aswin1906/github-advisory-2022 huggingface dataset:
Exposure of Sensitive Information to an Unauthorized Actor in MongoDB Rust Driver
Advisory: GHSA-4rjr-3gj2-5crq
Aliases: CVE-2021-20332
Published: 2022-05-24T19:09:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Specific MongoDB Rust Driver versions can include credentials used by the connection pool to authenticate connections in the monitoring event that is emitted when the pool is created. The user's logging infrastructure could then potentially ingest these events and unexpectedly leak the credentials. Note that such monitoring is not enabled by default.
DNS based denial of service in Apache Wicket
Advisory: GHSA-hmhg-95wh-r699
Aliases: CVE-2021-23937
Published: 2022-05-24T19:03:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A DNS proxy and possible amplification attack vulnerability in WebClientInfo of Apache Wicket allows an attacker to trigger arbitrary DNS lookups from the server when the X-Forwarded-For header is not properly sanitized. This DNS lookup can be engineered to overload an internal DNS server or to slow down request processing of the Apache Wicket application causing a possible denial of service on either the internal infrastructure or the web application itself. This issue affects Apache Wicket Apache Wicket 9.x version 9.2.0 and prior versions; Apache Wicket 8.x version 8.11.0 and prior versions; Apache Wicket 7.x version 7.17.0 and prior versions and Apache Wicket 6.x version 6.2.0 and later versions.
ChakraCore RCE Vulnerability
Advisory: GHSA-wcvc-rhfj-997g
Aliases: CVE-2016-7203
Published: 2022-05-14T02:22:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7202, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
Stored XSS vulnerability in Jenkins button labels
Advisory: GHSA-wv63-gwr9-5c55
Aliases: CVE-2021-21608
Published: 2022-05-24T17:39:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape button labels in the Jenkins UI.

This results in a cross-site scripting vulnerability exploitable by attackers with the ability to control button labels. An example of buttons with a user-controlled label are the buttons of the Pipeline `input` step.

Jenkins 2.275, LTS 2.263.2 escapes button labels in the Jenkins UI.
SimpleXML vulnerable to XML External Entity (XXE)
Advisory: GHSA-f5qf-vh69-9q4r
Aliases: CVE-2017-1000190
Published: 2022-05-14T00:55:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability resulting SSRF, information disclosure, DoS and so on.
Improper Input Validation in Apache Tomcat
Advisory: GHSA-6gjj-c5mj-4cvp
Aliases: CVE-2014-0033
Published: 2022-05-14T01:10:35Z

org/apache/catalina/connector/CoyoteAdapter.java in Apache Tomcat 6.0.33 through 6.0.37 does not consider the disableURLRewriting setting when handling a session ID in a URL, which allows remote attackers to conduct session fixation attacks via a crafted URL.
Cross-site Scripting in Gogs
Advisory: GHSA-ff28-f46g-r9g8
Aliases: CVE-2022-1464
Published: 2022-05-24T20:48:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

### Impact

The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations [allow uploading SVG (`text/xml`) files as issue attachments (non-default)](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284) are affected.

### Patches

Correctly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev.

### Workarounds

[Disable uploading SVG files (`text/xml`) as issue attachments](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284).

### References

https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.
Prototype pollution in @strikeentco/set
Advisory: GHSA-wwg2-2crq-6grr
Aliases: CVE-2020-28267
Published: 2022-05-24T17:34:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
Incorrect Authorization in Jenkins
Advisory: GHSA-7r4h-2h23-6jq9
Aliases: CVE-2017-2599
Published: 2022-05-13T01:12:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permissions to create new items (e.g. jobs) to overwrite existing items they don't have access to (SECURITY-321).
Keycloak Authentication Error
Advisory: GHSA-jf86-9434-f8c2
Aliases: CVE-2019-14910
Published: 2022-05-24T17:02:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.
Silverstripe CMS User Enumeration 
Advisory: GHSA-fwhr-g5r4-xgxf
Aliases: CVE-2017-12849
Published: 2022-05-17T00:28:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Response discrepancy in the login and password reset forms in SilverStripe CMS before 3.5.5 and 3.6.x before 3.6.1 allows remote attackers to enumerate users via timing attacks.
Jenkins vSphere Plugin disables SSL/TLS certificate validation by default
Advisory: GHSA-vq7p-f4fv-rr5x
Aliases: CVE-2018-1000151
Published: 2022-05-14T03:23:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

A man in the middle vulnerability exists in Jenkins vSphere Plugin 2.16 and older in VSphere.java that disables SSL/TLS certificate validation by default. vSphere Plugin 2.17 now has SSL/TLS certificate validation enabled by default.
Improper Privilege Management in craftercms
Advisory: GHSA-fj9v-g8fw-vxmf
Aliases: CVE-2021-23265
Published: 2022-05-17T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

A logged-in and authenticated user with a Reviewer Role may lock a content item.
Katello cleartext password storage issue
Advisory: GHSA-m4wh-848j-9w2r
Aliases: CVE-2019-14825
Published: 2022-05-24T17:01:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.2. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.
Denial of service in `tf.ragged.constant` due to lack of validation
Advisory: GHSA-cwpm-f78v-7m5c
Aliases: CVE-2022-29202
Published: 2022-05-24T22:10:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.ragged.constant`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/python/ops/ragged/ragged_factory_ops.py#L146-L239) does not fully validate the input arguments. This results in a denial of service by consuming all available memory:

```python
import tensorflow as tf
tf.ragged.constant(pylist=[],ragged_rank=8968073515812833920)
```
  
### Patches
We have patched the issue in GitHub commit [bd4d5583ff9c8df26d47a23e508208844297310e](https://github.com/tensorflow/tensorflow/commit/bd4d5583ff9c8df26d47a23e508208844297310e).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/55199).
Eugene Pankov Ajenti Cross-site scripting Vulnerabilities
Advisory: GHSA-2ch8-f849-pjg3
Aliases: CVE-2014-4301
Published: 2022-05-17T03:49:34Z

Multiple cross-site scripting (XSS) vulnerabilities in the `respond_error` function in `routing.py` in Eugene Pankov Ajenti before 1.2.21.7 allow remote attackers to inject arbitrary web script or HTML via the `PATH_INFO` to (1) `resources.js` or (2) resources.css in `ajenti:static/`, related to the traceback page.
phpMyAdmin XSS Vulnerability
Advisory: GHSA-3q28-xfw3-2q35
Aliases: CVE-2016-5732
Published: 2022-05-17T02:37:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in the partition-range implementation in `templates/table/structure/display_partitions.phtml` in the table-structure page in phpMyAdmin 4.6.x before 4.6.3 allow remote attackers to inject arbitrary web script or HTML via crafted table parameters.
Arbitrary code execution in Apache Struts 2
Advisory: GHSA-pw8r-x2qm-3h5m
Aliases: CVE-2013-2135
Published: 2022-05-14T01:57:01Z

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
Cross-site Scripting in Jenkins Core
Advisory: GHSA-9jcv-v4jp-w3cq
Aliases: CVE-2018-1000170
Published: 2022-05-14T01:04:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability exists in Jenkins 2.115 and older, LTS 2.107.1 and older, in confirmationList.jelly and stopButton.jelly that allows attackers with Job/Configure and/or Job/Create permission to create an item name containing JavaScript that would be executed in another user's browser when that other user performs some UI actions.
Typo3 Vulnerable to Insecure Deserialization
Advisory: GHSA-86hp-xrhj-fhpq
Aliases: CVE-2019-12747
Published: 2022-05-24T22:00:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.
Concurrent Execution using Shared Resource with Improper Synchronization in pyftpdlib
Advisory: GHSA-hw4g-fhcp-x5mq
Aliases: CVE-2010-3494
Published: 2022-05-17T05:47:39Z

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.
Drupal improper access restrictions
Advisory: GHSA-vpm6-h53m-x2xf
Aliases: CVE-2012-2153
Published: 2022-05-17T04:56:41Z

Drupal 7.x before 7.14 does not properly restrict access to nodes in a list when using a "contributed node access module," which allows remote authenticated users with the "Access the content overview page" permission to read all published nodes by accessing the admin/content page.
phpMyAdmin Remote Code Execution
Advisory: GHSA-gg36-9346-9qx9
Aliases: CVE-2013-3239
Published: 2022-05-17T04:58:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a SaveDir directory is configured, allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file, leading to interpretation of this file as an executable file by the Apache HTTP Server, as demonstrated by a .php.sql filename.
Stored XSS vulnerability in Validating String Parameter Plugin
Advisory: GHSA-fvwh-wv43-8qj5
Aliases: CVE-2020-2257
Published: 2022-05-24T17:28:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Validating String Parameter Plugin 2.4 and earlier does not escape regular expressions in tooltips. Additionally, Validating String Parameter Plugin 2.4 does not escape parameter names and parameter descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Validating String Parameter Plugin 2.5 escapes regular expressions in tooltips and parameter names. Parameter descriptions are rendered using the configured markup formatter.
RubyGems Improper Input Validation vulnerability
Advisory: GHSA-gv86-43rv-79m2
Aliases: CVE-2018-1000077
Published: 2022-05-14T01:01:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem setting an invalid homepage URL. This vulnerability is fixed in 2.7.6.
ChakraCore RCE Vulnerability
Advisory: GHSA-jv5x-p843-g4qr
Aliases: CVE-2018-8229
Published: 2022-05-13T01:20:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8227.
Jenkins Ansible Plugin man in the middle vulnerability
Advisory: GHSA-322x-jv5h-cvjh
Aliases: CVE-2018-1000149
Published: 2022-05-13T01:18:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

A man in the middle vulnerability exists in Jenkins Ansible Plugin 0.8 and older in `AbstractAnsibleInvocation.java`, `AnsibleAdHocCommandBuilder.java`, `AnsibleAdHocCommandInvocationTest.java`, `AnsibleContext.java`, `AnsibleJobDslExtension.java`, `AnsiblePlaybookBuilder.java`, `AnsiblePlaybookStep.java` that disables host key verification by default. Ansible Plugin 1.0 now enables host key verification by default, adding options allowing users to opt out.
Denial of service in Apache Mesos
Advisory: GHSA-x869-784m-jmj2
Aliases: CVE-2017-7687
Published: 2022-05-13T01:47:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Cross-site Scripting in LimeSurvey
Advisory: GHSA-r5f2-4wf4-cv66
Aliases: CVE-2019-16173
Published: 2022-05-24T16:55:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

LimeSurvey before v3.17.14 allows reflected XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. This occurs in application/core/Survey_Common_Action.php,
Improper Access Control in MySQL Connector Python
Advisory: GHSA-v5rq-w2xm-7g5f
Aliases: CVE-2019-2435
Published: 2022-05-13T01:22:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data.
.NET Core Remote Code Execution Vulnerability
Advisory: GHSA-rxg9-xrhp-64gj
Aliases: CVE-2021-24112
Published: 2022-05-24T17:43:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists when parsing certain types of graphics files. This vulnerability only exists on systems running on MacOS or Linux. This CVE ID is unique from CVE-2021-26701.
Subrion CMS CSRF Vulnerability
Advisory: GHSA-rc94-7v55-wmg6
Aliases: CVE-2017-15063
Published: 2022-05-14T02:01:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

There are CSRF vulnerabilities in Subrion CMS 4.1.x through 4.1.5, and before 4.2.0, because of a logic error. Although there is functionality to detect CSRF, it is called too late in the ia.core.php code, allowing (for example) an attack against the query parameter to panel/database.
CSRF in baserCMS 3.0.10 and earlier
Advisory: GHSA-397g-4jpj-44xg
Aliases: CVE-2016-4879
Published: 2022-05-13T01:28:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site request forgery (CSRF) vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Magento 2 Community Edition SSRF vulnerability
Advisory: GHSA-775w-gx3f-4j4f
Aliases: CVE-2019-8156
Published: 2022-05-24T17:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.
RubyGems Link Following vulnerability
Advisory: GHSA-gx69-6cp4-hxrj
Aliases: CVE-2018-1000073
Published: 2022-05-13T01:18:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in `install_location` function of `package.rb` that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6.
Unauthenticated File Read in PHP Proxy
Advisory: GHSA-3x3m-p2wx-g7cw
Aliases: CVE-2018-19458
Published: 2022-05-14T01:48:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In PHP Proxy 3.0.3, any user can read files from the server without authentication due to an `index.php?q=file:///` LFI URI, a different vulnerability than CVE-2018-19246.
Improper Neutralization of Special Elements used in an SQL Command  Pivotal Spring Data JPA
Advisory: GHSA-xr4v-28rm-pvgw
Aliases: CVE-2016-6652
Published: 2022-05-17T02:37:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-qjq9-wx5j-jrg6
Aliases: CVE-2017-17971
Published: 2022-05-14T03:50:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS.
XXE in SabreDAV before 1.7.11
Advisory: GHSA-qm4x-ch5w-gr62
Aliases: CVE-2014-2055
Published: 2022-05-17T04:42:42Z

SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.
Use after free in Apache Mesos
Advisory: GHSA-vpcv-78cp-whr3
Aliases: CVE-2017-9790
Published: 2022-05-13T01:48:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
OpenStack Image Service (Glance) allows remote authenticated users to bypass storage quota, cause denial of service
Advisory: GHSA-gvjg-r9fv-7qx9
Aliases: CVE-2015-5286
Published: 2022-05-17T03:44:52Z

OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allows remote authenticated users to bypass the storage quota and cause a denial of service (disk consumption) by deleting images that are being uploaded using a token that expires during the process.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9623.
Reversible One-Way Hash in io.github.javaezlib:JavaEZ
Advisory: GHSA-67fj-6w6m-w5j8
Aliases: CVE-2022-29249
Published: 2022-05-25T22:34:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
This weakness allows the force decryption of locked text by hackers. The issue is NOT critical for non-secure applications, however may be critical in a situation where the highest levels of security are required. This issue ONLY affects v1.6 and does not affect anything pre-1.6. Upgrading to 1.7 is advised.

### Patches
The vulnerability has been patched in release 1.7.

### Workarounds
Currently there is no way to fix the issue without upgrading.

### References
[CWE-327](https://cwe.mitre.org/data/definitions/327.html)
[CWE-328](https://cwe.mitre.org/data/definitions/328.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](http://github.com/JavaEZLib/JavaEZ/issues)
* Email us at [javaezlib@gmail.com](mailto:javaezlib@gmail.com)
Moodle XSS Vulnerability
Advisory: GHSA-595j-wpfg-23w4
Aliases: CVE-2018-1045
Published: 2022-05-14T03:46:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Moodle 3.x, there is XSS via a calendar event name.
Sandbox Bypass in Script Security Plugin
Advisory: GHSA-x5jm-rj37-5qh7
Aliases: CVE-2019-1003005
Published: 2022-05-13T01:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.50 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to provide a Groovy script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
Improper Limitation of a Pathname to a Restricted Directory in zt-zip
Advisory: GHSA-qcf3-9vmh-xw4r
Aliases: CVE-2018-1002201
Published: 2022-05-13T01:30:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

zt-zip before 1.13 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
ChakraCore RCE Vulnerability
Advisory: GHSA-448h-7hmp-99fg
Aliases: CVE-2017-0223
Published: 2022-05-17T02:35:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka "Scripting Engine Memory Corruption Vulnerability". This vulnerability is unique from CVE-2017-0252.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-v5m6-2m78-4vr2
Aliases: CVE-2019-7877
Published: 2022-05-24T16:52:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manage orders can inject malicious javascript.
Improper Access Control in Apache Tomcat
Advisory: GHSA-v646-rx6w-r3qq
Aliases: CVE-2016-5388
Published: 2022-05-13T01:23:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
Missing permission checks in Jenkins Azure Key Vault Plugin allow enumerating credentials IDs
Advisory: GHSA-gf8w-6hcm-rh3j
Aliases: CVE-2020-2313
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Azure Key Vault Plugin 2.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Azure Key Vault Plugin 2.1 requires the appropriate permissions.
XXE vulnerability in Jenkins Cobertura Plugin
Advisory: GHSA-vpfj-5gg5-fvfm
Aliases: CVE-2020-2138
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Cobertura Plugin 1.15 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for the 'Publish Cobertura Coverage Report' post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Cobertura Plugin 1.16 disables external entity resolution for its XML parser.
DNN XSS Vulnerability
Advisory: GHSA-m6w9-8cxc-jff7
Aliases: CVE-2018-14486
Published: 2022-05-14T01:17:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

DNN (formerly DotNetNuke) 9.1.1 allows cross-site scripting (XSS) via XML.
Privilege escalation for users with create/update permissions in Global Roles in Rancher
Advisory: GHSA-jwvr-vv7p-gpwq
Aliases: CVE-2021-36784
Published: 2022-05-02T19:39:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

### Impact
This vulnerability affects customers who utilize non-admin users that are able to create or edit [Global Roles](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/). The most common use case for this scenario is the [`restricted-admin`](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/global-permissions/#restricted-admin) role.

A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and including 2.6.3 which allows users who have create or update permissions on Global Roles to escalate their permissions, or those of another user, to admin-level permissions. Global Roles grant users Rancher-wide permissions, such as the ability to create clusters. In the identified versions of Rancher, when users are given permission to edit or create Global Roles, they are not restricted to only granting permissions which they already posses.

The privilege escalation can be taken advantage of in two ways by users with create or update permissions on Global Roles (including the `restricted-admin`):

1. Editing the global `admin` role to make it the default for new users, then creating a new user that will be elevated to the global `admin` role.
2. Creating a new global role with permissions already possessed by the `restricted-admin`, assigning this new role to a user, then modifying the global role to grant additional administrive like permissions (`'*'`) to the elevated user.

### Patches
Patched versions include releases 2.5.13, 2.6.4 and later versions.

### Workarounds
Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.

**Note:** If you have users who have create or edit permissions on Global Roles but are not admin users (for example, the `restricted-admin`), it is highly advised to review the roles and users created by those users for possible privilege escalations.

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
Denial of service in Spring Framework
Advisory: GHSA-hh26-6xwr-ggv7
Aliases: CVE-2022-22970
Published: 2022-05-13T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, applications that handle file uploads are vulnerable to DoS attack if they rely on data binding to set a MultipartFile or javax.servlet.Part to a field in a model object.
Jenkins 360 FireLine Plugin vulnerable to XML External Entity Reference
Advisory: GHSA-346g-jrx9-jgf4
Aliases: CVE-2019-10466
Published: 2022-05-24T16:59:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

An XML external entities (XXE) vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks.

## Note: Jenkins has suspended distribution of this plugin.
Missing permission check in Jenkins Gerrit Trigger Plugin
Advisory: GHSA-4r39-f4rh-j6q8
Aliases: CVE-2019-16552
Published: 2022-05-24T17:03:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A missing permission check in Jenkins Gerrit Trigger Plugin 2.30.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master.
Improper Neutralization of Input During Web Page Generation in Jupyter Notebook
Advisory: GHSA-4vwq-x64q-j4cj
Aliases: CVE-2015-6938
Published: 2022-05-14T02:04:49Z

Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.
Pimcore CSRF Vulnerability
Advisory: GHSA-gmff-vcv6-mmfr
Aliases: CVE-2018-14057
Published: 2022-05-14T02:36:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Pimcore before 5.3.0 allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging validation of the `X-pimcore-csrf-token` anti-CSRF token only in the "Settings > Users / Roles" function.
Improper Input Validation in Apache Qpid AMQP 0-x JMS
Advisory: GHSA-f38p-mq64-h784
Aliases: CVE-2016-4974
Published: 2022-05-14T02:46:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.
Stored XSS vulnerability in Jenkins FitNesse Plugin
Advisory: GHSA-f6vx-3fq6-hxm8
Aliases: CVE-2020-2175
Published: 2022-05-24T17:13:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

FitNesse Plugin 1.31 and earlier does not correctly escape report contents before showing them on the Jenkins UI.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to control the XML input files processed by the plugin.

FitNesse Plugin 1.33 escapes content from XML input files before rendering it on the Jenkins UI.
Cross-Site Request Forgery in Jenkins
Advisory: GHSA-hcxf-rq72-h4rr
Aliases: CVE-2019-10353
Published: 2022-05-24T16:50:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CSRF tokens in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier did not expire, thereby allowing attackers able to obtain them to bypass CSRF protection.
Buffer over-flow in Pillow
Advisory: GHSA-hr8g-f6r6-mr22
Aliases: CVE-2022-30595
Published: 2022-05-26T00:01:27Z

When reading a TGA file with RLE packets that cross scan lines, Pillow reads the information past the end of the first line without deducting that from the length of the remaining file data. This vulnerability was introduced in Pillow 9.1.0, and can cause a heap buffer overflow.

Opening an image with a zero or negative height has been found to bypass a decompression bomb check. This will now raise a SyntaxError instead, in turn raising a PIL.UnidentifiedImageError.
Cross-site Scripting in jquery.json-viewer
Advisory: GHSA-qp2q-6h9j-jg2r
Aliases: CVE-2022-30241
Published: 2022-05-05T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The jquery.json-viewer library before version 1.5.0 for Node.js does not properly escape characters such as < in a JSON object, as demonstrated by a SCRIPT element.
Microweber XSS Vulnerability
Advisory: GHSA-xmcr-x5x3-gjfx
Aliases: CVE-2018-1000826
Published: 2022-05-14T01:40:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.
Account takeover in facturascripts
Advisory: GHSA-vjq3-x3f2-fvxq
Aliases: CVE-2022-1715
Published: 2022-05-14T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.08 due to improper type casting.
Improper Input Validation in k8s.io/ingress-nginx
Advisory: GHSA-pvmg-xgmx-9mxh
Aliases: CVE-2021-25745
Published: 2022-05-07T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.
Malware in ctx
Advisory: GHSA-4g82-3jcr-q52w
Published: 2022-05-25T23:09:55Z

The `ctx` hosted project on [PyPI](https://pypi.org/project/ctx/) was taken over via user account compromise and replaced with a malicious project which contained runtime code that collected the content of `os.environ.items()` when instantiating `Ctx` objects. The captured environment variables were sent as a base64 encoded query parameter to a heroku application running at `https://anti-theft-web.herokuapp.com`.

If you installed the package between May 14, 2022 and May 24, 2022, and your environment variables contain sensitive data like passwords and API keys (like `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY`), we advise you to rotate your passwords and keys, then perform an audit to determine if they were exploited.
Wizkunde SAMLBase SAML Bypass
Advisory: GHSA-7gh2-8q93-87hp
Aliases: CVE-2018-5387
Published: 2022-05-13T01:02:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Jenkins Gitlab Authentication Plugin vulnerable to Session Fixation
Advisory: GHSA-682g-c99v-9r2g
Aliases: CVE-2019-10371
Published: 2022-05-24T16:52:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

GitLab Authentication Plugin does not invalidate the previous session and create a new one upon successful login. This allows attackers able to control or obtain another user’s pre-login session ID to impersonate them.

As of publication of this advisory, there is no fix.
RubyGems may allow a maliciously crafted gem to overwrite files
Advisory: GHSA-pm9x-4392-2c2p
Aliases: CVE-2017-0901
Published: 2022-05-13T01:38:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.
Keycloak CSRF Vulnerability
Advisory: GHSA-7fmw-85qm-h22p
Aliases: CVE-2017-12159
Published: 2022-05-13T01:38:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
SQL Injection in Zenario 7.1-7.6
Advisory: GHSA-jf5f-h3wr-j666
Aliases: CVE-2018-5960
Published: 2022-05-13T01:28:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Zenario v7.1 - v7.6 has SQL injection via the `Name` input field of organizer.php or admin_boxes.ajax.php in the `Categories - Edit` module.
Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability
Advisory: GHSA-pmqq-7wfv-jfff
Aliases: CVE-2016-5000
Published: 2022-05-13T01:14:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Improper Input Validation in Jenkins
Advisory: GHSA-wfj3-535m-p6fx
Aliases: CVE-2017-1000391
Published: 2022-05-14T01:04:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Jenkins versions 2.88 and earlier and 2.73.2 and earlier stores metadata related to 'people', which encompasses actual user accounts, as well as users appearing in SCM, in directories corresponding to the user ID on disk. These directories used the user ID for their name without additional escaping, potentially resulting in problems like overwriting of unrelated configuration files.
phpMyAdmin path disclosure
Advisory: GHSA-rmmf-5xhh-gg27
Aliases: CVE-2016-9853
Published: 2022-05-17T02:36:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An issue was discovered in phpMyAdmin. By calling some scripts that are part of phpMyAdmin in an unexpected way, it is possible to trigger phpMyAdmin to display a PHP error message which contains the full path of the directory where phpMyAdmin is installed. During an execution timeout in the export functionality, the errors containing the full path of the directory of phpMyAdmin are written to the export file. All 4.6.x versions (prior to 4.6.5), and 4.4.x versions (prior to 4.4.15.9) are affected. This CVE is for the fopen wrapper issue.
Improper Neutralization of Input During Web Page Generation in Apache Axis2
Advisory: GHSA-23x8-j7hm-5xwf
Aliases: CVE-2010-2103
Published: 2022-05-14T02:44:30Z

Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter.  NOTE: some of these details are obtained from third party information.
Yii2-StateMachine extension for Yii2 XSS Vulnerability
Advisory: GHSA-65qg-f77j-cccf
Aliases: CVE-2018-12290
Published: 2022-05-14T03:10:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Yii2-StateMachine extension v2.x.x for Yii2 has XSS.
XXE vulnerability in Jenkins Filesystem Trigger Plugin
Advisory: GHSA-cphv-7cxw-5hcc
Aliases: CVE-2021-21657
Published: 2022-05-24T19:03:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Filesystem Trigger Plugin 0.40 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Job/Configure permission or otherwise able to control the contents of an XML file being polled for changes to have Jenkins parse a crafted XML document that uses external entities for extraction of secrets from the polling Jenkins controller or agent, server-side request forgery, or denial-of-service attacks.

Filesystem Trigger Plugin 0.41 disables external entity resolution for its XML parser.
Resource leakage when decoding certificates and keys
Advisory: GHSA-g323-fr93-4j3c
Aliases: CVE-2022-1473
Published: 2022-05-04T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when decoding certificates or keys. If a long lived process periodically decodes certificates or keys its memory usage will expand without bounds and the process might be terminated by the operating system causing a denial of service. Also traversing the empty hash table entries will take increasingly more time. Typically such long lived processes might be TLS clients or TLS servers configured to accept client certificate authentication. The function was added in the OpenSSL 3.0 version thus older releases are not affected by the issue. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Deserialization of Untrusted Data in Spring-flex
Advisory: GHSA-8v4h-j42h-wfhc
Aliases: CVE-2017-3203
Published: 2022-05-13T01:36:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Improper Authorization in Undertoe
Advisory: GHSA-gv2w-88hx-8m9r
Aliases: CVE-2020-1745
Published: 2022-05-24T17:16:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.
Apache Struts Cross-site scripting Vulnerability
Advisory: GHSA-9cjh-qmvx-436c
Aliases: CVE-2005-3745
Published: 2022-05-01T02:20:38Z

Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
Showdoc XSS Vulnerability
Advisory: GHSA-2263-jwgm-wv97
Aliases: CVE-2018-16342
Published: 2022-05-14T02:19:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc v1.8.0 has XSS via a new page.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-77mv-p94f-qcq4
Aliases: CVE-2019-7934
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit newsletter templates to inject malicious javascript.
RubyGems HTTPS to HTTP redirect
Advisory: GHSA-228f-g3h7-3fj3
Aliases: CVE-2012-2125
Published: 2022-05-17T04:54:56Z

RubyGems before 1.8.23 can redirect HTTPS connections to HTTP, which makes it easier for remote attackers to observe or modify a gem during installation via a man-in-the-middle attack.
Improper Input Validation in Apache Struts
Advisory: GHSA-7jw3-5q4w-89qg
Aliases: CVE-2016-1181
Published: 2022-05-13T01:25:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
SimpleGeo python-oauth2 vulnerable to the use of Insufficiently Random Values to generate nonces
Advisory: GHSA-rv8h-p43r-4x5r
Aliases: CVE-2013-4347
Published: 2022-05-17T03:46:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.
Nokogiri gem, via libxml, is affected by DoS vulnerabilities
Advisory: GHSA-x2fm-93ww-ggvx
Aliases: CVE-2017-16932
Published: 2022-05-13T01:02:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

parser.c in libxml2 before 2.9.5 does not prevent infinite recursion in parameter entities.
SleekXMPP and Slixmpp Incorrect Implementation of Message Carbons 
Advisory: GHSA-c35g-jr5f-h83p
Aliases: CVE-2017-5591
Published: 2022-05-13T01:28:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for SleekXMPP up to 1.3.1 and Slixmpp all versions up to 1.2.3, as bundled in poezio (0.8 - 0.10) and other products.
Use of Externally-Controlled Input to Select Classes or Code in Infinispan
Advisory: GHSA-h47x-2j37-fw5m
Aliases: CVE-2019-10174
Published: 2022-05-24T17:01:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.