aswin1906/github-advisory-2022 huggingface dataset:
Improper Link Resolution Before File Access in Apache Hadoop
Advisory: GHSA-jpmf-8cj2-595g
Aliases: CVE-2014-3627
Published: 2022-05-17T04:20:31Z

The YARN NodeManager daemon in Apache Hadoop 0.23.0 through 0.23.11 and 2.x before 2.5.2, when using Kerberos authentication, allows remote cluster users to change the permissions of certain files to world-readable via a symlink attack in a public tar archive, which is not properly handled during localization, related to distributed cache.
Credentials stored in plain text by Jenkins tfs Plugin
Advisory: GHSA-w6c2-jrhh-jrxg
Aliases: CVE-2020-2249
Published: 2022-05-24T17:27:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

tfs Plugin 5.157.1 and earlier stores a webhook secret unencrypted in its global configuration file `hudson.plugins.tfs.TeamPluginGlobalConfig.xml` on the Jenkins controller as part of its configuration. This secret can be viewed by attackers with access to the Jenkins controller file system.
Moodle is vulnerable to Improper Input Validation in MoodleQuickForm class
Advisory: GHSA-m63h-q4x3-6hwj
Aliases: CVE-2013-2083
Published: 2022-05-13T01:12:59Z

The MoodleQuickForm class in `lib/formslib.php` in Moodle through 2.1.10, 2.2.x before 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly handle a certain array-element syntax, which allows remote attackers to bypass intended form-data filtering via a crafted request.
Improper Input Validation in Apache ActiveMQ
Advisory: GHSA-23cr-5hr4-rgwv
Aliases: CVE-2015-6524
Published: 2022-05-17T03:22:06Z

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
Exposure of Sensitive Information in Gradle publish plugin
Advisory: GHSA-cv78-v957-jx34
Aliases: CVE-2020-7599
Published: 2022-05-24T17:12:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is publicly visible (as it is in many popular public CI systems like TravisCI) this AWS pre-signed URL would allow a malicious actor to replace a recently uploaded plugin with their own.
ChakraCore RCE Vulnerability
Advisory: GHSA-j69r-w67w-gf35
Aliases: CVE-2016-0191
Published: 2022-05-14T02:24:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0186 and CVE-2016-0193.
Symfony Authentication Bypass
Advisory: GHSA-wvj5-r78r-hhfq
Aliases: CVE-2016-2403
Published: 2022-05-14T03:10:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
RCE vulnerability in RadarGun Plugin
Advisory: GHSA-723p-9rcj-xv8j
Aliases: CVE-2020-2123
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution vulnerability exploitable by users able to configure RadarGun Plugin’s build step.

RadarGun Plugin 1.8 configures its YAML parser to only instantiate safe types.
Magento 2 Community Edition IDOR Vulnerability
Advisory: GHSA-hpxv-vpfv-7jc9
Aliases: CVE-2019-7854
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.
Deserialization of Untrusted Data in org.codehaus.jackson:jackson-mapper-asl
Advisory: GHSA-c27h-mcmw-48hv
Aliases: CVE-2019-10202
Published: 2022-05-24T16:57:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.
ChakraCore RCE Vulnerability
Advisory: GHSA-3cwf-pwcg-57xr
Aliases: CVE-2018-0835
Published: 2022-05-13T01:18:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
Magmi XSS Vulnerability
Advisory: GHSA-r8vh-cm9f-rc29
Aliases: CVE-2017-7391
Published: 2022-05-17T02:51:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A Cross-Site Scripting (XSS) was discovered in Magmi 0.7.22. The vulnerability exists due to insufficient filtration of user-supplied data (prefix) passed to the `magmi-git-master/magmi/web/ajax_gettime.php` URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website.
Apache Tomcat Allows Replacing of XML Parser
Advisory: GHSA-r7c8-hghc-2mp8
Aliases: CVE-2011-2481
Published: 2022-05-17T02:44:28Z

Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.  NOTE: this vulnerability exists because of a CVE-2009-0783 regression.
Improper Control of Generation of Code in Apache Kafka
Advisory: GHSA-gh27-38p5-mrxc
Aliases: CVE-2018-1288
Published: 2022-05-13T01:02:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss.
OpenStack Image Service (Glance) vulnerable to Improper Access Control
Advisory: GHSA-5xrj-ghhp-hx7p
Aliases: CVE-2016-0757
Published: 2022-05-17T03:43:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show_multiple_locations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image.
Subrion CMS XSS
Advisory: GHSA-mxv3-qcmf-r6wj
Aliases: CVE-2018-16629
Published: 2022-05-14T01:31:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

`panel/uploads/#elf_l1_XA` in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
Stored XSS vulnerability in Coverage/Complexity Scatter Plot Plugin
Advisory: GHSA-f6mg-hmfp-6grw
Aliases: CVE-2020-2265
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not escape the method information in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step.
OpenStack Object Storage (swift) Code Injection vulnerability
Advisory: GHSA-v7mh-3jgf-r26c
Aliases: CVE-2012-4406
Published: 2022-05-17T01:42:16Z

OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote attackers to execute arbitrary code via a crafted pickle object.
Ignite Realtime Openfire vulnerable to XMPPbomb attack
Advisory: GHSA-j5qh-cp3p-2h87
Aliases: CVE-2014-2741
Published: 2022-05-17T04:44:51Z

nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-gfhf-2xr5-2fvw
Aliases: CVE-2019-19211
Published: 2022-05-24T17:11:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.
Improper path handling in Kustomization files allows for denial of service
Advisory: GHSA-7pwf-jg34-hxwp
Aliases: CVE-2022-24878
Published: 2022-05-20T16:58:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

The kustomize-controller enables the use of Kustomize’s functionality when applying Kubernetes declarative state onto a cluster. A malicious user can use a specially crafted `kustomization.yaml` to cause Denial of Service at controller level.

In multi-tenancy deployments this can lead to multiple tenants not being able to apply their Kustomizations until the malicious `kustomization.yaml` is removed and the controller restarted.

### Impact

Within the affected versions, users with write access to a Flux source are able to craft a malicious `kustomization.yaml` file which causes the controller to enter an endless loop.

### Patches

This vulnerability was fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0 released on 2022-04-20. The changes introduce better handling of Kustomization files blocking references that could lead to endless loops.

### Credits

The Flux engineering team found and patched this vulnerability.

### For more information

If you have any questions or comments about this advisory please open an issue in the [flux2 repository](http://github.com/fluxcd/flux2).
golang.org/x/crypto/salsa20/salsa uses insufficiently random values
Advisory: GHSA-r5c5-pr8j-pfp7
Aliases: CVE-2019-11840
Published: 2022-05-24T16:45:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

### Specific Go Packages Affected
golang.org/x/crypto/salsa20/salsa
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Advisory: GHSA-rh8q-vjgf-gf74
Aliases: CVE-2015-5345
Published: 2022-05-14T01:10:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
Magento 2 Community Edition Arbitrary File Deletion
Advisory: GHSA-653q-vqm6-gmjm
Aliases: CVE-2019-8090
Published: 2022-05-24T17:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-jxjc-6xmh-h7mg
Aliases: CVE-2020-24408
Published: 2022-05-24T17:31:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.
ChakraCore RCE Vulnerability
Advisory: GHSA-q9x6-7hjh-q9fc
Aliases: CVE-2018-0857
Published: 2022-05-13T01:18:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
CodeIgniter Session Fixation Vulnerability
Advisory: GHSA-g434-3q2j-hj4r
Aliases: CVE-2018-12071
Published: 2022-05-14T03:08:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A Session Fixation issue exists in CodeIgniter before 3.1.9 because `session.use_strict_mode` in the Session Library was mishandled.
Improper Neutralization of Input During Web Page Generation in Apache Hadoop
Advisory: GHSA-qm7f-r83w-3p46
Aliases: CVE-2017-3161
Published: 2022-05-13T01:08:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The HDFS web UI in Apache Hadoop before 2.7.0 is vulnerable to a cross-site scripting (XSS) attack through an unescaped query parameter.
CSRF vulnerability in Jenkins Amazon EC2 Plugin
Advisory: GHSA-9hvf-pfq3-7pp6
Aliases: CVE-2020-2090
Published: 2022-05-24T17:06:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Amazon EC2 Plugin 1.47 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.

This vulnerability might also allow attackers to capture credentials stored in Jenkins. We have not been able to confirm that this is possible.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

Amazon EC2 Plugin 1.48 requires POST requests and Overall/Administer permission for the affected form validation methods.
ChakraCore RCE Vulnerability
Advisory: GHSA-8h76-7vc3-mj3v
Aliases: CVE-2017-11792
Published: 2022-05-17T00:32:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allow an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11793, CVE-2017-11796, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
rtslib-fb weak permissions for /etc/target/saveconfig.json file
Advisory: GHSA-cpcw-p965-wpqx
Aliases: CVE-2020-14019
Published: 2022-05-24T17:21:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Python rtslib-fb through 2.1.72 has weak permissions for `/etc/target/saveconfig.json` because shutil.copyfile (instead of shutil.copy) is used, and thus permissions are not preserved.
Symfony Host Header Injection vulnerability in the HttpFoundation component
Advisory: GHSA-22pv-7v9j-hqxp
Aliases: CVE-2013-4752
Published: 2022-05-05T00:29:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Symfony 2.0.X before 2.0.24, 2.1.X before 2.1.12, 2.2.X before 2.2.5, and 2.3.X before 2.3.3 have an issue in the HttpFoundation component. The Host header can be manipulated by an attacker when the framework is generating an absolute URL. A remote attacker could exploit this vulnerability to inject malicious content into the Web application page and conduct various attacks.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-g8pg-qrvm-wgh2
Aliases: CVE-2020-2161
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages, resulting in a stored XSS vulnerability exploitable by users able to define node labels.
Backpack\CRUD for Laravel XSS Vulnerability
Advisory: GHSA-6gfm-gpr3-8wh9
Aliases: CVE-2018-20962
Published: 2022-05-24T16:52:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Backpack\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.
Segfault and OOB write due to incomplete validation in `EditDistance` in TensorFlow
Advisory: GHSA-2r2f-g8mw-9gvr
Aliases: CVE-2022-29208
Published: 2022-05-24T22:14:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

### Impact
The implementation of [`tf.raw_ops.EditDistance`]() has incomplete validation. Users can pass negative values to cause a segmentation fault based denial of service:

```python
import tensorflow as tf

hypothesis_indices = tf.constant(-1250999896764, shape=[3, 3], dtype=tf.int64) 
hypothesis_values = tf.constant(0, shape=[3], dtype=tf.int64)
hypothesis_shape = tf.constant(0, shape=[3], dtype=tf.int64)

truth_indices = tf.constant(-1250999896764, shape=[3, 3], dtype=tf.int64)
truth_values = tf.constant(2, shape=[3], dtype=tf.int64)
truth_shape = tf.constant(2, shape=[3], dtype=tf.int64) 

tf.raw_ops.EditDistance(
  hypothesis_indices=hypothesis_indices,
  hypothesis_values=hypothesis_values,
  hypothesis_shape=hypothesis_shape,
  truth_indices=truth_indices,
  truth_values=truth_values,
  truth_shape=truth_shape)
```

In multiple places throughout the code, we are computing an index for a write operation:

```cc
if (g_truth == g_hypothesis) {
  auto loc = std::inner_product(g_truth.begin(), g_truth.end(),
                                output_strides.begin(), int64_t{0});
  OP_REQUIRES(
      ctx, loc < output_elements,
      errors::Internal("Got an inner product ", loc,
                       " which would require in writing to outside of "
                       "the buffer for the output tensor (max elements ",
                       output_elements, ")"));
  output_t(loc) =
      gtl::LevenshteinDistance<T>(truth_seq, hypothesis_seq, cmp);
  // ...
}
```

However, the existing validation only checks against the upper bound of the array. Hence, it is possible to write before the array by massaging the input to generate negative values for `loc`.

### Patches
We have patched the issue in GitHub commit [30721cf564cb029d34535446d6a5a6357bebc8e7](https://github.com/tensorflow/tensorflow/commit/30721cf564cb029d34535446d6a5a6357bebc8e7).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
protobuf susceptible to buffer overflow
Advisory: GHSA-jwvw-v7c5-m82h
Aliases: CVE-2015-5237
Published: 2022-05-13T01:06:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.
Deserialization of Untrusted Data in Spring Security
Advisory: GHSA-vhrg-v3cv-p247
Aliases: CVE-2017-4995
Published: 2022-05-13T01:02:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Pivotal Spring Security 4.2.0.RELEASE through 4.2.2.RELEASE, and Spring Security 5.0.0.M1. When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets." Spring Security configures Jackson with global default typing enabled, which means that (through the previous exploit) arbitrary code could be executed if all of the following is true: (1) Spring Security's Jackson support is being leveraged by invoking SecurityJackson2Modules.getModules(ClassLoader) or SecurityJackson2Modules.enableDefaultTyping(ObjectMapper); (2) Jackson is used to deserialize data that is not trusted (Spring Security does not perform deserialization using Jackson, so this is an explicit choice of the user); and (3) there is an unknown (Jackson is not blacklisting it already) "deserialization gadget" that allows code execution present on the classpath. Jackson provides a blacklisting approach to protecting against this type of attack, but Spring Security should be proactive against blocking unknown "deserialization gadgets" when Spring Security enables default typing.
ChakraCore RCE Vulnerability
Advisory: GHSA-6xmv-mx7q-789r
Aliases: CVE-2018-8456
Published: 2022-05-13T01:20:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8354, CVE-2018-8391, CVE-2018-8457, CVE-2018-8459.
Nablarch Incomplete Cryptography
Advisory: GHSA-hmx6-gc2p-5p82
Aliases: CVE-2019-5919
Published: 2022-05-13T01:08:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

An incomplete cryptography of the data store function by using hidden tag in Nablarch 5 (5, and 5u1 to 5u13) allows remote attackers to obtain information of the stored data, to register invalid value, or alter the value via unspecified vectors.
ChakraCore RCE Vulnerability
Advisory: GHSA-rhvg-r9fw-9wqj
Aliases: CVE-2018-8557
Published: 2022-05-13T01:20:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8541, CVE-2018-8542, CVE-2018-8543, CVE-2018-8551, CVE-2018-8555, CVE-2018-8556, CVE-2018-8588.
Apache Ambari Open Redirect
Advisory: GHSA-w3p6-94x2-xcvm
Aliases: CVE-2015-5210
Published: 2022-05-17T04:03:11Z

Open redirect vulnerability in Apache Ambari before 2.1.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the targetURI parameter.
papercrop does not properly handle crop input
Advisory: GHSA-m44r-gv6q-9j9r
Aliases: CVE-2015-2784
Published: 2022-05-24T17:06:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The papercrop gem before 0.3.0 for Ruby on Rails does not properly handle crop input.
Improper Neutralization of Special Elements used in an LDAP Query in Jenkins
Advisory: GHSA-2x9h-h3c4-wqqh
Aliases: CVE-2016-9299
Published: 2022-05-14T01:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-crg2-6xv3-qg5f
Aliases: CVE-2020-2162
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins 2.227 and earlier, LTS 2.204.5 and earlier served files uploaded as file parameters to a build without specifying appropriate `Content-Security-Policy HTTP` headers. This resulted in a stored cross-site scripting (XSS) vulnerability exploitable by users with permissions to build a job with file parameters.\n\nJenkins now sets `Content-Security-Policy` HTTP headers when serving files uploaded via a file parameter to the same value as used for files in workspaces and archived artifacts not served using the Resource Root URL.\n\nThe system property `hudson.model.DirectoryBrowserSupport.CSP` can be set to override the value of `Content-Security-Policy` headers sent when serving these files. This is the same system property used for files in workspaces and archived artifacts unless those are served via the [Resource Root URL](https://www.jenkins.io/doc/upgrade-guide/2.204/#resource-domain-support) and works the same way for file parameters. See [Configuring Content Security Policy](https://www.jenkins.io/doc/book/security/configuring-content-security-policy) to learn more.\n\nEven when Jenkins is configured to serve files in workspaces and archived artifacts using the Resource Root URL (introduced in Jenkins 2.200), file parameters are not, and therefore still subject to `Content-Security-Policy` restrictions.
Django Access Restrictions Bypass 
Advisory: GHSA-46x4-9jmv-jc8p
Aliases: CVE-2016-2048
Published: 2022-05-17T03:43:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Django 1.9.x before 1.9.2, when `ModelAdmin.save_as` is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission.
Plone Arbitrary File Read
Advisory: GHSA-pvhv-qwc8-r2pg
Aliases: CVE-2012-5501
Published: 2022-05-17T04:32:23Z

`at_download.py` in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.
Direct Web Remoting vulnerable to Denial of Service
Advisory: GHSA-hg5p-233h-c7fh
Aliases: CVE-2007-0185
Published: 2022-05-01T17:42:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors related to a large number of calls in a batch.
Typo3 Vulnerable to Cache Poisoning
Advisory: GHSA-5479-gqqr-f9gj
Aliases: CVE-2014-9509
Published: 2022-05-17T04:18:00Z

**Problem Description:** A request URL with arbitrary arguments, but still pointing to the home page of  a TYPO3 installation can be cached if the configuration option `config.prefixLocalAnchors` is used with the values "all" or "cached". The impact of this vulnerability is that unfamiliar looking links to the home page can end up in the cache, which leads to a reload of the page in the browser when section links are followed by web page visitors, instead of just directly jumping to the requested section of the page. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page.

**Solution:** Removing the configuration options `config.prefixLocalAnchors` (and optionally also config.baseUrl) in favor of `config.absRefPrefix`

**Credits:** Thanks to Gernot Leitgab who discovered and reported the vulnerability.
Buffer overflow in Jenkins WMI Windows Agents plugin
Advisory: GHSA-xhw3-wmx2-76wf
Aliases: CVE-2022-30950
Published: 2022-05-18T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library. It provides a general-purpose remote command execution capability that Jenkins uses to check if Java is available, and if not, to install it.

This library has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine.

Additionally, while the processes are started as the user who connects to the named pipe, no access control takes place, potentially allowing users to start processes even if they’re not allowed to log in.

WMI Windows Agents Plugin 1.8.1 no longer includes the Windows Remote Command library. A Java runtime is expected to be available on agent machines and WMI Windows Agents Plugin 1.8.1 does not install a JDK automatically otherwise.
ChakraCore RCE Vulnerability
Advisory: GHSA-294j-r53x-w786
Aliases: CVE-2016-3389
Published: 2022-05-14T02:23:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3386, CVE-2016-7190, and CVE-2016-7194.
TripleO Heat templates might allow remote attackers to obtain sensitive information from private containers
Advisory: GHSA-8936-44gw-7664
Aliases: CVE-2015-5271
Published: 2022-05-17T03:56:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.
Log value insertion in craftercms
Advisory: GHSA-545f-pgp7-fwjf
Aliases: CVE-2021-23266
Published: 2022-05-17T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

An anonymous user can craft a URL with text that ends up in the log viewer as is. The text can then include textual messages to mislead the administrator.
Jenkins S3 Publisher Plugin transmits credentials in plain text during configuration
Advisory: GHSA-ffr6-8cv5-j637
Aliases: CVE-2020-2114
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

S3 Publisher Plugin stores a secret key in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by S3 publisher Plugin 0.11.4 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations. S3 Publisher Plugin 0.11.5 transmits the secret key in its global configuration encrypted.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-r68f-45jg-64m6
Aliases: CVE-2019-7927
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit product content pages to inject malicious javascript.
Exposure of Sensitive Information to an Unauthorized Actor in Undertow
Advisory: GHSA-vf6r-mmhc-3xcm
Aliases: CVE-2018-14642
Published: 2022-05-13T01:12:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.
Showdoc Unauthenticated Access
Advisory: GHSA-pfrc-5hhq-6hvr
Aliases: CVE-2018-19620
Published: 2022-05-13T01:50:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

ShowDoc 2.4.1 allows remote attackers to edit other users' notes by navigating with a modified `page_id`.
python-keystoneclient unsecure user password update
Advisory: GHSA-8q2m-pwxf-jc7g
Aliases: CVE-2013-2013
Published: 2022-05-17T00:55:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.
Magento 2 Community Edition RCE Vulnerability via SSRF
Advisory: GHSA-w3r8-fxv5-58pp
Aliases: CVE-2019-7892
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery.
Path traversal vulnerability in Jenkins agent names
Advisory: GHSA-pxgq-gqr9-5gwx
Aliases: CVE-2021-21605
Published: 2022-05-24T17:39:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier allows users with Agent/Configure permission to choose agent names that cause Jenkins to override unrelated `config.xml` files. If the global `config.xml` file is replaced, Jenkins will start up with unsafe legacy defaults after a restart.

Jenkins 2.275, LTS 2.263.2 ensures that agent names are considered valid names for items to prevent this problem.

In case of problems, this change can be reverted by setting the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `jenkins.model.Nodes.enforceNameRestrictions` to `false`.
Improper Neutralization of Input During Web Page Generation Apache Sling Servlets Post
Advisory: GHSA-8c82-9rgp-4qvr
Aliases: CVE-2017-9802
Published: 2022-05-14T02:45:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings, which allows for XSS attacks by passing specially crafted input strings.
Elefant CMS Improper Input Validation
Advisory: GHSA-pcf7-5974-vjh4
Aliases: CVE-2018-15601
Published: 2022-05-14T02:20:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

`apps/filemanager/handlers/upload/drop.php` in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
Jenkins Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Advisory: GHSA-8x8p-mfwv-9fjw
Aliases: CVE-2014-3680
Published: 2022-05-17T03:53:31Z

Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Job/READ permission to obtain the default value for the password field of a parameterized job by reading the DOM.
Improper Control of Generation of Code in Spring Security
Advisory: GHSA-5xm9-rf63-wj7h
Aliases: CVE-2011-2732
Published: 2022-05-17T05:18:15Z

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
ChakraCore RCE Vulnerability
Advisory: GHSA-hrf4-ww4w-6rv6
Aliases: CVE-2017-11797
Published: 2022-05-17T00:32:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Magento 2 Community Weak PRNG
Advisory: GHSA-c4r2-3f9r-rwp8
Aliases: CVE-2019-8113
Published: 2022-05-24T17:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer registration.
JBoss KeyCloak Cross-site Scripting Vulnerability
Advisory: GHSA-px42-mr8m-cpgh
Aliases: CVE-2014-3656
Published: 2022-05-17T19:57:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

If a JBoss Keycloak application was configured to use `*` as a permitted web origin in the Keycloak administrative console, crafted requests to the `login-status-iframe.html` endpoint could inject arbitrary Javascript into the generated HTML code via the "origin" query parameter, leading to a cross-site scripting (XSS) vulnerability.
jh_captcha for Typo3 XSS Vulnerability
Advisory: GHSA-23fm-v895-3qxq
Aliases: CVE-2020-15514
Published: 2022-05-24T17:22:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The jh_captcha extension through 2.1.3, and 3.x through 3.0.2, for TYPO3 allows XSS.
Missing Cryptographic Step in OWASP Enterprise Security API for Java
Advisory: GHSA-2g56-7jv7-wxxq
Aliases: CVE-2013-5960
Published: 2022-05-14T01:37:06Z

The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
Improper Neutralization of Input During Web Page Generation in JAMon
Advisory: GHSA-qpr7-5m63-hq2c
Aliases: CVE-2013-6235
Published: 2022-05-14T02:54:05Z

Multiple cross-site scripting (XSS) vulnerabilities in JAMon (Java Application Monitor) 2.7 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) listenertype or (2) currentlistener parameter to mondetail.jsp or ArraySQL parameter to (3) mondetail.jsp, (4) jamonadmin.jsp, (5) sql.jsp, or (6) exceptions.jsp.
Moodle Arbitrary Redirect
Advisory: GHSA-h798-h7ff-93xv
Aliases: CVE-2015-3175
Published: 2022-05-13T01:12:46Z

Multiple open redirect vulnerabilities in Moodle through 2.5.9, 2.6.x before 2.6.11, 2.7.x before 2.7.8, and 2.8.x before 2.8.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving an error page that links to a URL from an HTTP Referer header.
Missing permission checks in Jenkins OWASP Dependency-Track Plugin allow capturing credentials
Advisory: GHSA-xfrw-pcmc-r2p3
Aliases: CVE-2021-21632
Published: 2022-05-24T17:45:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing \"Secret text\" credentials stored in Jenkins. If no credentials ID is specified, the globally configured credential is used, if set up, and can likewise be captured.

OWASP Dependency-Track Plugin 3.1.1 requires appropriate permissions for the affected HTTP endpoints.
XXE vulnerability in Jenkins Nested View Plugin
Advisory: GHSA-5wc4-w63v-97c3
Aliases: CVE-2021-21680
Published: 2022-05-24T19:12:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Nested View Plugin 1.20 and earlier does not configure its XML transformer to prevent XML external entity (XXE) attacks.

This allows attackers able to configure views to have Jenkins parse a crafted view XML definition that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Nested View Plugin 1.21 disables external entity resolution for its XML transformer.
Fat Free CRM vulnerable to Exposure of Sensitive Information
Advisory: GHSA-f25h-3mj6-4jpg
Aliases: CVE-2013-7249
Published: 2022-05-17T04:55:27Z

Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for `users/1.xml`, a different vulnerability than CVE-2013-7224.
Exposure of Sensitive Information in System.Net.Http
Advisory: GHSA-2xjx-v99w-gqf3
Aliases: CVE-2019-0545
Published: 2022-05-14T01:41:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.
Missing permission checks in Jenkins P4 Plugin
Advisory: GHSA-f9v6-p7hp-c3qx
Aliases: CVE-2020-2142
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A missing permission check in Jenkins P4 Plugin 1.10.10 and earlier allows attackers with Overall/Read permission to trigger builds or add labels in the Perforce repository.

P4 Plugin 1.10.11 appropriate user permissions for the affected HTTP endpoints.
Use of Hard-coded Cryptographic Key in Apache Tomcat
Advisory: GHSA-6cr4-7c7p-p3xv
Aliases: CVE-2011-5064
Published: 2022-05-14T01:17:03Z

DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.
Python RSA allows attackers to spoof signatures
Advisory: GHSA-8rjr-6qq5-pj9p
Aliases: CVE-2016-1494
Published: 2022-05-14T00:59:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The verify function in the RSA package for Python (Python-RSA) before 3.3 allows attackers to spoof signatures with a small public exponent via crafted signature padding, aka a BERserk attack.
Joomla RCE Vulnerability
Advisory: GHSA-9m72-pw47-292w
Aliases: CVE-2018-17856
Published: 2022-05-13T01:19:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Joomla! before 3.8.13. com_joomlaupdate allows the execution of arbitrary code. The default ACL config enabled the ability of Administrator-level users to access com_joomlaupdate and trigger code execution.
Apache Struts Remote Java Code Execution
Advisory: GHSA-4wrr-9h5r-m92w
Aliases: CVE-2012-0391
Published: 2022-05-04T00:29:43Z

The `ExceptionDelegator` component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
Improper Access Control in JBoss mod_cluster
Advisory: GHSA-v2fp-h4qx-x3r6
Aliases: CVE-2012-1154
Published: 2022-05-17T05:18:47Z

mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
DNN Path Traversal via Zip Slip
Advisory: GHSA-4qf5-7xc2-wqpg
Aliases: CVE-2020-5187
Published: 2022-05-24T17:09:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal via unsafe handling of zip files
JacksonJsonpInterceptor susceptible to cross-site script inclusion (XSSI) attack
Advisory: GHSA-9xfc-j5mf-9w5p
Aliases: CVE-2016-6348
Published: 2022-05-17T02:49:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack.
Improper Certificate Validation in Jenkins Spira Importer Plugin
Advisory: GHSA-2j5w-cwc3-8hxw
Aliases: CVE-2019-16558
Published: 2022-05-24T17:03:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Jenkins Spira Importer Plugin 3.2.3 and earlier disables SSL/TLS certificate validation for the Jenkins master JVM.
Inconsistent Interpretation of HTTP Requests in Waitress
Advisory: GHSA-j7j6-7hfx-5522
Aliases: CVE-2019-16792
Published: 2022-05-24T17:07:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Stored XSS vulnerability in Jenkins VncRecorder Plugin
Advisory: GHSA-vqp8-h53h-3jfh
Aliases: CVE-2020-2205
Published: 2022-05-24T17:22:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

VncRecorder Plugin 1.25 and earlier does not escape a tool path in the `checkVncServ` form validation endpoint accessed e.g. via job configuration forms.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by Jenkins administrators.

VncRecorder Plugin 1.35 escapes the tool path.
Improper Access Control in Apache WSS4J
Advisory: GHSA-6r5v-hp32-fjqw
Aliases: CVE-2015-0227
Published: 2022-05-14T02:57:28Z

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."
Dolibarr ERP and CRM Insecure Encryption
Advisory: GHSA-98vc-98q7-57qf
Aliases: CVE-2017-7888
Published: 2022-05-17T02:45:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-9m48-54pj-h248
Aliases: CVE-2019-10383
Published: 2022-05-24T16:55:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.