aswin1906/github-advisory-2022 huggingface dataset:
Jenkins Plugin Installation Manager Tool did not verify plugin downloads
Advisory: GHSA-m8r4-c7jm-w782
Aliases: CVE-2020-2320
Published: 2022-05-24T17:35:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Plugin Installation Manager Tool is part of the Jenkins project Docker images. As `jenkins-plugin-cli` it is used to download and install plugins even before Jenkins is running.

Plugin Installation Manager Tool 2.1.3 and earlier does not verify plugin downloads. This may allow third parties such as mirror operators to provide crafted plugin downloads.

Plugin Installation Manager Tool 2.2.0 confirms that actual checksums of downloaded plugin match the expected checksums.

Docker images of Jenkins 2.269 and 2.263.1 contain Plugin Installation Manager Tool 2.2.0. Users of older Docker images can change the version they use by extending the Jenkins image and update the tool themselves with:

ARG PLUGIN_CLI_URL=https://github.com/jenkinsci/plugin-installation-manager-tool/releases/download/2.2.0/jenkins-plugin-manager-2.2.0.jar
RUN curl -fsSL ${PLUGIN_CLI_URL} -o /usr/lib/jenkins-plugin-manager.jar
Jenkinsfile Runner [1.0-beta-22](https://github.com/jenkinsci/jenkinsfile-runner/releases/tag/1.0-beta-22) Docker images also include Plugin Installation Manager Tool 2.2.0.
ChakraCore Memory Corruption Vulnerability
Advisory: GHSA-qxmj-3c5h-546c
Aliases: CVE-2019-0861
Published: 2022-05-13T01:21:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0829, CVE-2019-0860.
Publify vulnerable to DoS attack
Advisory: GHSA-vq74-9583-hrm4
Aliases: CVE-2014-3211
Published: 2022-05-17T19:57:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publify before 8.0.1 is vulnerable to a Denial of Service attack
Missing validation causes denial of service via `LoadAndRemapMatrix`
Advisory: GHSA-p9rc-rmr5-529j
Aliases: CVE-2022-29199
Published: 2022-05-24T22:09:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.LoadAndRemapMatrix`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/load_and_remap_matrix_op.cc#L70-L98) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

ckpt_path = tf.constant(
    "/tmp/warm_starting_util_test5kl2a3pc/tmpph76tep2/model-0", shape=[], dtype=tf.string)
old_tensor_name = tf.constant(
    "/tmp/warm_starting_util_test5kl2a3pc/tmpph76tep2/model-0", shape=[], dtype=tf.string)

row_remapping = tf.constant(0, shape=[], dtype=tf.int64)
col_remapping = tf.constant(3, shape=[3], dtype=tf.int64)
initializing_values = tf.constant([], shape=[0, 1], dtype=tf.float32)

tf.raw_ops.LoadAndRemapMatrix(
  ckpt_path=ckpt_path,
  old_tensor_name=old_tensor_name,
  row_remapping=row_remapping,
  col_remapping=col_remapping,
  initializing_values=initializing_values,
  num_rows=1,
  num_cols=1)
```

The code assumes `initializing_values` is a vector but there is no validation for this before accessing its value:

```cc
OP_REQUIRES_OK(context, context->input("row_remapping", &row_remapping_t));
const auto row_remapping = row_remapping_t->vec<int64_t>();
```

### Patches
We have patched the issue in GitHub commit [3150642acbbe254e3c3c5d2232143fa591855ac9](https://github.com/tensorflow/tensorflow/commit/3150642acbbe254e3c3c5d2232143fa591855ac9).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Magento 2 Community Edition DoS vulnerability
Advisory: GHSA-prw8-gqwp-f7fh
Aliases: CVE-2019-7915
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers.
Stored XSS vulnerability in Jenkins job build time trend
Advisory: GHSA-qgj4-rc8m-44mq
Aliases: CVE-2020-2220
Published: 2022-05-24T17:23:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the agent name in the build time trend page, resulting in a stored cross-site scripting vulnerability.

Jenkins 2.245, LTS 2.235.2 escapes the agent name.
October CMS XSS In Caption Tag of Profile
Advisory: GHSA-9hq8-v2jc-qj4r
Aliases: CVE-2015-5612
Published: 2022-05-17T04:08:19Z

Cross-site scripting (XSS) vulnerability in October CMS build 271 and earlier allows remote attackers to inject arbitrary web script or HTML via the caption tag of a profile image.
snipe-IT vulnerable to host header injection
Advisory: GHSA-9vh6-qfv6-vcqp
Aliases: CVE-2022-23064
Published: 2022-05-03T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Snipe-IT is a free, open-source IT asset/license management systemIn Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password reset token leak. This can lead to account take over.
Open redirect in ASP.NET Core
Advisory: GHSA-prrf-397v-83xh
Aliases: CVE-2019-1075
Published: 2022-05-24T16:50:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.
Jenkins Groovy Plugin sandbox bypass vulnerability
Advisory: GHSA-xfwj-2f34-32f5
Aliases: CVE-2019-1003006
Published: 2022-05-13T01:15:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in `src/main/java/hudson/plugins/groovy/StringScriptSource.java` that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM. In version 2.1, the affected HTTP endpoint applies a safe Groovy compiler configuration preventing the use of unsafe AST transforming annotations.
Possible DoS attack when using URLValidator
Advisory: GHSA-86vq-8qhc-5rqw
Aliases: CVE-2016-8738
Published: 2022-05-14T03:15:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
ChakraCore RCE Vulnerability
Advisory: GHSA-pcgp-vfgq-mf5j
Aliases: CVE-2018-8459
Published: 2022-05-13T01:20:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8354, CVE-2018-8391, CVE-2018-8456, CVE-2018-8457.
Arbitrary code execution in Apache Struts 2
Advisory: GHSA-4prj-vw9j-v6pr
Aliases: CVE-2016-4438
Published: 2022-05-14T00:54:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.
Jenkins Delphix Plugin vulnerable to Cleartext credential storage
Advisory: GHSA-4p59-p85x-f3wx
Aliases: CVE-2019-10453
Published: 2022-05-24T16:58:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Delphix Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Tomcat Vulnerable to Web Cache Poisoning
Advisory: GHSA-f2gq-p6qv-ccw4
Aliases: CVE-2005-2090
Published: 2022-05-01T02:04:54Z

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
xxl-job sensitive data exposure
Advisory: GHSA-m5q9-488r-4rmp
Aliases: CVE-2020-23811
Published: 2022-05-24T17:27:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

xxl-job 2.2.0 allows Information Disclosure of username, model, and password via job/admin/controller/UserController.java.
Nokogiri has vulnerable dependencies on libxml2 and libxslt
Advisory: GHSA-59gp-qqm7-cw4j
Aliases: CVE-2021-30560
Published: 2022-05-24T19:09:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Apache Tomcat XSS In Accept-Language Headers
Advisory: GHSA-xmc9-6p56-3c4v
Aliases: CVE-2007-1358
Published: 2022-05-01T17:52:51Z

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
ldap_fluff authentication bypass
Advisory: GHSA-9whh-582r-589h
Aliases: CVE-2012-5604
Published: 2022-05-14T03:24:09Z

The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors.
Improper Input Validation in Apache Axis2
Advisory: GHSA-wwq7-pxwc-p4rc
Aliases: CVE-2012-5785
Published: 2022-05-17T01:38:56Z

Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Incorrect Authorization in Puppet Enterprise Pipeline Jenkins Plugin
Advisory: GHSA-mj9c-vjp9-pggh
Aliases: CVE-2019-10458
Published: 2022-05-24T16:58:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist, allowing attackers able to execute Script Security protected scripts to execute arbitrary code.
Unrestricted Upload of File with Dangerous Type in yetiforce-crm
Advisory: GHSA-pqr6-3j58-9w58
Aliases: CVE-2022-1411
Published: 2022-05-06T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.
Rack Gem Subject to Denial of Service via Hash Collisions
Advisory: GHSA-v6j3-7jrw-hq2p
Aliases: CVE-2011-5036
Published: 2022-05-17T04:59:13Z

Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Openstack tripleo-heat-templates unauthenticated file access
Advisory: GHSA-w8gx-hhcx-px6w
Aliases: CVE-2017-12155
Published: 2022-05-13T01:42:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

A resource-permission flaw was found in the openstack-tripleo-heat-templates package where ceph.client.openstack.keyring is created as world-readable. A local attacker with access to the key could read or modify data on Ceph cluster pools for OpenStack as though the attacker were the OpenStack service, thus potentially reading or modifying data in an OpenStack Block Storage volume.
Cross-Site Request Forgery in Jenkins Git Plugin
Advisory: GHSA-rf5q-8gx3-xqfc
Aliases: CVE-2017-1000092
Published: 2022-05-17T00:33:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Git Plugin connects to a user-specified Git repository as part of form validation. An attacker with no direct access to Jenkins but able to guess at a username/password credentials ID could trick a developer with job configuration permissions into following a link with a maliciously crafted Jenkins URL which would result in the Jenkins Git client sending the username and password to an attacker-controlled server.
Mirumee Saleor CSRF Protection Disabled
Advisory: GHSA-fgjh-x3f8-8gmh
Aliases: CVE-2019-13594
Published: 2022-05-24T16:50:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST request without a valid CSRF token and be accepted by the server.
katello Cross-site Scripting vulnerability
Advisory: GHSA-mhhc-r88h-2qrm
Aliases: CVE-2018-16887
Published: 2022-05-14T01:03:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.
Incorrect Authorization in Jenkins Gerrit Trigger Plugin
Advisory: GHSA-4vf2-cm23-rf4c
Aliases: CVE-2018-1000106
Published: 2022-05-13T01:48:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to modify the Gerrit configuration in Jenkins.
Cross-Site Request Forgery in Apache CXF Fediz
Advisory: GHSA-f5ch-36rg-vfcc
Aliases: CVE-2017-7662
Published: 2022-05-13T01:09:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Apache CXF Fediz ships with an OpenId Connect (OIDC) service which has a Client Registration Service, which is a simple web application that allows clients to be created, deleted, etc. A CSRF (Cross Style Request Forgery) style vulnerability has been found in this web application in Apache CXF Fediz prior to 1.4.0 and 1.3.2, meaning that a malicious web application could create new clients, or reset secrets, etc, after the admin user has logged on to the client registration service and the session is still active.
Jenkins Google Calendar Plugin has Insufficiently Protected Credentials
Advisory: GHSA-8gq4-x72r-6xcr
Aliases: CVE-2019-10425
Published: 2022-05-24T16:56:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Google Calendar Plugin stores a calendar password unencrypted in job `config.xml` files on the Jenkins controller. This password can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.
CakePHP allows method override parameters to bypass CSRF checks
Advisory: GHSA-9pgx-pf36-w46r
Aliases: CVE-2020-35239
Published: 2022-05-24T17:40:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method.
Improper Authentication in Jenkins
Advisory: GHSA-m93h-5qmx-pphg
Aliases: CVE-2017-2604
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In Jenkins before versions 2.44 and 2.32.2, low privilege users were able to act on administrative monitors due to them not being consistently protected by permission checks (SECURITY-371).
Missing validation results in undefined behavior in `SparseTensorDenseAdd
Advisory: GHSA-rc9w-5c64-9vqq
Aliases: CVE-2022-29206
Published: 2022-05-24T22:13:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.SparseTensorDenseAdd`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/sparse_tensor_dense_add_op.cc) does not fully validate the input arguments:

```python
import tensorflow as tf

a_indices = tf.constant(0, shape=[17, 2], dtype=tf.int64)
a_values = tf.constant([], shape=[0], dtype=tf.float32)
a_shape = tf.constant([6, 12], shape=[2], dtype=tf.int64)

b = tf.constant(-0.223668531, shape=[6, 12], dtype=tf.float32)

tf.raw_ops.SparseTensorDenseAdd(
    a_indices=a_indices, a_values=a_values, a_shape=a_shape, b=b)
```

In this case, a reference gets bound to a `nullptr` during kernel execution. This is UB.

### Patches
We have patched the issue in GitHub commit [11ced8467eccad9c7cb94867708be8fa5c66c730](https://github.com/tensorflow/tensorflow/commit/11ced8467eccad9c7cb94867708be8fa5c66c730).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
OpenStack Nova uses insecure keystone middleware tmpdir by default
Advisory: GHSA-pxxv-rv32-2qgv
Aliases: CVE-2013-2030
Published: 2022-05-17T04:44:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
Improper Access Control in wp-graphql
Advisory: GHSA-w3xg-7q6m-3xwp
Aliases: CVE-2019-25060
Published: 2022-05-10T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site.
Exposure of Sensitive Information to an Unauthorized Actor in JGroup
Advisory: GHSA-cc62-496p-hrr7
Aliases: CVE-2013-4112
Published: 2022-05-17T04:50:16Z

The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.
Excessive memory allocation in graph URLs leads to denial of service in Jenkins
Advisory: GHSA-cxqw-vjcr-gp5g
Aliases: CVE-2021-21607
Published: 2022-05-24T17:39:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Jenkins renders several different graphs for features like agent and label usage statistics, memory usage, or various plugin-provided statistics.

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not limit the graph size provided as query parameters.

This allows attackers to request or to have legitimate Jenkins users request crafted URLs that rapidly use all available memory in Jenkins, potentially leading to out of memory errors.

Jenkins 2.275, LTS 2.263.2 limits the maximum size of graphs to an area of 10 million pixels. If a larger size is requested, the default size for the graph will be rendered instead.

This threshold can be configured by setting the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.util.Graph.maxArea` to a different number on startup.
Apache Geronimo Application Server CSRF vulnerabilities
Advisory: GHSA-678x-xfp4-r92r
Aliases: CVE-2009-0039
Published: 2022-05-02T03:12:31Z

Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
Spoon Library as used in Fork CMS allows PHP object injection
Advisory: GHSA-2p2x-mw56-jc98
Aliases: CVE-2019-15521
Published: 2022-05-24T16:54:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Spoon Library through 2014-02-06, as used in Fork CMS before 1.4.1 and other products, allows PHP object injection via a cookie containing an object.
Denial of service vulnerability exists in libxmljs
Advisory: GHSA-773h-w45w-f2f9
Aliases: CVE-2022-21144
Published: 2022-05-03T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

libxmljs provides libxml bindings for v8 javascript engine. This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.
Complete lack of CSRF protection in Jenkins Selenium Plugin can lead to OS command injection
Advisory: GHSA-rp4x-xpgf-4xv7
Aliases: CVE-2020-2196
Published: 2022-05-24T17:19:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints.

This allows attackers to perform the following actions:
- Restart the Selenium Grid hub.
- Delete or replace the plugin configuration.
- Start, stop, or restart Selenium configurations on specific nodes.

Through carefully chosen configuration parameters, these actions can result in OS command injection on the Jenkins controller.
ChakraCore RCE Vulnerability
Advisory: GHSA-79xq-c7xr-29jh
Aliases: CVE-2018-8541
Published: 2022-05-13T01:20:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8542, CVE-2018-8543, CVE-2018-8551, CVE-2018-8555, CVE-2018-8556, CVE-2018-8557, CVE-2018-8588.
Use After Free in Hermes
Advisory: GHSA-mph8-6787-r8hw
Aliases: CVE-2021-24037
Published: 2022-05-24T19:05:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A use after free in hermes, while emitting certain error messages, prior to commit d86e185e485b6330216dee8e854455c694e3a36e allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Shopware XXE Vulnerability
Advisory: GHSA-6m27-7cqj-2mxw
Aliases: CVE-2017-18357
Published: 2022-05-14T01:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Shopware before 5.3.4 has a PHP Object Instantiation issue via the sort parameter to the loadPreviewAction() method of the Shopware_Controllers_Backend_ProductStream controller, with resultant XXE via instantiation of a SimpleXMLElement object.
Mako contains Cross-site Scripting vulnerability
Advisory: GHSA-7q8x-38mc-p84f
Aliases: CVE-2010-2480
Published: 2022-05-17T05:48:31Z

Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.
Improper Authorization in Jenkins
Advisory: GHSA-4h47-h3cr-23wh
Aliases: CVE-2018-1000408
Published: 2022-05-13T01:48:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins user database security realm that results in the creation of an ephemeral user record in memory.
Concurrent Execution using Shared Resource with Improper Synchronization in Elasticsearch
Advisory: GHSA-jqm6-m3j3-8gg9
Aliases: CVE-2019-7614
Published: 2022-05-24T16:51:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

A race condition flaw was found in the response headers Elasticsearch versions before 7.2.1 and 6.8.2 returns to a request. On a system with multiple users submitting requests, it could be possible for an attacker to gain access to response header containing sensitive data from another user.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-6vc8-3xf2-qrxx
Aliases: CVE-2019-8232
Published: 2022-05-24T17:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
Credentials transmitted in plain text by Jenkins DeployHub Plugin
Advisory: GHSA-hm57-4qpx-f734
Aliases: CVE-2020-2156
Published: 2022-05-24T17:10:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

DeployHub Plugin stores credentials in job `config.xml` files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by DeployHub Plugin 8.0.14 and earlier. These credentials could be viewed by users with Extended Read permission.
Exposure of Sensitive Information to an Unauthorized Actor in Requests
Advisory: GHSA-cfj3-7x9c-4p3h
Aliases: CVE-2014-1829
Published: 2022-05-17T03:49:35Z

Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.
Credentials transmitted in plain text by OpenShift Deployer Plugin
Advisory: GHSA-2rrx-q65f-8945
Aliases: CVE-2020-2155
Published: 2022-05-24T17:10:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

OpenShift Deployer Plugin stores credentials in its global configuration file `org.jenkinsci.plugins.openshift.DeployApplication.xml` on the Jenkins controller as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by OpenShift Deployer Plugin 1.2.0 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Jenkins allows remote authenticated users to bypass intended restrictions and create or destroy arbitrary jobs
Advisory: GHSA-64mc-2m9p-23c8
Aliases: CVE-2014-3663
Published: 2022-05-17T03:53:35Z

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/CONFIGURE permission to bypass intended restrictions and create or destroy arbitrary jobs via unspecified vectors.
ChakraCore RCE Vulnerability
Advisory: GHSA-985m-xqv8-rh79
Aliases: CVE-2016-0193
Published: 2022-05-14T02:24:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0191.
VladTheEnterprising allows local users to write to arbitrary files via a symlink attack
Advisory: GHSA-x4vj-279x-qwf2
Aliases: CVE-2014-4996
Published: 2022-05-14T03:48:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

`lib/vlad/dba/mysql.rb` in the VladTheEnterprising gem 0.2 for Ruby allows local users to write to arbitrary files via a symlink attack on `/tmp/my.cnf.#{target_host}`.
Ignition config accessible to unprivileged software on VMware
Advisory: GHSA-hj57-j5cw-2mwp
Aliases: CVE-2022-1706
Published: 2022-05-25T19:37:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact
Unprivileged software in VMware VMs, including software running in unprivileged containers, can retrieve an Ignition config stored in a hypervisor guestinfo variable or OVF environment.  If the Ignition config contains secrets, this can result in the compromise of sensitive information.

### Patches
Ignition 2.14.0 and later [adds](https://github.com/coreos/ignition/pull/1350) a new systemd service, `ignition-delete-config.service`, that deletes the Ignition config from supported hypervisors (currently VMware and VirtualBox) during the first boot.  This ensures that unprivileged software cannot retrieve the Ignition config from the hypervisor.

If you have external tooling that requires the Ignition config to remain accessible in VM metadata after provisioning, and your Ignition config does not include sensitive information, you can prevent Ignition 2.14.0 and later from deleting the config by masking `ignition-delete-config.service`.  For example:

```json
{
  "ignition": {
    "version": "3.0.0"
  },
  "systemd": {
    "units": [
      {
        "name": "ignition-delete-config.service",
        "mask": true
      }
    ]
  }
}
```

### Workarounds
[Avoid storing secrets](https://coreos.github.io/ignition/operator-notes/#secrets) in Ignition configs. In addition to VMware, many cloud platforms allow unprivileged software in a VM to retrieve the Ignition config from a networked cloud metadata service. While platform-specific mitigation is possible, such as firewall rules that prevent access to the metadata service, it's best to store secrets in a dedicated platform such as [Hashicorp Vault](https://www.vaultproject.io/).

### Advice to Linux distributions
Linux distributions that ship Ignition should ensure the new `ignition-delete-config.service` is installed and enabled by default.

In addition, we recommend shipping a service similar to `ignition-delete-config.service` that runs when existing machines are upgraded, similar to the one in https://github.com/coreos/fedora-coreos-config/pull/1738. Consider giving your users advance notice of this change, and providing instructions for masking `ignition-delete-config.service` on existing nodes if users have tooling that requires the Ignition config to remain accessible in VM metadata.

### References
For more information, see #1300 and #1350.

### For more information
If you have any questions or comments about this advisory, [open an issue in Ignition](https://github.com/coreos/ignition/issues/new/choose) or email the CoreOS [development mailing list](https://lists.fedoraproject.org/archives/list/coreos@lists.fedoraproject.org/).
b3log Wide unauthenticated file access
Advisory: GHSA-6452-jr93-r5qm
Aliases: CVE-2019-13915
Published: 2022-05-24T16:50:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

b3log Wide before 1.6.0 allows three types of attacks to access arbitrary files. First, the attacker can write code in the editor, and compile and run it approximately three times to read an arbitrary file. Second, the attacker can create a symlink, and then place the symlink into a ZIP archive. An unzip operation leads to read access, and write access (depending on file permissions), to the symlink target. Third, the attacker can import a Git repository that contains a symlink, similarly leading to read and write access.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-525g-rvh4-v5c9
Aliases: CVE-2019-7926
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript.
ChakraCore RCE Vulnerability
Advisory: GHSA-wwm6-r38h-ppg7
Aliases: CVE-2018-8280
Published: 2022-05-13T01:20:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8286, CVE-2018-8290, CVE-2018-8294.
Improper Neutralization of Input During Web Page Generation in IPython
Advisory: GHSA-66gw-5xpf-gfp5
Aliases: CVE-2015-4707
Published: 2022-05-13T01:31:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-86pc-6mm8-542r
Aliases: CVE-2019-8148
Published: 2022-05-24T17:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder.
Symfony Incorrect Access Control
Advisory: GHSA-q87v-q8fw-gmj5
Aliases: CVE-2017-11365
Published: 2022-05-24T16:46:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Certain Symfony products are affected by: Incorrect Access Control. This affects Symfony 2.7.30 and Symfony 2.8.23 and Symfony 3.2.10 and Symfony 3.3.3. The type of exploitation is: remote. The component is: Password validator.
Fork CMS XSS Vulnerability
Advisory: GHSA-xcmj-xjhg-wvhq
Aliases: CVE-2018-20682
Published: 2022-05-14T01:39:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fork CMS 5.0.6 allows stored XSS via the `private/en/settings` `facebook_admin_ids` parameter (aka "Admin ids" input in the Facebook section).
DNN XSS Vulnerability
Advisory: GHSA-9phr-h5mx-4fp6
Aliases: CVE-2020-5186
Published: 2022-05-24T17:09:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).
Deserialization of Untrusted Data in org.jboss.resteasy:resteasy-yaml-provider
Advisory: GHSA-m2fv-3rqm-g7p5
Aliases: CVE-2018-1051
Published: 2022-05-13T01:33:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

It was found that the fix for CVE-2016-9606 in versions 3.0.22 and 3.1.2 was incomplete and Yaml unmarshalling in Resteasy is still possible via `Yaml.load()` in YamlProvider.

#### Mitigation:   
If the YamlProvider is enabled it's recommended to add authentication, and authorization to the endpoint expecting Yaml content to prevent exploitation of this vulnerability.
Jenkins Coverity Plugin has Insufficiently Protected Credentials
Advisory: GHSA-cghg-jcv6-4v5m
Aliases: CVE-2018-1000104
Published: 2022-05-13T01:48:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

A plaintext storage of a password vulnerability exists in Jenkins Coverity Plugin 1.10.0 and earlier in CIMInstance.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured keystore and private key passwords. The Coverity Plugin 1.11.0 integrates with Credentials Plugin to store passwords, and automatically migrates existing passwords.
Microweber XSS Vulnerability
Advisory: GHSA-582j-m369-hj2f
Aliases: CVE-2018-19917
Published: 2022-05-14T01:07:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.
Moodle sensitive information disclosure
Advisory: GHSA-c4cq-v4wp-28hg
Aliases: CVE-2016-5014
Published: 2022-05-13T01:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

In Moodle 2.x and 3.x, an unenrolled user still receives event monitor notifications even though they can no longer access the course.
Directory Traversal in Apache Tomcat
Advisory: GHSA-9737-qmgc-hfr9
Aliases: CVE-2008-5515
Published: 2022-05-14T01:17:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
Credential stored in plain text by BMC Release Package and Deployment Plugin
Advisory: GHSA-2j3r-x6xc-qqqj
Aliases: CVE-2020-2127
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins BMC Release Package and Deployment Plugin 1.1 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system. As of publication of this advisory, there is no fix.
Improper Verification of Cryptographic Signature in matrix-synapse
Advisory: GHSA-cppw-2mf8-qpm5
Aliases: CVE-2019-18835
Published: 2022-05-24T22:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Matrix Synapse before 1.5.0 mishandles signature checking on some federation APIs. Events sent over `/send_join`, `/send_leave`, and `/invite` may not be correctly signed, or may not come from the expected servers.
Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain
Advisory: GHSA-r9vv-xj4w-g8m8
Aliases: CVE-2016-4978
Published: 2022-05-13T01:11:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

The getObject method of the `javax.jms.ObjectMessage` class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Centreon Does Not Set HTTPOnly Flag
Advisory: GHSA-j224-7qr4-8646
Aliases: CVE-2019-17104
Published: 2022-05-24T16:58:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Centreon VM through 19.04.3, the cookie configuration within the Apache HTTP Server does not protect against theft because the HTTPOnly flag is not set.
Jenkins Multijob plugin did not check permissions in the Resume Build action
Advisory: GHSA-p9r2-gghq-hc57
Aliases: CVE-2017-1000390
Published: 2022-05-13T01:18:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins Multijob plugin version 1.25 and earlier did not check permissions in the Resume Build action, allowing anyone with Job/Read permission to resume the build. Multijob plugin 1.26 introduced a permission check requiring Overall/Administer. This was lowered to Job/Build in version 1.27.
Missing validation causes `TensorSummaryV2` to crash
Advisory: GHSA-2p9q-h29j-3f5v
Aliases: CVE-2022-29193
Published: 2022-05-24T16:38:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.TensorSummaryV2`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/summary_tensor_op.cc#L33-L58) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import numpy as np
import tensorflow as tf

tf.raw_ops.TensorSummaryV2(
  tag=np.array('test'),
  tensor=np.array(3),
  serialized_summary_metadata=tf.io.encode_base64(np.empty((0))))
```

The code assumes `axis` is a scalar but there is no validation for this.

```cc
    const Tensor& serialized_summary_metadata_tensor = c->input(2);
    // ...
    ParseFromTString(serialized_summary_metadata_tensor.scalar<tstring>()(),
                     v->mutable_metadata());
``` 

### Patches
We have patched the issue in GitHub commit [290bb05c80c327ed74fae1d089f1001b1e2a4ef7](https://github.com/tensorflow/tensorflow/commit/290bb05c80c327ed74fae1d089f1001b1e2a4ef7).
    
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.
    
### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University and Hong Jin from Singapore Management University.
Jenkins Cross-site Scripting vulnerability
Advisory: GHSA-cwh9-f8m6-6r63
Aliases: CVE-2014-3681
Published: 2022-05-14T01:48:04Z

Cross-site scripting (XSS) vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Apache Geode OQL bind parameter vulnerability
Advisory: GHSA-q7cp-r6cj-hpf5
Aliases: CVE-2017-9796
Published: 2022-05-14T03:46:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

When an Apache Geode cluster before v1.3.0 is operating in secure mode, a user with read access to specific regions within a Geode cluster may execute OQL queries containing a region name as a bind parameter that allow read access to objects within unauthorized regions.
Zend Framework CSRF Vulnerability
Advisory: GHSA-gwwq-54qp-9pgp
Aliases: CVE-2015-1786
Published: 2022-05-17T02:41:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site request forgery (CSRF) vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before 2.3.6 via null or malformed token identifiers.
Matrix Synapse Predictable Secret Key
Advisory: GHSA-jrqm-v8cv-53ww
Aliases: CVE-2019-5885
Published: 2022-05-13T01:08:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Matrix Synapse before 0.34.0.1, when the `macaroon_secret_key` authentication parameter is not set, uses a predictable value to derive a secret key and other secrets which could allow remote attackers to impersonate users.
Apache Storm remote code execution vulnerability
Advisory: GHSA-cg5h-q983-4rww
Aliases: CVE-2015-3188
Published: 2022-05-14T02:48:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The UI daemon in Apache Storm 0.10.0-beta allows remote users to run arbitrary code as the user running the web server. With kerberos authentication this could allow impersonation of arbitrary users on other systems, including HDFS and HBase.
Improper Authentication in Apache WSS4J
Advisory: GHSA-72m6-23ff-7q26
Aliases: CVE-2014-3612
Published: 2022-05-14T01:14:52Z

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.
JULI logging component in Apache Tomcat does not restrict certain permissions for web applications
Advisory: GHSA-w65j-cmqc-37p2
Aliases: CVE-2007-5342
Published: 2022-05-01T18:32:22Z

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the `org.apache.juli.FileHandler` handler.
Argo Exposure of Sensitive Information 
Advisory: GHSA-xj7v-c82w-92q2
Aliases: CVE-2018-21034
Published: 2022-05-24T17:13:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Argo versions prior to v1.5.0-rc1, it was possible for authenticated Argo users to submit API calls to retrieve secrets and other manifests which were stored within git.
CakePHPallows remote attackers to read arbitrary files via XML data containing external entity references
Advisory: GHSA-5964-pq8r-4q62
Aliases: CVE-2012-4399
Published: 2022-05-17T05:07:14Z

The Xml class in CakePHP 2.1.x before 2.1.5 and 2.2.x before 2.2.1 allows remote attackers to read arbitrary files via XML data containing external entity references, aka an XML external entity (XXE) injection attack.
Improper handling of untrusted branches in Gitea Jenkins Plugin
Advisory: GHSA-q98c-rqx7-7ghf
Aliases: CVE-2019-10330
Published: 2022-05-24T22:00:03Z

Jenkins Gitea Plugin prior to 1.1.2 did not implement trusted revisions, allowing attackers without commit access to the Git repo to change Jenkinsfiles even if Jenkins is configured to consider them to be untrusted.
Magento 2 Community Edition Information Disclosure
Advisory: GHSA-9pgc-rvp9-rqv3
Aliases: CVE-2019-7888
Published: 2022-05-24T16:52:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.