aswin1906/github-advisory-2022 huggingface dataset:
Nokogiri Implements libxml2 version vulnerable to null pointer dereferencing
Advisory: GHSA-286v-pcf5-25rc
Aliases: CVE-2021-3537
Published: 2022-05-24T19:02:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability.
CiviCRM SQL injection vulnerability via Quick Search API
Advisory: GHSA-4465-r2hg-v4rj
Aliases: CVE-2013-4662
Published: 2022-05-17T04:52:06Z

The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layer and conduct SQL injection attacks via a direct request to the "second layer" of the API, related to contact.getquick.
Apache OpenMeetings updates user password in insecure manner
Advisory: GHSA-xhj7-jr45-5w8r
Aliases: CVE-2017-7688
Published: 2022-05-13T01:47:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache OpenMeetings 1.0.0 updates user password in insecure manner. This issue is fixed in version 3.3.0.
Stored XSS vulnerability in Jenkins Extra Columns Plugin
Advisory: GHSA-wx66-pm7r-2q82
Aliases: CVE-2021-21630
Published: 2022-05-24T17:45:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. Additionally, a view containing such a job needs to be configured with the build parameters column, or the attacker also needs View/Configure permission.

Extra Columns Plugin 1.23 escapes parameter values in the build parameters column.
Incorrect Privilege Assignment in RESTEasy
Advisory: GHSA-qjpq-5pq3-43rr
Aliases: CVE-2014-3490
Published: 2022-05-14T01:18:38Z

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.
ChakraCore RCE Vulnerability
Advisory: GHSA-jr84-p554-62pm
Aliases: CVE-2020-0969
Published: 2022-05-24T17:14:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.
Magento 2 Community Edition Cross-site Scripting Vulnerability
Advisory: GHSA-qmwh-rh2g-3682
Aliases: CVE-2019-7875
Published: 2022-05-24T16:52:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to newsletter templates.
Missing permission checks in Jenkins Sounds Plugin allow OS command execution
Advisory: GHSA-h8w6-c53g-53vv
Aliases: CVE-2020-2097
Published: 2022-05-24T17:06:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins.
Stored XSS vulnerability in android-lint Plugin
Advisory: GHSA-28x9-hc4p-9vh2
Aliases: CVE-2020-2262
Published: 2022-05-24T17:28:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Android Lint Plugin 2.6 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to the plugin's post-build step.
Cross-Site Request Forgery in Jenkins
Advisory: GHSA-c735-g9f2-2mvp
Aliases: CVE-2020-2160
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An extension point in Jenkins allows selectively disabling cross-site request forgery (CSRF) protection for specific URLs.\n\nImplementations of that extension point received a different representation of the URL path than the Stapler web framework uses to dispatch requests in Jenkins 2.227 and earlier, LTS 2.204.5 and earlier. This discrepancy allowed attackers to craft URLs that would bypass the CSRF protection of any target URL.\n\nJenkins now uses the same representation of the URL path to decide whether CSRF protection is needed for a given URL as the Stapler web framework uses.\n\nIn case of problems, administrators can disable this security fix by setting the system property `hudson.security.csrf.CrumbFilter.UNPROCESSED_PATHINFO` to `true`.\n\nAs an additional safeguard, semicolon (`;`) characters in the path part of a URL are now banned by default. Administrators can disable this protection by setting the system property `jenkins.security.SuspiciousRequestFilter.allowSemicolonsInPath` to `true`.
Jenkins Poll SCM Plugin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-fv3c-6cw7-2qcq
Aliases: CVE-2017-1000093
Published: 2022-05-17T00:33:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins Poll SCM Plugin was not requiring requests to its API be sent via POST, thereby opening itself to Cross-Site Request Forgery attacks. This allowed attackers to initiate polling of projects with a known name. While Jenkins in general does not consider polling to be a protection-worthy action as it's similar to cache invalidation, the plugin specifically adds a permission to be able to use this functionality, and this issue undermines that permission. This functionality now is only available via POST.
Missing permission check in CloudBees CD Plugin allows scheduling builds
Advisory: GHSA-7rx6-4vwv-432g
Aliases: CVE-2021-21647
Published: 2022-05-24T17:48:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CloudBees CD Plugin does not perform a permission check in an HTTP endpoint.

This allows attackers with Item/Read permission to schedule builds of projects without having Item/Build permission.

CloudBees CD Plugin requires Item/Build permission to schedule builds via its HTTP endpoint.
Limited Authentication Bypass for Media Files
Advisory: GHSA-qm6v-cg9v-53j3
Aliases: CVE-2022-29237
Published: 2022-05-25T20:16:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers.

### Impact

The vulnerability allows attackers to bypass organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster.

If you do not run a multi-tenant cluster, you are not affected by this issue.

### Patches

This issue is fixed in Opencast 10.14 and 11.7.

### References

- [Patch fixing the issue](https://github.com/opencast/opencast/commit/8d5ec1614eed109b812bc27b0c6d3214e456d4e7)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)
Tiki Wiki CMS Groupware Cross-site scripting (XSS) vulnerability
Advisory: GHSA-h7jc-pg2r-mqj4
Aliases: CVE-2013-4714
Published: 2022-05-17T04:58:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Cross-site scripting (XSS) vulnerability in Tiki Wiki CMS Groupware 6 LTS before 6.13LTS, 9 LTS before 9.7LTS, 10.x before 10.4, and 11.x before 11.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
PIL and Pillow Vulnerable to Symlink Attack on Tmpfiles
Advisory: GHSA-x895-2wrm-hvp7
Aliases: CVE-2014-1932
Published: 2022-05-17T02:39:13Z

The (1) `load_djpeg` function in `JpegImagePlugin.py`, (2) `Ghostscript` function in `EpsImagePlugin.py`, (3) `load` function in `IptcImagePlugin.py`, and (4) `_copy` function in `Image.py` in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.
Improper socket reuse in Apache Tomcat
Advisory: GHSA-h3ch-5pp2-vh6w
Aliases: CVE-2022-25762
Published: 2022-05-14T00:01:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors.
Improper authorization of users and groups with the same base name in Jenkins GitLab Authentication Plugin
Advisory: GHSA-qq38-mxpq-rrpj
Aliases: CVE-2020-2228
Published: 2022-05-24T17:23:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

GitLab Authentication Plugin 1.5 and earlier does not differentiate between user names and hierarchical group names when performing authorization. This allows an attacker with permissions to create groups in GitLab to gain the privileges granted to another user or group.

GitLab Authentication Plugin 1.6 performs user name and group name authorization checks using the appropriate GitLab APIs.
Numpy Deserialization of Untrusted Data
Advisory: GHSA-9fq2-x9r6-wfmf
Aliases: CVE-2019-6446
Published: 2022-05-24T22:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

** DISPUTED **   An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is  a behavior that might have legitimate applications in (for example)  loading serialized Python object arrays from trusted and authenticated  sources.
Plaintext Storage in Jenkins Spira Importer Plugin
Advisory: GHSA-pwg7-4hxv-v4cw
Aliases: CVE-2019-16543
Published: 2022-05-24T17:01:41Z

Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
Cobbler has Exposed Dangerous Method or Function
Advisory: GHSA-8787-63px-3m23
Aliases: CVE-2018-10931
Published: 2022-05-13T01:54:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.
Missing validation causes denial of service via `LSTMBlockCell`
Advisory: GHSA-2vv3-56qg-g2cf
Aliases: CVE-2022-29200
Published: 2022-05-24T22:10:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.LSTMBlockCell`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/rnn/lstm_ops.cc) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

tf.raw_ops.LSTMBlockCell( 
  x=tf.constant(0.837607, shape=[28,29], dtype=tf.float32),
  cs_prev=tf.constant(0, shape=[28,17], dtype=tf.float32),
  h_prev=tf.constant(0.592631638, shape=[28,17], dtype=tf.float32),
  w=tf.constant(0.887386262, shape=[46,68], dtype=tf.float32),
  wci=tf.constant(0, shape=[], dtype=tf.float32),
  wcf=tf.constant(0, shape=[17], dtype=tf.float32),
  wco=tf.constant(0.592631638, shape=[28,17], dtype=tf.float32),
  b=tf.constant(0.75259006, shape=[68], dtype=tf.float32),
  forget_bias=1, cell_clip=0, use_peephole=False)
``` 
  
The code does not validate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tensor are accessed.
    
### Patches
We have patched the issue in GitHub commit [803404044ae7a1efac48ba82d74111fce1ddb09a](https://github.com/tensorflow/tensorflow/commit/803404044ae7a1efac48ba82d74111fce1ddb09a).
    
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information                
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
    
### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Stored XSS vulnerability in Jenkins console links
Advisory: GHSA-gfhj-524q-gcrm
Aliases: CVE-2020-2223
Published: 2022-05-24T17:23:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.244 and earlier, LTS 2.235.1 and earlier does not escape the `href` attribute of links to downstream jobs displayed in the build console page. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission.

Jenkins 2.245, LTS 2.235.2 escapes the `href` attribute of these links.
Stored XSS vulnerability in Jenkins Liquibase Runner Plugin
Advisory: GHSA-9hg7-xmf8-jxf9
Aliases: CVE-2020-2283
Published: 2022-05-24T17:29:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Liquibase Runner Plugin 1.4.5 and earlier does not escape changeset contents when showing them on the build page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide Liquibase changesets evaluated by the plugin.

Liquibase Runner Plugin 1.4.7 no longer supports evaluating changesets.
Anchor CMS Logs Credentials
Advisory: GHSA-hxcw-pqqc-rv85
Aliases: CVE-2018-7251
Published: 2022-05-13T01:39:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in `config/error.php` in Anchor 0.12.3. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error (such as "Too many connections") has occurred.
Jenkins Gitlab Authentication Plugin Open Redirect vulnerability
Advisory: GHSA-pg59-2w33-8vmc
Aliases: CVE-2019-10372
Published: 2022-05-24T16:52:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

GitLab Authentication Plugin records the HTTP `Referer` header when the authentication process starts and redirects users to that URL when the user has finished logging in.

This implements an open redirect, allowing malicious sites to implement a phishing attack, with users expecting they have just logged in to Jenkins.

As of publication of this advisory, there is no fix.
Deserialization of Untrusted Data in Liferay Portal
Advisory: GHSA-w7pm-cc4v-f3g8
Aliases: CVE-2020-7961
Published: 2022-05-24T17:12:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services (JSONWS).
Jython Improper Access Restrictions vulnerability
Advisory: GHSA-9347-9w64-q5wp
Aliases: CVE-2013-2027
Published: 2022-05-14T02:05:10Z

Jython before 2.7.2b3 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.
Silverstripe Framework SQLi Vulnerability
Advisory: GHSA-wvfw-w3x6-g526
Aliases: CVE-2019-5715
Published: 2022-05-14T01:10:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of SilverStripe 3 prior to 3.6.7 and 3.7.3, and all versions of SilverStripe 4 prior to 4.0.7, 4.1.5, 4.2.4, and 4.3.1 allows Reflected SQL Injection through Form and DataObject.
Moodle Unauthenticated Access
Advisory: GHSA-x32v-7qw8-cpq8
Aliases: CVE-2016-8642
Published: 2022-05-13T01:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In Moodle 2.x and 3.x, the question engine allows access to files that should not be available.
Improper Limitation of a Pathname to a Restricted Directory in WildFly
Advisory: GHSA-w8r2-5j8x-x8j6
Aliases: CVE-2018-10862
Published: 2022-05-14T01:06:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
Fileutils Command Injection vulnerability
Advisory: GHSA-9x97-x2p9-hvpf
Aliases: CVE-2013-2516
Published: 2022-05-14T01:33:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ruby Gem Fileutils prior to v0.7.1 contains a Command Injection vulnerability in user supplied url variable that is passed to the shell.
Total.js CMS Path Traversal
Advisory: GHSA-pwvp-h579-hfxg
Aliases: CVE-2019-15952
Published: 2022-05-24T16:55:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the Pages privilege can conduct a path traversal attack (../) to include .html files that are outside the permitted directory. Also, if a page contains a template directive, then the directive will be server side processed. Thus, if a user can control the content of a .html file, then they can inject a payload with a malicious template directive to gain Remote Command Execution. The exploit will work only with the .html extension.
Improper Limitation of a Pathname to a Restricted Directory in Jenkins
Advisory: GHSA-5hfp-964w-5vgm
Aliases: CVE-2018-1000997
Published: 2022-05-14T01:04:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A path traversal vulnerability exists in the Stapler web framework used by Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/org/kohsuke/stapler/Facet.java, groovy/src/main/java/org/kohsuke/stapler/jelly/groovy/GroovyFacet.java, jelly/src/main/java/org/kohsuke/stapler/jelly/JellyFacet.java, jruby/src/main/java/org/kohsuke/stapler/jelly/jruby/JRubyFacet.java, jsp/src/main/java/org/kohsuke/stapler/jsp/JSPFacet.java that allows attackers to render routable objects using any view in Jenkins, exposing internal information about those objects not intended to be viewed, such as their toString() representation.
HashiCorp go-getter command injection
Advisory: GHSA-x24g-9w7v-vprh
Aliases: CVE-2022-26945
Published: 2022-05-26T00:01:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

HashiCorp go-getter before 2.0.2 allows Command Injection.
i18n Vulnerable to Denial of Service Attack
Advisory: GHSA-34hf-g744-jw64
Aliases: CVE-2014-10077
Published: 2022-05-14T01:48:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.
Fat Free CRM subject to Cross-site Scripting
Advisory: GHSA-wcfx-3m6v-4frg
Aliases: CVE-2014-5441
Published: 2022-05-17T04:35:23Z

Multiple cross-site scripting (XSS) vulnerabilities in `app/views/layouts/application.html.haml` in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit user action.
Jenkins Cross-site Scripting vulnerability in project naming strategy
Advisory: GHSA-9g4m-ffx6-c29g
Aliases: CVE-2020-2230
Published: 2022-05-24T17:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, that is displayed on item creation.\n\nThis results in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.\n\nJenkins 2.252, LTS 2.235.4 escapes the project naming strategy description.
Moodle XSS Vulnerability
Advisory: GHSA-7ghm-fp7p-qvjq
Aliases: CVE-2016-9188
Published: 2022-05-17T03:38:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerabilities in Moodle CMS on or before 3.1.2 allow remote attackers to inject arbitrary web script or HTML via the s_additionalhtmlhead, s_additionalhtmltopofbody, and s_additionalhtmlfooter parameters.
Cross-site Scripting vulnerability in Mautic's tracking pixel functionality
Advisory: GHSA-pjpc-87mp-4332
Aliases: CVE-2022-25772
Published: 2022-05-25T22:36:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

### Impact

Mautic allows you to track open rates by using tracking pixels. 
The tracking information is stored together with extra metadata of the tracking request.

The output isn't sufficiently filtered when showing the metadata of the tracking information, which may lead to a vulnerable situation.

### Patches

Please upgrade to 4.3.0

### Workarounds
None.

### References
* Internally tracked under MST-38

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Improper Control of Generation of Code in Apache Struts
Advisory: GHSA-whmq-v94q-34p9
Aliases: CVE-2013-1965
Published: 2022-05-14T00:54:15Z

Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
ChakraCore RCE Vulnerability
Advisory: GHSA-h9cr-2hcf-cg8p
Aliases: CVE-2018-8543
Published: 2022-05-13T01:20:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8541, CVE-2018-8542, CVE-2018-8551, CVE-2018-8555, CVE-2018-8556, CVE-2018-8557, CVE-2018-8588.
CSRF vulnerability and in Jenkins OWASP Dependency-Track Plugin allow capturing credentials
Advisory: GHSA-v7xh-h48c-xw5f
Aliases: CVE-2021-21633
Published: 2022-05-24T17:45:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OWASP Dependency-Track Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing \"Secret text\" credentials stored in Jenkins. If no credentials ID is specified, the globally configured credential is used, if set up, and can likewise be captured.

Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

OWASP Dependency-Track Plugin 3.1.1 requires POST requests and appropriate permissions for the affected HTTP endpoints.
Insufficient Granularity of Access Control in JSDom
Advisory: GHSA-f4c9-cqv8-9v98
Aliases: CVE-2021-20066
Published: 2022-05-24T17:42:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

JSDom improperly allows the loading of local resources, which allows for local files to be manipulated by a malicious web page when script execution is enabled.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-j49x-jjmj-9fqj
Aliases: CVE-2019-8227
Published: 2022-05-24T17:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML.
Improper Input Validation in Jetty
Advisory: GHSA-qxp4-27vx-xmm3
Aliases: CVE-2011-4461
Published: 2022-05-14T01:27:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
XML Signature/Encryption Not Validated in Apache CXF
Advisory: GHSA-2g99-c67p-56hm
Aliases: CVE-2012-2379
Published: 2022-05-13T01:09:22Z

Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors.
Fat Free CRM Cross-Site Request Forgery vulnerability
Advisory: GHSA-wx7c-8j35-mpg8
Aliases: CVE-2015-1585
Published: 2022-05-14T02:49:30Z

Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.
Fork CMS Cross-site Scripting Vulnerability
Advisory: GHSA-74gc-hf33-5353
Aliases: CVE-2020-13633
Published: 2022-05-24T17:18:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Fork before 5.8.3 allows XSS via navigation_title or title.
Stored XSS vulnerability in Jenkins REST List Parameter Plugin
Advisory: GHSA-x3m6-vcp7-98mr
Aliases: CVE-2021-21635
Published: 2022-05-24T17:45:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

REST List Parameter Plugin 1.3.0 and earlier does not escape a parameter name reference in embedded JavaScript.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

REST List Parameter Plugin 1.3.1 no longer identifies a parameter using user-specified content.
Magento 2 Community Edition DoS vulnerability
Advisory: GHSA-hrg3-4q56-p2q5
Aliases: CVE-2019-7928
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial-of-service (DoS) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. By abusing insufficient brute-forcing defenses in the token exchange protocol, an unauthenticated attacker could disrupt transactions between the Magento merchant and PayPal.
Missing permission checks in Mac Plugin
Advisory: GHSA-2m74-x26c-g7xc
Aliases: CVE-2020-2148
Published: 2022-05-24T17:10:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Mac Plugin 1.1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified SSH server using attacker-specified credentials.
Loading a bgzip block can write out of bounds if size overflows.
Advisory: GHSA-cpqj-r29q-chrh
Aliases: CVE-2021-28027
Published: 2022-05-24T17:43:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the bam crate before 0.1.3 for Rust. There is an integer underflow and out-of-bounds write during the loading of a bgzip block.
Missing Authorization in Crafter CMS
Advisory: GHSA-2rr8-9c6g-8j5c
Aliases: CVE-2017-15680
Published: 2022-05-24T17:34:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

In Crafter CMS Crafter Studio 3.0 prior to 3.0.1 an IDOR vulnerability exists which allows unauthenticated attackers to view and modify administrative data.
Ignite Realtime Openfire allows Cross-site Scripting
Advisory: GHSA-5cg5-7vw6-jw4r
Aliases: CVE-2019-20526
Published: 2022-05-24T17:11:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter. This issue was fixed in version 4.4.2.
Plone Code Injection vulnerability
Advisory: GHSA-cxw7-85xm-3xrc
Aliases: CVE-2012-5488
Published: 2022-05-17T04:31:32Z

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.
Improper Authentication in Apache Kafka
Advisory: GHSA-xm78-4m3g-7wm7
Aliases: CVE-2017-12610
Published: 2022-05-13T01:25:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

In Apache Kafka 0.10.0.0 to 0.10.2.1 and 0.11.0.0 to 0.11.0.1, authenticated Kafka clients may use impersonation via a manually crafted protocol message with SASL/PLAIN or SASL/SCRAM authentication when using the built-in PLAIN or SCRAM server implementations in Apache Kafka.
CSRF vulnerability in Jenkins Swarm Plugin
Advisory: GHSA-c264-8834-ppj2
Aliases: CVE-2020-2192
Published: 2022-05-24T17:19:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Swarm Plugin adds API endpoints to add or remove agent labels. In Swarm Plugin 3.20 and earlier these only require a global Swarm secret to use, and no regular permission check is performed. This allows users with Agent/Create permission to add or remove labels of any agent.

Additionally, these API endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Swarm Plugin 3.21 requires POST requests and Agent/Configure permission for the affected agent to these endpoints. It no longer uses the global Swarm secret for these API endpoints.
phpMyAdmin Cross-site scripting (XSS) vulnerability via pageNumber value 
Advisory: GHSA-p632-5w74-x8xx
Aliases: CVE-2013-5002
Published: 2022-05-17T03:12:55Z

Cross-site scripting (XSS) vulnerability in `libraries/schema/Export_Relation_Schema.class.php` in phpMyAdmin 3.5.x before 3.5.8.2 and 4.0.x before 4.0.4.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted pageNumber value to schema_export.php.
futures_task::noop_waker_ref can segfault due to dereferencing a NULL pointer
Advisory: GHSA-p9m5-3hj7-cp5r
Aliases: CVE-2020-35907
Published: 2022-05-24T17:37:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected versions of the crate used a UnsafeCell in thread-local storage to return a noop waker reference, assuming that the reference would never be returned from another thread.

This resulted in a segmentation fault crash if Waker::wake_by_ref() was called on a waker returned from another thread due to it attempting to dereference a pointer that wasn't accessible from the main thread.
Apache NiFi host header poisoning issue
Advisory: GHSA-w4x6-j349-9r57
Aliases: CVE-2017-12632
Published: 2022-05-14T03:45:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
JBoss KeyCloak Open Redirect
Advisory: GHSA-5r7w-pjx8-99qg
Aliases: CVE-2014-3652
Published: 2022-05-17T19:57:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
ChakraCore RCE Vulnerability
Advisory: GHSA-wm27-49x2-mg9q
Aliases: CVE-2016-3259
Published: 2022-05-14T02:24:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3248.
Undertow Request Smuggling vulnerability
Advisory: GHSA-5gg7-5wv8-4gcj
Aliases: CVE-2017-12165
Published: 2022-05-13T01:38:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.
Magento 2 Community Edition SSRF vulnerability
Advisory: GHSA-hppc-rpfp-r8qw
Aliases: CVE-2019-7913
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code.
Microweber vulnerable to cross-site scripting (XSS)
Advisory: GHSA-6346-5r4h-ff5x
Aliases: CVE-2022-1555
Published: 2022-05-05T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Microweber is a drag and drop website builder and a powerful next generation CMS. Microweber versions 1.2.15 and prior are vulnerable to cross-site scripting. This could lead to injection of arbitrary JaveScript code, defacement of a page, or stealing cookies. A patch is available on the `master` branch of Microweber's GitHub repository.
Kimai v2 is vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-7v44-75jf-22gj
Aliases: CVE-2019-15481
Published: 2022-05-24T16:54:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Kimai v2 before 1.1 has XSS via a timesheet description.
Access controll bypass in Apache Tomcat
Advisory: GHSA-p26v-97vp-jcx6
Aliases: CVE-2011-1183
Published: 2022-05-14T02:56:10Z

Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
Magento 2 Community Edition Insufficient Access Controls
Advisory: GHSA-5hcx-vg88-hgpm
Aliases: CVE-2019-7904
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes.
Apache Camel camel-hessian component vulnerable to Java object deserialization
Advisory: GHSA-5whj-523x-6j68
Aliases: CVE-2017-12633
Published: 2022-05-14T01:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.
Improper Privilege Management in Jenkins
Advisory: GHSA-p4p5-3v2j-w5rv
Aliases: CVE-2018-1000865
Published: 2022-05-13T01:48:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Script Security Plugin 1.47 and earlier in groovy-sandbox/src/main/java/org/kohsuke/groovy/sandbox/SandboxTransformer.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM, if plugins using the Groovy sandbox are installed.
Apache Struts2 Broken Access Control Vulnerability
Advisory: GHSA-q5q8-jghf-3pm3
Aliases: CVE-2013-4310
Published: 2022-05-17T04:44:52Z

The Struts 2 action mapping mechanism supports the special parameter prefix action: which is intended to help with attaching navigational information to buttons within forms, under certain conditions this can be used to bypass security constraints. 

In Struts 2.3.15.3 the action mapping mechanism was changed to avoid circumventing security constraints. Two additional constants were introduced to steer behaviour of DefaultActionMapper:

- struts.mapper.action.prefix.enabled - when set to false support for "action:" prefix is disabled, set to false by default
- struts.mapper.action.prefix.crossNamespaces - when set to false, actions defined with "action:" prefix must be in the same namespace as current action
Missing Authorization in Jenkins Mercurial Plugin
Advisory: GHSA-vrrc-3wwh-frgx
Aliases: CVE-2020-2306
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Mercurial Plugin prior to 2.12, 2.10.1, 2.9.1, and 2.8.1 does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to obtain a list of names of configured Mercurial installations.

Mercurial Plugin 2.12, 2.10.1, 2.9.1, and 2.8.1 performs permission checks when listing configured Mercurial installations.
Cisco node-jose improper validation of JWT signature
Advisory: GHSA-jfxm-w8g2-4rcv
Aliases: CVE-2018-0114
Published: 2022-05-13T01:17:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A vulnerability in the Cisco node-jose open source library before 0.11.0 could allow an unauthenticated, remote attacker to re-sign tokens using a key that is embedded within the token. The vulnerability is due to node-jose following the JSON Web Signature (JWS) standard for JSON Web Tokens (JWTs). This standard specifies that a JSON Web Key (JWK) representing a public key can be embedded within the header of a JWS. This public key is then trusted for verification. An attacker could exploit this by forging valid JWS objects by removing the original signature, adding a new public key to the header, and then signing the object using the (attacker-owned) private key associated with the public key embedded in that JWS header.
Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext
Advisory: GHSA-5gmf-8gh2-hhfp
Aliases: CVE-2017-1000245
Published: 2022-05-13T01:41:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The SSH Plugin stores credentials which allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.
OS Command Injection in Plexus-utils
Advisory: GHSA-8vhq-qq4p-grq3
Aliases: CVE-2017-1000487
Published: 2022-05-13T01:11:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.
Moodle vulnerable to RCE
Advisory: GHSA-vr6v-g96p-cjc3
Aliases: CVE-2020-10738
Published: 2022-05-24T17:18:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before 3.7.6, 3.6 before 3.6.10, 3.5 before 3.5.12 and earlier unsupported versions. It was possible to create a SCORM package in such a way that when added to a course, it could be interacted with via web services in order to achieve remote code execution.
CSRF vulnerability in Jenkins warnings Plugin allows remote code execution
Advisory: GHSA-q564-vvx8-9388
Aliases: CVE-2020-2280
Published: 2022-05-24T17:29:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

warnings Plugin 5.0.1 and earlier does not require POST requests for a form validation method intended for testing custom warnings parsers, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to execute arbitrary code.

warnings Plugin 5.0.2 requires POST requests for the affected form validation method.

This vulnerability was caused by an incomplete fix to [SECURITY-1295](https://www.jenkins.io/security/advisory/2019-01-28/).
Jenkins Dashboard View Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-fv4q-4h24-23qr
Aliases: CVE-2019-10396
Published: 2022-05-24T16:55:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Dashboard View Plugin did not escape the build description on the Latest Builds View. This resulted in a cross-site scripting vulnerability exploitable by attackers able to control the description of builds shown on that view.

Dashboard View Plugin now applies the configured markup formatter to the build description, rendering it as it appears elsewhere in Jenkins.
Missing permission check in Jenkins Liquibase Runner Plugin allows enumerating credentials IDs
Advisory: GHSA-44cm-p9q7-rr3p
Aliases: CVE-2020-2285
Published: 2022-05-24T17:29:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Liquibase Runner Plugin 1.4.7 and earlier does not perform a permission check in an HTTP endpoint.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.

An enumeration of credentials IDs in Liquibase Runner Plugin 1.4.8 requires the appropriate permissions.
Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
Advisory: GHSA-9cvr-8xq4-2m73
Aliases: CVE-2014-8110
Published: 2022-05-14T01:14:52Z

Multiple cross-site scripting (XSS) vulnerabilities in the web based administration console in Apache ActiveMQ 5.x before 5.10.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Inadequate Encryption Strength in Jenkins
Advisory: GHSA-r9q2-3r6x-qmgp
Aliases: CVE-2017-2598
Published: 2022-05-13T01:36:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins before versions 2.44 and 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
ChakraCore RCE Vulnerability
Advisory: GHSA-m8x8-5ch7-c5w9
Aliases: CVE-2018-0836
Published: 2022-05-13T01:18:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
XMLTooling Library Incorrectly Handles Some Exceptions
Advisory: GHSA-6hvf-xvwm-vrw4
Aliases: CVE-2019-9628
Published: 2022-05-13T01:02:16Z
Withdrawn: 2023-08-01T18:26:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The XMLTooling library all versions prior to V3.0.4, provided with the OpenSAML and Shibboleth Service Provider software, contains an XML parsing class. Invalid data in the XML declaration causes an exception of a type that was not handled properly in the parser class and propagates an unexpected exception type.
OHDSI WebAPI vulnerable to SQL Injection
Advisory: GHSA-2chv-87wj-pjv2
Aliases: CVE-2019-15563
Published: 2022-05-24T16:54:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in `FeatureExtractionService.java`.
phpMyAdmin ReCaptcha bypass
Advisory: GHSA-v6fh-vg22-r6cm
Aliases: CVE-2015-6830
Published: 2022-05-17T03:18:28Z

libraries/plugins/auth/AuthenticationCookie.class.php in phpMyAdmin 4.3.x before 4.3.13.2 and 4.4.x before 4.4.14.1 allows remote attackers to bypass a multiple-reCaptcha protection mechanism against brute-force credential guessing by providing a correct response to a single reCaptcha.
Access restriction bypass in Apache Tomcat
Advisory: GHSA-3xpj-jgv5-q4vv
Aliases: CVE-2011-1582
Published: 2022-05-14T02:55:47Z

Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419.
Apache James Server OS Command Injection
Advisory: GHSA-cgvf-22vv-83h5
Aliases: CVE-2015-7611
Published: 2022-05-14T02:47:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
Improper Neutralization of Special Elements used in a Command  in Apache Cassandra
Advisory: GHSA-w7f2-gjxf-2gm9
Aliases: CVE-2015-0225
Published: 2022-05-14T02:49:56Z

The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.
Cross-site Scripting in wicket-jquery-ui
Advisory: GHSA-pjv3-rh6v-2pj8
Aliases: CVE-2018-1325
Published: 2022-05-14T00:58:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In wicket-jquery-ui <= 6.29.0, <= 7.10.1, <= 8.0.0-M9.1, JS code created in WYSIWYG editor will be executed on display.
Improper Neutralization of Input During Web Page Generation in Apache Solr
Advisory: GHSA-wgw2-gw4v-9w4j
Aliases: CVE-2014-3628
Published: 2022-05-17T04:17:55Z

Cross-site scripting (XSS) vulnerability in the Admin UI Plugin / Stats page in Apache Solr 4.x before 4.10.3 allows remote attackers to inject arbitrary web script or HTML via the fieldvaluecache object.
Prototype Pollution in convict
Advisory: GHSA-jjf5-wx3j-3fv7
Aliases: CVE-2022-21190
Published: 2022-05-14T00:01:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This affects the package convict before 6.2.3. This is a bypass of [CVE-2022-22143](https://security.snyk.io/vuln/SNYK-JS-CONVICT-2340604). The [fix](https://github.com/mozilla/node-convict/commit/3b86be087d8f14681a9c889d45da7fe3ad9cd880) introduced, relies on the startsWith method and does not prevent the vulnerability: before splitting the path, it checks if it starts with __proto__ or this.constructor.prototype. To bypass this check it's possible to prepend the dangerous paths with any string value followed by a dot, like for example foo.__proto__ or foo.this.constructor.prototype.
Plone Cross-site scripting Vulnerability
Advisory: GHSA-3g6w-4m7x-97v6
Aliases: CVE-2012-5494
Published: 2022-05-17T04:32:23Z

Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "{u,}translate."