aswin1906/github-advisory-2022 huggingface dataset:
Jenkins vulnerable to UDP amplification reflection attack
Advisory: GHSA-gpxv-776p-7gc7
Aliases: CVE-2020-2100
Published: 2022-05-24T17:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier supports two network discovery services (UDP multicast/broadcast and DNS multicast) by default.

The UDP multicast/broadcast service can be used in an amplification reflection attack, as very few bytes sent to the respective endpoint result in much larger responses: A single byte request to this service would respond with more than 100 bytes of Jenkins metadata which could be used in a DDoS attack on a Jenkins controller. Within the same network, spoofed UDP packets could also be sent to make two Jenkins controllers go into an infinite loop of replies to one another, thus causing a denial of service.

Jenkins 2.219, LTS 2.204.2 now disables both UDP multicast/broadcast and DNS multicast by default.

Administrators that need these features can re-enable them again by setting the system property `hudson.DNSMultiCast.disabled` to `false` (for DNS multicast) or the system property `hudson.udp` to `33848`, or another port (for UDP broadcast/multicast). These are the same system properties that controlled whether these features were enabled in the past, so any instances explicitly enabling these features by setting these system properties will continue to have them enabled.
Jenkins Dynatrace Plugin contains Incorrect Default Permissions
Advisory: GHSA-cqjv-whwg-wh47
Aliases: CVE-2019-10463
Published: 2022-05-24T16:59:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A missing permission check in Jenkins Dynatrace Application Monitoring Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. This issue was patched in version 2.1.5, however, please 

##NOTE: This plugin is marked as DEPRECATED
Incomplete List of Disallowed Inputs in Jenkins
Advisory: GHSA-ffgg-vphh-v273
Aliases: CVE-2017-2602
Published: 2022-05-13T01:36:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an improper blacklisting of the Pipeline metadata files in the agent-to-master security subsystem. This could allow metadata files to be written to by malicious agents (SECURITY-358).
OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack
Advisory: GHSA-j6xh-q826-55jw
Aliases: CVE-2013-4179
Published: 2022-05-17T04:58:58Z

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
Fork CMS XSS Vulnerability
Advisory: GHSA-8fjq-cpr7-cmfp
Aliases: CVE-2018-5215
Published: 2022-05-14T03:50:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.
Improper Authentication In Apache NiFi
Advisory: GHSA-jgj9-6v78-6g8m
Aliases: CVE-2017-5635
Published: 2022-05-13T01:46:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the "anonymous" user.
Review Board Cross-site scripting (XSS) vulnerability in the reviews dropdown
Advisory: GHSA-6g7x-4c7m-g63m
Aliases: CVE-2013-2209
Published: 2022-05-17T04:46:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N

Cross-site scripting (XSS) vulnerability in the auto-complete widget in htdocs/media/rb/js/reviews.js in Review Board 1.6.x before 1.6.17 and 1.7.x before 1.7.10 allows remote attackers to inject arbitrary web script or HTML via a full name.
Improper Restriction of XML External Entity Reference in Apache POI 
Advisory: GHSA-9jwc-q6j3-8g9g
Aliases: CVE-2019-12415
Published: 2022-05-24T16:59:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
Cross-site Scripting in Apache NiFi
Advisory: GHSA-m5r7-w9v3-ghmx
Aliases: CVE-2017-7665
Published: 2022-05-17T02:40:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.
Karteek Docsplit vulnerable to OS Command Injection
Advisory: GHSA-4fvg-pwv7-v54g
Aliases: CVE-2013-1933
Published: 2022-05-17T01:36:24Z

The `extract_from_ocr` function in `lib/docsplit/text_extractor.rb` in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
Authentication cache in Active Directory Jenkins Plugin allows logging in with any password
Advisory: GHSA-954f-xw44-56r2
Aliases: CVE-2020-2301
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode. Optionally, to reduce lookup time, a cache can be configured to remember user lookups and user authentications.

In Active Directory Plugin prior to 2.20 and 2.16.1, when run in Windows/ADSI mode, the provided password was not used when looking up an applicable cache entry. This allows attackers to log in as any user using any password while a successful authentication of that user is still in the cache.

As a workaround for this issue, the cache can be disabled.

Active Directory Plugin 2.20 and 2.16.1 includes the provided password in cache entry lookup.

Additionally, the Java system property `hudson.plugins.active_directory.CacheUtil.noCacheAuth` can be set to `true` to no longer cache user authentications.
Magento 2 Community Edition CSRF vulnerability
Advisory: GHSA-mhvf-j94g-3qp7
Aliases: CVE-2019-7851
Published: 2022-05-24T16:52:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unintended data deletion from customer pages.
ChakraCore RCE Vulnerability
Advisory: GHSA-g77f-7wm9-rh6p
Aliases: CVE-2016-0024
Published: 2022-05-14T02:26:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code via unspecified vectors, aka "Scripting Engine Memory Corruption Vulnerability."
Jeecg-Boot CMS arbitrary file upload vulnerability
Advisory: GHSA-jf7x-57g8-9hm5
Aliases: CVE-2020-28088
Published: 2022-05-24T19:10:22Z

An arbitrary file upload vulnerability in `/jeecg-boot/sys/common/upload` of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code.
Drupal Open Redirect
Advisory: GHSA-836p-6p4j-35cg
Aliases: CVE-2016-3164
Published: 2022-05-17T03:57:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
Jenkins Build-Publisher plugin has Insufficiently Protected Credentials
Advisory: GHSA-m3wv-fr8v-fmh7
Aliases: CVE-2017-1000387
Published: 2022-05-13T01:41:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Build-Publisher plugin version 1.21 and earlier stores credentials to other Jenkins instances in the file `hudson.plugins.build_publisher.BuildPublisher.xml` in the Jenkins master home directory. These credentials were stored unencrypted, allowing anyone with local file system access to access them. Additionally, the credentials were also transmitted in plain text as part of the configuration form. This could result in exposure of the credentials through browser extensions, cross-site scripting vulnerabilities, and similar situations. Build-Publisher Plugin 1.22 encrypts the credentials on disk, and only transmits their encrypted form to users viewing the configuration form.
Buffer Copy without Checking Size of Input in Pillow
Advisory: GHSA-r7rm-8j6h-r933
Aliases: CVE-2020-5311
Published: 2022-05-24T17:05:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

`libImaging/SgiRleDecode.c` in Pillow before 6.2.2 has an SGI buffer overflow.
Moodle XSS Vulnerability
Advisory: GHSA-93gj-rg98-h7mm
Aliases: CVE-2017-2644
Published: 2022-05-17T02:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Moodle 3.x, XSS can occur via evidence of prior learning.
Exposure of Sensitive Information to an Unauthorized Actor in Direct Web Remoting
Advisory: GHSA-hqw5-62gp-rqgm
Aliases: CVE-2014-5325
Published: 2022-05-17T03:46:06Z

The (1) DOMConverter, (2) JDOMConverter, (3) DOM4JConverter, and (4) XOMConverter functions in Direct Web Remoting (DWR) through 2.0.10 and 3.x through 3.0.RC2 allow remote attackers to read arbitrary files via DOM data containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Moodle sensitive information disclosure
Advisory: GHSA-5282-96ff-xx3h
Aliases: CVE-2016-3732
Published: 2022-05-13T01:12:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The capability check to access other badges in Moodle 3.0 through 3.0.3, 2.9 through 2.9.5, 2.8 through 2.8.11, 2.7 through 2.7.13, and earlier allows remote authenticated users to read the badges of other users.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-5c4g-p858-498x
Aliases: CVE-2019-7935
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content page titles to inject malicious javascript.
Improper Authorization in Jenkins Core
Advisory: GHSA-6rh5-23hx-j452
Aliases: CVE-2019-1003003
Published: 2022-05-13T01:05:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
Path traversal in Jenkins REPO Plugin
Advisory: GHSA-8vfc-fcr2-47pj
Aliases: CVE-2022-30949
Published: 2022-05-18T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SCMs support a number of different URL schemes, including local file system paths (e.g. using `file:` URLs).

Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well.

This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins-mailer-plugin
Advisory: GHSA-9v72-p5p3-9w65
Aliases: CVE-2017-2651
Published: 2022-05-13T01:36:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamically created list of users based on the changelogs. This could in some cases result in emails being sent to people who have no user account in Jenkins, and in rare cases even people who were not involved in whatever project was being built, due to some mapping based on the local-part of email addresses.
Magento 2 Community Edition Incorrect Authorization
Advisory: GHSA-f2g3-3c6q-4478
Aliases: CVE-2020-24401
Published: 2022-05-24T17:33:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect authorization vulnerability. A user can still access resources provisioned under their old role after an administrator removes the role or disables the user's account.
Apache Sling Auth Core bundle vulnerable to Open Redirection
Advisory: GHSA-j7f2-cqvq-5jcf
Aliases: CVE-2013-4390
Published: 2022-05-17T04:59:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter, related to "a custom login form and XSS."
Arbitrary file read vulnerability in Storable Configs Plugin
Advisory: GHSA-85wg-cg5p-m76p
Aliases: CVE-2020-2277
Published: 2022-05-24T17:28:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Storable Configs Plugin 1.0 and earlier allows users with Job/Read permission to read arbitrary files on the Jenkins controller.
New Relic .NET Agent contains SQL Injection
Advisory: GHSA-2rvx-cvfc-mcp2
Aliases: CVE-2017-9246
Published: 2022-05-17T02:35:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

New Relic .NET Agent before 6.3.123.0 adds SQL injection flaws to safe applications via vectors involving failure to escape quotes during use of the Slow Queries feature, as demonstrated by a mishandled quote in a VALUES clause of an INSERT statement, after bypassing a SET SHOWPLAN_ALL ON protection mechanism.
Echor contains Command Injection
Advisory: GHSA-8936-cgj4-phr2
Aliases: CVE-2014-1834
Published: 2022-05-14T03:44:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The `perform_request` function in `/lib/echor/backplane.rb` in echor 0.1.6 Ruby Gem allows local users to inject arbitrary code by adding a semi-colon in their username or password.
Deserialization of Untrusted Data in Jenkins
Advisory: GHSA-hhpm-5cp2-hg4x
Aliases: CVE-2018-1000861
Published: 2022-05-13T01:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Advisory: GHSA-fj6c-prgj-gr3r
Aliases: CVE-2010-3718
Published: 2022-05-14T01:17:02Z

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
Moodle XSS Vulnerability
Advisory: GHSA-cp39-43xr-2wrp
Aliases: CVE-2015-2269
Published: 2022-05-13T01:12:45Z

Multiple cross-site scripting (XSS) vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a (1) alt or (2) title attribute in an IMG element.
Apache Struts RCE Vulnerability
Advisory: GHSA-ggmp-fxfg-277r
Aliases: CVE-2016-3090
Published: 2022-05-14T03:15:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The `TextParseUtil.translateVariables` method in Apache Struts 2.x before 2.3.20 allows remote attackers to execute arbitrary code via a crafted OGNL expression with ANTLR tooling.
ChakraCore RCE Vulnerability
Advisory: GHSA-prhh-h793-h32r
Aliases: CVE-2018-1019
Published: 2022-05-13T01:18:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0980, CVE-2018-0990, CVE-2018-0993, CVE-2018-0994, CVE-2018-0995.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-5v5p-x8c2-mqxp
Aliases: CVE-2019-8122
Published: 2022-05-24T17:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with privileges to create products can craft custom layout update and use import product functionality to enable remote code execution.
Plone Denial of Service vulnerability via decompressing large zip archives
Advisory: GHSA-xfjq-9rxq-ph6m
Aliases: CVE-2013-4199
Published: 2022-05-17T04:49:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

(1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archive, which is expanded (decompressed).
Command Injection in SaltStack Salt
Advisory: GHSA-hcjf-rp5h-g5h3
Aliases: CVE-2021-31607
Published: 2022-05-24T17:48:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).
pyftpdlib vulnerable to allocation of resources without limits
Advisory: GHSA-cx59-cp6c-9fr8
Aliases: CVE-2007-6740
Published: 2022-05-01T18:45:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

The ftp_STOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which might allow remote authenticated users to cause a denial of service via a STOU command.
Arbitrary file delete in baserCMS
Advisory: GHSA-x73x-7gmx-w835
Aliases: CVE-2017-10843
Published: 2022-05-13T01:41:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

baserCMS version 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to delete arbitrary files via unspecified vectors when the "File" field is being used in the mail form.
Jenkins VMware Lab Manager Slaves Plugin vulnerable to Improper Certificate Validation
Advisory: GHSA-jxg7-cghf-mggx
Aliases: CVE-2019-10382
Published: 2022-05-24T16:52:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

VMware Lab Manager Slaves Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM.

As of publication of this advisory, there is no fix.
Jenkins iceScrum Plugin stores credentials in Cleartext
Advisory: GHSA-362p-56c9-q273
Aliases: CVE-2019-10443
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-8xg4-xq2v-v6j7
Aliases: CVE-2021-21692
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2538 / CVE-2021-21692: The operations `FilePath#renameTo` and `FilePath#moveAllChildrenTo` only check read permission on the source path.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2538 / CVE-2021-21692: The operations `FilePath#renameTo` and `FilePath#moveAllChildrenTo` check both read and delete permissions on the source path.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Deserialization of Untrusted Data in Jenkins
Advisory: GHSA-26wc-3wqp-g3rp
Aliases: CVE-2017-1000353
Published: 2022-05-13T01:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI, that would be deserialized using a new `ObjectInputStream`, bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2, and deprecating the remoting-based (i.e. Java serialization) CLI protocol, disabling it by default.
Ansible uses a socket with predictable filename in /tmp
Advisory: GHSA-fj24-ghp9-39v3
Aliases: CVE-2013-4259
Published: 2022-05-14T02:03:36Z

runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.
Token stored in plain text by DigitalOcean Plugin
Advisory: GHSA-8g6v-g8qc-5w7j
Aliases: CVE-2020-2126
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins DigitalOcean Plugin 1.1 and earlier stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system.
Moodle Arbitrary File Read via XML External Entity vulnerability
Advisory: GHSA-27j2-c838-c3qg
Aliases: CVE-2014-3543
Published: 2022-05-13T01:12:40Z

`mod/imscp/locallib.php` in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue affecting IMSCP resources and the IMSCC format.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-7xqv-jgv6-x2h8
Aliases: CVE-2019-7881
Published: 2022-05-24T16:52:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges (admin vs. admin XSS attack).
Magento 2 Community Edition Path Disclosure
Advisory: GHSA-xcgp-c6hp-cj4r
Aliases: CVE-2019-7852
Published: 2022-05-24T16:52:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file path could result in a redirect to the URL of the Magento admin panel, disclosing its location to potentially unauthorized parties.
URLTrigger Plugin server-side request forgery vulnerability
Advisory: GHSA-rv87-vcv4-fjvr
Aliases: CVE-2018-1000606
Published: 2022-05-14T03:05:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

A server-side request forgery vulnerability exists in Jenkins URLTrigger Plugin 0.41 and earlier in URLTrigger.java that allows attackers with Overall/Read access to cause Jenkins to send a GET request to a specified URL. As of version 0.43, this form validation method no longer connects to a user provided URL.
Jenkins iceScrum Plugin vulnerable to Missing Authorization
Advisory: GHSA-h5cx-w235-58hm
Aliases: CVE-2019-10442
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins iceScrum Plugin prior to version 1.1.6 allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials. This issue is patched in version 1.1.6
Reflected XSS vulnerability in Jenkins VncRecorder Plugin
Advisory: GHSA-fq52-6cjf-jw59
Aliases: CVE-2020-2206
Published: 2022-05-24T17:22:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

VncRecorder Plugin 1.25 and earlier does not escape a parameter value in the `checkVncServ` form validation endpoint output.

This results in a reflected cross-site scripting (XSS) vulnerability.

VncRecorder Plugin 1.35 escapes the parameter value in the output.
Missing XML Validation in Apache Tomcat
Advisory: GHSA-prc3-7f44-w48j
Aliases: CVE-2014-0119
Published: 2022-05-14T01:10:18Z

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
Insufficiently Protected Credentials in Jenkins AWS CodeBuild Plugin
Advisory: GHSA-mwg7-69hf-vqh3
Aliases: CVE-2018-1000404
Published: 2022-05-13T01:48:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins project Jenkins AWS CodeBuild Plugin version 0.26 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSClientFactory.java, CodeBuilder.java that can result in Credentials Disclosure. This attack appear to be exploitable via local file access. This vulnerability appears to have been fixed in 0.27 and later.
Creation of Temporary File With Insecure Permissions in logilab-commons
Advisory: GHSA-g5m2-22h2-rr3j
Aliases: CVE-2014-1839
Published: 2022-05-14T02:09:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

The Execute class in shellutils in logilab-common before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.
Apache Struts RCE Vulnerability
Advisory: GHSA-8c6j-ffmf-q6vm
Aliases: CVE-2016-3081
Published: 2022-05-14T00:54:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
ChakraCore RCE Vulnerability
Advisory: GHSA-rpfg-xf88-cq5r
Aliases: CVE-2019-0812
Published: 2022-05-13T01:21:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0829, CVE-2019-0860, CVE-2019-0861.
ChakraCore RCE Vulnerability
Advisory: GHSA-p37h-rg3w-23wx
Aliases: CVE-2018-8505
Published: 2022-05-13T01:20:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8510, CVE-2018-8511, CVE-2018-8513.
Moodle Oauth 2 Insufficiently Protects Against Compromise
Advisory: GHSA-rv62-6f56-j83w
Aliases: CVE-2019-14880
Published: 2022-05-24T17:12:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

A vulnerability was found in Moodle versions 3.7 before 3.7.3, 3.6 before 3.6.7, 3.5 before 3.5.9 and earlier. OAuth 2 providers who do not verify users' email address changes require additional verification during sign-up to reduce the risk of account compromise.
Reflected XSS vulnerability in Jenkins Micro Focus Application Automation Tools Plugin
Advisory: GHSA-gc2r-ccfh-62v9
Aliases: CVE-2021-22510
Published: 2022-05-24T17:46:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Micro Focus Application Automation Tools Plugin 6.7 and earlier does not escape user input in a form validation response.

This results in a reflected cross-site scripting (XSS) vulnerability.

Micro Focus Application Automation Tools Plugin 6.8 escapes user input in the affected form validation response.

A security hardening since Jenkins 2.275 and LTS 2.263.2 prevents exploitation of this vulnerability.
Uncontrolled Resource Consumption in Artemis and HornetQ
Advisory: GHSA-gc96-h5pr-839j
Aliases: CVE-2017-12174
Published: 2022-05-13T01:11:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryError.
PrestaShop PHP Object Injection
Advisory: GHSA-xx67-2j3v-h76p
Aliases: CVE-2018-20717
Published: 2022-05-14T01:37:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the orders section of PrestaShop before 1.7.2.5, an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to gain Remote Code Execution. This occurs because protection against serialized objects looks for a `0:` followed by an integer, but does not consider `0:+` followed by an integer.
Jenkins Delivery Pipeline Plugin Cross-site Scripting vulnerability
Advisory: GHSA-g364-c7w5-93wh
Aliases: CVE-2017-1000404
Published: 2022-05-14T03:45:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Jenkins Delivery Pipeline Plugin version 1.0.7 and earlier used the unescaped content of the query parameter 'fullscreen' in its JavaScript, resulting in a cross-site scripting vulnerability through specially crafted URLs. Version 1.0.8 of the plugin converts the value to a boolean (true/false) and inserts that into the page instead.
Missing Encryption of Sensitive Data in Apache Guacamole
Advisory: GHSA-wr7r-vg3c-54r5
Aliases: CVE-2018-1340
Published: 2022-05-13T01:49:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's session token. This cookie lacked the "secure" flag, which could allow an attacker eavesdropping on the network to intercept the user's session token if unencrypted HTTP requests are made to the same domain.
Arbitrary file existence check in file fingerprints in Jenkins
Advisory: GHSA-f585-9fw3-rj2m
Aliases: CVE-2021-21606
Published: 2022-05-24T17:39:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins provides a feature for jobs to store and track fingerprints of files used during a build. Jenkins 2.274 and earlier, LTS 2.263.1 and earlier provides a REST API to check where a given fingerprint was used by which builds. This endpoint does not fully validate that the provided fingerprint ID is properly formatted before checking for the XML metadata for that fingerprint on the controller file system.

This allows attackers with Overall/Read permission to check for the existence of XML files on the controller file system where the relative path can be constructed as 32 characters.

Jenkins 2.275, LTS 2.263.2 validates that a fingerprint ID is properly formatted before checking for its existence.
Improper Neutralization of Special Elements in Output Used by a Downstream Component in Codecov
Advisory: GHSA-mh2h-6j8q-x246
Aliases: CVE-2020-7596
Published: 2022-05-24T17:07:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument.
Apache Hadoop allows impersonation of arbitrary cluster user accounts
Advisory: GHSA-c6f9-4pmv-m7m6
Aliases: CVE-2012-1574
Published: 2022-05-17T02:54:07Z

The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors.
Jenkins Sonar Gerrit Plugin stores credentials unencrypted
Advisory: GHSA-6fv3-w7j6-5xfc
Aliases: CVE-2019-10467
Published: 2022-05-24T16:59:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Sonar Gerrit Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Script security sandbox bypass in Jenkins Job DSL Plugin
Advisory: GHSA-5r74-pgmq-92mm
Aliases: CVE-2019-1003034
Published: 2022-05-13T01:15:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Jenkins Job DSL Plugin 1.71 and earlier in job-dsl-core/src/main/groovy/javaposse/jobdsl/dsl/AbstractDslScriptLoader.groovy, job-dsl-plugin/build.gradle, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/JobDslWhitelist.groovy, job-dsl-plugin/src/main/groovy/javaposse/jobdsl/plugin/SandboxDslScriptLoader.groovy that allows attackers with control over Job DSL definitions to execute arbitrary code on the Jenkins master JVM.
Apache Struts is vulnerable to Cross-site Scripting
Advisory: GHSA-3g8j-jj54-3vjg
Aliases: CVE-2013-6348
Published: 2022-05-17T04:57:18Z

Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in `config-browser/`.
Withdrawn Advisory: OpenShift OAuth Server XSS Vulnerability
Advisory: GHSA-jgwg-35hf-xqrr
Aliases: CVE-2019-3876
Published: 2022-05-13T01:12:23Z
Withdrawn: 2023-09-28T20:29:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

## Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not affect a package in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references.

## Original Description

A flaw was found in the `/oauth/token/request` custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.
Firefly III vulnerable to stored XSS
Advisory: GHSA-9xmx-rj7j-fv9q
Aliases: CVE-2019-13644
Published: 2022-05-24T16:50:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction, and is executed on the tags/show/$tag_number$ tag summary page.
Apache Struts Open Redirect
Advisory: GHSA-wm8w-qp2f-728q
Aliases: CVE-2016-4433
Published: 2022-05-17T02:16:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks via a crafted request.
Node-Traceroute RCE Vulnerability
Advisory: GHSA-8j9v-qhp4-wv55
Aliases: CVE-2018-21268
Published: 2022-05-24T17:21:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the `Child.exec()` method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character.
AWS CodeDeploy Plugin stored AWS Secret Key in plain text
Advisory: GHSA-h66p-m766-33fv
Aliases: CVE-2018-1000403
Published: 2022-05-13T01:48:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins project Jenkins AWS CodeDeploy Plugin version 1.19 and earlier contains a Insufficiently Protected Credentials vulnerability in AWSCodeDeployPublisher.java that can result in Credentials Disclosure. This attack appears to be exploitable via local file access. 

AWS CodeDeploy Plugin 1.20 and newer stores the AWS Secret Key encrypted in the configuration files on disk and no longer transfers it to users viewing the configuration form in plain text. Existing jobs need to have their configuration saved for existing plain text secret keys to be overwritten.
Improper Input Validation in Undertow
Advisory: GHSA-2w73-fqqj-c92p
Aliases: CVE-2020-1757
Published: 2022-05-24T17:15:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.
lxml Cross-site Scripting Via Control Characters
Advisory: GHSA-57qw-cc2g-pv5p
Aliases: CVE-2014-3146
Published: 2022-05-14T04:01:59Z

Incomplete blacklist vulnerability in the `lxml.html.clean` module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the `clean_html` function.
Apache Geode vulnerable to Exposure of Sensitive Information
Advisory: GHSA-vh98-fqfc-4hj3
Aliases: CVE-2017-9797
Published: 2022-05-13T01:48:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H

When an Apache Geode cluster before v1.2.1 is operating in secure mode, an unauthenticated client can enter multi-user authentication mode and send metadata messages. These metadata operations could leak information about application data types. In addition, an attacker could perform a denial of service attack on the cluster.
Code Injection in baserCMS
Advisory: GHSA-69gw-v5ph-6vxq
Aliases: CVE-2017-10844
Published: 2022-05-14T01:22:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows an attacker to execute arbitrary PHP code on the server via unspecified vectors.
ChakraCore RCE Vulnerability
Advisory: GHSA-5ggm-q98v-76hx
Aliases: CVE-2018-8618
Published: 2022-05-13T01:21:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8617, CVE-2018-8624, CVE-2018-8629.
Plaintext Storage of a Password in Jenkins Configuration as Code Plugin
Advisory: GHSA-ggmx-pq89-7mcr
Aliases: CVE-2019-10345
Published: 2022-05-24T16:51:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Configuration as Code Plugin prior to version 1.25 did not treat the proxy password as a secret to be masked when logging or encrypted for export.
RubyGems Improper Verification of Cryptographic Signature vulnerability
Advisory: GHSA-mc6j-h948-v2p6
Aliases: CVE-2018-1000076
Published: 2022-05-14T01:01:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, and Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contain an Improper Verification of Cryptographic Signature vulnerability in package.rb. This can result in a mis-signed gem being installed, as the tarball would contain multiple gem signatures. This vulnerability has been fixed in 2.7.6.
Improper Access Control in MySQL Connectors Java
Advisory: GHSA-2xxh-f8r3-hvvr
Aliases: CVE-2017-3523
Published: 2022-05-13T01:45:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.40 and earlier. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
JBoss RichFaces Improper Input Validation vulnerability
Advisory: GHSA-xfxv-f945-4qv6
Aliases: CVE-2014-0086
Published: 2022-05-17T00:13:54Z

The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.
Incorrect Authorization in Jenkins Core
Advisory: GHSA-3297-944x-j7x7
Aliases: CVE-2017-2611
Published: 2022-05-13T01:16:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Jenkins before versions before 2.44 are vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents.
Apache XML Security For Java vulnerable to Infinite Loop
Advisory: GHSA-8gwc-x7mg-7p7p
Aliases: CVE-2013-5823
Published: 2022-05-14T00:02:32Z

Affected versions of xmlsec are subject to a denial of service vulnerability. Should a user check the signature of a message larger than 512 MB, the method `expandSize(int newPos)` of class `org.apache.xml.security.utils.UnsyncByteArrayOutputStream` goes in an endless loop. A remote attacker could use this flaw to supply crafted XML that would lead to a denial of service.
OS Command Injection in git-pull-or-clone
Advisory: GHSA-3x62-x456-q2vm
Aliases: CVE-2022-24437
Published: 2022-05-03T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package git-pull-or-clone before 2.0.2 is vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
## Credits

Credit @lirantal for discovering this vulnerability.
Apache Tomcat Directory Traversal
Advisory: GHSA-4prh-gqw8-rgh5
Aliases: CVE-2007-0450
Published: 2022-05-01T17:44:16Z

Directory traversal vulnerability in Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a `..` (dot dot) sequence with combinations of (1) `/` (slash), (2) `\` (backslash), and (3) URL-encoded backslash (`%5C`) characters in the URL, which are valid separators in Tomcat but not in Apache.
Jenkins CRX Content Package Deployer Plugin subject to Missing Authorization
Advisory: GHSA-jww4-2793-9gmg
Aliases: CVE-2019-10438
Published: 2022-05-24T16:58:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A missing permission check in Jenkins CRX Content Package Deployer Plugin prior to version 1.9 allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. This issue is patched in 1.9
Reflected XSS vulnerability in Jenkins AWSEB Deployment Plugin
Advisory: GHSA-f82v-pg74-6686
Aliases: CVE-2020-2174
Published: 2022-05-24T17:13:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AWSEB Deployment Plugin 0.3.19 and earlier does not escape various values printed as part of form validation output.

This results in a reflected cross-site scripting (XSS) vulnerability.

AWSEB Deployment Plugin 0.3.20 escapes the values printed as part of the affected form validation endpoints.
Jenkins Docker Plugin contains Cross-Site Request Forgery
Advisory: GHSA-m6gf-p26p-mx2w
Aliases: CVE-2019-10340
Published: 2022-05-24T16:50:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability in Jenkins Docker Plugin 1.1.6 and earlier in DockerAPI.DescriptorImpl#doTestConnection allowed users with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.