aswin1906/github-advisory-2022 huggingface dataset:
Cross-site Scripting in Beanstalk console
Advisory: GHSA-2cjf-w7c4-fhf6
Aliases: CVE-2022-0539
Published: 2022-02-10T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Beanstalk console (ptrofimov/beanstalk_console) prior to 1.7.14 is vulnerable to cross-site scripting.
Reachable Assertion in Tensorflow
Advisory: GHSA-8rcj-c8pj-v3m3
Aliases: CVE-2022-23564
Published: 2022-02-09T23:55:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
When decoding a resource handle tensor from protobuf, a TensorFlow process can encounter cases where a `CHECK` assertion is invalidated based on user controlled arguments. This allows attackers to cause denial of services in TensorFlow processes.

### Patches
We have patched the issue in GitHub commit [14fea662350e7c26eb5fe1be2ac31704e5682ee6](https://github.com/tensorflow/tensorflow/commit/14fea662350e7c26eb5fe1be2ac31704e5682ee6).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers
Advisory: GHSA-jh6m-3pqw-242h
Aliases: CVE-2020-14359
Published: 2022-02-09T00:56:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A vulnerability was found in all versions of the deprecated package Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) we can bypass our Gatekeeper. Lower case headers are also accepted by some webservers (e.g. Jetty). This means there is no protection when we put a Gatekeeper in front of a Jetty server and use lowercase headers.
Upload of file to arbitrary path in Apache Flink
Advisory: GHSA-7q5g-gph2-4rc6
Aliases: CVE-2020-17518
Published: 2022-02-09T22:29:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.
Prototype Pollution in safetydance
Advisory: GHSA-6m85-wvcr-pgw3
Aliases: CVE-2020-7737
Published: 2022-02-10T20:33:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

All versions of package safetydance are vulnerable to Prototype Pollution via the set function.
Validation bypass in frourio-express
Advisory: GHSA-mmj4-777p-fpq9
Aliases: CVE-2022-23624
Published: 2022-02-07T22:38:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

## 日本語

### 影響
v0.26.0以前のfrourioを使用している、かつvalidators/を利用している場合、ネストされたバリデータがリクエストのボディーとクエリに対して正しく働かないケースがあります。また、リクエストに対してバリデーションが効かなくなる入力があります。

### パッチ
frourioをv0.26.0かそれ以降のバージョンにアップデートをお願いします。frourio を使用したプロジェクトには `class-transformer` と `reflect-metadata` の依存への追加も必要となります。

### ワークアラウンド
controller側で自分でclass-transformerを使用してチェックする、vaildatorを使わない、など。

### さらなる情報

このセキュリティ勧告に関する質問やコメントについては、以下の方法でお問い合わせいただけます。
* [frourio](https://github.com/frouriojs/frourio)にIssueを開く。

## English

### Impact
Frourio users who uses frourio version prior to v0.26.0 and integration with class-validator through `validators/` folder. Validators does not work properly for request bodies and queries in specific situations. Addtionally, some kind of input is not validated. (false positives)

### Patches
Please update your frourio to v0.26.0 or later. You also need to install `class-transformer` and `reflect-metadata` to your project.

### Workarounds
Validate objects from request with class-transformer in controllers by yourself, or prevent using validators.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [frourio](https://github.com/frouriojs/frourio)
Out-of-bounds Write in iText
Advisory: GHSA-c32g-2mgr-cfq7
Aliases: CVE-2022-24197
Published: 2022-02-02T00:01:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
`CHECK`-failures in Tensorflow
Advisory: GHSA-4v5p-v5h9-6xjx
Aliases: CVE-2022-23565
Published: 2022-02-09T23:49:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
An attacker can trigger denial of service via assertion failure by altering a `SavedModel` on disk such that `AttrDef`s of some operation are duplicated.

### Patches
We have patched the issue in GitHub commit [c2b31ff2d3151acb230edc3f5b1832d2c713a9e0](https://github.com/tensorflow/tensorflow/commit/c2b31ff2d3151acb230edc3f5b1832d2c713a9e0).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Exposure of Sensitive Information to an Unauthorized Actor in follow-redirects
Advisory: GHSA-pw2r-vq6v-hr8c
Aliases: CVE-2022-0536
Published: 2022-02-10T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
Cross-site Scripting in Weblate
Advisory: GHSA-6jp6-9rf9-gc66
Aliases: CVE-2022-24710
Published: 2022-02-25T22:18:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

### Impact
Due to improper neutralization, it was possible to perform cross-site scripting via crafted user and language names.

### Patches

The issues were fixed in the 4.11 release. The following commits are addressing it:

* f6753a1a1c63fade6ad418fbda827c6750ab0bda
* 9e19a8414337692cc90da2a91c9af5420f2952f1
* 22d577b1f1e88665a88b4569380148030e0f8389

### Workarounds

You can look for crafted user and language names to see if you were affected.

### References
* https://hackerone.com/reports/1486674
* https://hackerone.com/reports/1486718
* https://hackerone.com/reports/1485226

### For more information
If you have any questions or comments about this advisory:
* Open a topic in [discussions](https://github.com/WeblateOrg/weblate/discussions)
* Email us at [care@weblate.org](mailto:care@weblate.org)
Cross-site Scripting in markdown-it-highlightjs
Advisory: GHSA-f246-xrrj-g8j6
Aliases: CVE-2020-7773
Published: 2022-02-10T20:19:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. 

```js
const markdownItHighlightjs = require("markdown-it-highlightjs");
const md = require('markdown-it'); 
const reuslt_xss = md().use(markdownItHighlightjs, { inline: true }).render('console.log(42){.">js}'); 
console.log(reuslt_xss);
```
Cross-Site Request Forgery in xwiki-platform
Advisory: GHSA-vh5c-jqfg-mhrh
Aliases: CVE-2021-32732
Published: 2022-02-10T22:42:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually tight to that email by forging a request to the Forgot username page. Note that since this page does not have a CSRF check it's quite easy to perform a lot of those requests.

### Patches
This issue has been patched in XWiki 12.10.5 and 13.2RC1. Two different patches are provided:
  - a first one to fix the CSRF problem
  - a more complex one that now relies on sending an email for the Forgot username process.

### Workarounds
It's possible to fix the problem without uprading by editing the ForgotUsername page in version below 13.x, to use the following code: https://github.com/xwiki/xwiki-platform/blob/69548c0320cbd772540cf4668743e69f879812cf/xwiki-platform-core/xwiki-platform-administration/xwiki-platform-administration-ui/src/main/resources/XWiki/ForgotUsername.xml#L39-L123

In version after 13.x it's also possible to edit manually the forgotusername.vm file, but it's really encouraged to upgrade the version here.

### References
  * https://jira.xwiki.org/browse/XWIKI-18384
  * https://jira.xwiki.org/browse/XWIKI-18408

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Insecure Temporary File in mlflow
Advisory: GHSA-vqj2-4v8m-8vrq
Aliases: CVE-2022-0736
Published: 2022-02-24T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

mlflow prior to 1.23.1 contains an insecure temporary file. The insecure function `tempfile.mktemp()` is deprecated and `mkstemp()` should be used instead.
Protection Mechanism Failure in Jenkins Doktor Plugin
Advisory: GHSA-64q9-f38h-9mwx
Aliases: CVE-2022-25204
Published: 2022-02-16T00:01:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Doktor Plugin 0.4.1 and earlier implements functionality that allows agent processes to render files on the controller as Markdown or Asciidoc, and error messages allow attackers able to control agent processes to determine whether a file with a given name exists.
Code injection in @rkesters/gnuplot
Advisory: GHSA-f2jw-pr2c-9x96
Aliases: CVE-2021-29369
Published: 2022-02-10T23:41:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands.
Path Traversal in ImpressCMS
Advisory: GHSA-389p-fchr-q2mg
Aliases: CVE-2022-24977
Published: 2022-02-15T00:02:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName, leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.
Improper Input Validation in Apache Pulsar
Advisory: GHSA-3whx-qrj5-hh2h
Aliases: CVE-2021-41571
Published: 2022-02-02T00:01:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user. The Admin API get-message-by-id requires the user to input a topic and a ledger id. The ledger id is a pointer to the data, and it is supposed to be a valid it for the topic. Authorisation controls are performed against the topic name and there is not proper validation the that ledger id is valid in the context of such ledger. So it may happen that the user is able to read from a ledger that contains data owned by another tenant. This issue affects Apache Pulsar Apache Pulsar version 2.8.0 and prior versions; Apache Pulsar version 2.7.3 and prior versions; Apache Pulsar version 2.6.4 and prior versions.
Command injection in strapi
Advisory: GHSA-xrjf-phvv-r4vr
Aliases: CVE-2022-0764
Published: 2022-02-27T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L

When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular [link](https://github.com/strapi/strapi/blob/master/packages/generators/app/lib/utils/fetch-npm-template.js#L13), this happens due to improper sanitization of user input.
Command Injection in Cobbler
Advisory: GHSA-6cm4-gm85-972c
Aliases: CVE-2021-45082
Published: 2022-02-20T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Cobbler through 3.3.0. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)
Improper input validation in umoci
Advisory: GHSA-9m95-8hx6-7p9v
Aliases: CVE-2021-29136
Published: 2022-02-15T01:17:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

### Impact

umoci 0.4.6 and earlier can be tricked into modifying host files by
creating a malicious layer that has a symlink with the name "." (or
"/"). Because umoci deletes inodes if they change types, this results in
the rootfs directory being replaced with an attacker-controlled symlink.
Subsequent image layers will then be applied on top of the target of the
symlink (which could be any directory on the host filesystem the user
running umoci has access to).

While umoci does have defences against symlink-based attacks, they are
all implemented by resolving things relative to the rootfs directory --
if the rootfs itself is a symlink, umoci resolves it first.

This vulnerability affects both "umoci unpack" and "umoci raw unpack".

### Patches
This issue has been patched in umoci 0.4.7, see the references section
for the specific commit which fixed this vulnerability.

### Workarounds
Note that if you use umoci as an unprivileged user (using the --rootless
flag) then umoci will not be able to overwrite any files that your user
doesn't have access to. Other possible mitigations are to run umoci
under an LSM profile such as AppArmor or SELinux to restrict the level
of access it has outside of container image directories.

### References
* [oss-security public disclosure](https://www.openwall.com/lists/oss-security/2021/04/06/2)
* [patch](https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57)

### Credits
Thanks to Robin Peraglie from Cure53 for discovering and reporting this
vulnerability.

### For more information

If you have any questions or comments about this advisory
* Open an issue in <https://github.com/opencontainers/umoci>.
* Email us at <security@opencontainers.org>.
Incorrect Authorization in Apache Solr
Advisory: GHSA-3c7p-vv5r-cmr5
Aliases: CVE-2020-13957
Published: 2022-02-10T00:31:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions. This issue is patched in 8.6.3.
Missing permission check in Jenkins autonomiq Plugin
Advisory: GHSA-6jv7-28mv-qp9c
Aliases: CVE-2022-25195
Published: 2022-02-16T00:01:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins autonomiq Plugin 1.15 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials.
Cross-site Scripting in Gitea
Advisory: GHSA-r3gq-wxqf-q4gh
Aliases: CVE-2021-45329
Published: 2022-02-10T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability exists in Gitea before 1.5.1 via the repository settings inside the external wiki/issue tracker URL field.
Open redirect in microweber
Advisory: GHSA-r992-xph6-h7x2
Aliases: CVE-2022-0560
Published: 2022-02-12T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

microweber prior to 1.2.11 is vulnerable to open redirect.
Insecure temporary file in Tensorflow
Advisory: GHSA-wc4g-r73w-x8mm
Aliases: CVE-2022-23563
Published: 2022-02-09T23:54:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

### Impact
In multiple places, TensorFlow uses `tempfile.mktemp` to create temporary files. While this is acceptable in testing, in utilities and libraries it is dangerous as a different process can create the file between the check for the filename in `mktemp` and the actual creation of the file by a subsequent operation (a TOC/TOU type of weakness).

In several instances, TensorFlow was supposed to actually create a temporary directory instead of a file. This logic bug is hidden away by the `mktemp` function usage.

### Patches
We have patched the issue in several commits, replacing `mktemp` with the safer `mkstemp`/`mkdtemp` functions, according to the usage pattern.
The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported on huntr.dev for one scenario and discovered via variant analysis on other instances.
Cross-Site Request Forgery microweber
Advisory: GHSA-ghww-cv4v-hmxx
Aliases: CVE-2022-0638
Published: 2022-02-18T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

microweber prior to version 1.2.11 is vulnerable to Cross-Site Request Forgery (CSRF).
Gitea Improper Input Validation
Advisory: GHSA-q47x-6mqq-4w92
Aliases: CVE-2019-11228
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the `form.MirrorAddress` before calling `SaveAddress`.
`CHECK`-failures during Grappler's `IsSimplifiableReshape` in Tensorflow
Advisory: GHSA-fq86-3f29-px2c
Aliases: CVE-2022-23581
Published: 2022-02-07T22:01:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The Grappler optimizer in TensorFlow can be used to cause a denial of service by altering a `SavedModel` such that [`IsSimplifiableReshape`](https://github.com/tensorflow/tensorflow/blob/a1320ec1eac186da1d03f033109191f715b2b130/tensorflow/core/grappler/optimizers/constant_folding.cc#L1687-L1742) would trigger `CHECK` failures.

### Patches
We have patched the issue in GitHub commits [ebc1a2ffe5a7573d905e99bd0ee3568ee07c12c1](https://github.com/tensorflow/tensorflow/commit/ebc1a2ffe5a7573d905e99bd0ee3568ee07c12c1), [1fb27733f943295d874417630edd3b38b34ce082](https://github.com/tensorflow/tensorflow/commit/1fb27733f943295d874417630edd3b38b34ce082), and [240655511cd3e701155f944a972db71b6c0b1bb6](https://github.com/tensorflow/tensorflow/commit/240655511cd3e701155f944a972db71b6c0b1bb6).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Apache CXF JMX Integration is vulnerable to a MITM attack
Advisory: GHSA-ffm7-7r8g-77xm
Aliases: CVE-2020-1954
Published: 2022-02-10T22:38:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache CXF has the ability to integrate with JMX by registering an `InstrumentationManager` extension with the CXF bus. If the `createMBServerConnectorFactory` property of the default `InstrumentationManagerImpl` is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.
Denial of Service in Packetbeat
Advisory: GHSA-9q3g-m353-cp4p
Aliases: CVE-2017-11480
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Packetbeat versions prior to 5.6.4 and 6.0.0 are affected by a denial of service flaw in the PostgreSQL protocol handler. If Packetbeat is listening for PostgreSQL traffic and a user is able to send arbitrary network traffic to the monitored port, the attacker could prevent Packetbeat from properly logging other PostgreSQL traffic.
Prototype pollution in Plist before 3.0.5 can cause denial of service
Advisory: GHSA-4cpg-3vgw-4877
Aliases: CVE-2022-22912
Published: 2022-02-18T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Prototype pollution vulnerability via `.parse()` in Plist allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
Cross-Site Request Forgery in Filebrowser
Advisory: GHSA-72wf-hwcq-65h9
Aliases: CVE-2021-46398
Published: 2022-02-05T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A Cross-Site Request Forgery (CSRF) vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim.
Denial of service in Apache OpenMeetings
Advisory: GHSA-g37q-26qx-8v2m
Aliases: CVE-2020-13951
Published: 2022-02-10T20:36:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
Deserialization of Untrusted Data in Magnolia CMS
Advisory: GHSA-pwr6-p3fh-grc2
Aliases: CVE-2021-46364
Published: 2022-02-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.
Out of bounds read in Tensorflow
Advisory: GHSA-vq36-27g6-p492
Aliases: CVE-2022-23592
Published: 2022-02-09T23:31:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

### Impact
TensorFlow's [type inference](https://github.com/tensorflow/tensorflow/blob/274df9b02330b790aa8de1cee164b70f72b9b244/tensorflow/core/graph/graph.cc#L223-L229) can cause a heap OOB read as the bounds checking is done in a `DCHECK` (which is a no-op during production):

```cc
if (node_t.type_id() != TFT_UNSET) {
  int ix = input_idx[i];
  DCHECK(ix < node_t.args_size())
      << "input " << i << " should have an output " << ix
      << " but instead only has " << node_t.args_size()
      << " outputs: " << node_t.DebugString();
  input_types.emplace_back(node_t.args(ix));
  // ...
}       
```   
      
An attacker can control `input_idx` such that `ix` would be larger than the number of values in `node_t.args`.
        
### Patches
We have patched the issue in GitHub commit [c99d98cd189839dcf51aee94e7437b54b31f8abd](https://github.com/tensorflow/tensorflow/commit/c99d98cd189839dcf51aee94e7437b54b31f8abd).
  
The fix will be included in TensorFlow 2.8.0. This is the only affected version.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Open redirect in karma
Advisory: GHSA-rc3x-jf5g-xvc5
Aliases: CVE-2021-23495
Published: 2022-02-26T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.
Authentication bypass in Apache Kylin
Advisory: GHSA-2hpg-vwqj-6h6w
Aliases: CVE-2020-13937
Published: 2022-02-10T20:25:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.
Cross-site Scripting by SVG upload in xwiki-platform
Advisory: GHSA-9jq9-c2cv-pcrj
Aliases: CVE-2021-43841
Published: 2022-02-10T22:42:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

### Impact
When using default XWiki configuration, it's possible for an attacker to upload an SVG containing a script executed when executing the download action on the file. 

### Patches
This problem has been patched so that the default configuration doesn't allow to display the SVG files in the browser.

### Workarounds
This issue can be fixed without the patch by setting properly the configuration to download or display files, see: https://www.xwiki.org/xwiki/bin/view/Documentation/AdminGuide/Attachments#HAttachmentdisplayordownload

### References
https://jira.xwiki.org/browse/XWIKI-18368

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira](http://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Generation of Error Message Containing Sensitive Information in keybloack
Advisory: GHSA-rvfc-g8j5-9ccf
Aliases: CVE-2020-1717
Published: 2022-02-09T00:59:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
Improper Access Control in infinispan-server-runtime
Advisory: GHSA-8674-26jc-wh98
Aliases: CVE-2020-25711
Published: 2022-02-09T22:56:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.
TLS certificate validation error in mellium.im/xmpp
Advisory: GHSA-m658-p24x-p74r
Aliases: CVE-2022-24968
Published: 2022-02-12T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

In Mellium mellium.im/xmpp through 0.21.0, an attacker capable of spoofing DNS TXT records can redirect a WebSocket connection request to a server under their control without causing TLS certificate verification to fail. This occurs because the wrong host name is selected during this verification.
Path Traversal in Eclipse Vert
Advisory: GHSA-vjw7-6gfq-6wf5
Aliases: CVE-2019-17640
Published: 2022-02-10T20:28:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Eclipse Vert.x 3.4.x up to 3.9.4, 4.0.0-milestone1, 4.0.0-milestone2, 4.0.0-milestone3, 4.0.0-milestone4, 4.0.0-milestone5, 4.0.0.Beta1, 4.0.0.Beta2, and 4.0.0.Beta3, StaticHandler doesn't correctly processes back slashes on Windows Operating systems, allowing, escape the webroot folder to the current working directory.
Stored Cross-site Scripting vulnerability in Jenkins Custom Checkbox Parameter Plugin
Advisory: GHSA-6q8r-5pm6-v2q8
Aliases: CVE-2022-25189
Published: 2022-02-16T00:01:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Custom Checkbox Parameter Plugin 1.1 and earlier does not escape parameter names of custom checkbox parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
OS Command Injection in jscover
Advisory: GHSA-c5hm-xc74-pqrg
Aliases: CVE-2020-7623
Published: 2022-02-10T23:37:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-vvw4-rfwf-p6hx
Aliases: CVE-2020-17527
Published: 2022-02-09T22:58:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
Missing permission check in Jenkins Conjur Secrets Plugin allows enumerating credentials IDs
Advisory: GHSA-372f-jc47-7gr5
Aliases: CVE-2022-25190
Published: 2022-02-16T00:01:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Conjur Secrets Plugin 1.0.11 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
TwitterServer Cross-site Scripting via /histograms endpoint
Advisory: GHSA-3mqv-8gxg-pfm4
Aliases: CVE-2020-35774
Published: 2022-02-09T22:37:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
Istio may not check inbound TCP connections against istio-policy
Advisory: GHSA-6g5f-f5pm-mjrg
Aliases: CVE-2019-12243
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:H/RL:O/RC:C

Istio 1.1.x through 1.1.6 has Incorrect Access Control. When `disablePolicyChecks` is set to `false`, inbound TCP connections do not generate Check requests to istio-policy and external authorization is not applied.

This behavior is a result of a change to `istio/pilot/pkg/networking/plugin/mixer/mixer.go` in 1.1.
SQL Injection in Jeecg-boot
Advisory: GHSA-vh2r-x97c-2vpr
Aliases: CVE-2022-22880
Published: 2022-02-17T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jeecg-boot v3.0 was discovered to contain a SQL injection vulnerability via the code parameter in /jeecg-boot/sys/user/queryUserByDepId.
Missing Authorization in Jenkins dbCharts Plugin
Advisory: GHSA-m5wp-p3gj-7q5g
Aliases: CVE-2022-25206
Published: 2022-02-16T00:01:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A missing check in Jenkins dbCharts Plugin 0.5.2 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified database via JDBC using attacker-specified credentials.
Cross-site Scripting in microweber
Advisory: GHSA-jjvm-3mfq-7gc7
Aliases: CVE-2022-0506
Published: 2022-02-09T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

microweber version 1.2.10 and prior is vulnerable to cross-site scripting.
Injection and Improper Input Validation in Apache Unomi
Advisory: GHSA-xp5j-wj4h-2jq9
Aliases: CVE-2020-13942
Published: 2022-02-10T00:30:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.
Out of bounds read in json-smart
Advisory: GHSA-fg2v-w576-w4v3
Aliases: CVE-2021-31684
Published: 2022-02-10T22:46:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was discovered in the indexOf function of JSONParserByteArray in JSON Smart versions prior to 1.3.3 and 2.4.5 which causes a denial of service (DOS) via a crafted web request.
Cross-site Scripting in microweber
Advisory: GHSA-wmj9-xh24-j4gx
Aliases: CVE-2022-0558
Published: 2022-02-11T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Division by zero in Tensorflow
Advisory: GHSA-87v6-crgm-2gfj
Aliases: CVE-2022-21735
Published: 2022-02-10T00:21:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact 
The [implementation of `FractionalMaxPool`](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/fractional_max_pool_op.cc#L36-L192) can be made to crash a TensorFlow process via a division by 0:

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.FractionalMaxPool(
  value=tf.constant(value=[[[[1, 4, 2, 3]]]], dtype=tf.int64),
  pooling_ratio=[1.0, 1.44, 1.73, 1.0],
  pseudo_random=False,
  overlapping=False,
  deterministic=False,
  seed=0,
  seed2=0,
  name=None)
```

### Patches
We have patched the issue in GitHub commit [ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb](https://github.com/tensorflow/tensorflow/commit/ba4e8ac4dc2991e350d5cc407f8598c8d4ee70fb).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.
Link Following in Kata Runtime
Advisory: GHSA-877x-32pm-p28x
Aliases: CVE-2020-2026
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.
Chrono has potential segfault issue in SPIFFE authenticator
Advisory: GHSA-45w3-v3g4-54pm
Published: 2022-02-11T19:11:36Z

### Impact
Several vulnerabilities have been reported in the `time` and `chrono` crates related to handling of calls to `localtime_r`. You can follow some of the discussions [here](https://github.com/chronotope/chrono/issues/602) and [here](https://github.com/time-rs/time/issues/293), and the associated CVE [here](https://nvd.nist.gov/vuln/detail/CVE-2020-26235). In our case, the issue with the dependency was flagged by our nightly CI build running [`cargo-audit`](https://github.com/parallaxsecond/parsec/issues/544). 

The vulnerability leads to a segfault in specific circumstances - namely, when one of a number of functions in the `time` crate is called while any other thread is setting an environment variable. Given that in the case of the Parsec service this affects the SPIFFE authenticator, Parsec service users can encounter the issue only when the JWT SVID authenticator is enabled and being used. We have not undergone any manual tracing to understand if the vulnerable methods are called anywhere in our stack, however it seems reasonable to expect that if that were to be the case, the issue would lie in JWT validation (i.e. when handling the dates found within a Json Web Token). JWT validation could thus fail, bringing down the thread in which the request happens. The rest of the threads continue to work. Since the threadpool implementation that we use [continues replenishing the pool](https://docs.rs/threadpool/latest/threadpool/) when one thread panics, the impact on the service should be minimal.

### Patches
No current patches exist as the problems lie in a number of dependencies that are not under our control (see more details [here](https://github.com/parallaxsecond/parsec/issues/544#issuecomment-1024185688)).

The issue tracking the required change in the `rust-spiffe` crate (through which the vulnerable dependencies are imported in Parsec) can be seen [here](https://github.com/maxlambrecht/rust-spiffe/issues/17). Once updates happen in our dependency chain that allow us to update beyond the vulnerable versions of `time` and `chrono`, a new version of the Parsec service will be tagged and released with the appropriate notifications.

### Workarounds
The only complete workaround is to use a different type of authenticator with the Parsec service. 

### References
As quoted in the initial paragraph, you can find out more information:
* in the `chrono` repo issue [here](https://github.com/chronotope/chrono/issues/602)
* in the `time` repo issue [here](https://github.com/time-rs/time/issues/293)
* in the official CVE report [here](https://nvd.nist.gov/vuln/detail/CVE-2020-26235)
* in our tracking issue [here](https://github.com/parallaxsecond/parsec/issues/544)

### For more information:
If you have any questions or comments about this advisory:
* Open an issue in [the Parsec service repo](https://github.com/parallaxsecond/parsec)
* Email us at [cncf-parsec-maintainers@lists.cncf.io](mailto:cncf-parsec-maintainers@lists.cncf.io)
Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server
Advisory: GHSA-8wrg-m8vm-5fvj
Aliases: CVE-2021-21403
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact

Authentication Bypass by Primary Weakness (CWE-305)

Commit:

https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1

ALL Users  is impacted.

### Patches

Yes, PLEASE UPGRADE TO v1.3.21-beta.d0ffc0a6
Division by zero in TFLite
Advisory: GHSA-gf2j-f278-xh4v
Aliases: CVE-2022-23557
Published: 2022-02-09T23:47:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact 
An attacker can craft a TFLite model that would trigger a division by zero in [`BiasAndClamp` implementation](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/lite/kernels/internal/common.h#L75):

```cc
inline void BiasAndClamp(float clamp_min, float clamp_max, int bias_size,
                         const float* bias_data, int array_size,
                         float* array_data) {
  // ...
  TFLITE_DCHECK_EQ((array_size % bias_size), 0);
  // ...
} 
```
  
There is no check that the `bias_size` is non zero.
  
### Patches
We have patched the issue in GitHub commit [8c6f391a2282684a25cbfec7687bd5d35261a209](https://github.com/tensorflow/tensorflow/commit/8c6f391a2282684a25cbfec7687bd5d35261a209).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Wang Xuan of Qihoo 360 AIVul Team.
Publify Business Logic Errors
Advisory: GHSA-x3rq-r3cm-5vc4
Aliases: CVE-2022-0524
Published: 2022-02-09T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Publify (formerly known as Typo) prior to version 9.2.7 is vulnerable to business logic errors.
Unencrypted md5 plaintext hash in metadata in AWS S3 Crypto SDK for golang
Advisory: GHSA-76wf-9vgp-pj7w
Published: 2022-02-11T23:26:12Z

### Summary

The golang AWS S3 Crypto SDK was impacted by an issue that can result in loss of confidentiality. An attacker with read access to an encrypted S3 bucket was able to recover the plaintext without accessing the encryption key.

### Risk/Severity

The vulnerability poses insider risks/privilege escalation risks, circumventing KMS controls for stored data.

### Impact

The issue has been fully mitigated by AWS as of Aug. 5th by disallowing the header in question.

The S3 crypto library tries to store an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plaintext in an offline attack, if the hash is readable to the attacker. In order to be impacted by this issue, the attacker has to be able to guess the plaintext as a whole. The attack is theoretically valid if the plaintext entropy is below the key size, i.e. if it is easier to brute force the plaintext instead of the key itself, but practically feasible only for short plaintexts or plaintexts otherwise accessible to the attacker in order to create a rainbow table.

The issue has been fixed server-side by AWS as of Aug 5th, by blocking the related metadata field. No S3 objects are affected anymore.

### Mitigation

The header in question is no longer served by AWS, making this attack fully mitigated as of Aug. 5th.

### Proof of concept

A [Proof of concept](https://github.com/sophieschmieg/exploits/tree/master/aws_s3_crypto_poc) is available in a separate github repository, this particular issue can be found at [here](https://github.com/sophieschmieg/exploits/blob/master/aws_s3_crypto_poc/exploit/hash_exploit.go):

```golang
func HashExploit(bucket string, key string, input *OfflineAttackInput) (string, error) {
	_, header, err := input.S3Mock.GetObjectDirect(bucket, key)
	length, err := strconv.Atoi(header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Length"))
	plaintextMd5 := header.Get("X-Amz-Meta-X-Amz-Unencrypted-Content-Md5")
	blocks := length / 16
	possiblePlaintextNum := 1
	segNum := len(input.PossiblePlaintextSegments)
	for i := 0; i < blocks; i++ {
		possiblePlaintextNum *= segNum
	}
	for i := 0; i < possiblePlaintextNum; i++ {
		w := i
		guess := ""
		for j := 0; j < blocks; j++ {
			guess += input.PossiblePlaintextSegments[w%segNum]
			w /= segNum
		}
		guessMd5 := md5.Sum([]byte(guess))
		if plaintextMd5 == base64.StdEncoding.EncodeToString(guessMd5[:]) {
			return guess, nil
		}
	}
	return "", fmt.Errorf("No plaintext found!")
}
```

The PoC will only work on old versions of the library, as the hash has been removed from being calculated as well.
Unrestricted Upload of File with Dangerous Type in motionEye
Advisory: GHSA-m2c7-42rf-c62f
Aliases: CVE-2021-44255
Published: 2022-02-01T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

motionEye <= 0.42.1 and motioneEyeOS <= 20200606 allow a remote attacker to upload a configuration backup file containing a malicious python pickle file. This is possible when an installation is accessible over the Internet and uses no or poor authentication credentials.

The GitHub repositories for motionEye and motionEyeOS are no longer being actively maintained as of January 2022, so release of a patched version is unlikely. Keeping a motionEye or motionEyeOS installation off of the Internet and/or using strong credentials provide protection against this issue.
Unauthenticated control plane denial of service attack in Istio
Advisory: GHSA-856q-xv3c-7f2f
Aliases: CVE-2022-23635
Published: 2022-02-23T14:59:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The Istio control plane, `istiod`, is vulnerable to a request processing error, allowing a malicious attacker that sends a specially crafted message which results in the control plane crashing. This endpoint is served over TLS port 15012, but does not require any authentication from the attacker.

For simple installations, Istiod is typically only reachable from within the cluster, limiting the blast radius. However, for some deployments, especially [multicluster](https://istio.io/latest/docs/setup/install/multicluster/primary-remote/) topologies, this port is exposed over the public internet.

### Patches

- Istio 1.13.1 and above
- Istio 1.12.4 and above
- Istio 1.11.7 and above

### Workarounds
There are no effective workarounds, beyond upgrading. Limiting network access to Istiod to the minimal set of clients can help lessen the scope of the vulnerability to some extent.

### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2022-003)

### For more information
If you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)
Arbitrary Code Execution in Handlebars
Advisory: GHSA-3cqr-58rm-57f8
Aliases: CVE-2019-20920
Published: 2022-02-10T20:38:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:L

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Denial of service in Grafana
Advisory: GHSA-h5rh-w6vm-9ghc
Aliases: CVE-2021-27358
Published: 2022-02-15T01:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H/E:U/RL:O/RC:R

The snapshot feature in Grafana before 7.4.2 can allow an unauthenticated remote attackers to trigger a Denial of Service via a remote API call if a commonly used configuration is set.
Prototype Pollution in @strikeentco/set
Advisory: GHSA-39qv-prmh-x37f
Aliases: CVE-2021-23497
Published: 2022-02-05T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This affects the package @strikeentco/set before 1.0.2. It allows an attacker to cause a denial of service and may lead to remote code execution. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-STRIKEENTCOSET-1038821
Uncontrolled Recursion in Play Framework
Advisory: GHSA-p8p6-rcp6-4mrm
Aliases: CVE-2020-26883
Published: 2022-02-10T20:23:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Play Framework 2.6.0 through 2.8.2, stack consumption can occur because of unbounded recursion during parsing of crafted JSON documents.
Code injection in Twig
Advisory: GHSA-5mv2-rx3q-4w2v
Aliases: CVE-2022-23614
Published: 2022-02-10T22:21:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

# Description

When in a sandbox mode, the `arrow` parameter of the `sort` filter must be a closure to avoid attackers being able to run arbitrary PHP functions.

# Resolution

We now disallow calling non Closure in the `sort` filter like we already did for some other filters.

# Credits

We would like to thank Marlon Starkloff for reporting the issue and Fabien Potencier for fixing the issue.
Request logging bypass in Jenkins Audit Trail Plugin
Advisory: GHSA-rpj6-2q8r-98f8
Aliases: CVE-2020-2287
Published: 2022-02-10T20:29:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Audit Trail Plugin logs requests whose URL path matches an admin-configured regular expression.\n\nA discrepancy between the behavior of the plugin and the Stapler web framework in parsing URL paths allows attackers to craft URLs that would bypass request logging in Audit Trail Plugin 3.6 and earlier. This only applies to Jenkins 2.227 and earlier, LTS 2.204.5 and earlier, as the fix for [SECURITY-1774](https://www.jenkins.io/security/advisory/2020-03-25/#SECURITY-1774) prohibits dispatch of affected requests.\n\nAudit Trail Plugin 3.7 processes request URL paths the same way as the Stapler web framework.