aswin1906/github-advisory-2022 huggingface dataset:
Missing permission check in Jenkins requests-plugin Plugin allows sending emails
Advisory: GHSA-w3gm-vv58-wr55
Aliases: CVE-2021-21676
Published: 2022-05-24T19:06:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

requests-plugin Plugin 2.2.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to send test emails to an attacker-specified email address.

requests-plugin Plugin 2.2.8 requires Overall/Administer permission to send test emails.
Insertion of Sensitive Information into Log File in Jenkins Mask Passwords Plugin
Advisory: GHSA-gp67-c7j2-2qg2
Aliases: CVE-2019-10370
Published: 2022-05-24T16:52:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Jenkins Mask Passwords Plugin 2.12.0 and earlier transmits globally configured passwords in plain text as part of the configuration form, potentially resulting in their exposure.
Plone Authenticated Denial of Service vulnerability
Advisory: GHSA-w3pw-qxjj-6prr
Aliases: CVE-2013-4188
Published: 2022-05-17T04:49:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources."
Integer Overflow or Wraparound in libxml2 affects Nokogiri
Advisory: GHSA-cgx6-hpwq-fhv5
Published: 2022-05-18T20:06:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

### Summary

Nokogiri v1.13.5 upgrades the packaged version of its dependency libxml2 from v2.9.13 to [v2.9.14](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14).

libxml2 v2.9.14 addresses [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824). This version also includes several security-related bug fixes for which CVEs were not created, including a potential double-free, potential memory leaks, and integer-overflow.

Please note that this advisory only applies to the CRuby implementation of Nokogiri `< 1.13.5`, and only if the _packaged_ libraries are being used. If you've overridden defaults at installation time to use _system_ libraries instead of packaged libraries, you should instead pay attention to your distro's `libxml2` and `libxslt` release announcements.


### Mitigation

Upgrade to Nokogiri `>= 1.13.5`.

Users who are unable to upgrade Nokogiri may also choose a more complicated mitigation: compile and link Nokogiri against external libraries libxml2 `>= 2.9.14` which will also address these same issues.


### Impact

#### libxml2 [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)

- **CVSS3 score**:
  - Unspecified upstream
  - Nokogiri maintainers evaluate at 8.6 (High) ([CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)). Note that this is different from the CVSS assessed by NVD.
- **Type**: Denial of service, information disclosure
- **Description**: In libxml2 before 2.9.14, several buffer handling functions in buf.c (xmlBuf*) and tree.c (xmlBuffer*) don't check for integer overflows. This can result in out-of-bounds memory writes. Exploitation requires a victim to open a crafted, multi-gigabyte XML file. Other software using libxml2's buffer functions, for example libxslt through 1.1.35, is affected as well.
- **Fixed**: https://gitlab.gnome.org/GNOME/libxml2/-/commit/2554a24

All versions of libml2 prior to v2.9.14 are affected.

Applications parsing or serializing multi-gigabyte documents (in excess of INT_MAX bytes) may be vulnerable to an integer overflow bug in buffer handling that could lead to exposure of confidential data, modification of unrelated data, or a segmentation fault resulting in a denial-of-service.


### References

- [libxml2 v2.9.14 release notes](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.9.14)
- [CVE-2022-29824](https://nvd.nist.gov/vuln/detail/CVE-2022-29824)
- [CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer](https://cwe.mitre.org/data/definitions/119.html)
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-h972-cwjv-2v39
Aliases: CVE-2017-1000398
Published: 2022-05-14T01:04:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The remote API in Jenkins 2.73.1 and earlier, 2.83 and earlier at /computer/(agent-name)/api showed information about tasks (typically builds) currently running on that agent. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only shows information about accessible tasks.
Improper Input Validation in Apache ActiveMQ
Advisory: GHSA-q9hr-3pg4-3jp4
Aliases: CVE-2015-5254
Published: 2022-05-13T01:30:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
Pimcore XSS Vulnerability
Advisory: GHSA-276r-24xq-hwg8
Aliases: CVE-2018-14059
Published: 2022-05-14T02:02:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore allows XSS via Users, Assets, Data Objects, Video Thumbnails, Image Thumbnails, Field-Collections, Objectbrick, Classification Store, Document Types, Predefined Properties, Predefined Asset Metadata, Quantity Value, and Static Routes functions.
Dangling reference in `access::Map` with Constant
Advisory: GHSA-9pqx-g3jh-qpqq
Aliases: CVE-2020-35711
Published: 2022-05-24T17:37:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue has been discovered in the arc-swap crate before 0.4.8 (and 1.x before 1.1.0) for Rust. Use of arc_swap::access::Map with the Constant test helper (or with a user-supplied implementation of the Access trait) could sometimes lead to dangling references being returned by the map.
Magento 2 Community Edition CSRF vulnerability
Advisory: GHSA-w392-68rg-pgg4
Aliases: CVE-2019-7947
Published: 2022-05-24T16:52:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Jenkins Redgate SQL Change Automation Plugin has Insufficiently Protected Credentials
Advisory: GHSA-9hpq-528p-48j3
Aliases: CVE-2019-16557
Published: 2022-05-24T17:03:47Z

Jenkins Redgate SQL Change Automation Plugin 2.0.3 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
XSS in Ignite Realtime Openfire via isTrustStore
Advisory: GHSA-m6pr-xcrm-4qqp
Aliases: CVE-2019-20366
Published: 2022-05-24T22:01:17Z

An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.
Stored XSS vulnerability in Jenkins Repository Connector Plugin
Advisory: GHSA-hg2w-3c4j-jjwm
Aliases: CVE-2021-21618
Published: 2022-05-24T17:43:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Repository Connector Plugin 2.0.3 escapes parameter names and descriptions when creating new parameters.
Gogs Directory Traversal
Advisory: GHSA-9hxg-w7qf-hh93
Aliases: CVE-2018-20303
Published: 2022-05-14T01:37:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
HashBrown CMS RCE
Advisory: GHSA-4gjv-5jjp-rcgh
Aliases: CVE-2020-6948
Published: 2022-05-24T17:06:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A remote code execution issue was discovered in HashBrown CMS through 1.3.3. `Server/Entity/Deployer/GitDeployer.js` has a `Service.AppService.exec call` that mishandles the URL, repository, username, and password.
OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
Advisory: GHSA-g2j5-7vgx-6xrx
Aliases: CVE-2015-5162
Published: 2022-05-14T03:59:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The image parser in OpenStack Cinder prior to 7.0.2, and 8.0.0 and above, prior to 9.0.0; Glance prior to 14.00; and Nova prior to 12.0.4 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumption) via a crafted disk image. This issue is patched in Cinder 7.0.2 and 9.0.0; Glance 14.0.0; and Nova 12.0.4
Deserialization of Untrusted Data in Spring Batch
Advisory: GHSA-4ph4-q9r5-6wm6
Aliases: CVE-2020-5411
Published: 2022-05-24T17:20:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

When configured to enable default typing, Jackson contained a deserialization vulnerability that could lead to arbitrary code execution. Jackson fixed this vulnerability by blacklisting known "deserialization gadgets". Spring Batch configures Jackson with global default typing enabled which means that through the previous exploit, arbitrary code could be executed if all of the following is true: * Spring Batch's Jackson support is being leveraged to serialize a job's ExecutionContext. * A malicious user gains write access to the data store used by the JobRepository (where the data to be deserialized is stored). In order to protect against this type of attack, Jackson prevents a set of untrusted gadget classes from being deserialized. Spring Batch should be proactive against blocking unknown "deserialization gadgets" when enabling default typing.
Incorrect Permission Assignment for Critical Resource in ShopXO
Advisory: GHSA-jfph-3hpg-2f65
Aliases: CVE-2022-28056
Published: 2022-05-03T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php.
Cross-site Scripting in html5lib
Advisory: GHSA-8f6m-gfq9-g33v
Aliases: CVE-2016-9910
Published: 2022-05-17T02:57:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909.
Typo3 API XSS Vulnerabilities
Advisory: GHSA-w3v6-r62r-fvqh
Aliases: CVE-2012-1608
Published: 2022-05-17T05:23:54Z

The `t3lib_div::RemoveXSS` API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters.
Apache Tapestry Unsafe Object Storage
Advisory: GHSA-c438-8cvq-pxxx
Aliases: CVE-2014-1972
Published: 2022-05-13T01:26:11Z

Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.
Apache Geode gfsh authorization vulnerability
Advisory: GHSA-h22r-h77w-2g5f
Aliases: CVE-2017-12622
Published: 2022-05-14T03:47:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

When an Apache Geode cluster before v1.3.0 is operating in secure mode and an authenticated user connects to a Geode cluster using the gfsh tool with HTTP, the user is able to obtain status information and control cluster members even without CLUSTER:MANAGE privileges.
Jenkins Inedo ProGet Plugin Plugin has Cleartext Transmission of Sensitive Information
Advisory: GHSA-f6g8-pxvp-9328
Aliases: CVE-2019-10412
Published: 2022-05-24T16:56:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Inedo ProGet Plugin Plugin stores a service password in its global Jenkins configuration.

While the password is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the password through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Inedo ProGet Plugin Plugin now encrypts the password transmitted to administrators viewing the global configuration form.
Django Incorrectly Validates URLs
Advisory: GHSA-f7cm-ccfp-3q4r
Aliases: CVE-2014-0480
Published: 2022-05-14T02:09:22Z

The `core.urlresolvers.reverse` function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a `//` (slash slash) in a URL, which triggers a scheme-relative URL to be generated.
Apache Sling POST Servlets Denial of Service Vulnerability
Advisory: GHSA-342c-f869-5m44
Aliases: CVE-2012-2138
Published: 2022-05-17T05:28:00Z

The `@CopyFrom` operation in the POST servlet in the `org.apache.sling.servlets.post` bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
Cross-Site Request Forgery in Apache Tomcat
Advisory: GHSA-76vr-72mv-mf3q
Aliases: CVE-2012-4431
Published: 2022-05-17T00:57:51Z

org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
Improper Input Validation in Bouncy Castle
Advisory: GHSA-8353-fgcr-xfhx
Aliases: CVE-2013-1624
Published: 2022-05-14T02:14:04Z

The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
Jenkins LDAP Email Plugin shows plain text password in configuration form 
Advisory: GHSA-53jw-4gwh-m8cm
Aliases: CVE-2019-10434
Published: 2022-05-24T16:57:28Z

Jenkins LDAP Email Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Django Cross-site Scripting Vulnerability
Advisory: GHSA-gv98-g628-m9x5
Aliases: CVE-2015-0220
Published: 2022-05-17T03:20:49Z

The `django.util.http.is_safe_url` function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a `\njavascript:` URL.
OpenStack Dashboard (aka Horizon) vulnerable to Cross-site Scripting
Advisory: GHSA-cmg8-5c63-pg95
Aliases: CVE-2014-0157
Published: 2022-05-14T02:09:21Z

Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to inject arbitrary web script or HTML via the description field of a Heat template.
RichFaces vulnerable to Expression Language Injection
Advisory: GHSA-3hx6-fqpj-xfjr
Aliases: CVE-2018-12532
Published: 2022-05-13T01:19:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.
Remote code execution due to insecure deserialization
Advisory: GHSA-4344-frcp-j22q
Aliases: CVE-2013-2165
Published: 2022-05-13T01:27:59Z

A flaw was found in the way JBoss RichFaces handled deserialization. A remote attacker could use this flaw to trigger the execution of the deserialization methods in any serializable class deployed on the server. This could lead to a variety of security impacts depending on the deserialization logic of these classes.
Jenkins Jira Plugin Incorrect Authorization vulnerability
Advisory: GHSA-fpg6-xqj4-j7wf
Aliases: CVE-2018-1000412
Published: 2022-05-13T01:18:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

An improper authorization vulnerability exists in Jenkins Jira Plugin 3.0.1 and earlier in JiraSite.java that allows attackers with Overall/Read access to have Jenkins connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. In version 3.0.2, this form validation method requires POST requests and Overall/Administer (for globally defined sites) or Item/Configure permissions (for sites defined for a folder).
Django Data leakage via admin history log
Advisory: GHSA-r7w6-p47g-vj53
Aliases: CVE-2013-0305
Published: 2022-05-05T02:48:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-4323-cfj5-98mh
Aliases: CVE-2017-18259
Published: 2022-05-14T03:23:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
Subrion CMS CSRF Vulnerability
Advisory: GHSA-5mh2-82g9-72jv
Aliases: CVE-2019-7357
Published: 2022-05-24T17:33:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Subrion CMS 4.2.1 has CSRF in `panel/modules/plugins/`. The attacker can remotely activate/deactivate the plugins.
Improper permission checks in Jenkins Copy Artifact Plugin
Advisory: GHSA-vv89-xggx-qqh2
Aliases: CVE-2020-2183
Published: 2022-05-24T17:17:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Copy Artifact Plugin 1.43.1 and earlier performs improper permission checks when determining whether a build can copy artifacts from another project build. This allows attackers, usually with Job/Configure permission, to configure jobs to copy artifacts from jobs they have no permission to access.

Copy Artifact Plugin 1.44 now properly performs permission checks when copying artifacts. When updating the plugin from a previous version, the previous behavior is retained (\"Migration mode\"). To enable the additional protections, switch to the new \"Production mode\". Doing so may cause existing jobs to fail to copy artifacts. For more information see the [plugin documentation](https://github.com/jenkinsci/copyartifact-plugin).
Publify has Improper Access Controls
Advisory: GHSA-c273-c6vg-4pv5
Aliases: CVE-2022-1810
Published: 2022-05-24T00:01:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A low-privileged user can modify and delete admin articles by changing the value of the `article[id]` parameter prior to 9.2.9.
Puppet Labs Facter allows local users to obtain sensitive Amazon EC2 IAM instance metadata
Advisory: GHSA-j436-h7hm-rx46
Aliases: CVE-2015-1426
Published: 2022-05-14T00:56:48Z

Puppet Labs Facter 1.6.0 through 2.4.0 allows local users to obtains sensitive Amazon EC2 IAM instance metadata by reading a fact for an Amazon EC2 node.
Inefficient Regular Expression Complexity in Jenkins Build Failure Analyzer Plugin
Advisory: GHSA-2hhc-f86x-x74f
Aliases: CVE-2019-16555
Published: 2022-05-24T17:03:47Z

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.
Improper Input Validation in Apache ActiveMQ
Advisory: GHSA-rxqh-fc23-gxp2
Aliases: CVE-2016-3088
Published: 2022-05-14T01:14:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
RubyGems Improper Input Validation vulnerability
Advisory: GHSA-p7f2-rr42-m9xm
Aliases: CVE-2017-0900
Published: 2022-05-14T01:04:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that cause a denial of service attack against RubyGems clients who have issued a `query` command.
Integer overflow in the bundled Brotli C library
Advisory: GHSA-5v8v-66v8-mwm7
Aliases: CVE-2020-8927
Published: 2022-05-24T17:28:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is recommended to update your Brotli library to 1.0.8 or later. If one cannot update, we recommend to use the "streaming" API as opposed to the "one-shot" API, and impose chunk size limits.
Jasig Java CAS Client, .NET CAS Client, and phpCAS contain URL parameter injection vulnerability
Advisory: GHSA-9fc5-q25c-r2wr
Aliases: CVE-2014-4172
Published: 2022-05-17T19:57:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.
SimpleSAMLphp XSS Vulnerability
Advisory: GHSA-fv7m-wc3v-wr3w
Aliases: CVE-2017-18121
Published: 2022-05-14T01:04:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The consentAdmin module in SimpleSAMLphp through 1.14.15 is vulnerable to a Cross-Site Scripting attack, allowing an attacker to craft links that could execute arbitrary JavaScript code on the victim's web browser.
Django Vulnerable to HTTP Response Splitting Attack
Advisory: GHSA-q5qw-4364-5hhm
Aliases: CVE-2015-5144
Published: 2022-05-17T00:48:30Z

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.
Remote code execution in ASP.NET Core
Advisory: GHSA-655q-9gvg-q4cm
Aliases: CVE-2020-0603
Published: 2022-05-24T17:06:16Z

A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.
Magento 2 Community Unrestricted File Upload
Advisory: GHSA-3h69-4frw-g2jm
Aliases: CVE-2019-7930
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal of file upload restrictions. This can result in arbitrary code execution when a malicious file is then uploaded and executed on the system.
XSS vulnerability in Jenkins Audit Trail Plugin
Advisory: GHSA-cj2g-wwfv-mvjh
Aliases: CVE-2020-2140
Published: 2022-05-24T17:10:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability. Audit Trail Plugin 3.3 escapes the affected part of the error message.
Apache Thrift Go Library Command Injection
Advisory: GHSA-r4m4-pmvw-m6j5
Aliases: CVE-2016-5397
Published: 2022-05-13T01:25:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.
Cobbler Arbitrary File Read
Advisory: GHSA-4vc9-4xpq-77vm
Aliases: CVE-2016-9605
Published: 2022-05-13T01:38:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A flaw was found in cobbler software component version 2.6.11-1. It suffers from an invalid parameter validation vulnerability, leading the arbitrary file reading. The flaw is triggered by navigating to a vulnerable URL via cobbler-web on a default installation.
Nokogiri affected by libxslt Use of Uninitialized Resource/Use After Free vulnerability
Advisory: GHSA-242x-7cm6-4w8j
Aliases: CVE-2019-18197
Published: 2022-05-24T16:59:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclosed.

Nokogiri prior to version 1.10.5 contains a vulnerable version of libxslt. Nokogiri version 1.10.5 upgrades the dependency to libxslt 1.1.34, which contains a patch for this issue.
Improper Handling of Exceptional Conditions in Apache Tomcat
Advisory: GHSA-jmvv-524f-hj5j
Aliases: CVE-2017-5664
Published: 2022-05-13T01:46:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is presented to the error page with the original HTTP method. If the error page is a static file, expected behaviour is to serve content of the file as if processing a GET request, regardless of the actual HTTP method. The Default Servlet in Apache Tomcat 9.0.0.M1 to 9.0.0.M20, 8.5.0 to 8.5.14, 8.0.0.RC1 to 8.0.43 and 7.0.0 to 7.0.77 did not do this. Depending on the original request this could lead to unexpected and undesirable results for static error pages including, if the DefaultServlet is configured to permit writes, the replacement or removal of the custom error page. Notes for other user provided error pages: (1) Unless explicitly coded otherwise, JSPs ignore the HTTP method. JSPs used as error pages must must ensure that they handle any error dispatch as a GET request, regardless of the actual method. (2) By default, the response generated by a Servlet does depend on the HTTP method. Custom Servlets used as error pages must ensure that they handle any error dispatch as a GET request, regardless of the actual method.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-v8fg-p27h-mxjp
Aliases: CVE-2019-8147
Published: 2022-05-24T17:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via customer attribute label.
Insecure Permissions in Phusion Passenger
Advisory: GHSA-whfx-877c-5p28
Aliases: CVE-2018-12027
Published: 2022-05-13T01:49:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said socket are writable by a normal user that is not the application's user, then that non-application user can swap that directory with something else, resulting in traffic being redirected to a non-application user's process through an alternative Unix domain socket.
Cross-site Scripting in OctoPrint
Advisory: GHSA-x7r7-wmj8-vv5g
Aliases: CVE-2022-1430
Published: 2022-05-19T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. The login endpoint allows for javascript injection which may lead to account takeover in a phishing scenario.
ImpressCMS Cross-site scripting Vulnerability
Advisory: GHSA-f5jh-q6mp-9c8p
Aliases: CVE-2014-4036
Published: 2022-05-17T04:42:16Z

A cross-site scripting (XSS) vulnerability in `modules/system/admin.php` in ImpressCMS 1.3.6.1 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a listimg action.
Incorrect Authorization in Jenkins
Advisory: GHSA-p265-xr98-3vmr
Aliases: CVE-2018-1999003
Published: 2022-05-13T01:00:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Queue.java that allows attackers with Overall/Read permission to cancel queued builds.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-cvvm-4cr9-r436
Aliases: CVE-2021-21695
Published: 2022-05-24T19:19:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2542 / CVE-2021-21695: `FilePath#listFiles` lists files outside directories with agent read access when following symbolic links.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2542 / CVE-2021-21695: `FilePath#listFiles` checks `stat` permission on files it returns, preventing listing files outside allowed directories.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Elgg open redirect
Advisory: GHSA-r6h7-846c-8m78
Aliases: CVE-2019-11016
Published: 2022-05-14T01:11:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect.
Stored XSS vulnerability in Jenkins Link Column Plugin
Advisory: GHSA-q2mm-w3qc-2936
Aliases: CVE-2020-2219
Published: 2022-05-24T17:22:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Link Column Plugin allows users with View/Configure permission to add a new column to list views that contain a user-configurable link.\n\nLink Column Plugin 1.0 and earlier does not filter the URL for these links, allowing the `javascript:` scheme. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure list views.
Ignite Realtime Openfire Server has Cross-site Scripting vulnerability in admin console
Advisory: GHSA-v3h2-4j2r-wqj8
Aliases: CVE-2017-15911
Published: 2022-05-17T00:23:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link, aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections, injection of iframes to establish communication channels, etc. The vulnerability is present after login into the application.
Improper Input Validation in IpMatcher
Advisory: GHSA-qj93-37f5-mr29
Aliases: CVE-2021-33318
Published: 2022-05-17T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An Input Validation Vulnerability exists in Joel Christner .NET C# packages WatsonWebserver, IpMatcher 1.0.4.1 and below (IpMatcher) and 4.1.3 and below (WatsonWebserver) due to insufficient validation of input IP addresses and netmasks against the internal Matcher list of IP addresses and subnets.
Apache OpenMeetings Cross-site Scripting vulnerability
Advisory: GHSA-pxj9-mw96-q634
Aliases: CVE-2017-7663
Published: 2022-05-17T02:28:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0. The issue is fixed in version 3.3.0.
Ansible Uses Plugins That Disclose Credentials
Advisory: GHSA-pm48-cvv2-29q5
Aliases: CVE-2019-14846
Published: 2022-05-24T16:58:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Ansible, all ansible_engine-2.x versions and ansible_engine-3.x up to ansible_engine-3.5, was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.
ChakraCore RCE Vulnerability
Advisory: GHSA-c6r3-ghjw-hgrj
Aliases: CVE-2017-11893
Published: 2022-05-14T01:06:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-hph9-9vcq-f7gp
Aliases: CVE-2018-1000862
Published: 2022-05-14T01:04:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

An information exposure vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in DirectoryBrowserSupport.java that allows attackers with the ability to control build output to browse the file system on agents running builds beyond the duration of the build using the workspace browser.
OS Command Injection in baserCMS
Advisory: GHSA-6j3p-vrph-j7qq
Aliases: CVE-2018-0569
Published: 2022-05-14T03:06:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors.
Improper neutralization of formula elements in yii-helpers
Advisory: GHSA-f9p3-h6cg-2cjr
Aliases: CVE-2022-1544
Published: 2022-05-03T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Jenkins Path Traversal vulnerability
Advisory: GHSA-3gp5-92h5-h855
Aliases: CVE-2014-3664
Published: 2022-05-17T01:24:36Z

Directory traversal vulnerability in Jenkins before 1.583 and LTS before 1.565.3 allows remote authenticated users with the Overall/READ permission to read arbitrary files via unspecified vectors.
XXE vulnerability in Rundeck Plugin
Advisory: GHSA-5xh7-6v3x-vrhj
Aliases: CVE-2020-2144
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Rundeck Plugin 3.6.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user with Overall/Read access to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Rundeck Plugin 3.6.7 disables external entity resolution for its XML parser.
ChakraCore information disclosure vulnerability
Advisory: GHSA-pjpr-2qqp-gprf
Aliases: CVE-2017-0208
Published: 2022-05-17T02:32:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, a.k.a. "Scripting Engine Information Disclosure Vulnerability."
Symfony CSRF Vulnerability
Advisory: GHSA-92x6-h2gr-8gxq
Aliases: CVE-2017-16653
Published: 2022-05-13T01:44:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The current implementation of CSRF protection in Symfony (Version >=2) does not use different tokens for HTTP and HTTPS; therefore the token is subject to MITM attacks on HTTP and can then be used in an HTTPS context to do CSRF attacks.
Syncthing symlink attack vulnerability
Advisory: GHSA-28xp-g7f6-7mhf
Aliases: CVE-2017-1000420
Published: 2022-05-14T03:49:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Syncthing version 0.14.33 and older is vulnerable to symlink traversal resulting in arbitrary file overwrite
phpMyAdmin Cryptographic Vulnerability
Advisory: GHSA-4gmg-gwjh-3mmr
Aliases: CVE-2016-1927
Published: 2022-05-17T03:43:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the Math.random JavaScript function, which makes it easier for remote attackers to guess passwords via a brute-force approach.
OpenStack Keystone Allows Remote User Account Creation
Advisory: GHSA-gf2q-j2qq-pjf2
Aliases: CVE-2012-3542
Published: 2022-05-17T05:22:32Z

OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API.  NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.
golang.org/x/net/html NULL Pointer Dereference vulnerability
Advisory: GHSA-2wp2-chmh-r934
Aliases: CVE-2018-17142
Published: 2022-05-13T01:19:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The html package (aka x/net/html) through 2018-09-17 in Go mishandles <math><template><mo><template>, leading to a "panic: runtime error" in parseCurrentToken in parse.go during an html.Parse call.
Cross-Site Request Forgery in Jenkins
Advisory: GHSA-pwv6-872c-gcg6
Aliases: CVE-2017-2613
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L

jenkins before versions 2.44, 2.32.2 is vulnerable to a user creation CSRF using GET by admins. While this user record was only retained until restart in most cases, administrators' web browsers could be manipulated to create a large number of user records (SECURITY-406).
Node.js Inspector RCE via DNS Rebinding
Advisory: GHSA-wq4c-wm6x-jw44
Aliases: CVE-2018-7160
Published: 2022-05-13T01:08:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.
Improper account password reset in Craft CMS
Advisory: GHSA-5cjr-78cq-3wrg
Aliases: CVE-2022-29933
Published: 2022-05-10T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Craft CMS through 3.7.36 allows a remote unauthenticated attacker, who knows at least one valid username, to reset the account's password and take over the account by providing a crafted HTTP header to the application while using the password reset functionality. Specifically, the attacker must send X-Forwarded-Host to the /index.php?p=admin/actions/users/send-password-reset-email URI. NOTE: the vendor's position is that a customer can already work around this by adjusting the configuration (i.e., by not using the default configuration).
Apache MyFaces Trinidad Deserialization Vulnerability
Advisory: GHSA-x7rc-4gqw-3q6q
Aliases: CVE-2016-5019
Published: 2022-05-13T01:25:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

`CoreResponseStateManager` in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized viewstate string.
Improper Input Validation in Apache Hadoop
Advisory: GHSA-pr9x-qmp5-j3rr
Aliases: CVE-2017-3162
Published: 2022-05-13T01:08:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

HDFS clients interact with a servlet on the DataNode to browse the HDFS namespace. The NameNode is provided as a query parameter that is not validated in Apache Hadoop before 2.7.0.
Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat
Advisory: GHSA-4v3g-g84w-hv7r
Aliases: CVE-2016-5018
Published: 2022-05-13T01:02:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
Improper Input Validation in Apache CXF
Advisory: GHSA-7vgj-8mw4-hg8r
Aliases: CVE-2017-12624
Published: 2022-05-13T01:09:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS services are vulnerable to this attack. From Apache CXF 3.2.1 and 3.1.14, message attachment headers that are greater than 300 characters will be rejected by default. This value is configurable via the property "attachment-max-header-size".
SQL injection in moodle
Advisory: GHSA-69c3-5xxf-58q2
Aliases: CVE-2022-30599
Published: 2022-05-19T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
AntSword RCE and XSS via code injection
Advisory: GHSA-hq75-ggc3-8h3q
Aliases: CVE-2019-13970
Published: 2022-05-24T16:50:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In antSword before 2.1.0, self-XSS in the database configuration leads to code execution via `modules/database/asp/index.js`, `modules/database/custom/index.js`, `modules/database/index.js`, or `modules/database/php/index.js`.
Cross-site Scripting in Jenkins vboxwrapper Plugin
Advisory: GHSA-9w23-w757-mvv8
Aliases: CVE-2022-30968
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins vboxwrapper Plugin 1.3 and earlier does not escape the name and description of VBox node parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. This results in stored cross-site scripting (XSS) vulnerabilities exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).