aswin1906/github-advisory-2022 huggingface dataset:
Magento 2 Community Edition Injection Vulnerability
Advisory: GHSA-hxmp-jcqj-83hm
Aliases: CVE-2019-7889
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications.
Cross-site Scripting in Jenkins Active Choices plugin
Advisory: GHSA-c2hw-w9qm-q5r9
Aliases: CVE-2017-1000386
Published: 2022-05-14T00:58:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Active Choices plugin version 1.5.3 and earlier allowed users with Job/Configure permission to provide arbitrary HTML to be shown on the 'Build With Parameters' page through the 'Active Choices Reactive Reference Parameter' type. This could include, for example, arbitrary JavaScript. Active Choices now sanitizes the HTML inserted on the 'Build With Parameters' page if and only if the script is executed in a sandbox. As unsandboxed scripts are subject to administrator approval, it is up to the administrator to allow or disallow problematic script output.
Passwords stored in plain text by Harvest SCM Plugin
Advisory: GHSA-jmp9-f42q-4g85
Aliases: CVE-2020-2130
Published: 2022-05-24T17:08:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Harvest SCM Plugin 0.5.1 and earlier stores SCM passwords unencrypted in its global configuration file `hudson.plugins.harvest.HarvestSCM.xml and in job config.xml` files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission (job config.xml only) or access to the Jenkins controller file system (both).
Cross-site Scripting in wiki manager join wiki page
Advisory: GHSA-ph5x-h23x-7q5q
Aliases: CVE-2022-29252
Published: 2022-05-25T22:41:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

### Impact
We found a possible XSS vector in the `WikiManager.JoinWiki ` wiki page related to the "requestJoin" field.

### Patches
The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3.

### Workarounds
The easiest workaround is to edit the wiki page `WikiManager.JoinWiki` (with wiki editor) and change the line

```
<input type='hidden' name='requestJoin' value="$!request.requestJoin"/>
```

into

```
<input type='hidden' name='requestJoin' value="$escapetool.xml($!request.requestJoin)">
```

### References
  * https://jira.xwiki.org/browse/XWIKI-19292
  * https://github.com/xwiki/xwiki-platform/commit/27f839133d41877e538d35fa88274b50a1c00b9b

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security mailing list](mailto:security@xwiki.org)
Path Traversal in Apache Atlas
Advisory: GHSA-m2rr-h6g4-9cm9
Aliases: CVE-2016-8752
Published: 2022-05-17T01:18:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache Atlas versions 0.6.0 (incubating), 0.7.0 (incubating), and 0.7.1 (incubating) allow access to the webapp directory contents by pointing to URIs like /js and /img.
Stored XSS vulnerability in multiple axis builds tooltips in Jenkins Matrix Project Plugin
Advisory: GHSA-w43x-5f8f-686p
Aliases: CVE-2020-2225
Published: 2022-05-24T17:23:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Matrix Project Plugin 1.16 and earlier does not escape the axis names shown in tooltips on the overview page of builds with multiple axes. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission.

Matrix Project Plugin 1.17 escapes the axis names shown in these tooltips.
Unescaped control characters in Gitblit
Advisory: GHSA-fh55-vwjc-69c7
Aliases: CVE-2022-31267
Published: 2022-05-22T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atext 'attacker@example.com\n\trole = "#admin"' value.
Cross-Site Request Forgery in Jolokia
Advisory: GHSA-fjhw-8222-g2hg
Aliases: CVE-2014-0168
Published: 2022-05-17T04:31:39Z

Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.
Missing permission checks in Jenkins Amazon EC2 Plugin
Advisory: GHSA-6hmm-77r2-h6hr
Aliases: CVE-2020-2091
Published: 2022-05-24T17:06:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Amazon EC2 Plugin 1.47 and earlier does not perform permission checks in methods performing form validation. This allows users with Overall/Read access to Jenkins to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.

This vulnerability might also allow attackers to capture credentials stored in Jenkins. We have not been able to confirm that this is possible.

Additionally, these form validation methods do not require POST requests, resulting in a CSRF vulnerability.

Amazon EC2 Plugin 1.48 requires POST requests and Overall/Administer permission for the affected form validation methods.
Apache Struts CSRF Vulnerability
Advisory: GHSA-38qw-j787-v8c2
Aliases: CVE-2016-4430
Published: 2022-05-17T00:29:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Apache Struts 2 2.3.20 through 2.3.28.1 mishandles token validation, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks via unspecified vectors.
Django Directory Traversal via ssi template tag
Advisory: GHSA-vjjp-9r83-22rc
Aliases: CVE-2013-4315
Published: 2022-05-17T04:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a `..` (dot dot) in a ssi template tag.
TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
Advisory: GHSA-47ww-mq32-g4xw
Aliases: CVE-2013-7075
Published: 2022-05-17T04:54:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated backend users to unserialize arbitrary PHP objects, delete arbitrary files, and possibly have other unspecified impacts via an unspecified parameter, related to a "missing signature."
Pillow denial of service via PNG bomb
Advisory: GHSA-h5rf-vgqx-wjv2
Aliases: CVE-2014-9601
Published: 2022-05-14T02:05:56Z

Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size when it is decompressed.
Improper Access Control in Apache CXF
Advisory: GHSA-3336-h95j-hvvf
Aliases: CVE-2015-5253
Published: 2022-05-13T01:09:20Z

The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
Stored XSS vulnerability in single axis builds tooltips in Jenkins Matrix Project Plugin
Advisory: GHSA-h6qc-455m-7v6v
Aliases: CVE-2020-2224
Published: 2022-05-24T17:23:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Matrix Project Plugin 1.16 and earlier does not escape node names shown in tooltips on the overview page of builds with a single axis. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Agent/Configure permission.

Matrix Project Plugin 1.17 escapes the node names shown in these tooltips.
PostgreSQL PL/Java Improper Privilege Management
Advisory: GHSA-837x-xww6-7jqm
Aliases: CVE-2016-0767
Published: 2022-05-13T01:06:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath.
Numpy arbitrary file write via symlink attack
Advisory: GHSA-2fc2-6r4j-p65h
Aliases: CVE-2014-1859
Published: 2022-05-14T01:08:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.
SEOmatic plugin for Craft CMS SSTI Vulnerability
Advisory: GHSA-6j9m-rp7m-3gfg
Aliases: CVE-2018-14716
Published: 2022-05-13T01:19:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A Server Side Template Injection (SSTI) was discovered in the SEOmatic plugin before 3.1.4 for Craft CMS, because requests that don't match any elements incorrectly generate the canonicalUrl, and can lead to execution of Twig code.
Arbitrary code execution in Apache Struts
Advisory: GHSA-737w-mh58-cxjp
Aliases: CVE-2013-1966
Published: 2022-05-14T00:54:15Z

Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
Fortify Plugin stored credentials in plain text
Advisory: GHSA-xr37-pjfh-qwwc
Aliases: CVE-2020-2107
Published: 2022-05-24T17:07:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fortify Plugin 19.1.29 and earlier stored its proxy server password unencrypted in job `config.xml` files. This password could be read by users with the Extended Read permission.

Fortify Plugin 19.2.30 now encrypts the proxy server password.
ChakraCore information disclosure vulnerability
Advisory: GHSA-w3qr-8v4r-592m
Aliases: CVE-2018-8452
Published: 2022-05-13T01:53:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft browsers, aka "Scripting Engine Information Disclosure Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge.
Laravel Framework Deserialization Vulnerability
Advisory: GHSA-pfg4-p438-p874
Aliases: CVE-2019-9081
Published: 2022-05-14T01:31:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable, related to the `__destruct` method of the PendingCommand class in `PendingCommand.php`.
Improper Input Validation Apache Commons Email
Advisory: GHSA-v7cm-w955-pj6g
Aliases: CVE-2018-1294
Published: 2022-05-14T01:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

If a user of Apache Commons Email (typically an application programmer) passes unvalidated input as the so-called "Bounce Address", and that input contains line-breaks, then the email details (recipients, contents, etc.) might be manipulated. Mitigation: Users should upgrade to Commons-Email 1.5. You can mitigate this vulnerability for older versions of Commons Email by stripping line-breaks from data, that will be passed to Email.setBounceAddress(String).
Shopware Cross-site Scripting Vulnerability
Advisory: GHSA-8qxh-hcr9-2379
Aliases: CVE-2019-12935
Published: 2022-05-24T22:00:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.
Umbraco CMS vulnerable to CSRF
Advisory: GHSA-x34j-wxq8-7vcm
Aliases: CVE-2015-8813
Published: 2022-05-17T02:56:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N

The `Page_Load` function in [Umbraco.Web/umbraco.presentation/umbraco/dashboard/FeedProxy.aspx.cs](https://github.com/umbraco/Umbraco-CMS/commit/924a016ffe7ae7ea6d516c07a7852f0095eddbce#diff-2899f01df84571577834f97a81637c65e20178ec6129b76c02f99789b23cf72e) in Umbraco before 7.4.0 allows remote attackers to conduct server-side request forgery (SSRF) attacks via the url parameter.
Rack arbitrary code execution via timing attack
Advisory: GHSA-xc85-32mf-xpv8
Aliases: CVE-2013-0263
Published: 2022-05-05T02:48:42Z

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Cross Site Request Forgery in Jenkins Storable Configs Plugin
Advisory: GHSA-rr2r-g6xm-58xj
Aliases: CVE-2022-30972
Published: 2022-05-18T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Storable Configs Plugin 1.0 and earlier allows attackers to have Jenkins parse a local XML file (e.g., archived artifacts) that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Prototype Pollution in Dexie
Advisory: GHSA-3xgx-r9j4-qw9w
Aliases: CVE-2022-21189
Published: 2022-05-03T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Dexie is a minimalistic wrapper for IndexedDB. The package dexie before 3.2.2, from 4.0.0-alpha.1 and before 4.0.0-alpha.3 are vulnerable to Prototype Pollution in the Dexie.setByKeyPath(obj, keyPath, value) function which does not properly check the keys being set (like __proto__ or constructor). This can allow an attacker to add/modify properties of the Object.prototype leading to prototype pollution vulnerability. **Note:** This vulnerability can occur in multiple ways, for example when modifying a collection with untrusted user input.
Keycloak XSS Vulnerability
Advisory: GHSA-458h-wv48-fq75
Aliases: CVE-2018-14655
Published: 2022-05-13T01:34:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using `response_mode=form_post` it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.
Unrestricted Upload of File with Dangerous Type Apache Tomcat
Advisory: GHSA-xjgh-84hx-56c5
Aliases: CVE-2017-12617
Published: 2022-05-14T01:07:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
XSS in various backend modules due to (un)escaping in JS notification module
Advisory: GHSA-jfxf-4frr-9j3q
Published: 2022-05-25T19:38:50Z

The notification module displaying flash messages unscapes HTML coming from the server, resulting in XSS vulnerabilities with various names and labels of entities (eg. workspace title or media title). This however means you must be a logged in user with respective rights in the first place to leverage the attack vector.
openark/orchestrator cross-site scripting vulnerability
Advisory: GHSA-752c-vfpf-cp2w
Aliases: CVE-2021-27940
Published: 2022-05-24T22:01:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.
Loop with Unreachable Exit Condition in Jenkins
Advisory: GHSA-9cjv-93g7-c6mv
Aliases: CVE-2018-1000864
Published: 2022-05-13T01:48:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists in Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in CronTab.java that allows attackers with Overall/Read permission to have a request handling thread enter an infinite loop.
Multiple vulnerabilities allow bypassing path filtering of agent-to-controller access control in Jenkins
Advisory: GHSA-929w-q433-4h9x
Aliases: CVE-2021-21693
Published: 2022-05-24T19:19:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The agent-to-controller security subsystem limits which files on the Jenkins controller can be accessed by agent processes.

Multiple vulnerabilities in the file path filtering implementation of Jenkins 2.318 and earlier, LTS 2.303.2 and earlier allow agent processes to read and write arbitrary files on the Jenkins controller file system, and obtain some information about Jenkins controller file systems.

SECURITY-2539 / CVE-2021-21693: When creating temporary files, permission to create files is only checked after they’ve been created.

We expect that most of these vulnerabilities have been present since [SECURITY-144 was addressed in the 2014-10-30 security advisory](https://www.jenkins.io/security/advisory/2014-10-30/).

Jenkins 2.319, LTS 2.303.3 addresses these security vulnerabilities.

SECURITY-2539 / CVE-2021-21693: When creating temporary files, permission to create files is checked before they are created based on an artificial path.

As some common operations are now newly subject to access control, it is expected that plugins sending commands from agents to the controller may start failing. Additionally, the newly introduced path canonicalization means that instances using a custom builds directory ([Java system property jenkins.model.Jenkins.buildsDir](https://www.jenkins.io/doc/book/managing/system-properties/#jenkins-model-jenkins-buildsdir)) or partitioning `JENKINS_HOME` using symbolic links may fail access control checks. See [the documentation](https://www.jenkins.io/doc/book/security/controller-isolation/agent-to-controller/#file-access-rules) for how to customize the configuration in case of problems.

If you are unable to immediately upgrade to Jenkins 2.319, LTS 2.303.3, you can install the [Remoting Security Workaround Plugin](https://www.jenkins.io/redirect/remoting-security-workaround/). It will prevent all agent-to-controller file access using `FilePath` APIs. Because it is more restrictive than Jenkins 2.319, LTS 2.303.3, more plugins are incompatible with it. Make sure to read the plugin documentation before installing it.
Improper Authentication in Apache Tomcat
Advisory: GHSA-28cq-6rmx-pjq4
Aliases: CVE-2012-5887
Published: 2022-05-17T01:38:30Z

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.
XXE vulnerability in Jenkins Visualworks Store Plugin
Advisory: GHSA-jvjm-j945-8qwc
Aliases: CVE-2020-2315
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Visualworks Store Plugin 1.1.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with the ability to control the output of a script that run Visualworks with StoreCI, or able to control an agent process, to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Visualworks Store Plugin 1.1.4 disables external entity resolution for its XML parser.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-jrjx-8gmw-jj2q
Aliases: CVE-2019-8137
Published: 2022-05-24T17:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate CMS section of the website can trigger remote code execution via custom layout update.
golang.org/x/net/html Improper Validation of Array Index vulnerability
Advisory: GHSA-mv93-wvcp-7m7r
Aliases: CVE-2018-17848
Published: 2022-05-13T01:26:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The html package (aka x/net/html) through 2018-09-25 in Go mishandles <math><template><mn><b></template>, leading to a "panic: runtime error" (index out of range) in (*insertionModeStack).pop in node.go, called from inHeadIM, during an html.Parse call.
phpMyAdmin Global variables scope injection vulnerability
Advisory: GHSA-x962-w72p-mv7q
Aliases: CVE-2013-4729
Published: 2022-05-17T05:07:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

import.php in phpMyAdmin 4.x before 4.0.4.1 does not properly restrict the ability of input data to specify a file format, which allows remote authenticated users to modify the GLOBALS superglobal array, and consequently change the configuration, via a crafted request.
Silverstripe Flash Clipboard Reflected XSS
Advisory: GHSA-rfvw-5848-gxc5
Aliases: CVE-2019-12205
Published: 2022-05-24T16:56:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SilverStripe versions 3.0.0 until 4.3.5 and 4.4.4 are vulnerable to Flash Clipboard Reflected XSS. Versions 4.3.5 and 4.4.4 of `silverstripe/framework` and version 1.3.5 of `silverstripe/admin` contain a fix for this issue.
RubyGems vulnerable to DNS hijack attack
Advisory: GHSA-wp3j-rvfp-624h
Aliases: CVE-2015-3900
Published: 2022-05-14T01:08:49Z

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."
Denial of service in ASP.NET Core
Advisory: GHSA-4jxx-4qxw-prxm
Aliases: CVE-2019-0982
Published: 2022-05-24T16:45:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
backup-agoddard and backup_checksum have Information Exposure vulnerability
Advisory: GHSA-wr5j-q359-6vr2
Aliases: CVE-2014-4993
Published: 2022-05-14T03:48:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

(1) `lib/backup/cli/utility.rb` in the `backup-agoddard` gem 3.0.28 and (2) `lib/backup/cli/utility.rb` in the `backup_checksum` gem 3.0.23 for Ruby place credentials on the openssl command line, which allows local users to obtain sensitive information by listing the process.
Singularity insecure permissions
Advisory: GHSA-mj73-5x75-9phh
Aliases: CVE-2019-19724
Published: 2022-05-24T17:04:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Insecure permissions (777) are set on `$HOME/.singularity` when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could lead to an information leak, and malicious redirection of operations performed against Sylabs cloud services.
Improper Input Validation in Apache Tomcat
Advisory: GHSA-wr3m-gw98-mc3j
Aliases: CVE-2011-4858
Published: 2022-05-14T03:52:45Z

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Improper Neutralization of Input During Web Page Generation Apache ActiveMQ
Advisory: GHSA-5jg4-p78r-p5j3
Aliases: CVE-2016-6810
Published: 2022-05-14T01:06:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache ActiveMQ 5.x before 5.14.2, an instance of a cross-site scripting vulnerability was identified to be present in the web based administration console. The root cause of this issue is improper user data output validation.
ChakraCore Privilege Escalation 
Advisory: GHSA-8r5c-8v97-g7vh
Aliases: CVE-2017-11914
Published: 2022-05-14T01:06:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
Missing permission checks in MongoDB Plugin
Advisory: GHSA-c26h-8h4p-4jgj
Aliases: CVE-2020-2267
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins MongoDB Plugin 1.3 and earlier allows attackers with Overall/Read permission to gain access to some metadata of any arbitrary files on the Jenkins controller.
Umbraco CMS XXE Vulnerability
Advisory: GHSA-h2vq-7gf2-qw9v
Aliases: CVE-2017-15280
Published: 2022-05-17T00:30:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

XML external entity (XXE) vulnerability in Umbraco CMS before 7.7.3 allows attackers to obtain sensitive information by reading files on the server or sending TCP requests to intranet hosts (aka SSRF), related to `Umbraco.Web/umbraco.presentation/umbraco/dialogs/importDocumenttype.aspx.cs`.
ChakraCore RCE Vulnerability
Advisory: GHSA-frh8-wrx9-gc53
Aliases: CVE-2018-8137
Published: 2022-05-13T01:20:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-1022, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8139.
Authenticated RCE in Zen Cart 1.5.5e
Advisory: GHSA-c9r9-3h38-r7vj
Aliases: CVE-2017-11675
Published: 2022-05-17T02:20:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The traverseStrictSanitize function in admin_dir/includes/classes/AdminRequestSanitizer.php in ZenCart 1.5.5e mishandles key strings, which allows remote authenticated users to execute arbitrary PHP code by placing that code into an invalid array index of the admin_name array parameter to admin_dir/login.php, if there is an export of an error-log entry for that invalid array index.
Dolibarr ERP and CRM contain XSS Vulnerability
Advisory: GHSA-f6h3-66xr-hqr2
Aliases: CVE-2019-19206
Published: 2022-05-24T17:02:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Dolibarr CRM/ERP 10.0.3 allows `viewimage.php?file=` Stored XSS due to JavaScript execution in an SVG image for a profile picture.
Cross-Site Request Forgery in Jenkins Blue Ocean Plugin
Advisory: GHSA-qxh5-5r5p-5gvf
Aliases: CVE-2019-1003012
Published: 2022-05-13T01:31:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

A data modification vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers to bypass all cross-site request forgery protection in Blue Ocean API. The vulnerability is found in:

- blueocean-core-js/src/js/bundleStartup.js
- blueocean-core-js/src/js/fetch.ts
- blueocean-core-js/src/js/i18n/i18n.js
- blueocean-core-js/src/js/urlconfig.js
- blueocean-rest/src/main/java/io/jenkins/blueocean/rest/APICrumbExclusion.java
- blueocean-web/src/main/java/io/jenkins/blueocean/BlueOceanUI.java
- blueocean-web/src/main/resources/io/jenkins/blueocean/BlueOceanUI/index.jelly
Tampering vulnerability in .NET Core
Advisory: GHSA-5633-f33j-c6f7
Aliases: CVE-2018-8416
Published: 2022-05-13T01:20:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

A tampering vulnerability exists when .NET Core improperly handles specially crafted files, aka ".NET Core Tampering Vulnerability." This affects .NET Core 2.1.
Symfony Directory Traversal
Advisory: GHSA-c49r-8gj6-768r
Aliases: CVE-2017-16654
Published: 2022-05-14T01:21:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in Symfony before 2.7.38, 2.8.31, 3.2.14, 3.3.13, 3.4-BETA5, and 4.0-BETA5. The Intl component includes various bundle readers that are used to read resource bundles from the local filesystem. The read() methods of these classes use a path and a locale to determine the language bundle to retrieve. The locale argument value is commonly retrieved from untrusted user input (like a URL parameter). An attacker can use this argument to navigate to arbitrary directories via the dot-dot-slash attack, aka Directory Traversal.
ChakraCore RCE Vulnerability
Advisory: GHSA-w9rv-wwxr-vc3q
Aliases: CVE-2018-8629
Published: 2022-05-13T01:21:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8583, CVE-2018-8617, CVE-2018-8618, CVE-2018-8624.
Improper Input Validation in BeanShell
Advisory: GHSA-gxg6-rc6c-v673
Aliases: CVE-2016-2510
Published: 2022-05-13T01:14:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.
Joomla! XSS Vulnerability
Advisory: GHSA-g3m5-vvj7-xrwv
Aliases: CVE-2018-11326
Published: 2022-05-14T03:16:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally, the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.
Cross site scripting in code-server
Advisory: GHSA-2gp3-6c9p-jp7w
Aliases: CVE-2021-42648
Published: 2022-05-12T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability exists in Coder Code-Server before 3.12.0, allows attackers to execute arbitrary code via crafted URL.
Users with Overall/Read access can enumerate credentials IDs in Amazon EC2 Plugin
Advisory: GHSA-rmp9-mc8w-mqf3
Aliases: CVE-2020-2188
Published: 2022-05-24T17:17:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Amazon EC2 Plugin provides a list of applicable credentials IDs to allow users configuring the plugin to select the one to use.

This functionality does not correctly check permissions in Amazon EC2 Plugin 1.50.1 and earlier, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Amazon EC2 Plugin 1.50.2 now requires Overall/Administer permission.
Apache ActiveMQ Apollo XXE Vulnerability
Advisory: GHSA-wmhw-hpwh-44pg
Aliases: CVE-2014-3579
Published: 2022-05-14T01:14:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

XML external entity (XXE) vulnerability in Apache ActiveMQ Apollo 1.x before 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.
ChakraCore RCE Vulnerability
Advisory: GHSA-38r7-rv5p-ggwq
Aliases: CVE-2018-8359
Published: 2022-05-13T01:20:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.
ASP.NET Core Denial of Service Vulnerability
Advisory: GHSA-3cf7-7wq6-8842
Aliases: CVE-2020-1161
Published: 2022-05-24T17:18:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.
OpenStack Compute (Nova) Denial of Service vulnerability
Advisory: GHSA-43hc-pwvx-pmfg
Aliases: CVE-2014-3708
Published: 2022-05-14T01:58:45Z

OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU consumption) via an IP filter in a list active servers API request.
OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks
Advisory: GHSA-p9wq-mjh8-q72m
Aliases: CVE-2015-1852
Published: 2022-05-17T03:17:26Z

The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
Apache Guacamole Race Condition vulnerability
Advisory: GHSA-3vv3-585q-wv6x
Aliases: CVE-2017-3158
Published: 2022-05-14T03:46:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.
SM2 Decryption Buffer Overflow
Advisory: GHSA-5ww6-px42-wc85
Aliases: CVE-2021-3711
Published: 2022-05-24T19:12:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k).
Incorrect Authorization in Jenkins Gerrit Trigger Plugin
Advisory: GHSA-wrqc-q8p5-76m5
Aliases: CVE-2018-1000105
Published: 2022-05-13T01:48:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

An improper authorization vulnerability exists in Jenkins Gerrit Trigger Plugin 2.27.4 and earlier in GerritManagement.java, GerritServer.java, and PluginImpl.java that allows an attacker with Overall/Read access to retrieve some configuration information about Gerrit in Jenkins.
Jenkins Call Remote Job Plugin has Insufficiently Protected Credentials
Advisory: GHSA-j8c7-fm85-6jj6
Aliases: CVE-2019-10422
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Call Remote Job Plugin stores a password unencrypted in job `config.xml` files on the Jenkins controller. This password can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

As of publication of this advisory, there is no fix.
TYPO3 OpenID extension Open redirect vulnerability
Advisory: GHSA-838c-v5cq-hp33
Aliases: CVE-2013-7079
Published: 2022-05-17T03:12:49Z

Open redirect vulnerability in the OpenID extension in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Improper Input Validation in Jenkins Pipeline: Groovy Plugin
Advisory: GHSA-99mf-f3qh-wqrp
Aliases: CVE-2020-2109
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Sandbox protection in Jenkins Pipeline: Groovy Plugin 2.78 and earlier can be circumvented through default parameter expressions in CPS-transformed methods.
Deserialization of Untrusted Data in Apache Tapestry
Advisory: GHSA-6mwh-fw4p-75fj
Aliases: CVE-2019-0195
Published: 2022-05-24T22:00:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

By manipulating classpath asset file URLs, an attacker could guess the path to a known file in the classpath and have it downloaded. If the attacker found the file with the value of the tapestry.hmac-passphrase configuration symbol, most probably the webapp's AppModule class, the value of this symbol could be used to craft a Java deserialization attack, thus running malicious injected Java code. The vector would be the t:formdata parameter from the Form component.
Insecure PRNG use in random_password_generator
Advisory: GHSA-ggfx-h9xj-5v9c
Aliases: CVE-2019-25061
Published: 2022-05-19T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
Improper Input Validation in Apache POI
Advisory: GHSA-5wfp-8643-c58x
Aliases: CVE-2014-3574
Published: 2022-05-17T01:24:36Z

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Apache Struts Dojo Plugin XSS Vulnerability
Advisory: GHSA-rm26-w253-9qv7
Aliases: CVE-2007-6726
Published: 2022-05-01T18:45:52Z

Multiple cross-site scripting (XSS) vulnerabilities in Dojo 0.4.1 and 0.4.2, as used in Apache Struts and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving (1) `xip_client.html` and (2) `xip_server.html` in `src/io/`.
Elefant CMS Code Execution Vulnerability
Advisory: GHSA-77j2-7whr-6vpx
Aliases: CVE-2018-16974
Published: 2022-05-14T01:57:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in `apps/filemanager/upload/drop.php` by using `/filemanager/api/rm/.htaccess` to remove the .htaccess file, and then using a filename that ends in .php followed by space characters (for bypassing the blacklist).
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-hhjg-g8xq-hhr3
Aliases: CVE-2009-0783
Published: 2022-05-02T03:18:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.
Deserialization of Untrusted Data in Infinispan
Advisory: GHSA-46r5-59fg-2fjc
Aliases: CVE-2017-15089
Published: 2022-05-14T00:59:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.
golang.org/x/net/http vulnerable to ping floods
Advisory: GHSA-hgr8-6h9x-f7q9
Aliases: CVE-2019-9512
Published: 2022-05-24T16:53:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

### Specific Go Packages Affected
golang.org/x/net/http2
XXE vulnerability in NUnit Plugin
Advisory: GHSA-xvhf-q744-5xm8
Aliases: CVE-2020-2115
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

NUnit Plugin 0.25 and earlier does not configure the XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.

NUnit Plugin 0.26 disables external entity processing for its XML parser.
Improper Neutralization of Input During Web Page Generation in Jenkins Git Plugin 
Advisory: GHSA-6c7r-6p5m-cp82
Aliases: CVE-2020-2136
Published: 2022-05-24T17:10:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins Git Plugin 4.2.0 and earlier does not escape the error message for the repository URL for Microsoft TFS field form validation, resulting in a stored cross-site scripting vulnerability.
Inefficient Algorithmic Complexity in Apache Santuario XML Security
Advisory: GHSA-r237-w2w6-jq3p
Aliases: CVE-2013-2172
Published: 2022-05-13T01:05:56Z

`jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java` in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."
Kubernetes arbitrary file overwrite
Advisory: GHSA-mm7g-f2gg-cw8g
Aliases: CVE-2017-1002102
Published: 2022-05-13T01:38:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N

In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running.
chrome-launcher subject to OS Command Injection
Advisory: GHSA-gp2j-mg4w-2rh5
Aliases: CVE-2020-7645
Published: 2022-05-24T17:17:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

chrome-launcher prior to 0.13.2 is subject to OS Command Injection via the `$HOME` environment variable in Linux operating systems. This issue is patched in version 0.13.2.
Django Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget
Advisory: GHSA-4894-5vqc-6r2r
Aliases: CVE-2013-4249
Published: 2022-05-17T01:33:07Z

Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.
Cookie parsing failure
Advisory: GHSA-hxrm-9w7p-39cc
Aliases: CVE-2020-1045
Published: 2022-05-24T17:27:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A security feature bypass vulnerability exists in the way Microsoft ASP.NET Core parses encoded cookie names.The ASP.NET Core cookie parser decodes entire cookie strings which could allow a malicious attacker to set a second cookie with the name being percent encoded.The security update addresses the vulnerability by fixing the way the ASP.NET Core cookie parser handles encoded names., aka 'Microsoft ASP.NET Core Security Feature Bypass Vulnerability'.
AVideo vulnerable to Improper Privilege Management
Advisory: GHSA-2mgx-226x-8pwv
Aliases: CVE-2020-23489
Published: 2022-05-24T17:34:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The import.json.php file before 8.9 for AVideo is vulnerable to a File Deletion vulnerability. This allows the deletion of configuration.php, causing certain privilege checks to not be in place, leading to privilege escalation to admin. Local File Inclusion may also leak credentials and important files.

### Patches
Upgrade to version 8.9
Kallithea CRLF injection vulnerability
Advisory: GHSA-vfg9-phjp-9frw
Aliases: CVE-2015-5285
Published: 2022-05-13T01:26:14Z

CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the `came_from` parameter to `_admin/login`.
Pimcore Vulnerable to PHP Object Injection Attacks
Advisory: GHSA-g7pj-3v97-3vxp
Aliases: CVE-2014-2921
Published: 2022-05-17T04:46:09Z

The `getObjectByToken` function in `Newsletter.php` in the `Pimcore_Tool_Newsletter` module in pimcore 1.4.9 through 2.0.0 does not properly handle an object obtained by unserializing Lucene search data, which allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via vectors involving a `Zend_Pdf_ElementFactory_Proxy` object and a pathname with a trailing `\0` character.
Missing permission check in Jenkins SSH Plugin
Advisory: GHSA-x454-72fx-69q3
Aliases: CVE-2022-30957
Published: 2022-05-18T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins SSH Plugin 2.6.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Python Keyring does not securely initialize encryption cipher
Advisory: GHSA-p3h7-3c45-qj4v
Aliases: CVE-2012-4571
Published: 2022-05-17T05:18:21Z

Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for `CryptedFileKeyring` files, which makes it easier for local users to obtain passwords via a brute-force attack.
Magento 2 Community Edition vulnerable to Improper Authorization
Advisory: GHSA-rwf7-652f-76mv
Aliases: CVE-2020-24404
Published: 2022-05-24T17:33:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected by an incorrect permissions vulnerability within the Integrations component. This vulnerability could be abused by users with permissions to the Pages resource to delete cms pages via the REST API without authorization.