aswin1906/github-advisory-2022 huggingface dataset:
Panic on incorrect date input to `simple_asn1`
Advisory: GHSA-3m6f-3gfg-4x56
Published: 2022-06-17T00:19:49Z

Version 0.6.0 of the `simple_asn1` crate panics on certain malformed
inputs to its parsing functions, including `from_der` and `der_decode`.
Because this crate is frequently used with inputs from the network, this
should be considered a security vulnerability.

The issue occurs when parsing the old ASN.1 "UTCTime" time format.  If an
attacker provides a UTCTime where the first character is ASCII but the
second character is above 0x7f, a string slice operation in the
`from_der_` function will try to slice into the middle of a UTF-8
character, and cause a panic.

This error was introduced in commit
[`d7d39d709577710e9dc8`](https://github.com/acw/simple_asn1/commit/d7d39d709577710e9dc8833ee57d200eef366db8),
which updated `simple_asn1` to use `time` instead of `chrono` because of
[`RUSTSEC-2020-159`](https://rustsec.org/advisories/RUSTSEC-2020-0159).
Versions of `simple_asn1` before 0.6.0 are not affected by this issue.

The [patch](https://github.com/acw/simple_asn1/pull/28) was applied in
`simple_asn1` version 0.6.1.
Optional `Deserialize` implementations lacking validation
Advisory: GHSA-jf5h-cf95-w759
Published: 2022-06-17T00:16:24Z

When activating the non-default feature `serialize`, most structs implement
`serde::Deserialize` without sufficient validation. This allows breaking
invariants in safe code, leading to:

* Undefined behavior in `as_string()` methods (which use
  `std::str::from_utf8_unchecked()` internally).
* Panics due to failed assertions.

See https://github.com/gz/rust-cpuid/issues/43.
NocoDB information disclosure vulnerability
Advisory: GHSA-mx8q-jqwm-85mv
Aliases: CVE-2022-2062
Published: 2022-06-14T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In NocoDB prior to 0.91.7, the SMTP plugin doesn't have verification or validation. This allows attackers to make requests to internal servers and read the contents.
Formula Injection in Exported Data
Advisory: GHSA-7rq4-qcpw-74gq
Published: 2022-06-17T01:17:22Z

### Impact

Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection

### Patches

- The issue is addressed in the upcoming 0.8.0 release
- This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release

### Workarounds

Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel).

### References

- https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/
- https://owasp.org/www-community/attacks/CSV_Injection

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github](http://github.com/inventree/inventree)
* Email us at [security@inventree.org](mailto:security@inventree.org)
Exposure of Sensitive Information to an Unauthorized Actor in semantic-release
Advisory: GHSA-x2pg-mjhr-2m5x
Aliases: CVE-2022-31051
Published: 2022-06-09T23:51:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

### Impact
_What kind of vulnerability is it? Who is impacted?_

Secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded from uri encoding by [encodeURI](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI). Occurrence is further limited to execution contexts where push access to the related repository is not available without modifying the repository url to inject credentials.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Fixed in 19.0.3

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Secrets that do not contain characters that are excluded from encoding with `encodeURI` when included in a URL are already masked properly.

### References
_Are there any links users can visit to find out more?_
* https://github.com/semantic-release/semantic-release/releases/tag/v19.0.3
* https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/encodeURI

### For more information
If you have any questions or comments about this advisory:
* Open a discussion in [semantic-release discussions](https://github.com/semantic-release/semantic-release/discussions)
Cross-site Scripting vulnerability in Jenkins
Advisory: GHSA-6g4r-q7qg-6qx6
Aliases: CVE-2022-34173
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Since Jenkins 2.340, the tooltip of the build button in list views supports HTML without escaping the job display name.

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356 addresses this vulnerability. The tooltip of the build button in list views is now escaped.

No Jenkins LTS release is affected by SECURITY-2776 or SECURITY-2780, as these were not present in Jenkins 2.332.x and fixed in the 2.346.x line before 2.346.1.
Improper handling of CSS at-rules in lettersanitizer
Advisory: GHSA-7r3r-gq8p-v9jj
Aliases: CVE-2022-31103
Published: 2022-06-23T17:48:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

All versions of lettersanitizer below 1.0.2 are affected by a denial of service issue when processing a CSS at-rule `@keyframes`.

This package is depended on by [react-letter](https://github.com/mat-sz/react-letter), therefore everyone using react-letter is also at risk.

### Patches

The problem has been patched in version 1.0.2.

### Workarounds

There is no workaround besides upgrading.

### References

The issue was originally reported in the react-letter repository: https://github.com/mat-sz/react-letter/issues/17

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [lettersanitizer](https://github.com/mat-sz/lettersanitizer/issues)
* Email me at [contact@matsz.dev](mailto:contact@matsz.dev)
Path Traversal vulnerability in Jenkins Embeddable Build Status Plugin
Advisory: GHSA-93mx-2vf9-28c4
Aliases: CVE-2022-34179
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a `style` query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to specify paths to other SVG images on the Jenkins controller file system.

Embeddable Build Status Plugin 2.0.4 restricts the `style` query parameter to one of the three legal values.
Uncontrolled Resource Consumption in @discordjs/opus
Advisory: GHSA-rvgf-69j7-xh78
Aliases: CVE-2022-25345
Published: 2022-06-18T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Improperly handled errors in @discordjs/opus cause hard crashes instead of returning the error to user land. All versions of package @discordjs/opus (<= 0.7.0) are vulnerable to Denial of Service (DoS) when trying to encode using an encoder with zero channels, or a non-initialized buffer. This leads to a hard crash due to improperly returning the errors from the invalid inputs.

As of version 0.8.0, the errors are correctly returned to the user and are no longer throwing hard crashes that cannot be recovered.
AutoUpdater module fails to validate certain nested components of the bundle
Advisory: GHSA-77xc-hjv8-ww97
Aliases: CVE-2022-29257
Published: 2022-06-16T23:18:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

### Impact
This vulnerability allows attackers who have control over a given apps update server / update storage to serve maliciously crafted update packages that pass the code signing validation check but contain malicious code in some components.

Please note that this kind of attack would require **significant** privileges in your own auto updating infrastructure and the ease of that attack entirely depends on your infrastructure security.

### Patches
This has been patched and the following Electron versions contain the fix:

* `18.0.0-beta.6`
* `17.2.0`
* `16.2.0`
* `15.5.0`

### Workarounds
There are no workarounds for this issue, please update to a patched version of Electron.

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org)
Unserialized Pop Chain in Laravel
Advisory: GHSA-vv7q-mfpc-qgm5
Aliases: CVE-2022-31279
Published: 2022-06-08T00:00:43Z
Withdrawn: 2022-08-22T16:36:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Withdrawn
This advisory has been withdrawn because it is not a security issue and the CVE has been revoked.

## Original Description
Laravel 9.1.8, when processing attacker-controlled data for deserialization, allows Remote Code Execution (RCE) via an unserialized pop chain in __destruct in Illuminate\Broadcasting\PendingBroadcast.php and __call in Faker\Generator.php.
Open redirect in caddy
Advisory: GHSA-2927-hv3p-f3vp
Aliases: CVE-2022-29718
Published: 2022-06-03T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Caddy v2.4 was discovered to contain an open redirect vulnerability. A remote unauthenticated attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
Insecure path traversal in Git Trigger Source can lead to arbitrary file read
Advisory: GHSA-qpgx-64h2-gc3c
Aliases: CVE-2022-25856
Published: 2022-06-17T01:03:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
A path traversal issue was found in the `(g *GitArtifactReader).Read() API. Read()` calls into `(g *GitArtifactReader).readFromRepository()` that opens and reads the file that contains the trigger resource definition:

```go
func (g *GitArtifactReader) readFromRepository(r *git.Repository, dir string)
```

No checks are made on this file at read time, which could lead an attacker to read files anywhere on the system. This could be achieved by either using symbolic links, or putting `../` in the path.

### Patches
A patch for this vulnerability has been released in the following Argo Events version:

v1.7.1

### Credits
Disclosed by [Ada Logics](https://adalogics.com/) in a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information
Open an issue in the [Argo Events issue tracker](https://github.com/argoproj/argo-events/issues) or [discussions](https://github.com/argoproj/argo-events/discussions)
Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-events
Reflected Cross-site Scripting in Jenkins Nested View Plugin
Advisory: GHSA-h642-5h74-3x9c
Aliases: CVE-2022-34182
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins Nested View Plugin 1.20 through 1.25 (both inclusive) does not escape search parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.

Nested View Plugin 1.26 escapes search parameters
Login timing attack in ibexa/core
Advisory: GHSA-2x4v-g8cx-jxrq
Published: 2022-06-02T21:02:24Z

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
Cross-site Scripting in NocoDB
Advisory: GHSA-hv6q-5g4f-8897
Aliases: CVE-2022-2079
Published: 2022-06-15T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.9.
RustEmbed generated `get` method allows for directory traversal when reading files from disk
Advisory: GHSA-cgw6-f3mj-h742
Published: 2022-06-17T00:18:08Z

When running in debug mode and the `debug-embed` (off by default) feature is
not enabled, the generated `get` method does not check that the input path is
a child of the folder given. 

This allows attackers to read arbitrary files in the file system if they have
control over the filename given. The following code will print the contents of
your `/etc/passwd` if adjusted with a correct number of `../`s depending on
where it is run from.

```rust
#[derive(rust_embed::RustEmbed)]
#[folder = "src/"]
pub struct Asset;

fn main() {
    let d = Asset::get("../../../etc/passwd").unwrap().data;
    println!("{}", String::from_utf8_lossy(&d));
}
```

The flaw was corrected by canonicalizing the input filename and ensuring that
it starts with the canonicalized folder path.
Path traversal in Concrete CMS
Advisory: GHSA-3jxh-6635-6jwp
Aliases: CVE-2022-30117
Published: 2022-06-25T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.Concrete CMS Security team ranked this 5.8 with CVSS v3.1 vector AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. Credit to Siebene for reporting.
Security Update for the OPC UA .NET Standard Stack
Advisory: GHSA-5q2v-6j86-5h9v
Aliases: CVE-2022-29862
Published: 2022-06-17T21:44:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was discovered in OPC UA .NET Standard Stack that allows a malicious client or server to cause a peer to hang with a carefully crafted message sent during secure channel creation.
Prototype Pollution in querymen
Advisory: GHSA-p23c-p8w2-ww5v
Aliases: CVE-2022-25871
Published: 2022-06-18T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

All versions of package querymen are vulnerable to Prototype Pollution if the parameters of exported function handler(type, name, fn) can be controlled by users without any sanitization. Note: This vulnerability derives from an incomplete fix of [CVE-2020-7600](https://security.snyk.io/vuln/SNYK-JS-QUERYMEN-559867).
Denial of service in bottle
Advisory: GHSA-xhp9-4947-rq78
Aliases: CVE-2022-31799
Published: 2022-06-03T00:01:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Bottle before 0.12.20 mishandles errors during early request binding.
Open redirect in web2py
Advisory: GHSA-cgrj-xjm7-9q27
Aliases: CVE-2022-33146
Published: 2022-06-28T00:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
Generated code can read and write out of bounds in safe code
Advisory: GHSA-3jch-9qgp-4844
Published: 2022-06-16T23:54:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Code generated by flatbuffers' compiler is `unsafe` but not marked as such.
See https://github.com/google/flatbuffers/issues/6627 for details.

All users that use generated code by `flatbuffers` compiler are recommended to:
1. not expose flatbuffer generated code as part of their public APIs
2. audit their code and look for any usage of `follow`, `push`, or any method that uses them
   (e.g. `self_follow`).
3. Carefuly go through the crates' documentation to understand which "safe" APIs are not
   intended to be used.
Cross-Site Request Forgery in Jenkins vRealize Orchestrator Plugin
Advisory: GHSA-c965-p3w4-835c
Aliases: CVE-2022-34211
Published: 2022-06-24T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers to send an HTTP POST request to an attacker-specified URL.
Embedded Malicious Code in ctx
Advisory: GHSA-67r3-h899-9w95
Published: 2022-06-02T15:46:06Z

The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects.
Incorrect Lifetime Bounds on Closures in `rusqlite`
Advisory: GHSA-q89g-4vhh-mvvm
Published: 2022-06-17T00:16:48Z

The lifetime bound on several closure-accepting `rusqlite` functions (specifically, functions which register a callback to be later invoked by SQLite) was too relaxed. If a closure referencing borrowed values on the stack is was passed to one of these functions, it could allow Rust code to access objects on the stack after they have been dropped.

The impacted functions are:

- Under `cfg(feature = "functions")`: `Connection::create_scalar_function`, `Connection::create_aggregate_function` and `Connection::create_window_function`.
- Under `cfg(feature = "hooks")`: `Connection::commit_hook`, `Connection::rollback_hook` and `Connection::update_hook`.
- Under `cfg(feature = "collation")`: `Connection::create_collation`.

The issue exists in all `0.25.*` versions prior to `0.25.4`, and all `0.26.*` versions prior to 0.26.2 (specifically: `0.25.0`, `0.25.1`, `0.25.2`, `0.25.3`, `0.26.0`, and `0.26.1`).

The fix is available in versions `0.26.2` and newer, and also has been back-ported to `0.25.4`. As it does not exist in `0.24.*`, all affected versions should have an upgrade path to a semver-compatible release.
Remote Code Execution in Apache Flume
Advisory: GHSA-x5m7-rwfx-w7qm
Aliases: CVE-2022-25167
Published: 2022-06-15T00:00:24Z

Apache Flume versions 1.4.0 through 1.9.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
QueryInterface should call AddRef before returning pointer
Advisory: GHSA-9rg7-3j4f-cf4x
Published: 2022-06-16T23:52:51Z

Affected version of this crate, which is a required dependency in com-impl, 
provides a faulty implementation of the `IUnknown::QueryInterface` method.

`QueryInterface` implementation must call `IUnknown::AddRef` before returning the pointer,
as describe in this documentation:
<https://docs.microsoft.com/en-us/windows/win32/api/unknwn/nf-unknwn-iunknown-queryinterface(refiid_void)>

As it is not incrementing the refcount as expected, the following calls to `IUnknown::Release` method 
will cause WMI to drop reference to the interface, and can lead to invalid reference.

This is documented in <https://docs.microsoft.com/en-us/windows/win32/learnwin32/managing-the-lifetime-of-an-object#reference-counting>

There is no simple workaround, as you can't know how many time QueryInterface will be called.
The only way to quick fix this is to use the macro expanded version of the code and modify 
the QueryInterface method to add the AddRef call yourself.

The issue was corrected in commit `9803f31fbd1717d482d848f041044d061fca6da7`.
Backdoor in api-res-py
Advisory: GHSA-6978-4w92-428p
Aliases: CVE-2022-31313
Published: 2022-06-09T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.
Information Disclosure via Export Module
Advisory: GHSA-8gmv-9hwg-w89g
Aliases: CVE-2022-31046
Published: 2022-06-17T20:52:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.0)

### Problem
The export functionality fails to limit the result set to allowed columns of a particular database table. This allows authenticated users to export internal details of database tables to which they already have access.

### Solution
Update to TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.

ℹ️  **Strong security defaults - Manual actions required**
Following User TSconfig setting would allow using the export functionality for particular users:
```
options.impexp.enableExportForNonAdminUser = 1
```

### Credits
Thanks to TYPO3 core merger Lina Wolf who reported this issue and to TYPO3 security member Torben Hansen  who fixed the issue.

### References
* [TYPO3-CORE-SA-2022-001](https://typo3.org/security/advisory/typo3-core-sa-2022-001)
Open Redirect in microweber
Advisory: GHSA-437j-5qc3-c589
Aliases: CVE-2022-2252
Published: 2022-06-30T00:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Open Redirect in GitHub repository microweber/microweber prior to 1.2.19.
Agent-to-controller security bypass in Jenkins xUnit Plugin
Advisory: GHSA-298j-9q4w-6rm4
Aliases: CVE-2022-34181
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

xUnit Plugin 3.0.8 and earlier implements an agent-to-controller message that creates a user-specified directory if it doesn’t exist, and parsing files inside it as test results.

This allows attackers able to control agent processes to create an arbitrary directory on the Jenkins controller or to obtain test results from existing files in an attacker-specified directory.

xUnit Plugin 3.1.0 changes the message type from agent-to-controller to controller-to-agent, preventing execution on the controller.
Signature forgery in Biscuit
Advisory: GHSA-75rw-34q6-72cr
Aliases: CVE-2022-31053
Published: 2022-06-17T00:38:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

The paper [Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin](https://eprint.iacr.org/2020/1484) defines a way to forge valid Γ-signatures, an algorithm that is used in the Biscuit specification version 1.
It would allow an attacker to create a token with any access level.

As Biscuit v1 was still an early version and not broadly deployed, we were able to contact all known users of Biscuit v1 and help them migrate to Biscuit v2.
We are not aware of any active exploitation of this vulnerability.

### Patches

The version 2 of the specification mandates a different algorithm than gamma signatures and as such is not affected by this vulnerability. The Biscuit implementations in Rust, Haskell, Go, Java and Javascript all have published versions following the v2 specification.

### Workarounds

There is no known workaround, any use of Biscuit v1 should be migrated to v2.

### References
[Cryptanalysis of Aggregate Γ-Signature and Practical Countermeasures in Application to Bitcoin](https://eprint.iacr.org/2020/1484)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [biscuit-auth/biscuit](https://github.com/biscuit-auth/biscuit)
* Ask questions on [Matrix](https://matrix.to/#/#biscuit-auth:matrix.org)
`SegQueue` creates zero value of any type
Advisory: GHSA-8gj8-hv75-gp94
Published: 2022-06-16T23:51:13Z

Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`.
This is unsound e.g. if `T` is a reference type (which must be non-null).
 
The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.
Use after free in Neon external buffers
Advisory: GHSA-8mj7-wxmc-f424
Published: 2022-06-17T00:13:40Z

Neon provides functionality for creating JavaScript `ArrayBuffer` (and the `Buffer` subtype) instances backed by bytes allocated outside of V8/Node. The [`JsArrayBuffer::external`](https://docs.rs/neon/0.10.0/neon/types/struct.JsArrayBuffer.html#method.external) and [`JsBuffer::external`](https://docs.rs/neon/0.10.0/neon/types/struct.JsBuffer.html#method.external) did not require `T: 'static` prior to Neon `0.10.1`. This allowed creating an externally backed buffer from types that may be freed while they are still referenced by a JavaScript `ArrayBuffer`.

The following example demonstrates use after free. It compiles on versions `<0.10.1` and fails to compile afterward.

```rust
pub fn soundness_hole(mut cx: FunctionContext) -> JsResult<JsArrayBuffer> {
    let mut data = vec![0u8, 1, 2, 3];
    
    // Creating an external from `&mut [u8]` instead of `Vec<u8>` since there is a blanket impl
    // of `AsMut<T> for &mut T`
    let buf = JsArrayBuffer::external(&mut cx, data.as_mut_slice());

    // `buf` is still holding a reference to `data`!
    drop(data);

    Ok(buf)
}
```
Cross-site Scripting in Microweber
Advisory: GHSA-27g3-58v4-fg9w
Aliases: CVE-2022-2130
Published: 2022-06-21T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L

Microweber versions 1.2.17 and prior are vulnerable to cross-site scripting. A patch is available on the `dev laravel9-php8` branch of the repository.
Token bruteforcing.
Advisory: GHSA-v7vq-3x77-87vg
Aliases: CVE-2022-29238
Published: 2022-06-16T23:10:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

### Impact
_What kind of vulnerability is it? Who is impacted?_

Authenticated requests to the notebook server with `ContentsManager.allow_hidden = False` only prevented listing the contents of hidden directories, not accessing individual hidden files or files in hidden directories (i.e. hidden files were 'hidden' but not 'inaccessible'). This could lead to notebook configurations allowing authenticated access to files that may reasonably be expected to be disallowed.

Because fully authenticated requests are required, this is of relatively low impact. But if a server's root directory contains sensitive files whose only protection from the server is being hidden (e.g. `~/.ssh` while serving $HOME), then any authenticated requests could access files if their names are guessable. Such contexts also necessarily have full access to the server and therefore execution permissions, which also generally grants access to all the same files. So this does not generally result in any privilege escalation or increase in information access, only an additional, unintended _means_ by which the files could be accessed.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

notebook 6.4.12

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

- Do not run the notebook server in a directory with hidden files, use subdirectories
- Use a custom ContentsManager with additional checks for `self.is_hidden(path)` prior to completing actions

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Unrestricted Upload of File with Dangerous Type in Elefant CMS
Advisory: GHSA-mwh6-g9wx-xcx3
Aliases: CVE-2017-20063
Published: 2022-06-21T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been classified as critical. Affected is an unknown function of the file /filemanager/upload/drop of the component File Upload. The manipulation leads to improper privilege management. It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
BlockWishList SQL Injection vulnerability
Advisory: GHSA-2jx3-5j9v-prpp
Aliases: CVE-2022-31101
Published: 2022-06-25T07:11:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

### Impact
An authenticated customer can perform SQL injection

### Patches
Issue is fixed in 2.1.1
Improper quoting of columns when using setOrderBy() or setGroupBy() on listing classes in Pimcore
Advisory: GHSA-gvmf-wcx6-p974
Aliases: CVE-2022-31092
Published: 2022-06-22T17:58:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. 
The actual issue is that quoting is not done properly in both cases, so there's the theoretical possibility to inject custom SQL if the developer is using this methods with input data and not doing proper input validation in advance and  so relies on the auto-quoting being done by the listing classes. 

##### Example: 
```php
// request url: https://example.com/foo?groupBy=o_id`; SELECT SLEEP(20);--

$list = new DataObject\Car\Listing();
$list->setOrderKey($request->get('orderBy'));
$list->setGroupBy($request->get('groupBy'));
$list->load();
```

### Patches
Upgrade to >= 10.4.4 or apply the following patch manually: 
https://github.com/pimcore/pimcore/commit/21559c6bf0e4e828d33ff7af6e88caecb5ac6549.patch

### Workarounds
Apply this patch manually: 
https://github.com/pimcore/pimcore/commit/21559c6bf0e4e828d33ff7af6e88caecb5ac6549.patch

### References
https://github.com/pimcore/pimcore/pull/12444
Cross-site Scripting in Jenkins JUnit Plugin
Advisory: GHSA-64mj-3p92-589v
Aliases: CVE-2022-34176
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission.

JUnit Plugin 1119.1121.vc43d0fc45561 applies the configured markup formatter to descriptions of test results.
Reading on uninitialized memory may cause UB ( `util::read_spv()` )
Advisory: GHSA-qj69-c89v-jwq2
Published: 2022-06-16T23:41:05Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.

Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
abomonation transmutes &T to and from &[u8] without sufficient constraints
Advisory: GHSA-hfxp-p695-629x
Published: 2022-06-16T23:24:29Z

This transmute is at the core of the abomonation crates. It's so easy to use it to violate alignment requirements that no test in the crate's test suite passes under miri.

The use of this transmute in serialization/deserialization also incorrectly assumes that the layout of a repr(Rust) type is stable.
This transmute can also disclose both the contents of padding bytes which may be an information leak and the contents of pointers, which may be used to defeat ASLR.
Apache Tika contains incomplete fix for regex DoS
Advisory: GHSA-6q8v-2hvm-fx37
Aliases: CVE-2022-33879
Published: 2022-06-28T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

The initial fixes in CVE-2022-30126 and CVE-2022-30973 for regexes in the StandardsExtractingContentHandler were insufficient, and we found a separate, new regex DoS in a different regex in the StandardsExtractingContentHandler. These are now fixed in 1.28.4 and 2.4.1.
Improper Privilege Management in NocoDB
Advisory: GHSA-fq4h-m3c8-8m2v
Aliases: CVE-2022-2063
Published: 2022-06-14T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.8.
Denial of service binding form from JSON in Play Framework
Advisory: GHSA-v8x6-59g4-5g3w
Aliases: CVE-2022-31018
Published: 2022-06-03T22:18:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

A denial-of-service vulnerability has been discovered in Play's forms library, in both the Scala and Java APIs. This can occur when using either the `Form#bindFromRequest` method on a JSON request body or the `Form#bind` method directly on a JSON value. If the JSON data being bound to the form contains a deeply-nested JSON object or array, the form binding implementation may consume all available heap space and cause an `OutOfMemoryError`. If executing on the default dispatcher and `akka.jvm-exit-on-fatal-error` is enabled—as it is by default—then this can crash the application process.

`Form.bindFromRequest` is vulnerable when using any body parser that produces a type of `AnyContent` or `JsValue` in Scala, or one that can produce a `JsonNode` in Java. This includes Play's default body parser.

### Patches

This vulnerability been patched in version 2.8.16. There is now a global limit on the depth of a JSON object that can be parsed, which can be configured by the user if necessary.

### Workarounds

Applications that do not need to parse a request body of type `application/json` can switch from the default body parser to another body parser that supports only the specific type of body they expect; for example, the `formUrlEncoded` body parser can be used if the Play action only needs to accept `application/x-www-form-urlencoded`.
Cross site scripting in SSCMS
Advisory: GHSA-4qf6-vpj8-p4r6
Aliases: CVE-2022-30349
Published: 2022-06-03T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

siteserver SSCMS 6.15.51 is vulnerable to Cross Site Scripting (XSS).
Cross-Site Scripting in TYPO3's Frontend Login Mailer
Advisory: GHSA-h4mx-xv96-2jgm
Aliases: CVE-2022-31049
Published: 2022-06-17T20:56:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9)

### Problem
User submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages.

### Solution
Update to TYPO3 versions 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

### Credits
Thanks to Christian Seifert who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

### References
* [TYPO3-CORE-SA-2022-004](https://typo3.org/security/advisory/typo3-core-sa-2022-004)
Cross-site Scripting vulnerability in repository issue list in Gogs
Advisory: GHSA-xq4v-vrp9-vcf2
Aliases: CVE-2022-31038
Published: 2022-06-08T22:24:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

### Impact
`DisplayName` allows all the characters from users, which leads to an XSS vulnerability when directly displayed in the issue list.

### Patches
`DisplayName` is sanitized before being displayed. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.

### Workarounds
Check and update the existing users' display names that contain malicious characters.

### References
N/A

### For more information
If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/pull/7009.
Path Traversal in file editor on Windows in Gogs
Advisory: GHSA-994f-7g86-qr56
Aliases: CVE-2022-1992
Published: 2022-06-08T20:15:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

### Impact

The malicious user is able to delete and upload arbitrary file(s). All installations on Windows with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.

### Patches

Path cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.

### Workarounds

N/A

### References

https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/

### For more information

If you have any questions or comments about this advisory, please post on #7001.
Plaintext Storage of a Password in Jenkins Convertigo Mobile Platform Plugin 
Advisory: GHSA-c8mf-mc3f-2wvc
Aliases: CVE-2022-34199
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Convertigo Mobile Platform Plugin 1.1 and earlier stores passwords unencrypted in job `config.xml` files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Regular expression denial of service in jquery-validation
Advisory: GHSA-j9m2-h2pv-wvph
Aliases: CVE-2021-43306
Published: 2022-06-03T00:00:59Z

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method
Cross-site Scripting in Apache Tomcat
Advisory: GHSA-6j88-6whg-x687
Aliases: CVE-2022-34305
Published: 2022-06-24T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
'Read' on uninitialized memory may cause UB
Advisory: GHSA-c6px-4grw-hrjr
Published: 2022-06-16T23:42:49Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation. The crate currently contains 4 occurrences of such cases. Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Stack overflow in rustc_serialize when parsing deeply nested JSON
Advisory: GHSA-2226-4v3c-cff8
Published: 2022-06-17T00:18:24Z

When parsing JSON using `json::Json::from_str`, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.

Example code that triggers the vulnerability is

```rust
fn main() {
    let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
```

[serde](https://crates.io/crates/serde) is recommended as a replacement to rustc_serialize.
Cross site scripting in Concrete CMS
Advisory: GHSA-m2ww-6wv6-vw3c
Aliases: CVE-2022-30120
Published: 2022-06-25T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

XSS in /dashboard/blocks/stacks/view_details/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot be exploited in modern-day web browsers due to an automatic input escape mechanism. Concrete CMS Security team ranked this vulnerability 3.1with CVSS v3.1 Vector AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. Sanitation has been added where built urls are output.
XML External Entity Reference in drools
Advisory: GHSA-rc57-9r3x-98cq
Aliases: CVE-2021-41411
Published: 2022-06-17T00:01:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

drools <=7.59.x is affected by an XML External Entity (XXE) vulnerability in KieModuleMarshaller.java. The Validator class is not used correctly, resulting in the XXE injection vulnerability.
`SegQueue` creates zero value of any type
Advisory: GHSA-6888-wf7j-34jq
Published: 2022-06-16T23:50:05Z

Affected versions of this crate called `mem::zeroed()` to create values of a user-supplied type `T`.
This is unsound e.g. if `T` is a reference type (which must be non-null).
 
The flaw was corrected by avoiding the use of `mem::zeroed()`, using `MaybeUninit` instead.
Access control issue in AlekSIS-Core
Advisory: GHSA-76x2-h8h3-cwjg
Aliases: CVE-2022-29773
Published: 2022-06-04T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.
Cross site scripting in XXL-job
Advisory: GHSA-8gvg-f6qp-39wx
Aliases: CVE-2022-29770
Published: 2022-06-04T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

XXL-Job v2.3.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /xxl-job-admin/jobinfo.
Potential segfault in `localtime_r` invocations
Advisory: GHSA-cqpr-pcm7-m3jc
Published: 2022-06-16T23:48:34Z
Withdrawn: 2022-07-21T18:06:06Z

### Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

### Workarounds 

No workarounds are known.
Cross site scripting in Jfinal
Advisory: GHSA-8rp2-j3vj-hgj4
Aliases: CVE-2022-29648
Published: 2022-06-03T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted X-Forwarded-For request.
Cross-site Scripting in Jfinal CMS
Advisory: GHSA-9pvq-4cc7-24jg
Aliases: CVE-2022-33113
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the keyword text field under the publish blog module.
Deserialization functions pass uninitialized memory to user-provided Read
Advisory: GHSA-m325-rxjv-pwph
Published: 2022-06-17T00:11:41Z

Affected versions of this crate passed an uninitialized buffer to a
user-provided `Read` instance in:

* `deserialize_binary`
* `deserialize_string`
* `deserialize_extension_others`
* `deserialize_string_primitive`

This can result in safe `Read` implementations reading from the uninitialized
buffer leading to undefined behavior.
Regular expression denial of service in devcert
Advisory: GHSA-fp36-299x-pwmw
Aliases: CVE-2022-1929
Published: 2022-06-03T00:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the devcert npm package, when an attacker is able to supply arbitrary input to the certificateFor method
Use after free in lru crate
Advisory: GHSA-qqmc-hwqp-8g2w
Published: 2022-06-17T00:11:13Z

Lru crate has use after free vulnerability.

Lru crate has two functions for getting an iterator. Both iterators give
references to key and value. Calling specific functions, like pop(), will remove
and free the value, and but it's still possible to access the reference of value
which is already dropped causing use after free.
Mechanize before v2.8.5 vulnerable to authorization header leak on port redirect
Advisory: GHSA-64qm-hrgp-pgr9
Aliases: CVE-2022-31033
Published: 2022-06-09T23:47:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

**Summary**

Mechanize (rubygem) `< v2.8.5` leaks the `Authorization` header after a redirect to a different port on the same site.

**Mitigation**

Upgrade to Mechanize v2.8.5 or later.

**Notes**

See [https://curl.se/docs/CVE-2022-27776.html](CVE-2022-27776) for a similar vulnerability in curl.

Cookies are shared with a server at a different port on the same site, per https://datatracker.ietf.org/doc/html/rfc6265#section-8.5 which states in part:

> Cookies do not provide isolation by port.  If a cookie is readable
> by a service running on one port, the cookie is also readable by a
> service running on another port of the same server.  If a cookie is
> writable by a service on one port, the cookie is also writable by a
> service running on another port of the same server.  For this
> reason, servers SHOULD NOT both run mutually distrusting services on
> different ports of the same host and use cookies to store security-
> sensitive information.
Unhandled crash in npm posix
Advisory: GHSA-27mx-gchc-6xjp
Aliases: CVE-2022-21211
Published: 2022-06-11T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is not invokable (not a function), and then it will crash with type-check.
URL previews of unusual or maliciously-crafted pages can crash Synapse media repositories or Synapse monoliths
Advisory: GHSA-22p3-qrh9-cx32
Aliases: CVE-2022-31052
Published: 2022-06-29T21:51:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact

URL previews of some web pages can exhaust the available stack space for the Synapse process due to unbounded recursion.
This is sometimes recoverable and leads to an error for the request causing the problem, but in other cases the Synapse process may crash altogether.

It is possible to exploit this maliciously, either by malicious users on the homeserver, or by remote users sending URLs that a local user's client may automatically request a URL preview for.
Remote users are not able to exploit this directly, because [the URL preview endpoint is authenticated](https://spec.matrix.org/v1.2/client-server-api/#get_matrixmediav3preview_url).

### Am I affected?

* deployments with `url_preview_enabled: false` set in configuration are not affected.
* deployments with `url_preview_enabled: true` set in configuration **are** affected.
* deployments with no configuration value set for `url_preview_enabled` are not affected, because the default is `false`.

### Patches

Administrators of homeservers with URL previews enabled are advised to upgrade to v1.61.1 or higher.

### Workarounds

* URL previews can be disabled in the configuration file by setting `url_preview_enabled: false`.
* Deployments using workers can choose to offload URL previews to one or more dedicated worker(s), ensuring that a process crash does not disrupt other functionality of Synapse.

### For more information

If you have any questions or comments about this advisory, e-mail us at [security@matrix.org](mailto:security@matrix.org).
Cross Site Request Forgery in Mingsoft MCMS
Advisory: GHSA-gp39-qj5f-43qv
Aliases: CVE-2022-29647
Published: 2022-06-03T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in MCMS 5.2.7. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
Cross-site Scripting in Dolibarr
Advisory: GHSA-f2g5-426f-353q
Aliases: CVE-2022-30875
Published: 2022-06-09T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.
OS Command Injection in git-promise
Advisory: GHSA-chj3-f7xw-367m
Aliases: CVE-2022-24376
Published: 2022-06-11T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior [vulnerability](https://security.snyk.io/vuln/SNYK-JS-GITPROMISE-567476) in this package. **Note:** Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. 
### Credits
 @lirantal for discovering this vulnerability.