aswin1906/github-advisory-2022 huggingface dataset:
Disputed: OS Command injection in github.com/kardianos/service
Advisory: GHSA-xm99-6pv5-q363
Aliases: CVE-2022-29583
Published: 2022-04-23T00:03:03Z
Withdrawn: 2023-05-24T17:39:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intended directory.

The validity of this vulnerability has been [questioned](https://github.com/kardianos/service/pull/290#issuecomment-1109831505) and the reporter has requested that the CVE be [disputed](https://github.com/kardianos/service/issues/289#issuecomment-1110546798).
Zope does not properly perform security registration for legacy names
Advisory: GHSA-h2xh-jvpf-xq42
Aliases: CVE-2000-1211
Published: 2022-04-30T18:15:07Z

Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities.
Stored Cross-site Scripting vulnerability in Jenkins Subversion Plugin
Advisory: GHSA-wpr6-qvcq-8269
Aliases: CVE-2022-29046
Published: 2022-04-13T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix.
Cross Site Request Forgery in Mingsoft MCMS
Advisory: GHSA-g94p-h263-c26q
Aliases: CVE-2022-27340
Published: 2022-04-23T00:03:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
SQL Injection in Django
Advisory: GHSA-2gwj-7jmv-h26r
Aliases: CVE-2022-28346
Published: 2022-04-13T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. `QuerySet.annotate()`, `aggregate()`, and `extra()` methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed `**kwargs`.
Keycloak is vulnerable to IDN homograph attack
Advisory: GHSA-mwm4-5qwr-g9pf
Published: 2022-04-28T21:00:31Z

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.
Header Injection
Advisory: GHSA-9h73-w7ch-rh73
Aliases: CVE-2018-1000883
Published: 2022-04-12T21:26:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Elixir Plug Plug version All contains a Header Injection vulnerability in Connection that can result in Given a cookie value, Headers can be added. This attack appear to be exploitable via Crafting a value to be sent as a cookie. This vulnerability appears to have been fixed in >= 1.3.5 or ~> 1.2.5 or ~> 1.1.9 or ~> 1.0.6.
Remote Code Execution in paginator
Advisory: GHSA-w98m-2xqg-9cvj
Aliases: CVE-2020-15150
Published: 2022-04-12T19:36:39Z

There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function.

### Impact
There is a vulnerability in Paginator which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the `paginate()` function. This will potentially affect all current users of `Paginator` prior to version >= 1.0.0.

### Patches
The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.

### Credits

Thank you to Peter Stöckli.
URL Rewrite vulnerability in multiple zendframework components
Advisory: GHSA-f6p5-76fp-m248
Published: 2022-04-28T21:09:54Z

zend-diactoros (and, by extension, Expressive), zend-http (and, by extension, Zend Framework MVC projects), and zend-feed (specifically, its PubSubHubbub sub-component) each contain a potential URL rewrite exploit. In each case, marshaling a request URI includes logic that introspects HTTP request headers that are specific to a given server-side URL rewrite mechanism.

When these headers are present on systems not running the specific URL rewriting mechanism, the logic would still trigger, allowing a malicious client or proxy to emulate the headers to request arbitrary content.
Cross-site Scripting in @rocket.chat/livechat
Advisory: GHSA-hf55-c445-2w97
Aliases: CVE-2022-21830
Published: 2022-04-03T00:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A blind self XSS vulnerability exists in RocketChat LiveChat versions lower than 1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.
Cross site scripting in FacturaScripts
Advisory: GHSA-p3w3-4ppm-c3f6
Aliases: CVE-2022-1514
Published: 2022-04-29T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

FacturaScripts prior to version 2022.06 is vulnerable to stored cross-site scripting via upload plugin functionality in zip format.
Access control bypass in Beego
Advisory: GHSA-28r6-jm5h-mrgg
Aliases: CVE-2021-30080
Published: 2022-04-06T00:01:30Z

An issue was discovered in the route lookup process in beego through 2.0.1, allows attackers to bypass access control.
Prototype Pollution in deepmerge-ts
Advisory: GHSA-r9w3-g83q-m6hq
Aliases: CVE-2022-24802
Published: 2022-04-01T17:26:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

deepmerge-ts is used to merge 2 or more objects respecting type information. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). A fix was released in version 4.0.2. Currently, there is no known workaround.
Command injection in cocoapods-downloader
Advisory: GHSA-7627-mp87-jf6q
Aliases: CVE-2022-24440
Published: 2022-04-02T00:00:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Path traversal in the OWASP Enterprise Security API
Advisory: GHSA-8m5h-hrqm-pxm2
Aliases: CVE-2022-23457
Published: 2022-04-27T21:09:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
The default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path.

### Patches
This vulnerability is patched in release 2.3.0.0 of ESAPI. See https://github.com/ESAPI/esapi-java-legacy/releases/tag/esapi-2.3.0.0 for details.

### Workarounds
Yes; in theory, one _could_ write the own implementation of the Validator interface. This would most easily be done by sub-classing a version of the affected `DefaultValidator` class and then overriding the affected `getValidDirectoryPath()` to correct the issue. However, this is not recommended.


### For more information
If you have any questions or comments about this advisory:
* Email one of the project co-leaders. See email addresses listed on  the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders".
* Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.
An attacker can execute malicious javascript in Live Helper Chat
Advisory: GHSA-9hgc-wpc5-v8p9
Aliases: CVE-2022-1530
Published: 2022-04-30T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. Attacker can execute malicious javascript on application.
Stored Cross-site Scripting vulnerabilities in Jenkins Extended Choice Parameter Plugin
Advisory: GHSA-gp7c-xmmm-7pqr
Aliases: CVE-2022-29038
Published: 2022-04-13T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not escape the name and description of Extended Choice parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Server side request forgery in LiveHelperChat
Advisory: GHSA-hhr9-7xvh-8xgc
Aliases: CVE-2022-1213
Published: 2022-04-06T00:01:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L

SSRF filter bypass port 80, 433 in LiveHelperChat prior to v3.67. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191
Denial of Service (DoS) in Nokogiri on JRuby
Advisory: GHSA-gx8x-g87m-h5q6
Published: 2022-04-11T21:38:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Summary

Nokogiri `v1.13.4` updates the vendored `org.cyberneko.html` library to `1.9.22.noko2` which addresses [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv). That CVE is rated 7.5 (High Severity).

See [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) for more information.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.


## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Impact

### [CVE-2022-24839](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv) in nekohtml

- **Severity**: High 7.5
- **Type**: [CWE-400](https://cwe.mitre.org/data/definitions/400.html) Uncontrolled Resource Consumption
- **Description**: The fork of `org.cyberneko.html` used by Nokogiri (Rubygem) raises a `java.lang.OutOfMemoryError` exception when parsing ill-formed HTML markup.
- **See also**: [GHSA-9849-p7jc-9rmv](https://github.com/sparklemotion/nekohtml/security/advisories/GHSA-9849-p7jc-9rmv)
Path Traversal: 'dir/../../filename' in moment.locale
Advisory: GHSA-8hfj-j24r-96c4
Aliases: CVE-2022-24785
Published: 2022-04-04T21:25:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg `fr` is directly used to switch moment locale.

### Patches
This problem is patched in 2.29.2, and the patch can be applied to all affected versions (from 1.0.1 up until 2.29.1, inclusive).

### Workarounds
Sanitize user-provided locale name before passing it to moment.js.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [moment repo](https://github.com/moment/moment)
Command injection in ruby-git
Advisory: GHSA-69p6-wvmq-27gg
Aliases: CVE-2022-25648
Published: 2022-04-20T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package prior to v1.11.0 is vulnerable to Command Injection via git argument injection. When calling the `fetch(remote = 'origin', opts = {})` function, the remote parameter is passed to the `git fetch` subcommand in a way such that additional flags can be set. The additional flags can be used to perform a command injection.
Cross site scripting in safe-svg
Advisory: GHSA-5h7w-hmxc-99g5
Aliases: CVE-2022-1091
Published: 2022-04-19T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).
Incorrect Authorization in cross-fetch
Advisory: GHSA-7gc6-qh9x-w6h8
Aliases: CVE-2022-1365
Published: 2022-04-17T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty.
Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .
Infinite loop in .Net Bond
Advisory: GHSA-rqrc-8q8f-cp9c
Aliases: CVE-2020-1469
Published: 2022-04-08T18:11:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists when the .NET implementation of Bond improperly parses input, aka 'Bond Denial of Service Vulnerability'. Handling of large container lengths that could cause an infinite loop when deserializing some payloads.
Arbitrary Code Execution in Cookie Serialization
Advisory: GHSA-5v4m-c73v-c7gq
Aliases: CVE-2017-1000053
Published: 2022-04-12T21:23:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The default serialization used by Plug session may result in code execution
  in certain situations. Keep in mind, however, the session cookie is signed
  and this attack can only be exploited if the attacker has access to your
  secret key as well as your signing/encryption salts. We recommend users to
  change their secret key base and salts if they suspect they have been leaked,
  regardless of this vulnerability.
Prototype Pollution in madlib-object-utils
Advisory: GHSA-pfv6-prqm-85q8
Aliases: CVE-2022-24279
Published: 2022-04-16T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the `setValue` method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)
Command injection in czproject/git-php
Advisory: GHSA-3xpw-vhmv-cw7h
Aliases: CVE-2022-25866
Published: 2022-04-26T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Out-of-bounds Write in zlib affects Nokogiri
Advisory: GHSA-v6gp-9mmm-c6p5
Published: 2022-04-11T21:21:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Summary

Nokogiri v1.13.4 updates the vendored zlib from 1.2.11 to 1.2.12, which addresses [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032). That CVE is scored as CVSS 7.4 "High" on the NVD record as of 2022-04-05.

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.4`, and only if the packaged version of `zlib` is being used. Please see [this document](https://nokogiri.org/LICENSE-DEPENDENCIES.html#default-platform-release-ruby) for a complete description of which platform gems vendor `zlib`. If you've overridden defaults at installation time to use system libraries instead of packaged libraries, you should instead pay attention to your distro's `zlib` release announcements. 

## Mitigation

Upgrade to Nokogiri `>= v1.13.4`.

## Impact

### [CVE-2018-25032](https://nvd.nist.gov/vuln/detail/CVE-2018-25032) in zlib

- **Severity**: High
- **Type**: [CWE-787](https://cwe.mitre.org/data/definitions/787.html) Out of bounds write
- **Description**: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
XSS Vulnerability in Action View tag helpers
Advisory: GHSA-ch3h-j2vf-95pv
Aliases: CVE-2022-27777
Published: 2022-04-27T22:32:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

There is a possible XSS vulnerability in Action View tag helpers. Passing untrusted input as hash keys can lead to a possible XSS vulnerability. This vulnerability has been assigned the CVE identifier CVE-2022-27777.

Versions Affected:  ALL
Not affected:       NONE
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

If untrusted data is passed as the hash key for tag attributes, there is a possibility that the untrusted data may not be properly escaped which can lead to an XSS vulnerability.

Impacted code will look something like this:

```
check_box_tag('thename', 'thevalue', false, aria: { malicious_input => 'thevalueofaria' })
```

Where the "malicious_input" variable contains untrusted data.

All users running an affected release should either upgrade or use one of the workarounds immediately.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Escape the untrusted data before using it as a key for tag helper methods.
HTML Injection in Froxlor
Advisory: GHSA-j739-gw6q-f4c7
Aliases: CVE-2020-29653
Published: 2022-04-14T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags.

Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protection, but AntiXSS only provides partial protection for this particular issue.
RCE in Studio-42 elFinder on Windows before 2.1.61
Advisory: GHSA-6p96-vfrc-fv32
Aliases: CVE-2022-27115
Published: 2022-04-12T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload.
Metrics exposure in Wildfly
Advisory: GHSA-c4r5-xvgw-2942
Aliases: CVE-2021-3503
Published: 2022-04-19T00:00:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data.
Type Confusion in LiveHelperChat
Advisory: GHSA-5cmw-fhq9-8fhh
Aliases: CVE-2022-1176
Published: 2022-04-01T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Live Helper Chat provides live support for your website. Loose comparison causes IDOR on multiple endpoints in LiveHelperChat prior to 3.96. There is a fix released in versions 3.96 and 3.97. Currently, there is no known workaround.
Code Injection in Bolt CMS
Advisory: GHSA-gprh-7767-cw39
Aliases: CVE-2021-40219
Published: 2022-04-12T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Bolt CMS <= 4.2 is vulnerable to Remote Code Execution. Unsafe theme rendering allows an authenticated attacker to edit theme to inject server-side template injection that leads to remote code execution.
Jetty HTTP Server Denial of Service vulnerability
Advisory: GHSA-p5rr-q5g6-gm42
Aliases: CVE-2004-2381
Published: 2022-04-29T03:01:19Z

HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.
Improper Neutralization of Formula Elements in a CSV File in Kimai 2
Advisory: GHSA-64fq-9c6w-rq44
Aliases: CVE-2021-43515
Published: 2022-04-09T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A CSV Injection vulnerablity exists in Kimai Kimai 2 prior to 1.14.1 via a description in a new timesheet.
Command injection in cocoapods-downloader
Advisory: GHSA-g397-v4w5-4m79
Aliases: CVE-2022-21223
Published: 2022-04-02T00:00:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg), the url (and/or revision, tag, branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.
Denial of service in Spring Security OAuth
Advisory: GHSA-c2cp-3xj9-97w9
Aliases: CVE-2022-22969
Published: 2022-04-22T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.
SQL Injection found in Pimcore
Advisory: GHSA-2v7p-f4qm-r5pc
Aliases: CVE-2022-1429
Published: 2022-04-23T00:03:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Pimcore is an open source data & experience management platform. A SQL injection was discovered in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6.
NextAuth.js default redirect callback vulnerable to open redirects
Advisory: GHSA-f9wg-5f46-cjmw
Aliases: CVE-2022-24858
Published: 2022-04-22T20:49:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

`next-auth` v3 users before version 3.29.2 are impacted. (We recommend upgrading to v4 in most cases. See our [migration guide](https://next-auth.js.org/getting-started/upgrade-v4)).`next-auth` v4 users before version 4.3.2 are impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your `callbacks` option:

```js
// async redirect(url, baseUrl) { // v3
async redirect({ url, baseUrl }) { // v4
    // Allows relative callback URLs
    if (url.startsWith("/")) return new URL(url, baseUrl).toString()
    // Allows callback URLs on the same origin
    else if (new URL(url).origin === baseUrl) return url
    return baseUrl
}
```
If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.
Cross site scripting in actionpack Rubygem
Advisory: GHSA-q58j-fmvf-9rq6
Aliases: CVE-2011-1497
Published: 2022-04-22T00:24:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability flaw was found in the `auto_link` function in Rails before version 3.0.6.
XML Injection in Xerces Java affects Nokogiri
Advisory: GHSA-xxx9-3xcr-gjj3
Published: 2022-04-11T21:30:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

## Summary

Nokogiri v1.13.4 updates the vendored `xerces:xercesImpl` from 2.12.0 to 2.12.2, which addresses [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437). That CVE is scored as CVSS 6.5 "Medium" on the NVD record.

Please note that this advisory only applies to the **JRuby** implementation of Nokogiri `< 1.13.4`.

## Mitigation

Upgrade to Nokogiri `>= v1.13.4`.

## Impact

### [CVE-2022-23437](https://nvd.nist.gov/vuln/detail/CVE-2022-23437) in xerces-J

- **Severity**: Medium
- **Type**: [CWE-91](https://cwe.mitre.org/data/definitions/91.html) XML Injection (aka Blind XPath Injection)
- **Description**: There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
- **See also**: https://github.com/advisories/GHSA-h65f-jvqw-m9fj
Incorrect Use of Privileged APIs in org.xwiki.platform.skin.skinx
Advisory: GHSA-ghcq-472w-vf4h
Aliases: CVE-2022-24821
Published: 2022-04-08T21:59:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

### Impact

Simple users can create global SSX/JSX without specific rights: in theory only users with Programming Rights should be allowed to create SSX or JSX that are executed everywhere on a wiki. But a bug allow anyone with edit rights to actually create those. 

### Patches
This issue has been patched in XWiki 13.10-rc-1, 12.10.11 and 13.4.6. 

### Workarounds
There's no easy workaround for this issue, administrators should upgrade their wiki.

### References
https://jira.xwiki.org/browse/XWIKI-19155

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki Security ML](mailto:security@xwiki.org)
Page Compare Reflected Cross-site Scripting (XSS) vulnerability
Advisory: GHSA-w5m2-299g-rff5
Aliases: CVE-2022-28820
Published: 2022-04-26T12:59:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Impact

ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in `/apps/acs-commons/content/page-compare.html` endpoint via the `a` and `b` GET parameters. User input submitted via these parameters is not validated or sanitized.

An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.

### Patches

This issue has been resolved in 5.2.0.

### Workarounds

None 

### References

N/A

### For more information

If you have any questions or comments about this advisory open an issue in acs-aem-commons.

### Credit

This issue was discovered and reported by Black Lantern Security.

https://hackerone.com/reports/1466020