aswin1906/github-advisory-2022 huggingface dataset:
Denial of service in go-ethereum
Advisory: GHSA-vrcc-g6vj-mh5w
Aliases: CVE-2021-42219
Published: 2022-03-18T00:01:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Go-Ethereum v1.10.9 was discovered to contain an issue which allows attackers to cause a denial of service (DoS) via sending an excessive amount of messages to a node. This is caused by missing memory in the component /ethash/algorithm.go.
Integer overflow in cmark-gfm table parsing extension leads to heap memory corruption
Advisory: GHSA-fmx4-26r3-wxpf
Published: 2022-03-03T20:28:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

CommonMarker uses `cmark-gfm` for rendering [Github Flavored Markdown](https://github.github.com/gfm/). An [integer overflow in `cmark-gfm`'s table row parsing](https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x) may lead to heap memory corruption when parsing tables who's marker rows contain more than UINT16_MAX columns. The impact of this heap corruption ranges from Information Leak to Arbitrary Code Execution.

If affected versions of CommonMarker are used for rendering remote user controlled markdown, this vulnerability may lead to Remote Code Execution (RCE).

### Patches

This vulnerability has been patched in the following CommonMarker release:

- v0.23.4

### Workarounds

The vulnerability exists in the table markdown extensions of `cmark-gfm`. Disabling any use of the table extension will prevent this vulnerability from being triggered.

### References

- https://github.com/github/cmark-gfm/security/advisories/GHSA-mc3g-88wq-6f4x

### Acknowledgements

We would like to thank Felix Wilhelm of Google's Project Zero for reporting this vulnerability

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [CommonMarker](http://github.com/gjtorikian/commonmarker)
Cross site request forgery in Jenkins Job and Node ownership Plugin
Advisory: GHSA-85f9-w9cx-h363
Aliases: CVE-2022-28150
Published: 2022-03-30T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Job and Node ownership Plugin 0.13.0 and earlier does not perform a permission check in several HTTP endpoints. This allows attackers with Item/Read permission to change the owners and item-specific permissions of a job. Additionally, this endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Exposure of Sensitive Information to an Unauthorized Actor in PhpMyAdmin
Advisory: GHSA-vx8q-j7h9-vf6q
Aliases: CVE-2022-0813
Published: 2022-03-11T00:02:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

PhpMyAdmin before 5.1.3 allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pma_parameter, and the cookie section.
Improper Verification of Cryptographic Signature in node-forge
Advisory: GHSA-x4jg-mjrx-434g
Aliases: CVE-2022-24772
Published: 2022-03-18T23:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### References

For more information, please see
["Bleichenbacher's RSA signature forgery based on implementation error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/)
by Hal Finney.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
CSRF vulnerability in Jenkins Job and Node ownership Plugin
Advisory: GHSA-9hcj-449v-9234
Aliases: CVE-2022-28152
Published: 2022-03-30T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers to restore the default ownership of a job.
Moodle reflected XSS
Advisory: GHSA-78fm-qhh8-8858
Aliases: CVE-2021-32478
Published: 2022-03-12T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected.
Remote code execution in net.mingsoft:ms-mcms
Advisory: GHSA-qwh6-xwj4-9cjg
Aliases: CVE-2021-46384
Published: 2022-03-05T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

net.mingsoft:ms-mcms <=5.2.5 is affected by: RCE. The impact is: execute arbitrary code (remote). The attack vector is: ${"freemarker.template.utility.Execute"?new()("calc")}. ¶¶ MCMS has a pre-auth RCE vulnerability through which allows unauthenticated attacker with network access via http to compromise MCMS. Successful attacks of this vulnerability can result in takeover of MCMS.
Stored Cross-site Scripting vulnerability in Jenkins Job and Node ownership Plugin
Advisory: GHSA-x63v-prhc-xx6f
Aliases: CVE-2022-28149
Published: 2022-03-30T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Job and Node ownership Plugin 0.13.0 and earlier does not escape the names of the secondary owners, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Cross-site Scripting in ShowDoc
Advisory: GHSA-mg5h-9rhq-4cqx
Aliases: CVE-2022-0937
Published: 2022-03-15T00:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Code Injection in PHPUnit
Advisory: GHSA-r7c9-c69m-rph8
Aliases: CVE-2017-9841
Published: 2022-03-26T00:19:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `<?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Open Redirect in django-spirit
Advisory: GHSA-5p9j-w2wx-qx4c
Aliases: CVE-2022-0869
Published: 2022-03-07T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.
Failure to validate signature during handshake
Advisory: GHSA-j3ff-xp6c-6gcc
Aliases: CVE-2022-24759
Published: 2022-03-18T18:57:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

### Impact
`@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process.
This may allow a man-in-the-middle to pose as other peers and get those peers banned.

### Patches
Users should upgrade to 4.1.2 or 5.0.3

### Workarounds
No workarounds, just patch upgrade

### References
https://github.com/ChainSafe/js-libp2p-noise/pull/130
Cross-site Scripting in ShowDoc
Advisory: GHSA-wg8p-w946-c482
Aliases: CVE-2022-0956
Published: 2022-03-16T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Cross Site Scripting (XSS) in @finastra/ssr-pages
Advisory: GHSA-7f63-h6g3-7cwm
Aliases: CVE-2022-24717
Published: 2022-03-01T22:09:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function.

### References
- https://github.com/Finastra/ssr-pages/pull/2
- https://github.com/Finastra/ssr-pages/pull/2/commits/133606ffaec2edd9918d9fba5771ed21da7876a5
- https://github.com/Finastra/ssr-pages/commit/98abc59e28fec48246be0d59ac144675d6361073
XML External Entity Reference vulnerability in Jenkins Pipeline: Phoenix AutoTest Plugin
Advisory: GHSA-rwg2-w82x-v57j
Aliases: CVE-2022-28155
Published: 2022-03-30T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
This allows attackers able to control the input files for the `readXml` or `writeXml` build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Cross-Site Request Forgery in Anchor CMS
Advisory: GHSA-322v-p3jc-7hrg
Aliases: CVE-2022-25576
Published: 2022-03-26T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component anchor/routes/posts.php. This vulnerability allows attackers to arbitrarily delete posts.
Multiple security issues in Pomerium's embedded envoy
Advisory: GHSA-j34v-3552-5r7j
Published: 2022-03-01T22:04:17Z

Envoy, which Pomerium is based on, has issued multiple CVEs impacting stability and security.

Though Pomerium may not be vulnerable to all of the issues, it is recommended that all users upgrade to Pomerium v0.16.4 as soon as possible to minimize risk.

### Impact

- Possible DoS or crash
- Resources available to unauthorized users
- Pomerium may trust upstream certificates that should not be trusted

### Patches
Patched in v0.16.4

### Workarounds
No

### References

[Envoy Security Announcement](https://groups.google.com/g/envoy-security-announce/c/QBGxoqZdTR4)

* [CVE-2021-43824](https://github.com/envoyproxy/envoy/security/advisories/GHSA-vj5m-rch8-5r2p) (CVSS Score 6.5, Medium): Envoy 1.21.0 and earlier - Potential null pointer dereference when using JWT filter safe_regex match
* [CVE-2021-43825](https://github.com/envoyproxy/envoy/security/advisories/GHSA-h69p-g6xg-mhhh) (CVSS Score 6.1, Medium): Envoy 1.21.0 and earlier - Use-after-free when response filters increase response data, and increased data exceeds downstream buffer limits.
* [CVE-2021-43826](https://github.com/envoyproxy/envoy/security/advisories/GHSA-cmx3-fvgf-83mf) (CVSS Score 6.1, Medium): Envoy 1.21.0 and earlier - Use-after-free when tunneling TCP over HTTP, if downstream disconnects during upstream connection establishment
* [CVE-2022-21654](https://github.com/envoyproxy/envoy/security/advisories/GHSA-5j4x-g36v-m283) (CVSS Score 7.3, High): Envoy 1.7.0 and later - Incorrect configuration handling allows mTLS session re-use without re-validation after validation settings have changed.
* [CVE-2022-21655](https://github.com/envoyproxy/envoy/security/advisories/GHSA-7r5p-7fmh-jxpg) (CVSS Score 7.5, High): Envoy 1.21 and earlier - Incorrect handling of internal redirects to routes with a direct response entry
* [CVE-2022-21657](https://github.com/envoyproxy/envoy/security/advisories/GHSA-837m-wjrv-vm5g) (CVSS Score 3.1, Low): Envoy 1.20.1 and earlier - X.509 Extended Key Usage and Trust Purposes bypass

### For more information
If you have any questions or comments about this advisory:

Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
Email us at [security@pomerium.com](mailto:security@pomerium.com)
CSRF vulnerability and missing permission checks in Jenkins kubernetes-cd Plugin allow capturing credentials
Advisory: GHSA-794j-hx96-4w3m
Aliases: CVE-2022-27211
Published: 2022-03-16T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A missing/An incorrect permission check in Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CSRF vulnerability and missing permission checks in Jenkins Extended Choice Parameter Plugin allow SSRF
Advisory: GHSA-fqpx-xfjr-2qr9
Aliases: CVE-2022-27204
Published: 2022-03-16T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Embedded Malicious Code in node-ipc
Advisory: GHSA-97m3-w2cp-4xx6
Aliases: CVE-2022-23812
Published: 2022-03-16T23:54:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package node-ipc versions 10.1.1 and 10.1.2 are vulnerable to embedded malicious code that was introduced by the maintainer. The malicious code was intended to overwrite arbitrary files dependent upon the geo-location of the user IP address. The maintainer removed the malicious code in version 10.1.3.
Elasticsearch privilege escalation
Advisory: GHSA-pgq6-ccqj-hpqr
Aliases: CVE-2022-23708
Published: 2022-03-04T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A flaw was discovered in Elasticsearch 7.17.0’s upgrade assistant, in which upgrading from version 6.x to 7.x would disable the in-built protections on the security index, allowing authenticated users with “*” index permissions access to this index. Users running a cluster on an affected version that had previously been upgraded from 6.x, should upgrade to 7.17.1. Users that are planning to upgrade from 6.x should not perform an upgrade from 6.x to versions 7.16 through 7.17.0 and should use 7.17.1+ for upgrades from 6.x.
Prototype Pollution in set-in
Advisory: GHSA-6956-83fg-5wc5
Aliases: CVE-2022-25354
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the `setIn` method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
Cross-site Scripting in Pimcore
Advisory: GHSA-j29f-m23h-3p8p
Aliases: CVE-2022-0911
Published: 2022-03-17T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Possible code injection vulnerability in Rails / Active Storage
Advisory: GHSA-w749-p3v6-hccq
Aliases: CVE-2022-21831
Published: 2022-03-08T21:25:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Active Storage module of Rails starting with version 5.2.0 is possibly vulnerable to code injection. This issue was patched in versions 5.2.6.3, 6.0.4.7, 6.1.4.7, and 7.0.2.3. To work around this issue, applications should implement a strict allow-list on accepted transformation methods or arguments.  Additionally, a strict ImageMagick security policy will help mitigate this issue.
SQL Injection in Fork CMS
Advisory: GHSA-rr8m-29g8-8cgc
Aliases: CVE-2022-1064
Published: 2022-03-26T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Fork CMS is vulnerable to SQL injection through marking blog comments on bulk as spam in versions prior to 5.11.1.
Path Traversal in Studio-42 elFinder through 2.1.60
Advisory: GHSA-7q88-jxvp-9gp2
Aliases: CVE-2022-26960
Published: 2022-03-22T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

`connector.minimal.php` in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths.
SQL Injection in Fork CMS
Advisory: GHSA-q863-cchm-c6c6
Aliases: CVE-2022-0153
Published: 2022-03-25T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Fork CMS contains a SQL injection vulnerability in versions prior to version 5.11.1. When deleting submissions which belong to a formular (made with module `FormBuilder`), the parameter `id[]` is vulnerable to SQL injection.
Cross-site Scripting in GeniXCMS
Advisory: GHSA-5mwx-f6w6-7w5r
Aliases: CVE-2022-24563
Published: 2022-03-04T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.
Code injection in RazorEngine
Advisory: GHSA-ph3v-2hq5-5qfq
Aliases: CVE-2021-46703
Published: 2022-03-07T00:00:41Z

In the IsolatedRazorEngine component of Antaris RazorEngine through 4.5.1-alpha001, an attacker can execute arbitrary .NET code in a sandboxed environment (if users can externally control template contents). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Cross-site Scripting in ShowDoc
Advisory: GHSA-xm3x-787m-p66r
Aliases: CVE-2022-0964
Published: 2022-03-16T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.webmv` file upload.
Code Injection in CRI-O
Advisory: GHSA-6x2m-w449-qwx7
Aliases: CVE-2022-0811
Published: 2022-03-15T20:13:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact
A flaw introduced in CRI-O version 1.19 which an attacker can use to bypass the safeguards and set arbitrary kernel parameters on the host. As a result, anyone with rights to deploy a pod on a Kubernetes cluster that uses the CRI-O runtime can abuse the `kernel.core_pattern` kernel parameter to achieve container escape and arbitrary code execution as root on any node in the cluster.

### Patches
The patches will be present in 1.19.6, 1.20.7, 1.21.6, 1.22.3, 1.23.2, 1.24.0

### Workarounds
- Users can set manage_ns_lifecycle to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option.
- An admission webhook could be created to deny pods that specify a `+` in the sysctl value of a pod.
- A [PodSecurityPolicy](https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#podsecuritypolicy) [deprecated] could be created, specifying all sysctls as forbidden like so: 
```
apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: sysctl-psp
spec:
  forbiddenSysctls:
    - "*"
```
However, this option will not work if any sysctls are required by any pods in the cluster.


### Credits
Credit for finding this vulnerability goes to John Walker and Manoj Ahuje of Crowdstrike. The CRI-O community deeply thanks them for the report.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues)
* To make a report, email your vulnerability to the private
[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list
with the security details and the details expected for [all CRI-O bug
reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).
Cross-site Scripting in ShowDoc
Advisory: GHSA-gq77-3r6x-383w
Aliases: CVE-2022-0880
Published: 2022-03-13T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc version 2.10.3 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 2.10.4.
Exposure of Sensitive Information to an Unauthorized Actor in OpenStack tripleo-heat-templates
Advisory: GHSA-hm3x-jwwf-jpr9
Aliases: CVE-2021-4180
Published: 2022-03-24T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

An information exposure flaw in openstack-tripleo-heat-templates allows an external user to discover the internal IP or hostname. An attacker could exploit this by checking the `www_authenticate_uri parameter` (which is visible to all end users) in configuration files. This would give sensitive information which may aid in additional system exploitation. A patch is available on the `master` branch and anticipated to be part of version 11.6.1.
Stored Cross-site Scripting vulnerability in Jenkins Favorite Plugin
Advisory: GHSA-874r-46c6-7p4r
Aliases: CVE-2022-27196
Published: 2022-03-16T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Favorite Plugin 2.4.0 and earlier does not escape the names of jobs in the favorite column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure or Item/Create permissions.
Open Redirect in archivy
Advisory: GHSA-28mg-98xm-q493
Aliases: CVE-2022-0697
Published: 2022-03-08T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

archivy prior to version 1.7.1 is vulnerable to open redirect.
Improper Restriction of Rendered UI Layers or Frames in Sylius
Advisory: GHSA-4jp3-q2qm-9fmw
Aliases: CVE-2022-24733
Published: 2022-03-14T21:55:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Impact

It is possible for a page controlled by an attacker to load the website within an iframe. This will enable a clickjacking attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker

### Patches

The issue is fixed in versions: 1.9.10, 1.10.11, 1.11.2, and above.

### Workarounds

Every response from app should have an X-Frame-Options header set to: ``sameorigin``. To achieve that you just need to add a new **subscriber** in your app. 

```php
<?php

// src/EventListener/XFrameOptionsSubscriber.php

namespace App\EventListener

final class XFrameOptionsSubscriber implements EventSubscriberInterface
{
    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::RESPONSE => 'onKernelResponse',
        ];
    }

    public function onKernelResponse(ResponseEvent $event): void
    {
        if (!$this->isMainRequest($event)) {
            return;
        }

        $response = $event->getResponse();

        $response->headers->set('X-Frame-Options', 'sameorigin');
    }

    private function isMainRequest(ResponseEvent $event): bool
    {
        if (\method_exists($event, 'isMainRequest')) {
            return $event->isMainRequest();
        }

        return $event->isMasterRequest();
    }
}

```

And register it in the container:

```yaml
# config/services.yaml
services:
    # ...
    App\EventListener\XFrameOptionsSubscriber:
        tags: ['kernel.event_subscriber']
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)
* Email us at [security@sylius.com](mailto:security@sylius.com)
XML External Entities Vulnerability in CVRF-CSAF-Converter
Advisory: GHSA-m8gq-83gh-v42v
Aliases: CVE-2022-27193
Published: 2022-03-16T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

CVRF-CSAF-Converter before 1.0.0-rc2 resolves XML External Entities (XXE). This leads to the inclusion of arbitrary (local) file content into the generated output document. An attacker can exploit this to disclose information from the system running the converter.
Stored XSS vulnerability in Jenkins Bitbucket Server Integration Plugin
Advisory: GHSA-45v7-65q8-x294
Aliases: CVE-2022-28133
Published: 2022-03-30T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not limit URL schemes for callback URLs on OAuth consumers, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create BitBucket Server consumers.
HashiCorp Nomad vulnerable to Allocation of Resources Without Limits or Throttling
Advisory: GHSA-3382-r9q8-4hfg
Aliases: CVE-2022-24685
Published: 2022-03-01T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

HashiCorp Nomad and Nomad Enterprise 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 is vulnerable to Allocation of Resources Without Limits or Throttling.
Command injection in guake
Advisory: GHSA-7x48-7466-3g33
Aliases: CVE-2021-23556
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L

Guake is a drop-down terminal for GNOME. The package guake before 3.8.5 is vulnerable to Exposed Dangerous Method or Function due to the exposure of execute_command and execute_command_by_uuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via the d-bus method. **Note:** Exploitation requires the user to have installed another malicious program that will be able to send dbus signals or run terminal commands.
Open Redirect in urijs
Advisory: GHSA-8h2f-7jc4-7m3m
Aliases: CVE-2022-0868
Published: 2022-03-07T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

urijs prior to version 1.19.10 is vulnerable to open redirect. This is the result of a bypass for the fix to CVE-2022-0613.
Sandbox bypass in fenom
Advisory: GHSA-674v-3g2w-84gx
Aliases: CVE-2021-46433
Published: 2022-03-29T00:01:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In fenom 2.12.1 and before, there is a way in fenom/src/Fenom/Template.php function getTemplateCode()to bypass sandbox to execute arbitrary PHP code when disable_native_funcs is true.
SSRF in repository migration
Advisory: GHSA-7v5r-r995-q2x2
Aliases: CVE-2022-0870
Published: 2022-03-12T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.
Code injection in accesslog
Advisory: GHSA-8m2f-74r2-x3f2
Aliases: CVE-2022-25760
Published: 2022-03-18T00:01:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L

All versions of package accesslog are vulnerable to Arbitrary Code Injection due to the usage of the Function constructor without input sanitization. If (attacker-controlled) user input is given to the format option of the package's exported constructor function, it is possible for an attacker to execute arbitrary JavaScript code on the host that this package is being run on.
SaltStack Improper Verification of Cryptographic Signature
Advisory: GHSA-2q4g-wfm6-5fpm
Aliases: CVE-2022-22934
Published: 2022-03-30T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in SaltStack Salt in versions before 3002.8, 3003.4, 3004.1. Salt Masters do not sign pillar data with the minion’s public key, which can result in attackers substituting arbitrary pillar data.
Hard coded credentials in FreeTAKServer
Advisory: GHSA-f897-875p-23x7
Aliases: CVE-2022-25510
Published: 2022-03-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

FreeTAKServer 1.9.8 contains a hardcoded Flask secret key which allows attackers to create crafted cookies to bypass authentication or escalate privileges.
Cross-site Scripting in microweber
Advisory: GHSA-2cv6-6437-39p2
Aliases: CVE-2022-0930
Published: 2022-03-13T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Authentication Bypass by Capture-replay in Apache Spark
Advisory: GHSA-9rr6-jpg7-9jg6
Aliases: CVE-2021-38296
Published: 2022-03-11T00:02:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later
Jenkins NUnit Plugin vulnerable to Protection Mechanism Failure
Advisory: GHSA-8cxw-wvhc-p4x4
Aliases: CVE-2022-43414
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Jenkins NUnit Plugin 0.27 and earlier implements an agent-to-controller message that parses files inside a user-specified directory as test results, allowing attackers able to control agent processes to obtain test results from files in an attacker-specified directory on the Jenkins controller. NUnit Plugin 0.28 changes the message type from agent-to-controller to controller-to-agent, preventing execution on the controller.
OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration
Advisory: GHSA-4vf4-955g-vxp2
Aliases: CVE-2022-31037
Published: 2022-10-18T19:52:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

### Impact
Shipping rule edit page is vulnerable to cross site scripting (XSS) payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule.
parse-server crashes when receiving file download request with invalid byte range
Advisory: GHSA-h423-w6qv-2wj3
Aliases: CVE-2022-39313
Published: 2022-10-18T16:08:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

Parse Server crashes when a file download request is received with an invalid byte range.

### Patches

Improved parsing of the range parameter to properly handle invalid range requests.

### Workarounds

None

### References

- [GHSA-h423-w6qv-2wj3](https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3)
Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API
Advisory: GHSA-3q8r-f3pj-3gc4
Aliases: CVE-2022-41672
Published: 2022-10-07T18:16:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
HyperDown vulnerable to Cross-site Scripting
Advisory: GHSA-4r9g-w48q-8jwm
Aliases: CVE-2022-25849
Published: 2022-10-26T12:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

HyperDown is a markdown parser written for the Chinese website SegmentFault. Improper validation of the href attribute allows for Cross-site Scripting. At publication there are no patched versions, and no known workarounds.
Exposure of sensitive Slack webhook URLs in debug logs and traces
Advisory: GHSA-4mjx-2gh5-ph8h
Aliases: CVE-2022-39292
Published: 2022-10-10T21:07:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact

Debug logs expose sensitive URLs for Slack webhooks that contain private information.

### Patches
The problem is fixed in v1.3.2 which redacts sensitive URLs for webhooks.

### Workarounds
Disabling/filtering debug logs in case you use Slack webhooks using tracing log level and filters.

### References
https://github.com/abdolence/slack-morphism-rust/releases/tag/v1.3.2

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [repo](https://github.com/abdolence/slack-morphism-rust)
* Read our [security policy](https://github.com/abdolence/slack-morphism-rust/blob/master/SECURITY.md)
LIEF vulnerable to denial of service through segmentation fault
Advisory: GHSA-38hf-c37x-32hv
Aliases: CVE-2022-40922
Published: 2022-10-04T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A vulnerability in the LIEF::MachO::BinaryParser::init_and_parse function of LIEF v0.12.1 allows attackers to cause a denial of service (DOS) through a segmentation fault via a crafted MachO file. A [patch](https://github.com/lief-project/LIEF/commit/fde2c48986739fabd2cf9b40b9af149a89c57850) for this issue is available at commit fde2c48986739fabd2cf9b40b9af149a89c57850.
Stored XSS vulnerability in Jenkins Contrast Continuous Application Security Plugin
Advisory: GHSA-hvcr-927w-qcvq
Aliases: CVE-2022-43420
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Contrast Continuous Application Security Plugin 3.9 and earlier does not escape data returned from the Contrast service when generating a report.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control or modify Contrast service API responses.

Contrast Continuous Application Security Plugin 3.10 escapes the affected data.
Jenkins Tuleap Git Branch Source Plugin allows unauthenticated attackers to trigger Tuleap projects whose configured repo matches attacker-specified value
Advisory: GHSA-73v5-w6fg-2m44
Aliases: CVE-2022-43421
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Tuleap Git Branch Source Plugin 3.2.4 and earlier allows unauthenticated attackers to trigger Tuleap projects whose configured repository matches the attacker-specified value. Tuleap Git Branch Source Plugin 3.2.5 requires a token to access the webhook endpoint.
Stored XSS vulnerability in Jenkins Pipeline: Supporting APIs Plugin
Advisory: GHSA-64r9-x74q-wxmh
Aliases: CVE-2022-43409
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Pipeline: Supporting APIs Plugin provides a feature to add hyperlinks, that send POST requests when clicked, to build logs. These links are used by Pipeline: Input Step Plugin to allow users to proceed or abort the build, or by Pipeline: Job Plugin to allow users to forcibly terminate the build after aborting it.

Pipeline: Supporting APIs Plugin 838.va_3a_087b_4055b and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to create Pipelines.

Pipeline: Supporting APIs Plugin 839.v35e2736cfd5c properly encodes URLs of these hyperlinks in build logs.
Apache XML Graphics Batik vulnerable to code execution via SVG.
Advisory: GHSA-r29w-r9ph-vm76
Aliases: CVE-2022-41704
Published: 2022-10-25T19:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16. It is recommended to update to version 1.16.
OpenFGA Authorization Bypass
Advisory: GHSA-f4mm-2r69-mg5f
Aliases: CVE-2022-39342
Published: 2022-10-25T20:21:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

### Overview
During our internal security assessment, it was discovered that OpenFGA versions `v0.2.3` and prior are vulnerable to authorization bypass under certain conditions.

### Am I Affected?
You are affected by this vulnerability if you are using `openfga/openfga` version `v0.2.3` or prior, and your model has a relation defined as a tupleset (the right hand side of a ‘from’ statement) that involves anything other than a direct relationship (e.g. ‘as self’)

### How to fix that?
Upgrade to version `v0.2.4`.

### Backward Compatibility
This update is not backward compatible.
Any model involving rewritten tupleset relations will no longer be acceptable and has to be modified.
Fat Free CRM vulnerable to Remote Denial of Service via Tasks endpoint
Advisory: GHSA-p75c-5x3h-cxcg
Aliases: CVE-2022-39281
Published: 2022-10-07T21:19:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
An authenticated user can perform a remote Denial of Service attack against Fat Free CRM.

This vulnerability has been assigned the CVE identifier: CVE-2022-39281

Affected versions: All
Not affected: None
Fixed versions: 0.20.1

All users running an affected release should either upgrade or apply the patch immediately.

### Releases
Fixed versions: 0.20.1 and above

### Patches

If you are unable to upgrade immediately, you should apply the following patch.

```
diff --git a/app/models/polymorphic/task.rb b/app/models/polymorphic/task.rb
index d3d5c32c..7cdb24d6 100644
--- a/app/models/polymorphic/task.rb
+++ b/app/models/polymorphic/task.rb
@@ -189,6 +189,7 @@ class Task < ActiveRecord::Base
   #----------------------------------------------------------------------------
   def self.bucket_empty?(bucket, user, view = "pending")
     return false if bucket.blank? || !ALLOWED_VIEWS.include?(view)
+    return false unless Setting.task_bucket.map(&:to_s).include?(bucket.to_s)

     if view == "assigned"
       assigned_by(user).send(bucket).pending.count
```

### Credits

Thanks to @p- for reporting this and working with us to responsibly disclose this vulnerability.

### Further information
If you have any questions or comments about this advisory, please Open an issue in [GitHub Issue Tracker](https://github.com/fatfreecrm/fat_free_crm/issues)
minimatch ReDoS vulnerability
Advisory: GHSA-f8q6-p94x-37v3
Aliases: CVE-2022-3517
Published: 2022-10-18T12:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Lavalite vulnerable to Arbitrary File Read via Directory Traversal
Advisory: GHSA-cm22-88qr-7ffh
Aliases: CVE-2022-42188
Published: 2022-10-19T12:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In Lavalite 9.0.0, the XSRF-TOKEN cookie is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server.
Gogs vulnerable to Cross-site Scripting
Advisory: GHSA-mcjj-2fvq-mc3r
Aliases: CVE-2022-32174
Published: 2022-10-11T19:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.
Agent-to-controller security bypass vulnerability in Jenkins Compuware Topaz Utilities Plugin
Advisory: GHSA-2x49-wj38-78q9
Aliases: CVE-2022-43422
Published: 2022-10-19T19:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Compuware Topaz Utilities Plugin 1.0.8 and earlier implements an agent/controller message that does not limit where it can be executed.

It allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).

Compuware Topaz Utilities Plugin 1.0.9 restricts execution of the agent/controller message to agents.
October CMS Safe Mode bypass leads to authenticated Remote Code Execution
Advisory: GHSA-x4q7-m6fp-4v9v
Aliases: CVE-2022-35944
Published: 2022-10-13T19:11:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

### Impact

This vulnerability only affects installations that rely on the safe mode restriction, commonly used when providing public access to the admin panel. Assuming an attacker has access to the admin panel and permission to open the "Editor" section, they can bypass the Safe Mode (`cms.safe_mode`) restriction to introduce new PHP code in a CMS template using a specially crafted request.

### Patches

The issue has been patched in v2.2.34 and v3.0.66

### References

Credits to:

-  David Miller

### For more information

If you have any questions or comments about this advisory:

- Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Blst vulnerable to incorrect results for some inputs in blst_fp_eucl_inverse function
Advisory: GHSA-x279-68rr-jp4p
Published: 2022-10-07T07:25:33Z

### Impact
Blst versions v0.3.0 to v0.3.2 can produce the incorrect outputs for some inputs to the blst_fp_eucl_inverse function. This could theoretically result in the creation of an invalid signature from correct inputs. However, fuzzing of higher level functions such as sign and verify were unable to produce incorrect results and there has been no reported occurrences of this issue being encountered in production use.

### Description
During the course of differential fuzzing of the blst library by @guidovranken it was discovered that blst would produce the incorrect result for some input values in the inverse function. This was the result of the introduction of a new inversion formula in version v0.3.0. This source of these incorrect outputs was due to two issues:

1. The amount of inner loop iterations was not sufficient for the algorithm to converge.
2. It was erroneously assumed that the absolute value of the intermediate result would be capped at 767-bits. As a result, some output values were truncated by one bit or the most significant bit was misinterpreted as the sign.

### Patches
This issue has been resolved in the v0.3.3 release and users are recommended to upgrade immediately.

### References
The software used to uncover this issue can be found [here](https://github.com/guidovranken/cryptofuzz).

### Credits
A special thanks to Guido Vranken (@guidovranken) for his discovery and disclosure of this vulnerability.

### For more information
If you have any questions or comments about this advisory please email us at [hello@supranational.net](mailto:hello@supranational.net)
Apache Isis Cross-site Scripting vulnerability
Advisory: GHSA-7pfc-cc9x-8p4m
Aliases: CVE-2022-42466
Published: 2022-10-19T12:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.
Prototype pollution in webpack loader-utils
Advisory: GHSA-76p3-8jx3-jpfq
Aliases: CVE-2022-37601
Published: 2022-10-13T12:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils prior to version 2.0.3 via the name variable in parseQuery.js.
Using a Custom Cipher with `NID_undef` may lead to NULL encryption
Advisory: GHSA-4f63-89w9-3jjv
Aliases: CVE-2022-3358
Published: 2022-10-11T19:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third party provider has been loaded that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. Applications that only use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5).
Rdiffweb subject to Business Logic Errors
Advisory: GHSA-jw36-mrvg-j5fx
Aliases: CVE-2022-3363
Published: 2022-10-27T12:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.
Agent-to-controller security bypass vulnerability in Jenkins Compuware Xpediter Code Coverage Plugin
Advisory: GHSA-mfcw-83qg-4vw3
Aliases: CVE-2022-43424
Published: 2022-10-19T19:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier implements an agent/controller message that does not limit where it can be executed.

It allows attackers able to control agent processes to obtain the values of Java system properties from the Jenkins controller process.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).

Compuware Xpediter Code Coverage Plugin 1.0.8 restricts execution of the agent/controller message to agents.
Apache Shiro Authentication Bypass vulnerability
Advisory: GHSA-45x9-q6vj-cqgq
Aliases: CVE-2022-40664
Published: 2022-10-12T12:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher.
Apache IoTDB subject to ReDOS with Java 8
Advisory: GHSA-g6hg-4v3c-6jq7
Aliases: CVE-2022-43766
Published: 2022-10-26T19:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache IoTDB versions 0.12.2 through 0.12.6, and 0.13.0 through 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. This issue is patched in 0.13.3. Users should upgrade or use a later version of Java to avoid it.
Shinken Solutions Shinken Monitoring vulnerable to Incorrect Access Control
Advisory: GHSA-p373-jqfm-j6wr
Aliases: CVE-2022-37298
Published: 2022-10-20T12:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Shinken Solutions Shinken Monitoring Version 2.4.3 affected is vulnerable to Incorrect Access Control. The `SafeUnpickler` class found in `shinken/safepickle.py` implements a weak authentication scheme when unserializing objects passed from monitoring nodes to the Shinken monitoring server.