aswin1906/github-advisory-2022 huggingface dataset:
admidio CSRF Vulnerability
Advisory: GHSA-c4v8-2hg8-jv77
Aliases: CVE-2017-8382
Published: 2022-05-17T02:42:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

admidio 3.2.8 has CSRF in `adm_program/modules/members/members_function.php` with an impact of deleting arbitrary user accounts.
Cross-site Scripting in Apache Struts
Advisory: GHSA-56f8-g68r-j699
Aliases: CVE-2011-1772
Published: 2022-05-17T05:35:28Z

Multiple Cross-Site Scripting (XSS) in XWork generated error pages in Apache Struts. By default, XWork doesn't escape action's names in automatically generated error page, allowing for a successful XSS attack. When Dynamic Method Invocation (DMI) is enabled, the action name is generated dynamically base on request parameters. This allows to call non-existing page and method to produce error page with injected code as below. As of Struts 2.2.3 the action names are escaped when automatically generated error pages are rendered.
Vault GitHub Action did not correctly mask multi-line secrets in output
Advisory: GHSA-4mgv-m5cm-f9h7
Aliases: CVE-2021-32074
Published: 2022-05-24T19:01:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.

The vault-action implementation did not correctly handle the marking of multi-line variables. As a result, multi-line secrets were not correctly masked in vault-action output.

Remediation:
Customers using vault-action should evaluate the risk associated with this issue, and consider upgrading to vault-action 2.2.0 or newer. Please refer to https://github.com/marketplace/actions/vault-secrets for more information.
Aubio is vulnerable to denial of service via aubio_source_avcodec_readframe function
Advisory: GHSA-rcv6-7hmv-fj7h
Aliases: CVE-2018-14521
Published: 2022-05-14T02:59:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in aubio 0.4.6. A SEGV signal can occur in `aubio_source_avcodec_readframe` in `io/source_avcodec.c`, as demonstrated by aubiomfcc.
CSRF vulnerability in Amazon EC2 Plugin
Advisory: GHSA-w6hw-57jq-h7f5
Aliases: CVE-2020-2186
Published: 2022-05-24T17:17:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Amazon EC2 Plugin 1.50.1 and earlier does not require POST requests in several HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities. This allows an attacker to provision instances with an attacker-specified template ID.

Amazon EC2 Plugin 1.50.2 now requires POST requests for the affected HTTP endpoints.
Apache James Hupa Webmail application Cross-site Scripting Vulnerabilities
Advisory: GHSA-7crp-p2vc-69r7
Aliases: CVE-2012-3536
Published: 2022-05-14T03:37:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was addressed in Hupa 0.0.3.
Plone denial of service via RSS Feed Request
Advisory: GHSA-79hj-474h-v4xv
Aliases: CVE-2012-5506
Published: 2022-05-17T04:32:05Z

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user does not have permission to access.
Password stored in plain text by Jenkins HP ALM Quality Center Plugin
Advisory: GHSA-fc3j-cfqv-pfrm
Aliases: CVE-2020-2218
Published: 2022-05-24T17:22:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

HP ALM Quality Center Plugin 1.6 and earlier stores a password in plain text in its global configuration file `org.jenkinsci.plugins.qc.QualityCenterIntegrationRecorder.xml`. This password can be viewed by users with access to the Jenkins controller file system.
Improper Limitation of a Pathname to a Restricted Directory in Jboss EAP Undertow
Advisory: GHSA-prfw-3qx6-g9xr
Aliases: CVE-2018-1048
Published: 2022-05-13T01:12:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.
gitjacker arbitrary code execution
Advisory: GHSA-4j5x-f394-xx79
Aliases: CVE-2021-29417
Published: 2022-05-24T22:01:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.
Podman Symlink Vulnerability
Advisory: GHSA-r34v-gqmw-qvgj
Aliases: CVE-2019-18466
Published: 2022-05-24T16:59:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.
Plone is vulnerable to denial of service
Advisory: GHSA-wrf2-2rch-cmr9
Aliases: CVE-2012-5499
Published: 2022-05-17T04:31:18Z

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to `formatColumns`.
Incorrect MAC key used in the RC4-MD5 ciphersuite
Advisory: GHSA-638m-m8mh-7gw2
Aliases: CVE-2022-1434
Published: 2022-05-04T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key. This makes the MAC key trivially predictable. An attacker could exploit this issue by performing a man-in-the-middle attack to modify data being sent from one endpoint to an OpenSSL 3.0 recipient such that the modified data would still pass the MAC integrity check. Note that data sent from an OpenSSL 3.0 endpoint to a non-OpenSSL 3.0 endpoint will always be rejected by the recipient and the connection will fail at that point. Many application protocols require data to be sent from the client to the server first. Therefore, in such a case, only an OpenSSL 3.0 server would be impacted when talking to a non-OpenSSL 3.0 client. If both endpoints are OpenSSL 3.0 then the attacker could modify data being sent in both directions. In this case both clients and servers could be affected, regardless of the application protocol. Note that in the absence of an attacker this bug means that an OpenSSL 3.0 endpoint communicating with a non-OpenSSL 3.0 endpoint will fail to complete the handshake when using this ciphersuite. The confidentiality of data is not impacted by this issue, i.e. an attacker cannot decrypt data that has been encrypted using this ciphersuite - they can only modify it. In order for this attack to work both endpoints must legitimately negotiate the RC4-MD5 ciphersuite. This ciphersuite is not compiled by default in OpenSSL 3.0, and is not available within the default provider or the default ciphersuite list. This ciphersuite will never be used if TLSv1.3 has been negotiated. In order for an OpenSSL 3.0 endpoint to use this ciphersuite the following must have occurred: 1) OpenSSL must have been compiled with the (non-default) compile time option enable-weak-ssl-ciphers 2) OpenSSL must have had the legacy provider explicitly loaded (either through application code or via configuration) 3) The ciphersuite must have been explicitly added to the ciphersuite list 4) The libssl security level must have been set to 0 (default is 1) 5) A version of SSL/TLS below TLSv1.3 must have been negotiated 6) Both endpoints must negotiate the RC4-MD5 ciphersuite in preference to any others that both endpoints have in common Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Firefly III vulnerable to reflected cross-site scripting
Advisory: GHSA-mrc2-h7q2-pp97
Aliases: CVE-2019-13646
Published: 2022-05-24T16:50:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query.
RubyGems file overwrite vulnerability
Advisory: GHSA-95vx-q4c2-64gr
Aliases: CVE-2007-0469
Published: 2022-05-01T17:44:34Z

The `extract_files` function in `installer.rb` in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.
LavaLite Stored Cross-site Scripting vulnerability
Advisory: GHSA-3cfg-rxh6-h2rh
Aliases: CVE-2020-36397
Published: 2022-05-24T19:06:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross site scripting (XSS) vulnerability in the `/admin/contact/contact` component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the `New` parameter.
Denial-of-service vulnerability processing large chat messages containing many newlines
Advisory: GHSA-gj94-v4p9-w672
Published: 2022-05-25T22:34:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact
PocketMine-MP caps maximum chat message length at 512 Unicode characters, or about 2048 bytes. No more than 2 chat messages may be sent per tick. However, due to legacy reasons, incoming chat message blobs are split by `\n`, and each part is treated as a separate message, the length of each part is individually checked. The length of the whole message is not checked.

This leads to an exploitable performance issue, in which a malicious client may send a chat packet of several megabytes containing nothing but `\n` newline characters. The server will parse this into a very large array and spend a long time (several milliseconds) iterating over it for no reason.

Furthermore, due to the lack of sufficient rate limit checks before parsing messages, malicious clients may bombard the server with many thousands of these malicious messages, causing lockups for a significant amount of time (seconds or minutes).

### Patches
This bug was addressed in https://github.com/pmmp/PocketMine-MP/commit/df33e179e5d3ff13b56a2d7060bf592b0f797258 by:
- checking the length of the incoming message as a whole before parsing it - it may not be larger than `messageCounter * maxChatMessageSize` (`messageCounter` is decremented once for every message sent)
- limiting the maximum number of times a message may be split on newlines before giving up and discarding the message (maximum 3 parts; anything after the first 2 parts is discarded)

### Workarounds
Handle `DataPacketReceiveEvent` and check for these excessive newlines in incoming `TextPacket`.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Cross-site Scripting in Jenkins Application Detector Plugin
Advisory: GHSA-6wh8-mr6f-6cx2
Aliases: CVE-2022-30960
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Application Detector Plugin 1.0.8 and earlier does not escape the name of Chois Application Version parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Apache Solr insecure inter-node communication
Advisory: GHSA-c82r-qg3w-q5mv
Aliases: CVE-2017-7660
Published: 2022-05-14T01:56:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Solr uses a PKI based mechanism to secure inter-node communication when security is enabled. It is possible to create a specially crafted node name that does not exist as part of the cluster and point it to a malicious node. This can trick the nodes in cluster to believe that the malicious node is a member of the cluster. So, if Solr users have enabled BasicAuth authentication mechanism using the BasicAuthPlugin or if the user has implemented a custom Authentication plugin, which does not implement either "HttpClientInterceptorPlugin" or "HttpClientBuilderPlugin", his/her servers are vulnerable to this attack. Users who only use SSL without basic authentication or those who use Kerberos are not affected.
Plone XSS in profile home_page property
Advisory: GHSA-859j-668v-mrr6
Aliases: CVE-2017-1000482
Published: 2022-05-14T03:49:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A member of the Plone site could set javascript in the `home_page` property of their profile, and have this executed when a visitor clicks the home page link on the author page.
CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files
Advisory: GHSA-rw73-xmpv-j5x2
Aliases: CVE-2006-5031
Published: 2022-05-01T07:24:12Z

Directory traversal vulnerability in `app/webroot/js/vendors.php` in Cake Software Foundation CakePHP before 1.1.8.3544 allows remote attackers to read arbitrary files via a `..` (dot dot) in the file parameter, followed by a filename ending with `%00` and a `.js` filename.
Subrion CMS CSRF Vulnerability
Advisory: GHSA-c939-g732-48r8
Aliases: CVE-2017-18366
Published: 2022-05-14T01:10:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Subrion CMS 4.1.5 has CSRF in `blog/delete/`.
Elastic APM agent for Ruby vulnerable to Improper Certificate Validation
Advisory: GHSA-35j2-p8fh-x966
Aliases: CVE-2019-7615
Published: 2022-05-24T16:51:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

A TLS certificate validation flaw was found in Elastic APM agent for Ruby versions before 2.9.0. When specifying a trusted server CA certificate via the `server_ca_cert` setting, the Ruby agent would not properly verify the certificate returned by the APM server. This could result in a man in the middle style attack against the Ruby agent.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-2crc-5vq6-386r
Aliases: CVE-2019-8111
Published: 2022-05-24T17:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage plugin functionality related to email templates to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code.
XSS vulnerability in Jenkins notification bar
Advisory: GHSA-98gq-6hxg-52r6
Aliases: CVE-2021-21603
Published: 2022-05-24T17:39:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape notification bar response contents (typically shown after form submissions via Apply button).

This results in a cross-site scripting (XSS) vulnerability exploitable by attackers able to influence notification bar contents.

Jenkins 2.275, LTS 2.263.2 escapes the content shown in notification bars.
Prototype Pollution in jsgui-lang-essentials
Advisory: GHSA-p3pg-64pv-v7jg
Aliases: CVE-2022-25301
Published: 2022-05-03T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

All versions of package `jsgui-lang-essentials` are vulnerable to Prototype Pollution due to allowing all `Object` attributes to be altered, including their magical attributes such as `proto`, `constructor` and `prototype`.
Magento 2 Community Edition Information Disclosure
Advisory: GHSA-274w-2j5w-m2xj
Aliases: CVE-2019-7899
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Path Traversal in Apache Oozie
Advisory: GHSA-2fx6-r6qx-3c7h
Aliases: CVE-2017-15712
Published: 2022-05-14T03:37:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Vulnerability allows a user of Apache Oozie 3.1.3-incubating to 4.3.0 and 5.0.0-beta1 to expose private files on the Oozie server process. The malicious user can construct a workflow XML file containing XML directives and configuration that reference sensitive files on the Oozie server host.
Cross-site Scripting in Graylog Server
Advisory: GHSA-h7g4-65mf-6mxh
Aliases: CVE-2018-11650
Published: 2022-05-14T03:15:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications, related to toastr and util/UserNotification.js.
Remote code execution vulnerability in Jenkins Templating Engine Plugin
Advisory: GHSA-p6qc-37hq-wqr6
Aliases: CVE-2021-21646
Published: 2022-05-24T17:48:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin.

This vulnerability allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM.

Templating Engine Plugin 2.2 integrates with Script Security Plugin to protect its pipeline configurations.
ChakraCore RCE Vulnerability
Advisory: GHSA-qfcq-4vv7-9mq7
Aliases: CVE-2017-11911
Published: 2022-05-14T01:06:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
Missing permission check in Jenkins Implied Labels Plugin allows reconfiguring the plugin
Advisory: GHSA-5hw2-327v-vvr6
Aliases: CVE-2020-2282
Published: 2022-05-24T17:29:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Implied Labels Plugin 0.6 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to configure the plugin.

Implied Labels Plugin 0.7 requires Overall/Administer permission to configure the plugin.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-3ccx-7588-r6c6
Aliases: CVE-2019-7866
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor.
XXE Vulnerability in XMLBundle 0.1.7
Advisory: GHSA-qvwf-w35m-6r95
Aliases: CVE-2017-1000477
Published: 2022-05-14T03:49:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result in denial of service attacks.
Plone Sandbox Bypass
Advisory: GHSA-9m4g-f42q-vrrh
Aliases: CVE-2012-5487
Published: 2022-05-17T04:32:24Z

The sandbox whitelisting function (`allowmodule.py`) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.
graphite-web is vulnerable to Remote Code Execution via renderLocalView function 
Advisory: GHSA-m923-w2gj-v43g
Aliases: CVE-2013-5093
Published: 2022-05-17T05:03:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.
Stored XSS vulnerability in Jenkins Artifact Repository Parameter Plugin
Advisory: GHSA-gc87-qwmv-7x9x
Aliases: CVE-2021-21622
Published: 2022-05-24T17:43:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Artifact Repository Parameter Plugin 1.0.0 and earlier does not escape parameter names and descriptions.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Artifact Repository Parameter Plugin 1.0.1 escapes parameter names and descriptions.
Plone Cross-site scripting Vulnerability
Advisory: GHSA-q46g-v7r4-9vhr
Aliases: CVE-2012-5490
Published: 2022-05-17T04:32:23Z

Cross-site scripting (XSS) vulnerability in `kssdevel.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Jenkins vulnerable to Cross-site Scripting
Advisory: GHSA-826f-32qm-vm3j
Aliases: CVE-2013-2033
Published: 2022-05-14T01:52:20Z

Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.
Plone User account enumeration via crafted URL
Advisory: GHSA-683w-84m7-p8pw
Aliases: CVE-2012-5497
Published: 2022-05-17T04:31:18Z

membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.
Insertion of Sensitive Information into Externally-Accessible File or Directory in Jenkins Credentials Plugin
Advisory: GHSA-xm94-9jw8-p6hw
Aliases: CVE-2019-10320
Published: 2022-05-24T16:46:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.
Cross-site Scripting in SmartyException
Advisory: GHSA-9gqj-ppv2-f2hq
Aliases: CVE-2012-4437
Published: 2022-05-17T04:02:12Z

Cross-site scripting (XSS) vulnerability in the `SmartyException` class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.
Magento 2 Community Edition RCE via Unsafe File Upload
Advisory: GHSA-7pxg-6p87-8c9v
Aliases: CVE-2020-24407
Published: 2022-05-24T17:33:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated users with administrative permissions to the System/Data and Transfer/Import components.
Cleartext Transmission of Sensitive Information in Jenkins Configuration as Code Plugin
Advisory: GHSA-r69h-6c4g-63xf
Aliases: CVE-2019-10363
Published: 2022-05-24T16:51:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Jenkins Configuration as Code Plugin 1.24 and earlier did not reliably identify sensitive values expected to be exported in their encrypted form.
Incorrect permission checks in Jenkins Role-based Authorization Strategy Plugin may allow accessing some items
Advisory: GHSA-rm4m-39fj-288c
Aliases: CVE-2021-21624
Published: 2022-05-24T17:44:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Items (like jobs) can be organized hierarchically in Jenkins, using the Folders Plugin or something similar. An item is expected to be accessible only if all its ancestors are accessible as well.

Role-based Authorization Strategy Plugin 3.1 and earlier does not correctly perform permission checks to determine whether an item should be accessible.

This allows attackers with Item/Read permission on nested items to access them, even if they lack Item/Read permission for parent folders.

Role-based Authorization Strategy Plugin 3.1.1 requires Item/Read permission on parent items to grant Item/Read permission on an individual item.

As a workaround in older releases, do not grant permissions on individual items to users who do not have access to parent items.

In case of problems, the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `com.michelin.cio.hudson.plugins.rolestrategy.RoleMap.checkParentPermissions` can be set to false, completely disabling this fix.
Moodle Does Not Escape Characters In Email Headers
Advisory: GHSA-2hh3-jmv8-5fmx
Aliases: CVE-2016-5013
Published: 2022-05-13T01:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

In Moodle 2.x and 3.x, text injection can occur in email headers, potentially leading to outbound spam.
Regular expression denial of service in Apache ShenYu
Advisory: GHSA-cw56-j3fm-7w57
Aliases: CVE-2022-26650
Published: 2022-05-18T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.java uses Pattern.matches(conditionData.getParamValue(), realData) to make judgments, where both parameters are controllable by the user. This can cause an attacker pass in malicious regular expressions and characters causing a resource exhaustion. This issue affects Apache ShenYu (incubating) 2.4.0, 2.4.1 and 2.4.2 and is fixed in 2.4.3.
Setuptools vulnerable to Man-in-the-middle attacks
Advisory: GHSA-27x4-j476-jp5f
Aliases: CVE-2013-1633
Published: 2022-05-17T05:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
phpMyAdmin Cryptographic Vulnerability
Advisory: GHSA-9xhq-pm7v-693p
Aliases: CVE-2016-9847
Published: 2022-05-17T02:36:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An issue was discovered in phpMyAdmin. When the user does not specify a blowfish_secret key for encrypting cookies, phpMyAdmin generates one at runtime. A vulnerability was reported where the way this value is created uses a weak algorithm. This could allow an attacker to determine the user's blowfish_secret and potentially decrypt their cookies. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
Magento 2 Community Edition Cryptographic Flaw
Advisory: GHSA-7h8v-f2g9-39fx
Aliases: CVE-2019-7858
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information with an algorithm that is insufficiently resistant to brute force attacks.
Nokogiri vulnerable to DoS while parsing XML documents
Advisory: GHSA-62qp-3fxm-9wxf
Aliases: CVE-2013-6460
Published: 2022-05-05T00:29:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Nokogiri gem has Denial of Service via infinite loop when parsing XML documents
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-7cjc-xppr-xj6x
Aliases: CVE-2019-10403
Published: 2022-05-24T22:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not escape the SCM tag name on the tooltip for SCM tag actions, resulting in a stored XSS vulnerability exploitable by users able to control SCM tag names for these actions.
Improper Access Control in Apache Shiro
Advisory: GHSA-4q2v-j639-cp7p
Aliases: CVE-2016-6802
Published: 2022-05-14T02:46:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet context path.
Metasploit Framework user exposes Metasploit to same deserialization issue that is exploited by that module
Advisory: GHSA-xgww-h98f-24qf
Aliases: CVE-2020-7385
Published: 2022-05-24T17:48:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a "hack-back" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.
Missing Initialization of Resource in Apache Arrow
Advisory: GHSA-8cw2-jv5c-c825
Aliases: CVE-2019-12408
Published: 2022-05-24T17:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow 0.14.0 to 0.14.1 had a uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
Missing Authorization in Jenkins SSH plugin
Advisory: GHSA-7h2j-h5xp-h3gh
Aliases: CVE-2022-30959
Published: 2022-05-18T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
phpMyAdmin CSRF Vulnerability
Advisory: GHSA-xwf2-53mc-r8hx
Aliases: CVE-2018-19969
Published: 2022-05-14T01:09:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

phpMyAdmin 4.7.x and 4.8.x versions prior to 4.8.4 are affected by a series of CSRF flaws. By deceiving a user into clicking on a crafted URL, it is possible to perform harmful SQL operations such as renaming databases, creating new tables/routines, deleting designer pages, adding/deleting users, updating user passwords, killing SQL processes, etc.
Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow
Advisory: GHSA-xrp2-fhq4-4q3w
Aliases: CVE-2022-29211
Published: 2022-05-24T22:15:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.histogram_fixed_width`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc) is vulnerable to a crash when the values array contain `NaN` elements:

```python
import tensorflow as tf
import numpy as np

tf.histogram_fixed_width(values=np.nan, value_range=[1,2])
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/histogram_op.cc#L35-L74) assumes that all floating point operations are defined and then converts a floating point result to an integer index:

```cc
index_to_bin.device(d) =
    ((values.cwiseMax(value_range(0)) - values.constant(value_range(0)))
         .template cast<double>() /
     step)
        .cwiseMin(nbins_minus_1)
        .template cast<int32>();
```

If `values` contains `NaN` then the result of the division is still `NaN` and the cast to `int32` would result in a crash.

This only occurs on the CPU implementation.

### Patches
We have patched the issue in GitHub commit [e57fd691c7b0fd00ea3bfe43444f30c1969748b5](https://github.com/tensorflow/tensorflow/commit/e57fd691c7b0fd00ea3bfe43444f30c1969748b5).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/45770).
Jenkins CCM Plugin vulnerable to Improper Restriction of XML External Entity Reference
Advisory: GHSA-c4mp-h3m2-h5mc
Aliases: CVE-2018-1000054
Published: 2022-05-14T03:38:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Jenkins CCM Plugin 3.1 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
Password stored in plain text by Parasoft Environment Manager Plugin
Advisory: GHSA-gmg2-3w6v-945p
Aliases: CVE-2020-2132
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Parasoft Environment Manager Plugin 2.14 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Users with Overall/Read access could enumerate credentials IDs in Jenkins Fortify on Demand Plugin
Advisory: GHSA-fph2-fwjq-prjf
Aliases: CVE-2020-2202
Published: 2022-05-24T17:22:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fortify on Demand Plugin provides a list of applicable credentials IDs to allow users configuring the plugin to select the one to use.

This functionality does not correctly check permissions in Fortify on Demand Plugin 6.0.0 and earlier, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Fortify on Demand Plugin 6.0.1 now requires the appropriate permissions.
Magento 2 Community Edition Unsafe File Upload
Advisory: GHSA-v527-6h5r-cfg8
Aliases: CVE-2019-7871
Published: 2022-05-24T16:52:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection.
GleamTech FileUltimate Cross-site Scripting
Advisory: GHSA-rrwx-8wm4-qhh4
Aliases: CVE-2020-15015
Published: 2022-05-24T17:21:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The FileExplorer component in GleamTech FileUltimate 6.1.5 allows XSS via an SVG document.
Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows enumerating credentials IDs
Advisory: GHSA-h246-g39x-7vmx
Aliases: CVE-2021-21662
Published: 2022-05-24T22:01:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

XebiaLabs XL Deploy Plugin 10.0.1 and earlier does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in XebiaLabs XL Deploy Plugin 10.0.2 requires the appropriate permissions.
Ruby vulnerable to denial of service
Advisory: GHSA-hgg7-cghq-xhf4
Aliases: CVE-2013-1821
Published: 2022-05-17T03:23:26Z

When reading text nodes from an XML document, the REXML parser can be coerced in to allocating extremely large string objects which can consume all of the memory on a machine, causing a denial of service.

Jruby resolves this bug in version 1.7.3 as noted in https://www.jruby.org/2013/02/21/jruby-1-7-3.html
Integer overflow in solana_rbpf
Advisory: GHSA-ffx3-8qvm-pq3j
Aliases: CVE-2022-31264
Published: 2022-05-22T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program.
Symfony Allows URI Restrictions Bypass Via Double-Encoded String
Advisory: GHSA-83c3-qx27-2rwr
Aliases: CVE-2012-6431
Published: 2022-05-17T05:17:03Z

On the Symfony 2.0.x version, there's a security issue that allows access to routes protected by a firewall even when the user is not logged in.

Both the Routing component and the Security component uses the path returned by `getPathInfo()` to match a Request. The `getPathInfo()` returns a decoded path, but the Routing component (`Symfony\Component\Routing\Matcher\UrlMatcher`) decodes the path a second time; whereas the Security component, `Symfony\Component\HttpFoundation\RequestMatcher`, does not.

This difference causes Symfony 2.0 to be vulnerable to double encoding attacks.
dhowden tag panic due to out-of-bounds read
Advisory: GHSA-wg79-2cgp-qrjm
Aliases: CVE-2020-29245
Published: 2022-05-24T17:37:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Due to improper bounds checking, a number of methods in dhowden tag before 0.0.0-20201120070457-d52dcb253c63 can trigger a panic via `readAtomData` due to attempted out-of-bounds reads. If the package is used to parse user supplied input, this may be used as a vector for a denial of service attack.
ChakraCore RCE Vulnerability
Advisory: GHSA-vfjw-crcq-q92v
Aliases: CVE-2016-3199
Published: 2022-05-14T02:24:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3214.
Nokogiri vulnerable to libxslt protection mechanism bypass
Advisory: GHSA-qxcg-xjjg-66mj
Aliases: CVE-2019-11068
Published: 2022-05-13T01:21:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A dependency of Nokogiri, libxslt through 1.1.33 allows bypass of a protection mechanism because callers of `xsltCheckRead` and `xsltCheckWrite` permit access even upon receiving a `-1` error code. `xsltCheckRead` can return `-1` for a crafted URL that is not actually invalid and is subsequently loaded.
Access to Unix domain socket can lead to privileges escalation in Cilium
Advisory: GHSA-6p8v-8cq8-v2r3
Aliases: CVE-2022-29178
Published: 2022-05-24T21:14:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

### Impact

Users with host file system access on a node and the privileges to run as group ID 1000 can gain access to the per node API of Cilium via Unix domain socket on the host where Cilium is running. If a malicious user is able to gain unprivileged access to a user corresponding to this group, then they can leverage this access to compromise the integrity as well as system availability on that host. Operating Systems that have unprivileged users **not** belonging the group ID 1000 are **not** affected by this vulnerability.

Best practices for managing the secure deployment of Kubernetes clusters will typically limit the ability for a malicious user to deploy pods with access to this group or to access the host filesystem, and limit user access to the nodes for users belonging to this group. These best practices include (but are not limited to) enforcing Admission Control policies to limit the configuration of Kubernetes Pod [hostPath](https://kubernetes.io/docs/concepts/storage/volumes/#hostpath) and [SecurityContext](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) fields.

### Patches

Cilium versions >=1.9.16, >=1.10.11, >=1.11.5 mitigate this issue by setting the default group to 0 (root).

### Workarounds

Prevent Cilium from running with group 1000 by modifying Cilium's DaemonSet to run with the following command:

```yaml
      containers:
      - name: cilium-agent
        args:
        - -c
        - "groupdel cilium && cilium-agent --config-dir=/tmp/cilium/config-map"
        command:
        - bash
```
instead of
```yaml
      containers:
      - name: cilium-agent
        args:
        - --config-dir=/tmp/cilium/config-map
        command:
        - cilium-agent
```

### Acknowledgements

The Cilium community has worked together with members of Isovalent and Form 3 to prepare these mitigations.  Special thanks to Daniel Iziourov and Daniel Teixeira for their cooperation.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@cilium.io](mailto:security@cilium.io)
Improper Limitation of a Pathname to a Restricted Directory in Apache Solr
Advisory: GHSA-j8qw-mwmv-28cg
Aliases: CVE-2013-6397
Published: 2022-05-17T04:04:29Z

Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT.  NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
Loop with Unreachable Exit Condition in Netty
Advisory: GHSA-rv63-gqm8-9w8q
Aliases: CVE-2016-4970
Published: 2022-05-13T01:11:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
Bundler may install gems from a different source than expected
Advisory: GHSA-49jx-9cmc-xjxm
Aliases: CVE-2013-0334
Published: 2022-05-05T02:48:48Z

Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
Missing XML Validation in Spring Framework
Advisory: GHSA-vp63-rrcm-9mph
Aliases: CVE-2013-7315
Published: 2022-05-13T01:02:38Z

The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.
OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Advisory: GHSA-qhch-g8qr-p497
Aliases: CVE-2014-3641
Published: 2022-05-17T04:21:11Z

The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from the Cinder-volume host by cloning and attaching a volume with a crafted qcow2 header.
Exposure of repository credentials to external third-party sources in Rancher
Advisory: GHSA-4fc7-hc63-7fjg
Aliases: CVE-2021-36778
Published: 2022-05-02T19:33:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

### Impact
This issue only happens when the user configures access credentials to a private repository in Rancher inside `Apps & Marketplace > Repositories`. It affects Rancher versions 2.5.0 up to and including 2.5.11 and from 2.6.0 up to and including 2.6.2.

An insufficient check of the same-origin policy when downloading Helm charts from a configured private repository can lead to exposure of the repository credentials to a third-party provider. This exposure happens when the private repository:

1. Does an HTTP redirect to a third-party repository or external storage provider.
2. Downloads an icon resource for the chart hosted on a third-party provider.

The address of the private repository is not leaked, only the credentials are leaked in the HTTP `Authorization` header in base64 format.

With the patched versions, the default behavior now is to only send the private repository credentials when subdomain or domain hostname match when following the redirect or downloading external resources.

### Patches
Patched versions include releases 2.5.12, 2.6.3 and later versions.

### Workarounds
1. Update Rancher to a patched version.
2. Check the Helm charts in your configured private repository for possible redirects to third-party storage, and for Helm chart icons from third-party sources.
3. Evaluate any Helm chart that might lead to the mentioned scenario and change affected credentials if deemed necessary.

### References
Information about the same-origin check and how to disable it is available in Rancher [documentation](https://rancher.com/docs/rancher/v2.6/en/helm-charts/#repositories).

### For more information
If you have any questions or comments about this advisory:
* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).
OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information
Advisory: GHSA-5mj6-643f-2g85
Aliases: CVE-2013-2256
Published: 2022-05-14T01:58:46Z

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.
Jenkins Embeddable Build Status Plugin contains Cross-site Scripting
Advisory: GHSA-94rj-c4jj-v476
Aliases: CVE-2019-10346
Published: 2022-05-24T16:50:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin.
Credentials transmitted in plain text by Skytap Cloud CI Plugin
Advisory: GHSA-q2wv-m3pq-xpv9
Aliases: CVE-2020-2157
Published: 2022-05-24T17:10:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Skytap Cloud CI Plugin stores credentials in job `config.xml` files as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Skytap Cloud CI Plugin 2.07 and earlier. These credentials could be viewed by users with Extended Read permission.
Cross site scripting in Croogo
Advisory: GHSA-r4h9-gv2m-9x97
Aliases: CVE-2017-1000510
Published: 2022-05-14T03:41:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Croogo versions before 4.x contain a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.