aswin1906/github-advisory-2022 huggingface dataset:
Cross-site Scripting in Jenkins Rebuilder Plugin
Advisory: GHSA-7m8v-w6f9-q2f9
Aliases: CVE-2018-1000415
Published: 2022-05-14T01:38:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability exists in Jenkins Rebuilder Plugin 1.28 and earlier in 
```
RebuildAction/BooleanParameterValue.jelly,  
RebuildAction/ExtendedChoiceParameterValue.jelly,  
RebuildAction/FileParameterValue.jelly,  
RebuildAction/LabelParameterValue.jelly,  
RebuildAction/ListSubversionTagsParameterValue.jelly,  
RebuildAction/MavenMetadataParameterValue.jelly,  
RebuildAction/NodeParameterValue.jelly,  
RebuildAction/PasswordParameterValue.jelly,  
RebuildAction/RandomStringParameterValue.jelly,  
RebuildAction/RunParameterValue.jelly,  
RebuildAction/StringParameterValue.jelly,  
RebuildAction/TextParameterValue.jelly,  
RebuildAction/ValidatingStringParameterValue.jelly  
```
that allows users with Job/Configuration permission to insert arbitrary HTML into rebuild forms.
ImpressCMS Path Traversal to Arbitrary File Delete
Advisory: GHSA-wcj4-ff9m-5r7g
Aliases: CVE-2014-1836
Published: 2022-05-17T04:12:03Z

Absolute path traversal vulnerability in `htdocs/libraries/image-editor/image-edit.php` in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the `image_path` parameter in a cancel action.
TYPO3 Flow Cross-site scripting (XSS) vulnerability
Advisory: GHSA-vc74-c4m6-9979
Aliases: CVE-2013-7082
Published: 2022-05-17T01:29:43Z

Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in TYPO3 Flow (formerly FLOW3) 1.1.x before 1.1.1 and 2.0.x before 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.
CSRF in PHP Server Monitor before 3.3.2
Advisory: GHSA-w2g4-g8xr-px4x
Aliases: CVE-2018-18921
Published: 2022-05-14T01:42:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

PHP Server Monitor before 3.3.2 has CSRF, as demonstrated by a Delete action.
Improper Restriction of XML External Entity Reference in  iText
Advisory: GHSA-86p9-x5pw-94qx
Aliases: CVE-2017-9096
Published: 2022-05-13T01:14:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not disable external entities, which might allow remote attackers to conduct XML external entity (XXE) attacks via a crafted PDF.
Out-of-bounds read in admesh
Advisory: GHSA-5jrq-582v-9767
Aliases: CVE-2018-25033
Published: 2022-05-09T00:00:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in libadmesh.a.
CSRF vulnerability in Jenkins Shelve Project Plugin
Advisory: GHSA-9f37-ggxm-h6wx
Aliases: CVE-2020-2321
Published: 2022-05-24T17:35:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Shelve Project Plugin 3.0 and earlier does not require POST requests for HTTP endpoints, resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to shelve, unshelve, or delete a project.

Shelve Project Plugin 3.1 requires POST requests for the affected HTTP endpoints.
Open redirect vulnerability in Jenkins CAS Plugin
Advisory: GHSA-2vvr-5757-qp87
Aliases: CVE-2021-21673
Published: 2022-05-24T19:06:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

CAS Plugin 1.6.0 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.

This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication.

CAS Plugin 1.6.1 only redirects to relative (Jenkins) URLs.
Apache Archiva vulnerable to Cross-site Scripting
Advisory: GHSA-8jfm-rgmg-3wq2
Aliases: CVE-2016-5005
Published: 2022-05-14T01:09:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in Apache Archiva prior to version 2.2.1 allows remote authenticated administrators to inject arbitrary web script or HTML via the connector.sourceRepoId parameter to admin/addProxyConnector_commit.action.
Django Image Field Vulnerable to Image Decompression Bombs
Advisory: GHSA-59w8-4wm2-4xw8
Aliases: CVE-2012-3443
Published: 2022-05-17T05:12:01Z

The `django.forms.ImageField` class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.
phpMyAdmin micro history Implementation XSS Vulnerability
Advisory: GHSA-6wfj-2mw7-p5cg
Aliases: CVE-2014-6300
Published: 2022-05-14T02:09:44Z

Cross-site scripting (XSS) vulnerability in the micro history implementation in phpMyAdmin 4.0.x before 4.0.10.3, 4.1.x before 4.1.14.4, and 4.2.x before 4.2.8.1 allows remote attackers to inject arbitrary web script or HTML, and consequently conduct a cross-site request forgery (CSRF) attack to create a root account, via a crafted URL, related to js/ajax.js.
Improper Limitation of a Pathname to a Restricted Directory in Jenkins
Advisory: GHSA-4jhm-5f7g-75fp
Aliases: CVE-2018-1000863
Published: 2022-05-13T01:48:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

A data modification vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in User.java, IdStrategy.java that allows attackers to submit crafted user names that can cause an improper migration of user record storage formats, potentially preventing the victim from logging into Jenkins.
Code execution in Apache Struts 1 plugin
Advisory: GHSA-29rm-6752-gvwv
Aliases: CVE-2017-9791
Published: 2022-05-13T01:26:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Struts 1 plugin used with Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.
Symfony Arbitrary PHP code Execution
Advisory: GHSA-7w53-hfpw-rg3g
Aliases: CVE-2013-1397
Published: 2022-05-17T01:36:49Z

Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.
Improper Authentication in Apache CXF
Advisory: GHSA-2p7x-jcr3-7p2c
Aliases: CVE-2012-0803
Published: 2022-05-13T01:09:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request.
Apache XML Security For Java vulnerable to authentication bypass by HMAC truncation
Advisory: GHSA-8hfm-837h-hjg5
Aliases: CVE-2009-0217
Published: 2022-05-02T03:13:38Z

The design of the W3C XML Signature Syntax and Processing (XMLDsig) recommendation, as implemented in multiple products.

The Apache XML Security (Java) is affected by the vulnerability published in US-Cert VU #466161. See: http://www.kb.cert.org/vuls/id/466161 for more information. This bug can allow an attacker to bypass authentication by inserting/modifying a small HMAC truncation length parameter in the XML Signature HMAC based SignatureMethod algorithms.

An inexhaustive list of additional affected products includes:  
1. the Oracle Security Developer Tools component in Oracle Application Server 10.1.2.3, 10.1.3.4, and 10.1.4.3IM; 
2. the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, and 8.1 SP6; 
3. Mono before 2.4.2.2; 
4. XML Security Library before 1.2.12; 
5. IBM WebSphere Application Server Versions 6.0 through 6.0.2.33, 6.1 through 6.1.0.23, and 7.0 through 7.0.0.1; 
6. Sun JDK and JRE Update 14 and earlier; 
7. Microsoft .NET Framework 3.0 through 3.0 SP2, 3.5, and 4.0; and other products uses a parameter that defines an HMAC truncation length (HMACOutputLength) but does not require a minimum for this length, which allows attackers to spoof HMAC-based signatures and bypass authentication by specifying a truncation length with a small number of bits.
Yii Framework Reflected XSS
Advisory: GHSA-4xh9-5vh8-3p58
Aliases: CVE-2017-7271
Published: 2022-05-17T02:46:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reflected Cross-site scripting (XSS) vulnerability in Yii Framework before 2.0.11, when development mode is used, allows remote attackers to inject arbitrary web script or HTML via crafted request data that is mishandled on the debug-mode exception screen.
XXE vulnerability in Jenkins Job Import Plugin
Advisory: GHSA-882r-r8fw-p538
Aliases: CVE-2019-1003015
Published: 2022-05-13T01:31:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

An XML external entity (XXE) processing vulnerability exists in Jenkins Job Import Plugin 2.1 and earlier in src/main/java/org/jenkins/ci/plugins/jobimport/client/RestApiClient.java that allows attackers with the ability to control the HTTP server (Jenkins) queried in preparation of job import to read arbitrary files, perform a denial of service attack, etc.
Typo3 Host Header Spoofing Vulnerability
Advisory: GHSA-594h-cx6w-p4jf
Aliases: CVE-2014-3941
Published: 2022-05-14T04:01:58Z

TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted HTTP Host header, related to "Host Spoofing."
Pagekit File Upload vulnerability
Advisory: GHSA-692x-89xv-64jx
Aliases: CVE-2019-19013
Published: 2022-05-24T17:01:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A CSRF vulnerability in Pagekit 1.0.17 allows an attacker to upload an arbitrary file by removing the CSRF token from a request.
Password stored in plain text by ECX Copy Data Management Plugin
Advisory: GHSA-6793-gmp9-2535
Aliases: CVE-2020-2128
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins ECX Copy Data Management Plugin 1.9 and earlier stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.
Improper Input Validation in Apache Struts
Advisory: GHSA-7qwv-cwgj-c8rj
Aliases: CVE-2006-1547
Published: 2022-05-01T06:50:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.
Improper Input Validation in Jupyter Notebook
Advisory: GHSA-92mr-v722-f48m
Aliases: CVE-2015-7337
Published: 2022-05-17T03:25:49Z

The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.
Jenkins Violation Comments to GitLab Plugin has Insufficiently Protected Credentials
Advisory: GHSA-8hwr-589g-xpj2
Aliases: CVE-2019-10415
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Violation Comments to GitLab Plugin stored API tokens unencrypted in job `config.xml` files and its global configuration file `org.jenkinsci.plugins.jvctgl.ViolationsToGitLabGlobalConfiguration.xml` on the Jenkins controller. These credentials could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Violation Comments to GitLab Plugin now stores these credentials encrypted. Existing jobs need to have their configuration saved for existing plain text credentials to be overwritten.
Possible DoS attack when using URLValidator
Advisory: GHSA-xg75-68x3-7p3q
Aliases: CVE-2016-4465
Published: 2022-05-17T02:16:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of service via a null value for a URL field.
Tiki Wiki CMS XSS Vulnerability
Advisory: GHSA-7f2f-crxg-cpfv
Aliases: CVE-2018-7302
Published: 2022-05-14T03:38:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tiki 17.1 allows upload of a .PNG file that actually has SVG content, leading to XSS.
Fat Free CRM has fixed token value
Advisory: GHSA-g897-cgfc-7q8v
Aliases: CVE-2013-7222
Published: 2022-05-17T04:55:27Z

`config/initializers/secret_token.rb` in Fat Free CRM before 0.12.1 has a fixed `FatFreeCRM::Application.config.secret_token` value, which makes it easier for remote attackers to spoof signed cookies by referring to the key in the source code.
Path traversal vulnerability in Blue Ocean Plugin
Advisory: GHSA-vq7j-6pcq-f48p
Aliases: CVE-2020-2254
Published: 2022-05-24T17:28:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Blue Ocean Plugin 1.23.2 and earlier provides an undocumented feature flag, `blueocean.features.GIT_READ_SAVE_TYPE`, that when set to the value `clone` allows an attacker with Item/Configure or Item/Create permission to read arbitrary files on the Jenkins controller file system.

Blue Ocean Plugin 1.23.3 no longer includes this feature and redirects existing usage to a safer alternative.
Pillow denial of service via Crafted Block Size
Advisory: GHSA-cfmr-38g9-f2h7
Aliases: CVE-2014-3589
Published: 2022-05-14T02:05:20Z

`PIL/IcnsImagePlugin.py` in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.
Jenkins SAML Plugin allows bypassing CSRF protection for any URL
Advisory: GHSA-r5w3-pfq8-3r82
Aliases: CVE-2021-21678
Published: 2022-05-24T19:12:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs. SAML Plugin implements this extension point for the URL that users are redirected to after login.

In SAML Plugin 2.0.7 and earlier this implementation is too permissive, allowing attackers to craft URLs that would bypass the CSRF protection of any target URL.\n\nThis vulnerability was originally introduced in SAML Plugin 1.1.3.

SAML Plugin 2.0.8 restricts which URLs it disables cross-site request forgery (CSRF) protection for to the one URL that needs it.
Cross-site scripting in Apache Tomcat
Advisory: GHSA-j788-fx57-99wp
Aliases: CVE-2009-0781
Published: 2022-05-02T03:18:14Z

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
Magento 2 Community Edition Cross-site Scripting Vulnerability
Advisory: GHSA-pw2f-m22m-p75c
Aliases: CVE-2019-7909
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to email templates.
Dolibarr CRM allows Privilege Escalation
Advisory: GHSA-25h3-mw3p-w8r7
Aliases: CVE-2020-14201
Published: 2022-05-24T17:26:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Advisory: GHSA-hxp8-r9g3-grfr
Aliases: CVE-2019-7619
Published: 2022-05-24T17:00:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Elasticsearch versions 7.0.0-7.3.2 and 6.7.0-6.8.3 contain a username disclosure flaw was found in the API Key service. An unauthenticated attacker could send a specially crafted request and determine if a username exists in the Elasticsearch native realm.
hammer_cli_foreman Improper Certificate Validation vulnerability
Advisory: GHSA-77h8-xr85-3x5q
Aliases: CVE-2017-2667
Published: 2022-05-13T01:36:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks.
Lift Sensitive Information Disclosure
Advisory: GHSA-jf9v-fxfq-wm76
Aliases: CVE-2013-3300
Published: 2022-05-17T05:07:19Z

The JsonParser class in json/JsonParser.scala in Lift before 2.5 interprets a certain end-index value as a length value, which allows remote authenticated users to obtain sensitive information from other users' sessions via invalid input data containing a < (less than) character.
Moodle XSS Vulnerability
Advisory: GHSA-4r2p-wpv5-683w
Aliases: CVE-2019-3808
Published: 2022-05-13T01:14:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A flaw was found in Moodle versions 3.6 to 3.6.1, 3.5 to 3.5.3, 3.4 to 3.4.6, 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it, but does have that access in certain places. Note that the capability is intended for use by trusted users, and is only assigned to teachers and managers by default.
Unrestricted Upload of File with Dangerous Type in Sonatype Nexus Repository Manager
Advisory: GHSA-hmjv-px3j-933c
Aliases: CVE-2019-16530
Published: 2022-05-24T16:59:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Sonatype Nexus Repository Manager 2.x before 2.14.15 and 3.x before 3.19, and IQ Server before 72, has remote code execution.
Restkit Does Not Validate TLS certificates
Advisory: GHSA-p9cv-hrxr-fxx8
Aliases: CVE-2015-2674
Published: 2022-05-17T01:59:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the `ssl.wrap_socket` function in Python with the default CERT_NONE value for the cert_reqs argument.
Expected Behavior Violation in Apache Tomcat
Advisory: GHSA-9hg2-395j-83rm
Aliases: CVE-2017-5651
Published: 2022-05-13T01:46:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
Uncontrolled Resource Consumption in WildFly
Advisory: GHSA-97hp-6q9g-5cw2
Aliases: CVE-2020-25689
Published: 2022-05-24T17:32:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.
Etherpad Lite Access Restriction Bypass
Advisory: GHSA-mvmv-rq2j-97p2
Aliases: CVE-2018-6835
Published: 2022-05-13T01:53:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

`node/hooks/express/apicalls.js` in Etherpad Lite before v1.6.3 mishandles JSONP, which allows remote attackers to bypass intended access restrictions.
Improper permission checks in Jenkins Swarm Plugin
Advisory: GHSA-j852-mp82-wv2g
Aliases: CVE-2020-2191
Published: 2022-05-24T17:19:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent.

Swarm Plugin 3.21 requires Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.
dijit editor cross-site scripting vulnerability
Advisory: GHSA-wp32-wq34-2rqh
Aliases: CVE-2018-6561
Published: 2022-05-14T03:44:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.
Plone Unrestricted Filed Manipulation vulnerability via content edit forms
Advisory: GHSA-6fgf-x7wg-hp8r
Aliases: CVE-2013-4193
Published: 2022-05-17T04:49:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.
OpenStack Neutron allows remote authenticated users to cause a denial of service
Advisory: GHSA-4pmp-38hf-rmwj
Aliases: CVE-2014-3555
Published: 2022-05-17T03:06:07Z
Withdrawn: 2023-04-14T18:33:38Z

OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (crash or long firewall rule updates) by creating a large number of allowed address pairs.
Plaintext Storage of a Password in Jenkins Eagle Tester Plugin
Advisory: GHSA-vj6f-q4w6-qx9p
Aliases: CVE-2020-2129
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Eagle Tester Plugin 1.0.9 and earlier stores a password unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.
Arbitrary file read vulnerability in Jenkins Persona Plugin
Advisory: GHSA-5mfw-p6qv-wgvv
Aliases: CVE-2020-2293
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Persona Plugin 2.4 and earlier allows users with Overall/Read permission to read arbitrary files on the Jenkins controller.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-jh69-6vv2-wfp5
Aliases: CVE-2020-9016
Published: 2022-05-24T17:09:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
Missing Release of Resource after Effective Lifetime in Jenkins
Advisory: GHSA-2632-h32j-6rg9
Aliases: CVE-2018-1999043
Published: 2022-05-13T01:50:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in BasicAuthenticationFilter.java, BasicHeaderApiTokenAuthenticator.java that allows attackers to create ephemeral in-memory user records by attempting to log in using invalid credentials.
Bundler allows attacker to inject arbitrary code via secondary Gem source
Advisory: GHSA-jvgm-pfqv-887x
Aliases: CVE-2016-7954
Published: 2022-05-14T00:57:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.  NOTE: this might overlap CVE-2013-0334.
Exposure of Sensitive Information in Jenkins Core
Advisory: GHSA-jgpr-qrw2-6gp3
Aliases: CVE-2016-0790
Published: 2022-05-14T03:58:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify API tokens, which makes it easier for remote attackers to determine API tokens via a brute-force approach.
ChakraCore RCE Vulnerability
Advisory: GHSA-6gj2-5366-p95v
Aliases: CVE-2018-8381
Published: 2022-05-13T01:20:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8266, CVE-2018-8380, CVE-2018-8384.
DOMPDF Information Disclosure
Advisory: GHSA-jwf8-mjj8-r8hq
Aliases: CVE-2014-5011
Published: 2022-05-17T19:57:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

DOMPDF before 0.6.2 allows Information Disclosure.
Cross-Site Request Forgery in Jenkins Git Plugin
Advisory: GHSA-r8rw-xx57-m64q
Aliases: CVE-2019-1003010
Published: 2022-05-14T01:06:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery vulnerability exists in Jenkins Git Plugin 3.9.1 and earlier in src/main/java/hudson/plugins/git/GitTagAction.java that allows attackers to create a Git tag in a workspace and attach corresponding metadata to a build record.
SCart is vulnerable to cross-site scripting (XSS) 
Advisory: GHSA-7pfc-cx3m-v22x
Aliases: CVE-2022-21149
Published: 2022-05-03T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

SCart e-commerce is a free open source for businesses, built on the Laravel framework. The package s-cart/s-cart before 6.9 and the package s-cart/core before 6.9 are vulnerable to cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL. An attacker can gain unauthorized access to that user's account through the stolen cookie.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-58xm-mxjf-254g
Aliases: CVE-2021-21685
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2427 / CVE-2021-21685: `FilePath#mkdirs` does not check permission to create parent directories.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2427 / CVE-2021-21685: `FilePath#mkdirs` checks permission to create parent directories.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Default inheritable capabilities for linux container should be empty
Advisory: GHSA-f3fp-gc8g-vw66
Aliases: CVE-2022-29162
Published: 2022-05-24T17:36:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

### Impact

A bug was found in runc where `runc exec --cap` executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.

### Patches
This bug has been fixed in runc 1.1.2. Users should update to this version as soon as possible.

This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities.

In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.

### Credits
The opencontainers project would like to thank [Andrew G. Morgan](https://github.com/AndrewGMorgan) for responsibly disclosing this issue in accordance with the [opencontainers org security policy](https://github.com/opencontainers/.github/blob/master/SECURITY.md).

### For more information
If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/opencontainers/runc/issues/new)
* Email us at [security@opencontainers.org](mailto:security@opencontainers.org) if you think you’ve found a security bug
Cross-Site Request Forgery in Spring Framework
Advisory: GHSA-rp4p-g69r-438x
Aliases: CVE-2013-4152
Published: 2022-05-13T01:02:38Z

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.
Plone allows weak passwords
Advisory: GHSA-cw58-gpgw-hwx2
Aliases: CVE-2020-7940
Published: 2022-05-24T17:07:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.
Missing permission checks in Jenkins Ansible Plugin allow enumerating credentials IDs
Advisory: GHSA-6xqj-wvgp-rqp8
Aliases: CVE-2020-2310
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Ansible Plugin 1.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Ansible Plugin 1.1 requires the appropriate permissions.
Jenkins Log Parser Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-xqqw-cqjp-52xm
Aliases: CVE-2019-10410
Published: 2022-05-24T16:56:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Log Parser Plugin did not escape an error message shown when log parsing patterns are invalid. This resulted in a persisted cross-site scripting vulnerability exploitable by attackers able to control the log parsing rules configuration, typically users with Job/Configure permission.

Jenkins applies the missing escaping by default since 2.146 and LTS 2.138.2, so newer Jenkins releases are not affected by this vulnerability.

Log Parser Plugin version 2.1 escapes all variables displayed in its views.
OpenStack Object Storage (Swift) allows remote attackers to cause a denial of service
Advisory: GHSA-fxwr-2vxm-cg7p
Aliases: CVE-2016-0738
Published: 2022-05-17T03:29:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close server connections, which allows remote attackers to cause a denial of service (proxy-server resource consumption) via a series of interrupted requests to a Large Object URL.
phpMyAdmin cross-site scripting Vulnerability in Table or Column Names
Advisory: GHSA-jqmr-wqgp-8mh2
Aliases: CVE-2014-4986
Published: 2022-05-17T03:20:58Z

Multiple cross-site scripting (XSS) vulnerabilities in js/functions.js in phpMyAdmin 4.0.x before 4.0.10.1, 4.1.x before 4.1.14.2, and 4.2.x before 4.2.6 allow remote authenticated users to inject arbitrary web script or HTML via a crafted (1) table name or (2) column name that is improperly handled during construction of an AJAX confirmation message.
Integer overflow in `SpaceToBatchND`
Advisory: GHSA-jjm6-4vf7-cjh4
Aliases: CVE-2022-29203
Published: 2022-05-24T22:11:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of `tf.raw_ops.SpaceToBatchND` (in all backends such as XLA and handwritten kernels) is vulnerable to an integer overflow:

```python
import tensorflow as tf

input = tf.constant(-3.5e+35, shape=[10,19,22], dtype=tf.float32)
block_shape = tf.constant(-1879048192, shape=[2], dtype=tf.int64)
paddings = tf.constant(0, shape=[2,2], dtype=tf.int32)
tf.raw_ops.SpaceToBatchND(input=input, block_shape=block_shape, paddings=paddings)
```

The result of this integer overflow is used to allocate the output tensor, hence we get a denial of service via a `CHECK`-failure (assertion failure), as in [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md).

### Patches
We have patched the issue in GitHub commit [acd56b8bcb72b163c834ae4f18469047b001fadf](https://github.com/tensorflow/tensorflow/commit/acd56b8bcb72b163c834ae4f18469047b001fadf).
  
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.
  
### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
  
### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Deserialization of Untrusted Data in Apache commons collections
Advisory: GHSA-fjq5-5j5f-mvxh
Aliases: CVE-2015-7501
Published: 2022-05-13T01:25:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

It was found that the Apache commons-collections library permitted code execution when deserializing objects involving a specially constructed chain of classes. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using the commons-collections library.
Apache OpenMeetings vulnerable to parameter manipulation attacks
Advisory: GHSA-2q65-xxg6-3qh5
Aliases: CVE-2017-7682
Published: 2022-05-13T01:47:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Apache OpenMeetings 3.2.0 is vulnerable to parameter manipulation attacks, as a result attacker has access to restricted areas.
Undertow Uncontrolled Resource Consumption
Advisory: GHSA-rf6q-vx79-mjxr
Aliases: CVE-2021-3629
Published: 2022-05-25T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.
Improper Authentication in Apache Tomcat
Advisory: GHSA-4f7h-9j2x-cmr4
Aliases: CVE-2011-5062
Published: 2022-05-14T01:17:03Z

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184.
Deserialization of Untrusted Data in Infinispan
Advisory: GHSA-qqfc-m9hc-pqv3
Aliases: CVE-2018-1131
Published: 2022-05-13T01:33:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept certain types of objects, achieving code execution and possible further attacks. Versions 9.0.3.Final, 9.1.7.Final, 8.2.10.Final, 9.2.2.Final, 9.3.0.Alpha1 are believed to be affected.
Missing permission check in Jenkins Blue Ocean Plugin
Advisory: GHSA-5m4q-x28v-q6wp
Aliases: CVE-2022-30954
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins Blue Ocean Plugin 1.25.3 and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified HTTP server. Blue Ocean Plugin 1.25.4 requires POST requests and the appropriate permissions for the affected HTTP endpoints.
TYPO3 is vulnerable to Mass Assignment in the Extension table administration library
Advisory: GHSA-5fj8-wh3g-qvq2
Aliases: CVE-2013-7080
Published: 2022-05-17T04:54:37Z

The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, and 6.0.0 through 6.0.11 allows remote attackers to write to arbitrary fields in the configuration database table via crafted links, aka "Mass Assignment."
Exposure of Sensitive Information to an Unauthorized Actor in OpenSAML
Advisory: GHSA-v723-58jv-2qc4
Aliases: CVE-2013-6440
Published: 2022-05-13T01:04:00Z

The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration.
phpMyAdmin Authentication Bypass
Advisory: GHSA-567r-vqj7-5cw7
Aliases: CVE-2016-6629
Published: 2022-05-17T02:37:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in phpMyAdmin involving the `$cfg['ArbitraryServerRegexp']` configuration directive. An attacker could reuse certain cookie values in a way of bypassing the servers defined by ArbitraryServerRegexp. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
Moodle SSRF Vulnerability
Advisory: GHSA-qqjv-mc2v-p7mc
Aliases: CVE-2018-1042
Published: 2022-05-14T00:55:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Moodle 3.x has Server Side Request Forgery in the filepicker.
Wildfly-OpenSSL memory leak flaw
Advisory: GHSA-hxj4-885f-grgp
Aliases: CVE-2020-25644
Published: 2022-05-24T17:30:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.
TYPO3 Improper Access Management in the File Abstraction Layer
Advisory: GHSA-p9jg-9w87-6rg4
Aliases: CVE-2013-4320
Published: 2022-05-17T04:43:27Z

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows remote authenticated users to create or read arbitrary files via a crafted URL.
Improper user session handling in filegator
Advisory: GHSA-47vg-483w-hp3m
Aliases: CVE-2022-1849
Published: 2022-05-25T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

FileGator prior to version 7.8.0 is vulnerable to session fixation.
Magento 2 Community Edition Insecure Component
Advisory: GHSA-xgcp-59g2-wm8g
Aliases: CVE-2019-8136
Published: 2022-05-24T17:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An insecure component vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Magento 2 codebase leveraged outdated versions of HTTP specification abstraction implemented in symphony component.
kube-state-metrics may expose secret content in metrics
Advisory: GHSA-c92w-72c5-9x59
Aliases: CVE-2019-10223
Published: 2022-05-24T17:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.
Centreon SQL Injection
Advisory: GHSA-5jxp-4x68-mhqc
Aliases: CVE-2018-19312
Published: 2022-05-14T00:55:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.24) allows SQL Injection via the searchVM parameter to the main.php?p=20408 URI.
Apache Geronimo console 1.0 vulnerable to cross-site scripting
Advisory: GHSA-2jxh-3cx8-xw65
Aliases: CVE-2006-0254
Published: 2022-05-01T06:38:20Z

Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer. Version 1.1 contains fixes for these issues.
Improper Limitation of a Pathname to a Restricted Directory in Jenkins
Advisory: GHSA-5p59-v5wm-77v4
Aliases: CVE-2018-6356
Published: 2022-05-13T01:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins before 2.107 and Jenkins LTS before 2.89.4 did not properly prevent specifying relative paths that escape a base directory for URLs accessing plugin resource files. This allowed users with Overall/Read permission to download files from the Jenkins master they should not have access to. On Windows, any file accessible to the Jenkins master process could be downloaded. On other operating systems, any file within the Jenkins home directory accessible to the Jenkins master process could be downloaded.
Jenkins SAML Plugin Session Fixation vulnerability
Advisory: GHSA-4pjx-86pg-x4j5
Aliases: CVE-2018-1000602
Published: 2022-05-14T03:07:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A session fixation vulnerability exists in Jenkins SAML Plugin 1.0.6 and earlier in SamlSecurityRealm.java that allows unauthorized attackers to impersonate another users if they can control the pre-authentication session. SAML Plugin 1.0.7 invalidates the previous session during login and creates a new one.
Improper Input Validation in Apache Tomcat
Advisory: GHSA-42j3-498q-m6vp
Aliases: CVE-2014-0227
Published: 2022-05-14T01:10:18Z

java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter 
Advisory: GHSA-qf8x-vqjv-92gr
Aliases: CVE-2022-24901
Published: 2022-05-04T18:59:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Weak validation of the Apple certificate URL in the Apple Game Center authentication adapter allows to bypass authentication and makes the server vulnerable to DoS attacks.

### Patches
The vulnerability has been fixed by improving the URL validation and adding additional checks of the resource the URL points to before downloading it.
Minikube RCE via DNS Rebinding
Advisory: GHSA-6pcv-qqx4-mxm3
Aliases: CVE-2018-1002103
Published: 2022-05-13T01:35:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In Minikube versions 0.3.0-0.29.0, minikube exposes the Kubernetes Dashboard listening on the VM IP at port 30000. In VM environments where the IP is easy to predict, the attacker can use DNS rebinding to indirectly make requests to the Kubernetes Dashboard, create a new Kubernetes Deployment running arbitrary code. If minikube mount is in use, the attacker could also directly access the host filesystem.
Mortbay Jetty Double Slash URI Information Disclosure Vulnerability
Advisory: GHSA-4jjw-xrr6-9v3p
Aliases: CVE-2007-6672
Published: 2022-05-01T18:45:22Z

Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple `/` (slash) characters in the URI.
Apache Storm log viewer path traversal vulnerability
Advisory: GHSA-cpp8-r8pr-wv4v
Aliases: CVE-2014-0115
Published: 2022-05-17T00:24:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a `..` (dot dot) in the file parameter to log.
Improper Neutralization of Input During Web Page Generation in Apache Solr
Advisory: GHSA-mx2h-hf7j-2x3p
Aliases: CVE-2015-8795
Published: 2022-05-17T03:59:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in the Admin UI in Apache Solr before 5.1 allow remote attackers to inject arbitrary web script or HTML via crafted fields that are mishandled during the rendering of the (1) Analysis page, related to webapp/web/js/scripts/analysis.js or (2) Schema-Browser page, related to webapp/web/js/scripts/schema-browser.js.