-05-05T02:48:48Z

Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.
Jenkins Google Login Plugin Session Fixation vulnerability
Advisory: GHSA-rp82-xvg3-727c
Aliases: CVE-2018-1000173
Published: 2022-05-14T03:18:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

A session fixaction vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows unauthorized attackers to impersonate another user if they can control the pre-authentication session. Google Login Plugin 1.3.1 invalidates the previous session during login, and creates a new one.
Cross-site Scripting in facturascripts
Advisory: GHSA-6465-r752-2h8v
Aliases: CVE-2022-1682
Published: 2022-05-13T00:01:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reflected cross-site scripting using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.08. This can lead to theft of a user's cookies, which in turn could lead to account takeover or do other malicious activities in a victim's browser.
Inbound TCP Agent Protocol/3 authentication bypass in Jenkins
Advisory: GHSA-qp4f-2w67-c8hw
Aliases: CVE-2020-2099
Published: 2022-05-24T17:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Jenkins 2.213 and earlier, LTS 2.204.1 and earlier includes support for the Inbound TCP Agent Protocol/3 for communication between controller and agents. While [this protocol has been deprecated in 2018](https://www.jenkins.io/changelog-old/#v2.128) and was recently removed from Jenkins in 2.214, it could still easily be enabled in Jenkins LTS 2.204.1, 2.213, and older.

This protocol incorrectly reuses encryption parameters which allow an unauthenticated remote attacker to determine the connection secret. This secret can then be used to connect attacker-controlled Jenkins agents to the Jenkins controller.

Jenkins 2.204.2 no longer allows for the use of Inbound TCP Agent Protocol/3 by default. The system property `jenkins.slaves.JnlpSlaveAgentProtocol3.ALLOW_UNSAFE` can be set to `true` to allow enabling the Inbound TCP Agent Protocol/3 in Jenkins 2.204.2, but doing so is strongly discouraged.

Inbound TCP Agent Protocol/3 was removed completely from Jenkins 2.214 and will not be part of Jenkins LTS after the end of the 2.204.x line.
Plone Open Redirect Vulnerability
Advisory: GHSA-8g72-gq68-6gqh
Aliases: CVE-2017-1000481
Published: 2022-05-14T03:49:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.
phpMyAdmin CSRF Vulnerability
Advisory: GHSA-f9hx-5jq4-fgjm
Aliases: CVE-2017-1000499
Published: 2022-05-14T01:05:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

phpMyAdmin versions 4.7.x (prior to 4.7.6.1/4.7.7) are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc.
Improper Authentication in Apache Tomcat
Advisory: GHSA-hffm-fqv4-w27r
Aliases: CVE-2011-5063
Published: 2022-05-14T01:17:03Z

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.
Cross-site Scripting in Jenkins JDK Parameter Plugin
Advisory: GHSA-5pmp-7wc9-v7vw
Aliases: CVE-2022-30963
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins JDK Parameter Plugin 1.0 and earlier does not escape the name and description of JDK parameters on views displaying parameters. This results in stored cross-site scripting (XSS) vulnerabilities exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Podman has Files or Directories Accessible to External Parties
Advisory: GHSA-vmhj-p9hw-vgrf
Aliases: CVE-2020-1726
Published: 2022-05-24T17:08:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume. This issue was introduced in version 1.6.0.
golang.org/x/crypto/ssh NULL Pointer Dereference vulnerability
Advisory: GHSA-3vm4-22fp-5rfm
Aliases: CVE-2020-29652
Published: 2022-05-24T22:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A nil pointer dereference in the golang.org/x/crypto/ssh component through v0.0.0-20201203163018-be400aefbc4c for Go allows remote attackers to cause a denial of service against SSH servers. An attacker can craft an authentication request message for the `gssapi-with-mic` method which will cause NewServerConn to panic via a nil pointer dereference if ServerConfig.GSSAPIWithMICConfig is nil.
Showdoc CSRF Vulnerability
Advisory: GHSA-3p87-gqw8-4pf2
Aliases: CVE-2018-19621
Published: 2022-05-14T01:45:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

`server/index.php?s=/api/teamMember/save` in ShowDoc 2.4.2 has a CSRF that can add members to a team.
Plone Information Disclosure
Advisory: GHSA-f8pg-wp5j-rjxx
Aliases: CVE-2012-5491
Published: 2022-05-17T04:32:26Z

`z3c.form`, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain the default form field values by leveraging knowledge of the form location and the element id.
Insecure Inherited Permissions in  Apache Hadoop
Advisory: GHSA-mf7c-35mq-75pj
Aliases: CVE-2016-6811
Published: 2022-05-14T03:24:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
Passwords stored in plain text by Mail Commander Plugin for Jenkins-ci Plugin
Advisory: GHSA-485q-v457-3p58
Aliases: CVE-2020-2318
Published: 2022-05-24T17:33:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Mail Commander Plugin for Jenkins-ci Plugin 1.0.0 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
JGit Improper Input Validation vulnerability
Advisory: GHSA-6vvc-c2m3-cjf3
Aliases: CVE-2014-9390
Published: 2022-05-17T19:57:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine; libgit2; Egit; and JGit allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
ws-xmlrpc DoS Vulnerability
Advisory: GHSA-r2pg-w96p-pcpj
Aliases: CVE-2016-5004
Published: 2022-05-17T02:40:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes.
keycloak vulnerable to unauthorized login via mail server setup
Advisory: GHSA-cf8f-w2c5-p5jr
Aliases: CVE-2019-14837
Published: 2022-05-24T17:05:43Z

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
Deserialization of Untrusted Data in Apache OpenJPA
Advisory: GHSA-j65f-mvgw-prp2
Aliases: CVE-2013-1768
Published: 2022-05-14T03:30:19Z

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
Improper Restriction of Recursive Entity References in DTDs in Apache POI
Advisory: GHSA-78vv-qj73-h9m5
Aliases: CVE-2017-5644
Published: 2022-05-13T01:14:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Stored XSS vulnerability in Jenkins Timestamper Plugin
Advisory: GHSA-6xxf-rwv4-mrjm
Aliases: CVE-2020-2137
Published: 2022-05-24T17:10:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Timestamper Plugin 1.11.1 and earlier does not escape or sanitize the HTML formatting used to display the timestamps in console output for builds.

This results in a stored cross-site scripting vulnerability that can be exploited by users with Overall/Administer permission.

Timestamper Plugin 1.11.2 sanitizes the HTML formatting for timestamps and only allows basic, safe HTML formatting.
Cross-Site Request Forgery in hawtio
Advisory: GHSA-q4q2-fvwf-6ghv
Aliases: CVE-2017-7556
Published: 2022-05-13T01:36:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user.
ClusterLabs crmsh vulnerable to shell code injection
Advisory: GHSA-99xx-83jm-h24m
Aliases: CVE-2020-35459
Published: 2022-05-24T17:38:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call `crm history` (when `crm` is run) were able to execute commands via shell code injection to the crm history commandline, potentially allowing escalation of privileges.
Restlet Arbitrary Java Code Execution via a serialized object
Advisory: GHSA-f3mv-g3xr-fp7w
Aliases: CVE-2013-4271
Published: 2022-05-17T03:28:57Z

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.
Camaleon CMS Insufficient Session Expiration vulnerability
Advisory: GHSA-438x-2p9v-g8h9
Aliases: CVE-2021-25970
Published: 2022-05-24T22:28:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Camaleon CMS 0.1.7 through 2.6.0 doesn’t terminate the active session of the users, even after the admin changes the user’s password. A user that was already logged in, will still have access to the application even after the password was changed. Resolved in commit `77e31bc6cdde7c951fba104aebcd5ebb3f02b030` which is included in the `2.6.0.1` release.
Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness
Advisory: GHSA-vmq9-cm7m-4p8p
Aliases: CVE-2018-1000665
Published: 2022-05-14T02:01:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Dojo Dojo Objective Harness (DOH) version prior to version 1.14 contains a Cross Site Scripting (XSS) vulnerability in `unit.html` and `testsDOH/_base/loader/i18n-exhaustive/i18n-test/unit.html` and `testsDOH/_base/i18nExhaustive.js` in the DOH that can result in Victim attacked through their browser - deliver malware, steal HTTP cookies, bypass CORS trust. This attack appear to be exploitable via Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. This vulnerability appears to have been fixed in 1.14.
angular vulnerable to regular expression denial of service (ReDoS)
Advisory: GHSA-m2h2-264f-f486
Aliases: CVE-2022-25844
Published: 2022-05-03T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.

**Note:**
1. This package has been deprecated and is no longer maintained.
2. The vulnerable versions are 1.7.0 and higher.
Improper Authentication in Apache Hadoop
Advisory: GHSA-9r7g-325h-mxrm
Aliases: CVE-2014-0229
Published: 2022-05-17T02:53:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the (1) refreshNamenodes, (2) deleteBlockPool, and (3) shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service (DataNodes shutdown) or perform unnecessary operations by issuing a command.
Keycloak Open Redirect
Advisory: GHSA-3qh2-mccc-q5m6
Aliases: CVE-2018-14658
Published: 2022-05-13T01:34:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in `org.keycloak.protocol.oidc.utils.RedirectUtils` before the redirect url is verified. This can lead to an Open Redirection attack
Missing authorization in Jenkins Kubernetes Plugin
Advisory: GHSA-g2r3-4g8q-h5rj
Aliases: CVE-2020-2309
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Kubernetes Plugin prior to 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Kubernetes Plugin 1.27.4, 1.26.5, 1.25.4.1, and 1.21.6 requires the appropriate permissions.
Flarum Core Leaks PII
Advisory: GHSA-p6m5-x83r-hqmr
Aliases: CVE-2018-19133
Published: 2022-05-14T01:44:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In Flarum Core 0.1.0-beta.7.1, a serious leak can get everyone's email address.
Microweber Discloses Sensitive Information
Advisory: GHSA-pmxg-w9c7-ffmq
Aliases: CVE-2020-13405
Published: 2022-05-24T17:23:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

`userfiles/modules/users/controller/controller.php` in Microweber before 1.1.20 allows an unauthenticated user to disclose the users database via a `/modules/ POST` request.
XXE vulnerability in Jenkins Subversion Plugin
Advisory: GHSA-vp5f-8jgw-j53c
Aliases: CVE-2020-2304
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Subversion Plugin 2.13.2 disables external entity resolution for its XML parser.