aswin1906/github-advisory-2022 huggingface dataset:
Feehi CMS vulnerable to Cross-site Scripting in Username Field
Advisory: GHSA-v762-47vh-j7q3
Aliases: CVE-2020-21146
Published: 2022-05-24T17:40:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Feehi CMS 2.0.8 is affected by a cross-site scripting (XSS) vulnerability. When the user name is inserted as JavaScript code, browsing the post will trigger the XSS.
Typo3 XSS Vulnerability
Advisory: GHSA-3w22-wrwx-2r75
Aliases: CVE-2018-6905
Published: 2022-05-14T03:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

The page module in TYPO3 before 8.7.11 has XSS via `$GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename']`, as demonstrated by an admin entering a crafted site name during the installation process.
phpMyAdmin CSS Injection Vulnerability
Advisory: GHSA-3fgq-cmr4-97rr
Aliases: CVE-2017-1000015
Published: 2022-05-14T01:18:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a CSS injection attack through crafted cookie parameters
Jenkins SSH Agent Plugin exposes SSH private key password to users with permission to read the build log
Advisory: GHSA-wwgx-94v6-fc2p
Aliases: CVE-2018-1999036
Published: 2022-05-13T01:50:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

An exposure of sensitive information vulnerability exists in Jenkins SSH Agent Plugin 1.15 and earlier in SSHAgentStepExecution.java that exposes the SSH private key password to users with permission to read the build log. As of version 1.16, the plugin no longer logs the ssh-add invocation that would reveal the passphrase.
Missing permission check in Jenkins Pipeline Maven Integration Plugin allows enumerating credentials IDs
Advisory: GHSA-32xp-m6vg-gwpj
Aliases: CVE-2020-2233
Published: 2022-05-24T17:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Pipeline Maven Integration Plugin 3.8.2 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read access to Jenkins to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Pipeline Maven Integration Plugin 3.8.3 requires the appropriate permissions.
Apache OpenMeetings may allow authenticated attacker to deny service for privileged users
Advisory: GHSA-cv9j-7q4x-v2g2
Aliases: CVE-2018-1286
Published: 2022-05-13T01:49:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In Apache OpenMeetings 3.0.0 - 4.0.1, CRUD operations on privileged users are not password protected allowing an authenticated attacker to deny service for privileged users. The issue is fixed in version 4.0.2.
baserCMS vulnerable to Access Control Bypass
Advisory: GHSA-mjj9-33j8-pfwh
Aliases: CVE-2018-0572
Published: 2022-05-13T01:48:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to bypass access restriction to view or alter a restricted content via unspecified vectors.
Stored XSS vulnerability in Jenkins Active Choices Plugin
Advisory: GHSA-9jv5-wf44-8vfm
Aliases: CVE-2020-2289
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Active Choices Plugin 2.4 and earlier does not escape the name and description of build parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Active Choices Plugin 2.5 escapes the name of build parameters and applies the configured markup formatter to the description of build parameters.
HashiCorp go-getter unsafe downloads could lead to arbitrary host access
Advisory: GHSA-cjr4-fv6c-f3mv
Aliases: CVE-2022-30322
Published: 2022-05-26T00:01:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

HashiCorp go-getter through 2.0.2 does not safely perform downloads. Arbitrary host access was possible via go-getter path traversal, symlink processing, and command injection flaws.
Plone is vulnerable to information exposure via the object manager implementation 
Advisory: GHSA-qphh-5fv5-2mjj
Aliases: CVE-2013-4196
Published: 2022-05-17T04:49:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.
Credentials stored in plain text by Jenkins TraceTronic ECU-TEST Plugin
Advisory: GHSA-qvjr-x8fw-hghv
Aliases: CVE-2021-21612
Published: 2022-05-24T17:39:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

TraceTronic ECU-TEST Plugin 2.23.1 and earlier stores credentials unencrypted in its global configuration file `de.tracetronic.jenkins.plugins.ecutest.report.atx.installation.ATXInstallation.xml` on the Jenkins controller as part of its configuration.

These credentials can be viewed by users with access to the Jenkins controller file system.

TraceTronic ECU-TEST Plugin 2.24 adds a new option type for sensitive options. Previously stored credentials are migrated to that option type on Jenkins startup.
Reflected XSS in Zen Cart before 1.5.7a
Advisory: GHSA-wxxx-2x6v-979f
Aliases: CVE-2020-6578
Published: 2022-05-24T17:44:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Zen Cart 1.5.6d allows reflected XSS via the main_page parameter to `includes/templates/template_default/common/tpl_main_page.php` or `includes/templates/responsive_classic/common/tpl_main_page.php.`
django-markupfield Arbitrary File Read
Advisory: GHSA-wxmr-7xjv-8xqw
Aliases: CVE-2015-0846
Published: 2022-05-17T04:13:43Z

django-markupfield before 1.3.2 uses the default docutils `RESTRUCTUREDTEXT_FILTER_SETTINGS` settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.
Plone unauthorized member addition vulnerability
Advisory: GHSA-984m-rj28-8c6x
Aliases: CVE-2015-7315
Published: 2022-05-17T00:35:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
Cross site scripting in Angular
Advisory: GHSA-c75v-2vq8-878f
Aliases: CVE-2021-4231
Published: 2022-05-27T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in Angular up to 11.0.4/11.1.0-next.2. It has been classified as problematic. Affected is the handling of comments. The manipulation leads to cross site scripting. It is possible to launch the attack remotely but it might require an authentication first. Upgrading to version 11.0.5 and 11.1.0-next.3 is able to address this issue. The name of the patch is ba8da742e3b243e8f43d4c63aa842b44e14f2b09. It is recommended to upgrade the affected component.
SiCKRAGE Discloses Plaintext Credentials
Advisory: GHSA-jrcv-3c5h-rh3q
Aliases: CVE-2018-9160
Published: 2022-05-13T01:53:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.
Symfony DoS
Advisory: GHSA-r2rq-3h56-fqm4
Aliases: CVE-2018-11386
Published: 2022-05-14T01:14:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the HttpFoundation component in Symfony 2.7.x before 2.7.48, 2.8.x before 2.8.41, 3.3.x before 3.3.17, 3.4.x before 3.4.11, and 4.0.x before 4.0.11. The PDOSessionHandler class allows storing sessions on a PDO connection. Under some configurations and with a well-crafted payload, it was possible to do a denial of service on a Symfony application without too much resources.
PEAR core file overwrite vulnerability
Advisory: GHSA-xxv8-pv43-57x5
Aliases: CVE-2017-5630
Published: 2022-05-13T01:28:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-hw55-f8wc-82m6
Aliases: CVE-2019-10406
Published: 2022-05-24T22:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global configuration, resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.
Improper Neutralization of Input During Web Page Generation in Select2
Advisory: GHSA-rf66-hmqf-q3fc
Aliases: CVE-2016-10744
Published: 2022-05-14T01:14:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
Password stored in plain text by Jenkins TestComplete support Plugin
Advisory: GHSA-r32r-f6wr-cc3w
Aliases: CVE-2020-2209
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins TestComplete support Plugin prior to version 2.5.2 stores a password unencrypted in job `config.xml` files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system. Version 2.5.2 contains a patch for this issue.
Improper Authentication in Hibernate Validator
Advisory: GHSA-845h-985r-jrqh
Aliases: CVE-2014-3558
Published: 2022-05-14T01:18:38Z

ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.
Laravel Framework RCE Vulnerability
Advisory: GHSA-qvqm-h22r-4cp9
Aliases: CVE-2018-15133
Published: 2022-05-14T00:56:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29, remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in `Illuminate/Encryption/Encrypter.php` and PendingBroadcast in `gadgetchains/Laravel/RCE/3/chain.php` in phpggc. The attacker must know the application key, which normally would never occur, but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.
Regular expression denial of service in url_regex
Advisory: GHSA-hg3w-7hj9-m3f7
Aliases: CVE-2022-21195
Published: 2022-05-21T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash.
Plone SQL Injection Vulnerability
Advisory: GHSA-hhmf-7rgg-gcw5
Aliases: CVE-2020-7939
Published: 2022-05-24T17:07:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
Rack vulnerable to Denial of Service
Advisory: GHSA-v882-ccj6-jc48
Aliases: CVE-2013-0184
Published: 2022-05-05T02:48:31Z

Unspecified vulnerability in `Rack::Auth::AbstractRequest` in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
Cross-Site Request Forgery in Spring Framework
Advisory: GHSA-8cmm-qj8g-fcp6
Aliases: CVE-2014-0054
Published: 2022-05-13T01:02:38Z

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
ChakraCore RCE Vulnerability
Advisory: GHSA-h575-j3ph-hjvc
Aliases: CVE-2018-0931
Published: 2022-05-13T01:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0873, CVE-2018-0874, CVE-2018-0930, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-8v75-8jj8-77gf
Aliases: CVE-2019-7874
Published: 2022-05-24T16:52:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.
python-jose failure to use a constant time comparison for HMAC keys
Advisory: GHSA-w799-prg3-cx77
Aliases: CVE-2016-7036
Published: 2022-05-17T03:02:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

python-jose before 1.3.2 allows attackers to have unspecified impact by leveraging failure to use a constant time comparison for HMAC keys.
Exposure of Sensitive Information to an Unauthorized Actor in Requests
Advisory: GHSA-652x-xj99-gmcc
Aliases: CVE-2014-1830
Published: 2022-05-14T02:09:22Z

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.
AsyncSSH SSH Server Authentication Bypass
Advisory: GHSA-97cv-6pjf-5f9q
Aliases: CVE-2018-7749
Published: 2022-05-14T01:29:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The SSH server implementation of AsyncSSH before 1.12.1 does not properly check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step.
Cross-Site Request Forgery in Jenkins
Advisory: GHSA-85wq-pqhp-hmq6
Aliases: CVE-2017-1000356
Published: 2022-05-14T03:44:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an issue in the Jenkins user database authentication realm: create an account if signup is enabled; or create an account if the victim is an administrator, possibly deleting the existing default admin user in the process and allowing a wide variety of impacts.
Cross site scripting in Apache Sling
Advisory: GHSA-xwf4-88xr-hx2j
Aliases: CVE-2016-5394
Published: 2022-05-13T01:25:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString() method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities.
Improper Input Validation in OpenSymphony XWork
Advisory: GHSA-wxw2-2mx5-c5qf
Aliases: CVE-2008-6504
Published: 2022-05-17T02:11:15Z

ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
Zend Framework Allows SQL Injection
Advisory: GHSA-v59p-p692-v382
Aliases: CVE-2015-0270
Published: 2022-05-24T16:59:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zend Framework before 2.2.10 and 2.3.x before 2.3.5 has Potential SQL injection in PostgreSQL Zend\Db adapter.
Improper Input Validation in Apache Tomcat
Advisory: GHSA-jc7p-5r39-9477
Aliases: CVE-2016-6816
Published: 2022-05-13T01:14:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.
Dulwich RCE Vulnerability
Advisory: GHSA-cwwh-4382-6fwr
Aliases: CVE-2017-16228
Published: 2022-05-13T01:44:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Dulwich before 0.18.5, when an SSH subprocess is used, allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117.
Improper Restriction of XML External Entity Reference in Apache NiFi
Advisory: GHSA-42wx-65g4-5cxv
Aliases: CVE-2018-1309
Published: 2022-05-14T03:16:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Jenkins Groovy Plugin sandbox bypass vulnerability
Advisory: GHSA-fm3j-r98g-97jh
Aliases: CVE-2019-1003033
Published: 2022-05-13T01:15:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, `src/main/java/hudson/plugins/groovy/StringScriptSource.java` that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM. Groovy Plugin 2.2 uses Script Security APIs that apply sandbox protection during these phases.
Exposure of Sensitive Information to an Unauthorized Actor in Spring Security
Advisory: GHSA-3533-rvpc-6x56
Aliases: CVE-2012-5055
Published: 2022-05-17T05:17:30Z

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.
SabreDAV Directory Traversal vulnerability
Advisory: GHSA-qg5v-jw6f-rpfj
Aliases: CVE-2013-1939
Published: 2022-05-14T01:52:20Z

The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a `\` (backslash) character.
Istio ReDoS Vulnerability
Advisory: GHSA-qcvw-82hh-gq38
Aliases: CVE-2019-14993
Published: 2022-05-24T16:53:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Istio before 1.1.13 and 1.2.x before 1.2.4 mishandles regular expressions for long URIs, leading to a denial of service during use of the JWT, VirtualService, HTTPAPISpecBinding, or QuotaSpecBinding API.
pyxdg Arbitrary File Overwrite via Race Condition
Advisory: GHSA-7372-q459-jxhr
Aliases: CVE-2014-1624
Published: 2022-05-17T01:27:07Z

Race condition in the `xdg.BaseDirectory.get_runtime_dir` function in pyxdg 0.25 allows local users to overwrite arbitrary files by pre-creating `/tmp/pyxdg-runtime-dir-fallback-victim` to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the `get_runtime_dir` function is called.
nsufficiently Protected Credentials in ActiveMQ Artemis
Advisory: GHSA-q9g8-9hpp-xc82
Aliases: CVE-2020-10727
Published: 2022-05-24T17:21:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A flaw was found in ActiveMQ Artemis management API from version 2.7.0 up until 2.12.0, where a user inadvertently stores passwords in plaintext in the Artemis shadow file (etc/artemis-users.properties file) when executing the `resetUsers` operation. A local attacker can use this flaw to read the contents of the Artemis shadow file.
Denial of Service in jsonparser
Advisory: GHSA-8vrw-m3j9-j27c
Aliases: CVE-2020-35381
Published: 2022-05-25T19:21:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

jsonparser before 1.1.1 allows attackers to cause a denial of service via a GET call.
October CMS CSRF 
Advisory: GHSA-vm6r-4p4v-232x
Aliases: CVE-2017-16244
Published: 2022-05-13T01:24:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka Build 426) due to improper validation of CSRF tokens for postback handling, allowing an attacker to successfully take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.
Cross-site Scripting in Jenkins Random String Parameter Plugin
Advisory: GHSA-38w4-q97c-xh4x
Aliases: CVE-2022-30966
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Random String Parameter Plugin 1.0 and earlier does not escape the name and description of Random String parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Content-Security-Policy protection for user content disabled by Jenkins ZAP Pipeline Plugin
Advisory: GHSA-4c87-9xq5-5c35
Aliases: CVE-2020-2214
Published: 2022-05-24T17:22:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins sets the `Content-Security-Policy` header to static files served by Jenkins (specifically `DirectoryBrowserSupport`), such as workspaces, `/userContent`, or archived artifacts.

ZAP Pipeline Plugin prior to 1.10 globally disables the `Content-Security-Policy` header for static files served by Jenkins. This allows cross-site scripting (XSS) attacks by users with the ability to control files in workspaces, archived artifacts, etc.

Jenkins instances with [Resource Root URL](https://www.jenkins.io/doc/upgrade-guide/2.204/#resource-domain-support) configured are largely unaffected. A possible exception are file parameter downloads. The behavior of those depends on the specific version of Jenkins:
- Jenkins 2.231 and newer, including 2.235.x LTS, is unaffected, as all resource files from user content are generally served safely from a different domain, without restrictions from `Content-Security-Policy` header.
- Jenkins between 2.228 (inclusive) and 2.230 (inclusive), as well as all releases of Jenkins 2.222.x LTS and the 2.204.6 LTS release, are affected by this vulnerability, as file parameters are not served via the Resource Root URL.
- Jenkins 2.227 and older, 2.204.5 and older, don’t have XSS protection for file parameter values, see [SECURITY-1793](https://www.jenkins.io/security/advisory/2020-03-25/#SECURITY-1793).
Missing permission check in Jenkins Project Inheritance Plugin
Advisory: GHSA-hj32-9mcw-5cwh
Aliases: CVE-2020-2197
Published: 2022-05-24T17:19:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins limits access to job configuration XML data (`config.xml`) to users with Job/ExtendedRead permission, typically implied by Job/Configure permission. Project Inheritance Plugin has several job inspection features, including the API URL `/job/…​/getConfigAsXML` for its Inheritance Project job type that does something similar.

Project Inheritance Plugin 21.04.03 and earlier does not check permissions for this new endpoint, granting access to job configuration XML data to every user with Job/Read permission.

Additionally, the encrypted values of secrets stored in the job configuration are not redacted, as they would be by the `config.xml` API for users without Job/Configure permission.
Maltego incorrectly shares a MISP connection across users in a remote-transform use case
Advisory: GHSA-fj35-m94r-9h4c
Aliases: CVE-2020-12889
Published: 2022-05-24T17:17:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case. Version 1.4.5 contains a patch.
Denial of service in ASP.NET Core
Advisory: GHSA-f9jc-rrm2-pmfg
Aliases: CVE-2017-11883
Published: 2022-05-13T01:42:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to remotely cause a denial of service attack against a .NET Core web application by improperly handling web requests, aka ".NET CORE Denial Of Service Vulnerability".
XXE vulnerability in Jenkins CVS Plugin
Advisory: GHSA-g9hg-x9c9-7xgr
Aliases: CVE-2020-2324
Published: 2022-05-24T17:35:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

CVS Plugin 2.16 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

CVS Plugin 2.17 disables external entity resolution for its XML parser.
Diavante vue-storefront-api and storefront-api disclose stack trace
Advisory: GHSA-9wxj-37p8-49ff
Aliases: CVE-2020-11883
Published: 2022-05-24T17:15:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In Divante vue-storefront-api through 1.11.1 and storefront-api through 1.0-rc.1, as used in VueStorefront PWA, unexpected HTTP requests lead to an exception that discloses the error stack trace, with absolute file paths and Node.js module names.
Cabot Cross Site Scripting (XSS) vulnerability via Endpoint column
Advisory: GHSA-mqwh-r366-4224
Aliases: CVE-2020-7734
Published: 2022-05-24T17:29:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L

All versions up to 0.11.16 of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
Potentially compromised builds 
Advisory: GHSA-rfj2-4g26-7jw5
Aliases: CVE-2019-10249
Published: 2022-05-24T16:45:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

All Xtext & Xtend versions prior to 2.18.0 were built using HTTP instead of HTTPS file transfer and thus the built artifacts may have been compromised.
Stored XSS vulnerability in Jenkins Active Choices Plugin
Advisory: GHSA-rjch-j5x9-fgph
Aliases: CVE-2020-2290
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Active Choices Plugin 2.4 and earlier does not escape `List` and `Map` return values of sandboxed scripts for Reactive Reference Parameter.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

This issue is caused by an incomplete fix for [SECURITY-470](https://www.jenkins.io/security/advisory/2017-10-23/#persisted-cross-site-scripting-vulnerability-in-active-choices-plugin).

Active Choices Plugin 2.5 escapes all legal return values of sandboxed scripts.
phpMyAdmin DoS Vulnerability
Advisory: GHSA-2mcj-3r3r-v5wm
Aliases: CVE-2016-6623
Published: 2022-05-17T02:37:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in phpMyAdmin. An authorized user can cause a denial-of-service (DoS) attack on a server by passing large values to a loop. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
Cross-Site Request Forgery in Jenkins
Advisory: GHSA-99hj-ppg3-2xwc
Aliases: CVE-2017-1000504
Published: 2022-05-14T01:04:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A race condition during Jenkins 2.94 and earlier; 2.89.1 and earlier startup could result in the wrong order of execution of commands during initialization. There is a very short window of time after startup during which Jenkins may no longer show the 'Please wait while Jenkins is getting ready to work' message but Cross-Site Request Forgery (CSRF) protection may not yet be effective.
Fat Free CRM Cross-site Scripting vulnerability
Advisory: GHSA-gmg5-r3c4-3fm9
Aliases: CVE-2019-10226
Published: 2022-05-24T16:47:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI.
Routinator infinite loop vulnerability
Advisory: GHSA-m3x9-623g-35c4
Aliases: CVE-2021-43172
Published: 2022-05-24T19:20:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NLnet Labs Routinator prior to 0.10.2 happily processes a chain of RRDP repositories of infinite length causing it to never finish a validation run. In RPKI, a CA can choose the RRDP repository it wishes to publish its data in. By continuously generating a new child CA that only consists of another CA using a different RRDP repository, a malicious CA can create a chain of CAs of de-facto infinite length. Routinator prior to version 0.10.2 did not contain a limit on the length of such a chain and will therefore continue to process this chain forever. As a result, the validation run will never finish, leading to Routinator continuing to serve the old data set or, if in the initial validation run directly after starting, never serve any data at all.
Ignite Realtime Openfire allows Cross-site Scripting
Advisory: GHSA-22c6-3h88-26m3
Aliases: CVE-2019-20527
Published: 2022-05-24T17:11:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter. This issue was fixed in version 4.4.2.
Plone Information Disclosure
Advisory: GHSA-cq5g-924m-7fxh
Aliases: CVE-2012-5505
Published: 2022-05-17T04:32:20Z

`atat.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.
Cross-origin Resource Sharing bypass in ASP.NET Core
Advisory: GHSA-3rp6-rjw4-cq39
Aliases: CVE-2017-8700
Published: 2022-05-13T01:47:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass Cross-origin Resource Sharing (CORS) configurations and retrieve normally restricted content from a web application, aka "ASP.NET Core Information Disclosure Vulnerability".
Uncontrolled Resource Consumption in Apache Tomcat
Advisory: GHSA-pxcx-cxq8-4mmw
Aliases: CVE-2014-0230
Published: 2022-05-14T01:10:18Z

Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
Jenkins Cross-Site Request Forgery vulnerability
Advisory: GHSA-78cj-2m29-q5r9
Aliases: CVE-2013-0329
Published: 2022-05-05T02:48:48Z

Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.
Jenkins HipChat Plugin allows attackers with Overall/Read access to obtain credential IDs
Advisory: GHSA-798p-53r7-mgw9
Aliases: CVE-2018-1000419
Published: 2022-05-13T01:18:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An improper authorization vulnerability exists in Jenkins HipChat Plugin 2.2.0 and earlier in HipChatNotifier.java that allows attackers with Overall/Read access to obtain credentials IDs for credentials stored in Jenkins. As of version 2.2.1, an enumeration of credentials IDs in this plugin requires Overall/Administer permission.
RCE vulnerability in Jenkins AWS SAM Plugin
Advisory: GHSA-qrm8-cw73-r9w8
Aliases: CVE-2020-2180
Published: 2022-05-24T17:15:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to configure a job or control the contents of a previously configured \"AWS SAM deploy application\" build step’s YAML SAM template file (`template.yaml` or equivalent) file.

AWS SAM Plugin 1.2.3 configures its YAML parser to only instantiate safe types.
Jenkins vFabric Application Director Plugin Insufficiently Protected Credentials
Advisory: GHSA-hx82-2ggv-vwm5
Aliases: CVE-2019-10419
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vFabric Application Director Plugin stores the Application Director password unencrypted in its global configuration file `jfullam.vfabric.jenkins.plugin.ApplicationDirectorPostBuildDeployer.xml` on the Jenkins controller. This password can be viewed by users with access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.
OpenTSDB Cross-site Scripting vulnerability
Advisory: GHSA-r68m-wq3x-2hqw
Aliases: CVE-2018-12973
Published: 2022-05-14T03:06:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter `json` to the /q URI.
Jenkins Email Extension Plugin SMTP password transmitted and displayed in plain text
Advisory: GHSA-5c4v-vh95-c67c
Aliases: CVE-2020-2232
Published: 2022-05-24T17:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Email Extension Plugin stores an SMTP password in its global configuration file `hudson.plugins.emailext.ExtendedEmailPublisher.xml` on the Jenkins controller as part of its configuration.

While this password is stored encrypted on disk, it is transmitted and displayed in plain text as part of the configuration form by Email Extension Plugin 2.72 and 2.73. This can result in exposure of the password.

Email Extension Plugin 2.74 transmits the SMTP password in its global configuration encrypted and masks it using a password field.
Cross-site Scripting in Jenkins Autocomplete Parameter Plugin
Advisory: GHSA-cj9j-v8jp-6hm9
Aliases: CVE-2022-30970
Published: 2022-05-18T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Autocomplete Parameter Plugin 1.1 and earlier references Dropdown Autocomplete parameter and Auto Complete String parameter names in an unsafe manner from Javascript embedded in view definitions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

While this looks similar to SECURITY-2729, this is an independent problem and exploitable even on views rendering parameters that otherwise attempt to prevent XSS vulnerabilities in parameter names.
ActiveMQ's OpenWire protocol exposes certain system details as plain text
Advisory: GHSA-7qm4-p377-fr2r
Aliases: CVE-2017-15709
Published: 2022-05-13T01:11:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

When using the OpenWire protocol in ActiveMQ versions 5.14.0 to 5.15.2 it was found that certain system details (such as the OS and kernel version) are exposed as plain text.
Moodle sensitive information disclosure
Advisory: GHSA-hjrj-7wcj-7j3c
Aliases: CVE-2016-0724
Published: 2022-05-13T01:12:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The (1) `core_enrol_get_course_enrolment_methods` and (2) `enrol_self_get_instance_info` web services in Moodle through 2.6.11, 2.7.x before 2.7.12, 2.8.x before 2.8.10, 2.9.x before 2.9.4, and 3.0.x before 3.0.2 do not consider the `moodle/course:viewhiddencourses` capability, which allows remote authenticated users to obtain sensitive information via a web-service request.
OpenPGP 1.2.0 and earlier decrypts arbitrary messages
Advisory: GHSA-qmvq-f3fj-m3wg
Aliases: CVE-2015-8013
Published: 2022-05-17T02:15:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

s2k.js in OpenPGP.js will decrypt arbitrary messages regardless of passphrase for crafted PGP keys which allows remote attackers to bypass authentication if message decryption is used as an authentication mechanism via a crafted symmetrically encrypted PGP message.
Improper Access Control in MySQL Connectors Java
Advisory: GHSA-gc43-g62c-99g2
Aliases: CVE-2015-2575
Published: 2022-05-17T00:25:07Z

Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL 5.1.34 and earlier allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Connector/J.
RCE vulnerability in Google Kubernetes Engine Plugin
Advisory: GHSA-wf76-qgqq-gcfj
Aliases: CVE-2020-2121
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability exploitable by users able to provide YAML input files to Google Kubernetes Engine Plugin’s build step.

Google Kubernetes Engine Plugin 0.8.1 configures its YAML parser to only instantiate safe types.
Jenkins AWS CodeDeploy Plugin has Insufficiently Protected Credentials
Advisory: GHSA-644j-jcc4-crx7
Aliases: CVE-2018-1000402
Published: 2022-05-14T03:00:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a File and Directory Information Exposure vulnerability in AWSCodeDeployPublisher.java that can result in Disclosure of environment variables. This vulnerability appears to have been fixed in 1.20 and later.
katello SQL Injection vulnerability
Advisory: GHSA-jx5v-788g-qw58
Aliases: CVE-2018-14623
Published: 2022-05-13T01:34:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.
Cross Site Request Forgery in Jenkins Blue Ocean Plugin
Advisory: GHSA-hgpq-42pf-9vfq
Aliases: CVE-2022-30953
Published: 2022-05-18T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.25.3 and earlier allows attackers to connect to an attacker-specified HTTP server. Blue Ocean Plugin 1.25.4 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
ChakraCore RCE via Out-of-bounds write
Advisory: GHSA-4v6q-gjm6-6vv4
Aliases: CVE-2019-1002
Published: 2022-05-24T22:00:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
Converse.js Exposure of Sensitive Information
Advisory: GHSA-mv4h-qm24-x4gh
Aliases: CVE-2018-6591
Published: 2022-05-14T03:12:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Converse.js and Inverse.js through 3.3 allow remote attackers to obtain sensitive information because it is too difficult to determine whether safe publication of private data was configured or even intended. For example, users might have an expectation that chatroom bookmarks are private, but the various interacting software components do not necessarily make that happen.
Apache ActiveMQ default configuration subject to denial of service
Advisory: GHSA-34fp-xvxp-rg22
Aliases: CVE-2012-6551
Published: 2022-05-17T03:46:32Z

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.
Concurrent Execution using Shared Resource with Improper Synchronization in Spring Security
Advisory: GHSA-4644-hg35-55m9
Aliases: CVE-2011-2731
Published: 2022-05-17T04:59:50Z

Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-fc6h-769x-gff5
Aliases: CVE-2021-33618
Published: 2022-05-24T19:20:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.
RubyGems Infinite Loop vulnerability
Advisory: GHSA-74pv-v9gh-h25p
Aliases: CVE-2018-1000075
Published: 2022-05-13T01:48:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.
SwiftNIO SSL arbitrary code execution vulnerability
Advisory: GHSA-frg3-gpcx-968f
Aliases: CVE-2019-8849
Published: 2022-05-24T17:04:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SwiftNIO application using TLS may be able to execute arbitrary code. The issue was addressed by signaling that an executable stack is not required. This issue is fixed in SwiftNIO SSL 2.4.1.
Cross-site Scripting in FacturaScripts
Advisory: GHSA-m8gv-gvhf-7rhp
Aliases: CVE-2022-1571
Published: 2022-05-05T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

FacturaScripts versions 2022.06 and prior are vulnerable to reflected cross-site scripting attacks. This vulnerability can use arbitrarily executed javascript code to steal users' cookies, perform HTTP request, get content of `same origin` page, etc. A fix is available on the `master` branch of the GitHub repository and anticipated to be part of version 2022.07.
JBoss EJB Client information disclosure vulnerability
Advisory: GHSA-2259-h742-5vr4
Aliases: CVE-2021-20250
Published: 2022-05-24T19:02:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the server it is deployed on. The highest threat from this vulnerability is to data confidentiality.
CSRF vulnerability in Jenkins P4 Plugin
Advisory: GHSA-rjjq-63c7-8724
Aliases: CVE-2020-2141
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery vulnerability in Jenkins P4 Plugin 1.10.10 and earlier allows attackers to trigger builds or add a labels in Perforce.
Deserialization of Untrusted Data in Jython
Advisory: GHSA-6r7r-jj8h-pq6v
Aliases: CVE-2016-4000
Published: 2022-05-13T01:25:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.
Dolibarr ERP and CRM Sensitive Data Disclosure
Advisory: GHSA-p9wf-x8h5-44fr
Aliases: CVE-2017-14240
Published: 2022-05-17T01:05:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.
Centreon Sensitive Data Exposure vulnerability
Advisory: GHSA-h5qv-p378-3hhr
Aliases: CVE-2020-10945
Published: 2022-05-24T17:18:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Centreon before 19.10.7 exposes Session IDs in server responses.
Apache Solr Cross-site scripting Vulnerability
Advisory: GHSA-4fxw-g29w-r8mx
Aliases: CVE-2015-8796
Published: 2022-05-17T02:24:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in `webapp/web/js/scripts/schema-browser.js` in the Admin UI in Apache Solr before 5.3 allows remote attackers to inject arbitrary web script or HTML via a crafted schema-browse URL.
Improper path handling in kustomization files allows path traversal
Advisory: GHSA-j77r-2fxf-5jrw
Aliases: CVE-2022-24877
Published: 2022-05-04T18:04:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use built-in features and a specially crafted `kustomization.yaml` to expose sensitive data from the controller’s pod filesystem. In multi-tenancy deployments this can lead to privilege escalation if the controller's service account has elevated permissions.

Within the affected versions, users with write access to a Flux source are able to use built-in features to expose sensitive data from the controller’s pod filesystem using a malicious `kustomization.yaml` file.

This vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce a new Kustomize file system implementation which ensures that all files being handled are contained within the Kustomization working directory, blocking references to any files that do not meet that requirement.

Automated tooling (e.g. conftest) could be employed as a workaround, as part of a user's CI/CD pipeline to ensure that their `kustomization.yaml` files conform with specific policies, blocking access to sensitive path locations.
ChakraCore information disclosure vulnerability
Advisory: GHSA-wwfw-m54g-gv72
Aliases: CVE-2019-0648
Published: 2022-05-13T01:21:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data.To exploit the vulnerability, an attacker must know the memory address of where the object was created.The update addresses the vulnerability by changing the way certain functions handle objects in memory, aka Scripting Engine Information Disclosure Vulnerability. This CVE ID is unique from CVE-2019-0658.