aswin1906/github-advisory-2022 huggingface dataset:
JBoss RESTEasy vulnerable to Improper Input Validation
Advisory: GHSA-hgjr-xwj3-jfvw
Aliases: CVE-2016-9606
Published: 2022-05-14T02:37:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.
Denial of service in ASP.NET Core
Advisory: GHSA-6px8-22w5-w334
Aliases: CVE-2019-0564
Published: 2022-05-14T01:41:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.
ChakraCore RCE Vulnerability
Advisory: GHSA-wc52-2xwv-h7xr
Aliases: CVE-2018-0873
Published: 2022-05-13T01:18:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the Chakra scripting engine handles objects in memory, aka "Chakra Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0872, CVE-2018-0874, CVE-2018-0930, CVE-2018-0931, CVE-2018-0933, CVE-2018-0934, CVE-2018-0936, and CVE-2018-0937.
Cross site scripting attack in ServiceStack Framework
Advisory: GHSA-vcfc-9wcp-j623
Aliases: CVE-2019-1010199
Published: 2022-05-24T22:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response, hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed, the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.
Missing Authorization in Jenkins Blue Ocean Plugin
Advisory: GHSA-phf8-3qgv-rg5q
Aliases: CVE-2017-1000105
Published: 2022-05-13T01:18:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The optional Run/Artifacts permission can be enabled by setting a Java system property. Blue Ocean did not check this permission before providing access to archived artifacts, Item/Read permission was sufficient.
Plone Multiple open redirect vulnerabilities
Advisory: GHSA-j67j-8hrp-76xm
Aliases: CVE-2013-4195
Published: 2022-05-17T04:49:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Path traversal in Jenkins Git Plugin
Advisory: GHSA-84cm-vjwm-m979
Aliases: CVE-2022-30947
Published: 2022-05-18T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SCMs support a number of different URL schemes, including local file system paths (e.g. using `file:` URLs).

Historically in Jenkins, only agents checked out from SCM, and if multiple projects share the same agent, there is no expected isolation between builds besides using different workspaces unless overridden. Some Pipeline-related features check out SCMs from the Jenkins controller as well.

This allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller’s file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
kajam allows local users to obtain sensitive information by listing the process
Advisory: GHSA-4ph7-5c44-pppv
Aliases: CVE-2014-4999
Published: 2022-05-14T03:47:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

`vendor/plugins/dataset/lib/dataset/database/mysql.rb` in the kajam gem 1.0.3.rc2 for Ruby places the mysql user password on the (1) mysqldump command line in the capture function and (2) mysql command line in the restore function, which allows local users to obtain sensitive information by listing the process.
Improper Neutralization of Input During Web Page Generation in Apache CXF
Advisory: GHSA-vw2c-5wph-v92r
Aliases: CVE-2016-6812
Published: 2022-05-13T01:09:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.
Plone Header Injection
Advisory: GHSA-fq9r-8jpm-2222
Aliases: CVE-2015-7318
Published: 2022-05-17T00:35:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
GitLab Grit Gem for Ruby contains a flaw allowing arbitrary commands to be executed
Advisory: GHSA-95xq-v4m2-fq3r
Aliases: CVE-2013-4489
Published: 2022-05-17T04:43:33Z

The Grit gem for Ruby, as used in GitLab 5.2 before 5.4.1 and 6.x before 6.2.3, allows remote authenticated users to execute arbitrary commands, as demonstrated by the search box for the GitLab code search feature.

GitLab Grit Gem for Ruby contains a flaw in the app/contexts/search_context.rb script. The issue is triggered when input passed via the code search box is not properly sanitized, which allows strings to be evaluated by the shell. This may allow a remote attacker to execute arbitrary commands.
MAGMI plugin for Magento Unsafe File Upload
Advisory: GHSA-x3gh-95p8-43qv
Aliases: CVE-2014-8770
Published: 2022-05-14T00:56:27Z

Unrestricted file upload vulnerability in `magmi/web/magmi.php` in the MAGMI (aka Magento Mass Importer) plugin 0.7.17a and earlier for Magento Community Edition (CE) allows remote authenticated users to execute arbitrary code by uploading a ZIP file that contains a PHP file, then accessing the PHP file via a direct request to it in `magmi/plugins/`.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-8qq4-8jvq-mfw4
Aliases: CVE-2017-12616
Published: 2022-05-14T01:10:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
HashiCorp Consul Access Restriction Bypass
Advisory: GHSA-fhm8-cxcv-pwvc
Aliases: CVE-2019-8336
Published: 2022-05-13T01:22:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbitrary token within secondary datacenters, because a token with literally "<hidden>" as its secret is used in unusual circumstances.
Jenkins Diagnostic page exposed session cookies
Advisory: GHSA-4jjj-cm7q-v6hr
Aliases: CVE-2020-2103
Published: 2022-05-24T17:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins shows various technical details about the current user on the `/whoAmI` page. In [a previous fix](https://www.jenkins.io/security/advisory/2019-09-25/#SECURITY-1505), the `Cookie` header value containing the HTTP session ID was redacted. However, user metadata shown on this page could also include the HTTP session ID in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier.

This allows attackers able to exploit a cross-site scripting vulnerability to obtain the HTTP session ID value from this page.

Jenkins 2.219, LTS 2.204.2 no longer prints out the affected user metadata that might contain the HTTP session ID.

Additionally, we also redact values of further authentication-related HTTP headers in addition to `Cookie` on this page as a hardening.
Subrion CMS XSS
Advisory: GHSA-2cmg-vxvh-8h7h
Aliases: CVE-2018-11317
Published: 2022-05-24T16:49:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Subrion CMS before 4.1.4 has XSS.
Improper Neutralization of CRLF Sequences in urllib3 library for Python
Advisory: GHSA-r64q-w8jr-g9qp
Aliases: CVE-2019-11236
Published: 2022-05-13T01:09:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In the urllib3 library through 1.24.2 for Python, CRLF injection is possible if the attacker controls the request parameter.
TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module 
Advisory: GHSA-5cmc-r23m-hvrr
Aliases: CVE-2013-7077
Published: 2022-05-17T01:29:43Z

Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Centreon allows SNMP trap SQL Injection
Advisory: GHSA-w2xf-4gg9-87wr
Aliases: CVE-2018-19281
Published: 2022-05-14T00:55:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.27) allows SNMP trap SQL Injection.
Cross-site Scripting in moodle
Advisory: GHSA-wvh5-78h5-gmgr
Aliases: CVE-2022-30596
Published: 2022-05-19T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
Possible shell escape sequence injection vulnerability in Rack
Advisory: GHSA-wq4h-7r42-5hrr
Aliases: CVE-2022-30123
Published: 2022-05-27T16:36:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

There is a possible shell escape sequence injection vulnerability in the Lint
and CommonLogger components of Rack.  This vulnerability has been assigned the
CVE identifier CVE-2022-30123.

Versions Affected:  All.
Not affected:       None
Fixed Versions:     2.0.9.1, 2.1.4.1, 2.2.3.1

## Impact
Carefully crafted requests can cause shell escape sequences to be written to
the terminal via Rack's Lint middleware and CommonLogger middleware.  These
escape sequences can be leveraged to possibly execute commands in the victim's
terminal.

Impacted applications will have either of these middleware installed, and
vulnerable apps may have something like this:

```
use Rack::Lint
```

Or

```
use Rack::CommonLogger
```

All users running an affected release should either upgrade or use one of the
workarounds immediately.

## Workarounds
Remove these middleware from your application
GraniteDS Insecure Deserialization
Advisory: GHSA-8m35-r25c-qr56
Aliases: CVE-2017-3199
Published: 2022-05-13T01:28:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the ability to spoof or control an RMI server connection may be able to send serialized Java objects that execute arbitrary code when deserialized.
Moodle is vulnerable to Sensitive Information Disclosure
Advisory: GHSA-wmmc-qjq2-vvm2
Aliases: CVE-2013-2080
Published: 2022-05-13T01:12:58Z

The core_grade component in Moodle through 2.2.10, 2.3.x before 2.3.7, and 2.4.x before 2.4.4 does not properly consider the existence of hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role and reading the Gradebook Overview report.
XMPP Clients User Impersonation Vulnerability in Movim Moxl
Advisory: GHSA-hq38-v658-g3wp
Aliases: CVE-2017-5605
Published: 2022-05-17T02:57:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks. This CVE is for Movim 0.8 - 0.10.
Ansible Sandbox Escape via Symlink Attack
Advisory: GHSA-wwwh-47wp-m522
Aliases: CVE-2015-6240
Published: 2022-05-13T01:54:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
Cloudera HUE Account Enumeration
Advisory: GHSA-rxfp-8jmr-xc95
Aliases: CVE-2016-4947
Published: 2022-05-17T02:56:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Cloudera HUE 3.9.0 and earlier allows remote attackers to enumerate user accounts via a request to `desktop/api/users/autocomplete`.
Improper Restriction of XML External Entity Reference in python-docx
Advisory: GHSA-34wj-p5jm-2p96
Aliases: CVE-2016-5851
Published: 2022-05-13T01:06:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

python-docx before 0.8.6 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted document.
python-glanceclient vulnerable to SSL server spoofing due to unverified X.509 certificate
Advisory: GHSA-qgfg-gvff-523v
Aliases: CVE-2013-4111
Published: 2022-05-14T02:10:39Z

The Python client library for Glance (python-glanceclient) before 0.10.0 does not properly check the preverify_ok value, which prevents the server hostname from being verified with a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate and allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Non-constant time HMAC comparison
Advisory: GHSA-fj6f-6933-839j
Aliases: CVE-2020-2102
Published: 2022-05-24T17:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not use a constant-time comparison when checking whether two HMACs are equal. This could potentially allow attackers to use statistical methods to obtain a valid HMAC for an attacker-controlled input value.

Jenkins 2.219, LTS 2.204.2 now uses a constant-time comparison when validating HMACs.
Improper Authentication in OpenSAML
Advisory: GHSA-qwwj-qj3f-9hv7
Aliases: CVE-2011-1411
Published: 2022-05-17T05:02:41Z

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Uncontrolled Resource Consumption in Apache Commons Compress
Advisory: GHSA-6fxm-66hq-fc96
Aliases: CVE-2012-2098
Published: 2022-05-13T01:07:05Z

Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.
Duplicate Advisory: tgstation-server vulnerable to cached user logins in legacy server
Advisory: GHSA-7r36-jf3c-jhp4
Published: 2022-05-13T01:50:31Z
Withdrawn: 2023-06-09T22:54:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-42r6-p4px-qvv6. This link is maintained to preserve external references.

## Original Description
In Tgstation tgstation-server 3.2.4.0 through 3.2.1.0 (fixed in 3.2.5.0), active logins would be cached, allowing subsequent logins to succeed with any username or password.
python-keystoneclient missing expiration check in PKI token validation 
Advisory: GHSA-4rrr-j7ff-r844
Aliases: CVE-2013-2104
Published: 2022-05-17T04:54:13Z

python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.
Password written to the build log by Jenkins SQLPlus Script Runner Plugin
Advisory: GHSA-rwh3-5g7v-3c5m
Aliases: CVE-2020-2312
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SQLPlus Script Runner Plugin 2.0.12 and earlier prints the `sqlplus` command invocation to the build log.

This log message does not redact a password provided as part of a command line argument. This password can be viewed by users with Item/Read permission.

SQLPlus Script Runner Plugin 2.0.13 no longer prints the password in the build log.
ChakraCore RCE Vulnerability
Advisory: GHSA-p6f4-h6w5-9jmc
Aliases: CVE-2016-7242
Published: 2022-05-14T02:22:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, and CVE-2016-7243.
Chakra Core Privilege Escalation 
Advisory: GHSA-pcr8-75v3-w9pf
Aliases: CVE-2017-11862
Published: 2022-05-17T00:19:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
Improper Restriction of XML External Entity Reference in Spring Framework
Advisory: GHSA-f93f-g33r-8pcp
Aliases: CVE-2014-0225
Published: 2022-05-13T01:02:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.
XSS vulnerability in Jenkins Markdown Formatter Plugin
Advisory: GHSA-xqpp-26pp-2365
Aliases: CVE-2021-21660
Published: 2022-05-24T19:03:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Markdown Formatter Plugin 0.1.0 and earlier uses a Markdown library to parse Markdown that does not escape crafted link target URLs.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to edit any description rendered using the configured markup formatter.

Markdown Formatter Plugin 0.2.0 uses a different Markdown library that is not affected by this problem.
Smarty Path Traversal Vulnerability
Advisory: GHSA-65j5-vpm7-6xp4
Aliases: CVE-2018-16831
Published: 2022-05-14T01:58:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Smarty before 3.1.33-dev-4 allows attackers to bypass the trusted_dir protection mechanism via a `file:./../` substring in an include statement.
Stored XSS vulnerability in Jenkins Yet Another Build Visualizer Plugin
Advisory: GHSA-3mwj-7vmq-w43p
Aliases: CVE-2020-2236
Published: 2022-05-24T17:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Yet Another Build Visualizer Plugin 1.11 and earlier does not escape tooltip content.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Run/Update permission.

Yet Another Build Visualizer Plugin 1.12 escapes tooltip content.
Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client
Advisory: GHSA-jwh2-ffg4-48xc
Aliases: CVE-2021-20218
Published: 2022-05-24T17:44:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
Opencast RCE Vulnerability
Advisory: GHSA-qwfv-5jwj-582h
Aliases: CVE-2017-1000217
Published: 2022-05-14T01:06:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Opencast 2.3.2 and older versions are vulnerable to script injections through media and metadata in the player and media module resulting in arbitrary code execution, fixed in 2.3.3 and 3.0.
Stored XSS in LavaLite 5.8.0
Advisory: GHSA-vv33-27jm-cvxq
Aliases: CVE-2020-36395
Published: 2022-05-24T19:06:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross site scripting (XSS) vulnerability in the /admin/user/team component of LavaLite 5.8.0 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "New" parameter.
Silverstripe CMS Open Redirect
Advisory: GHSA-fh35-p8ph-p545
Aliases: CVE-2015-5062
Published: 2022-05-14T02:48:26Z

Open redirect vulnerability in SilverStripe CMS & Framework 3.1.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnURL parameter to dev/build.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-ff7r-7rrm-wx6w
Aliases: CVE-2019-7882
Published: 2022-05-24T16:52:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.
Symfony Open Redirect
Advisory: GHSA-r7p7-qr7p-2rrf
Aliases: CVE-2017-16652
Published: 2022-05-14T01:21:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in Symfony 2.7.x before 2.7.38, 2.8.x before 2.8.31, 3.2.x before 3.2.14, and 3.3.x before 3.3.13. `DefaultAuthenticationSuccessHandler` or `DefaultAuthenticationFailureHandler` takes the content of the `_target_path` parameter and generates a redirect response, but no check is performed on the path, which could be an absolute URL to an external domain. This Open redirect vulnerability can be exploited for example to mount effective phishing attacks.
Gogs XSS Vulnerability
Advisory: GHSA-px5r-fqj6-r2f8
Aliases: CVE-2018-17031
Published: 2022-05-14T02:01:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X-Content-Type-Options: nosniff" header is not sent.
Missing Authorization in Jenkins Pipeline: Shared Groovy Libraries Plugin
Advisory: GHSA-9x5v-8352-244g
Aliases: CVE-2019-10357
Published: 2022-05-24T16:51:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
kevinsawicki/http-request Missing certificate validation
Advisory: GHSA-8mx3-gp3p-vgg7
Aliases: CVE-2019-1010206
Published: 2022-05-24T22:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

OSS Http Request (kevinsawicki/http-request) is missing SSL/TLS certificate validation. The impact is: certificate spoofing. The component is: use this library when https communication. The attack vector is: certificate spoofing.
Smarty Path Traversal Vulnerability
Advisory: GHSA-7gfx-wxfh-7rvm
Aliases: CVE-2018-13982
Published: 2022-05-13T01:05:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

`Smarty_Security::isTrustedResourceDir()` in Smarty before 3.1.33 is prone to a path traversal vulnerability due to insufficient template code sanitization. This allows attackers controlling the executed template code to bypass the trusted directory security restriction and read arbitrary files.
Improper handling of multiline messages in node-irc
Advisory: GHSA-52rh-5rpj-c3w6
Published: 2022-05-05T16:00:50Z

node-irc is a socket wrapper for the IRC protocol that extends Node.js' EventEmitter. The vulnerability allows an attacker to manipulate a Matrix user into executing IRC commands by having them reply to a maliciously crafted message. Incorrect handling of a CR character allowed for making part of the message be sent to the IRC server verbatim rather than as a message to the channel.
The vulnerability has been patched in node-irc version 1.2.1.
Improper Restriction of XML External Entity Reference in Castor
Advisory: GHSA-jwwr-fjgh-cv2x
Aliases: CVE-2014-3004
Published: 2022-05-13T01:05:37Z

The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.
Missing permission checks in Jenkins Chaos Monkey Plugin
Advisory: GHSA-mr75-899x-qcxq
Aliases: CVE-2020-2322
Published: 2022-05-24T17:35:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Chaos Monkey Plugin 0.3 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to generate load and to generate memory leaks.

Chaos Monkey Plugin 0.4 requires Overall/Administer permission to generate load and to generate memory leaks.
Gem in a Box vulnerable to Cross-site Request Forgery
Advisory: GHSA-qwv2-2x8g-g43g
Aliases: CVE-2017-14683
Published: 2022-05-13T01:31:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

geminabox (aka Gem in a Box) before 0.13.7 has CSRF, as demonstrated by an unintended gem upload.
Jenkins Google Login Plugin Open Redirect vulnerability
Advisory: GHSA-j279-cx9m-jv3w
Aliases: CVE-2018-1000174
Published: 2022-05-14T03:18:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

An open redirect vulnerability exists in Jenkins Google Login Plugin 1.3 and older in GoogleOAuth2SecurityRealm.java that allows attackers to redirect users to an arbitrary URL after successful login. Google Login Plugin 1.3.1 only performs redirects to relative URLs.
Exposure of Sensitive Information in Apache Storm Logviewer
Advisory: GHSA-r9pv-hg64-jqrp
Aliases: CVE-2019-0202
Published: 2022-05-24T16:51:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints.
phpMyFAQ CSRF
Advisory: GHSA-p57w-9q28-j6v7
Aliases: CVE-2018-16650
Published: 2022-05-14T02:02:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

phpMyFAQ before 2.9.11 allows CSRF.
Improper Control of Generation of Code in doT
Advisory: GHSA-297x-8xj4-vcxv
Aliases: CVE-2020-8141
Published: 2022-05-24T17:11:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The dot package v1.1.2 uses Function() to compile templates. This can be exploited by the attacker if they can control the given template or if they can control the value set on Object.prototype.
The Undertow module of WildFly allows source code disclosure
Advisory: GHSA-4vwv-x3gp-2j4g
Aliases: CVE-2015-3198
Published: 2022-05-17T02:19:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Undertow module of WildFly versions  8.1.0.Final, 8.2.0.Final, 9.0.0.CR1  allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.
Echor Ruby Gem credentials can be stolen via process table monitoring
Advisory: GHSA-j4gx-p3x5-m987
Aliases: CVE-2014-1835
Published: 2022-05-14T03:44:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The perform_request function in /lib/echor/backplane.rb in echor 0.1.6 Ruby Gem allows local users to steal the login credentials by watching the process table.
ingress-nginx component for Kubernetes allows file overwrite
Advisory: GHSA-hhpm-74pm-hf35
Aliases: CVE-2020-8553
Published: 2022-05-24T17:24:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.
Plone Cross-site scripting Vulnerability
Advisory: GHSA-hr59-35cr-qf43
Aliases: CVE-2012-5502
Published: 2022-05-17T04:32:24Z

Cross-site scripting (XSS) vulnerability in safe_html.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with permissions to edit content to inject arbitrary web script or HTML via unspecified vectors.
Uninitialized read in Nokogiri gem
Advisory: GHSA-4hm9-844j-jmxp
Aliases: CVE-2019-13117
Published: 2022-05-24T16:49:06Z

In numbers.c in libxslt 1.1.33, an xsl:number with certain format strings could lead to a uninitialized read in xsltNumberFormatInsertNumbers. This could allow an attacker to discern whether a byte on the stack contains the characters A, a, I, i, or 0, or any other character.
Plone credentials stored in session cookie
Advisory: GHSA-hjp5-hv33-q58g
Aliases: CVE-2008-1396
Published: 2022-05-01T23:39:47Z

Plone CMS 3.1.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
Zen Cart vulnerable to authenticated remote code execution
Advisory: GHSA-38f9-4vhq-9cr8
Aliases: CVE-2021-3291
Published: 2022-05-24T17:40:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element (within the modules edit page) and inserting a command.
Path Traversal in Eclipse Mojarra
Advisory: GHSA-q388-j7cw-ff7w
Aliases: CVE-2013-3827
Published: 2022-05-17T03:13:10Z

Multiple path traversal flaws where found in Mojarra JSF2 implementation for identifying resources by name or from libraries. An unauthenticated remote attacker can use these flaws to gather otherwise undisclosed information from within an application's root.
Improper Input Validation in strapi
Advisory: GHSA-65wv-528r-m892
Aliases: CVE-2020-13961
Published: 2022-05-24T17:21:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Strapi before 3.0.2 could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.
FTP backend for Duplicity Discloses Passwords to Process Listing
Advisory: GHSA-wxcw-rqxc-hj85
Aliases: CVE-2007-5201
Published: 2022-05-01T18:31:03Z

The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments.
ChakraCore RCE Vulnerability
Advisory: GHSA-399v-jg88-3gx6
Aliases: CVE-2018-0856
Published: 2022-05-13T01:18:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
RCE vulnerability in Jenkins Yaml Axis Plugin
Advisory: GHSA-324h-2v7h-q3xx
Aliases: CVE-2020-2179
Published: 2022-05-24T17:15:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to configure a multi-configuration (Matrix) job, or control the contents of a previously configured job’s SCM repository.

Yaml Axis Plugin 0.2.1 configures its YAML parser to only instantiate safe types.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-pgj6-jmj5-wqfx
Aliases: CVE-2021-21694
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2541 / CVE-2021-21694: `FilePath#toURI`, `FilePath#hasSymlink`, `FilePath#absolutize`, `FilePath#isDescendant`, and `FilePath#get*DiskSpace` do not check any permissions.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2541 / CVE-2021-21694: `FilePath#toURI`, `FilePath#hasSymlink`, `FilePath#absolutize`, `FilePath#isDescendant` check stat permission. `FilePath#get*DiskSpace` methods are no longer allowed to be executed by an agent.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Helm Improper Certificate Validation
Advisory: GHSA-x6r5-vxfg-gq3v
Aliases: CVE-2019-1010275
Published: 2022-05-24T16:50:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

helm Before 2.7.2 is affected by: CWE-295: Improper Certificate Validation. The impact is: Unauthorized clients could connect to the server because self-signed client certs were aloowed. The component is: helm (many files updated, see https://github.com/helm/helm/pull/3152/files/1096813bf9a425e2aa4ac755b6c991b626dfab50). The attack vector is: A malicious client could connect to the server over the network. The fixed version is: 2.7.2.
ChakraCore RCE Vulnerability
Advisory: GHSA-gxxx-j8m7-hh7m
Aliases: CVE-2018-8294
Published: 2022-05-13T01:20:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8280, CVE-2018-8286, CVE-2018-8290.
Improper Authentication in pip
Advisory: GHSA-c5h8-cq4v-cvfm
Aliases: CVE-2013-5123
Published: 2022-05-24T22:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
Jenkins SourceGear Vault plugin transmits credentials in plain text
Advisory: GHSA-jrmf-xhr6-3428
Aliases: CVE-2019-10435
Published: 2022-05-24T16:57:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. As of the publication of the advisory, there are no patches and the plugin is unmaintained.
Jenkins Quality Gates Plugin transmits credentials in plain text during configuration 
Advisory: GHSA-gvcj-72h4-8xm9
Aliases: CVE-2020-2151
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Quality Gates Plugin stores credentials in its global configuration file `quality.gates.jenkins.plugin.GlobalConfig.xml` on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Quality Gates Plugin 2.5 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Stored XSS vulnerability in Jenkins brakeman Plugin
Advisory: GHSA-7q9r-vhg2-789w
Aliases: CVE-2020-2122
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

brakeman Plugin 0.12 and earlier did not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability.

This vulnerability can be exploited by users able to control the Brakeman post-build step input data.\n\nbrakeman Plugin 0.13 escape affected values from the parsed file as they are recorded.

This fix is only applied to newly recorded data after a fixed version of the plugin is installed; historical data may still contain unsafe values.
Apache Tomcat Mishandles Character Sequence in Cookies
Advisory: GHSA-6j8f-66vh-39mj
Aliases: CVE-2007-3385
Published: 2022-05-01T18:13:14Z

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the `\"` character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
Incorrect Access Control in Phusion Passenger
Advisory: GHSA-jjhj-8gx7-x836
Aliases: CVE-2018-12028
Published: 2022-05-13T01:49:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an error, it would cause Passenger's process manager to kill said reported arbitrary PID.
Improper Authentication in Apache Hadoop
Advisory: GHSA-pxv5-5vmp-3jj4
Aliases: CVE-2013-2192
Published: 2022-05-17T02:54:07Z

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
Missing certificate validation in Apache JMeter
Advisory: GHSA-j7j7-g4ww-pxg5
Aliases: CVE-2018-1287
Published: 2022-05-13T01:49:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache JMeter 2.X and 3.X, when using Distributed Test only (RMI based), jmeter server binds RMI Registry to wildcard host. This could allow an attacker to get Access to JMeterEngine and send unauthorized code. This only affect those running in Distributed mode.

In distributed mode, JMeter makes an architectural assumption that it is operating on a 'safe' network. i.e. everyone with access to the network is considered trusted.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in pyftpdlib
Advisory: GHSA-mpg6-rgp4-35rr
Aliases: CVE-2009-5010
Published: 2022-05-02T04:00:27Z

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.1 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, a different vulnerability than CVE-2010-3494.
Stored XSS vulnerability in Jenkins Static Analysis Utilities Plugin
Advisory: GHSA-fg6g-52rg-vr9q
Aliases: CVE-2020-2316
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Static Analysis Utilities Plugin 1.96 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.
XWork in Apache Struts Reveals Sensitive Information
Advisory: GHSA-9ccm-g362-2r35
Aliases: CVE-2011-2088
Published: 2022-05-14T02:55:17Z

XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772.3.
Py2Play Unpickles Untrusted Objects
Advisory: GHSA-wcpc-f63g-x26q
Aliases: CVE-2005-2875
Published: 2022-05-01T02:12:26Z

Py2Play allows remote attackers to execute arbitrary Python code via pickled objects, which Py2Play unpickles and executes.
Denial of service in .NET core
Advisory: GHSA-3gp9-h8hw-pxpw
Aliases: CVE-2021-1721
Published: 2022-05-24T17:43:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

.NET Core and Visual Studio Denial of Service Vulnerability due to a vulnerability which exists when creating HTTPS web request during X509 certificate chain building.
Improper Resource Shutdown or Release in Apache Tomcat
Advisory: GHSA-9785-w233-x6hv
Aliases: CVE-2017-5650
Published: 2022-05-13T01:46:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the handling of an HTTP/2 GOAWAY frame for a connection did not close streams associated with that connection that were currently waiting for a WINDOW_UPDATE before allowing the application to write more data. These waiting streams each consumed a thread. A malicious client could therefore construct a series of HTTP/2 requests that would consume all available processing threads.
Insufficient Data Verification in io.really:jwt-scala
Advisory: GHSA-9pxm-8g95-q5xr
Aliases: CVE-2017-10862
Published: 2022-05-17T00:28:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

jwt-scala 1.2.2 and earlier fails to verify token signatures correctly which may lead to an attacker being able to pass specially crafted JWT data as a correctly signed token.
Stored XSS vulnerability in Jenkins Release Plugin
Advisory: GHSA-vmg8-g8j3-m355
Aliases: CVE-2020-2292
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Release Plugin 2.10.2 and earlier does not escape the release version in badge tooltip, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Release/Release permission.
XXE vulnerability in Jenkins WebSphere Deployer Plugin
Advisory: GHSA-f5wx-w2f9-82gh
Aliases: CVE-2020-2108
Published: 2022-05-24T17:07:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

WebSphere Deployer Plugin 1.6.1 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks. This could be exploited by a user with Job/Configure permissions to upload a specially crafted war file containing a `WEB-INF/ibm-web-ext.xml` which is parsed by the plugin.
Jenkins RapidDeploy Plugin missing permission check
Advisory: GHSA-m4vq-v7hw-7fqq
Aliases: CVE-2019-16571
Published: 2022-05-24T17:03:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins RapidDeploy Plugin 4.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified web server.
Code Injection in Masuit.Tools.Core
Advisory: GHSA-vh38-ghx6-vmvg
Aliases: CVE-2022-21167
Published: 2022-05-03T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

All versions of package Masuit.Tools.Core are vulnerable to Arbitrary Code Execution via the ReceiveVarData<T> function in the SocketClient.cs component. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.
Sup Code Injection vulnerability
Advisory: GHSA-hh2x-7mf9-78fr
Aliases: CVE-2013-4479
Published: 2022-05-17T03:20:59Z

`lib/sup/message_chunks.rb` in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.
ChakraCore RCE Vulnerability
Advisory: GHSA-3w4v-qfqc-3433
Aliases: CVE-2019-0539
Published: 2022-05-13T01:21:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0567, CVE-2019-0568.
Jenkins Beaker Builder Plugin has Insufficiently Protected Credentials
Advisory: GHSA-9678-5f6f-wp3f
Aliases: CVE-2019-10398
Published: 2022-05-24T16:55:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Beaker builder Plugin stored the Beaker password unencrypted on the Jenkins controller. This password could be viewed by users with access to the Jenkins controller file system.

Beaker builder Plugin now stores these credentials encrypted.
OpenAPI Tools OpenAPI Generator uses HTTP in various files
Advisory: GHSA-27j5-2h6r-c9q2
Aliases: CVE-2019-11405
Published: 2022-05-24T16:44:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

OpenAPI Tools OpenAPI Generator before 4.0.0-20190419.052012-560 uses http:// URLs in various build.gradle, build.gradle.mustache, and build.sbt files, which may have caused insecurely resolved dependencies.