aswin1906/github-advisory-2022 huggingface dataset:
Jenkins GitHub Branch Source Plugin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-w66r-f5gg-gqwm
Aliases: CVE-2017-1000091
Published: 2022-05-17T00:33:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

GitHub Branch Source Plugin connects to a user-specified GitHub API URL (e.g. GitHub Enterprise) as part of form validation and completion (e.g. to verify Scan Credentials are correct). This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect to any web server and send credentials with a known ID, thereby possibly capturing them. Additionally, this functionality did not require POST requests be used, thereby allowing the above to be performed without direct access to Jenkins via Cross-Site Request Forgery. An enumeration of credentials IDs in this plugin now requires the permission to have Extended Read permission (when that permission is enabled; otherwise Configure permission) to the job in whose context credentials are being accessed. If no job context exists, Overall/Administer permission is required.
Improper Input Validation in Apache Batik
Advisory: GHSA-wfw6-mmmp-87xm
Aliases: CVE-2015-0250
Published: 2022-05-17T00:28:34Z

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.
Credentials transmitted in plain text by Repository Connector Plugin
Advisory: GHSA-4fjc-fwj2-7xfg
Aliases: CVE-2020-2149
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Repository Connector Plugin stores credentials in its global configuration file `org.jvnet.hudson.plugins.repositoryconnector.RepositoryConfiguration.xml` on the Jenkins controller as part of its configuration.

While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Repository Connector Plugin 1.2.6 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.
mPDF Unsafe Deserialization
Advisory: GHSA-3cwc-m7c2-qr86
Aliases: CVE-2019-1000005
Published: 2022-05-14T01:33:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

mPDF version 7.1.7 and earlier contains a CWE-502: Deserialization of Untrusted Data vulnerability in getImage() method of Image/ImageProcessor class that can result in Arbitry code execution, file write, etc.. This attack appears to be exploitable via attacker must host crafted image on victim server and trigger generation of pdf file with content `<img src="phar://path/to/crafted/image">`. This vulnerability appears to have been fixed in 7.1.8.
Cross-site Scripting in in JRuby
Advisory: GHSA-wmq2-jc9m-xp4m
Aliases: CVE-2010-1330
Published: 2022-05-02T06:21:36Z

The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string.
ChakraCore RCE Vulnerability
Advisory: GHSA-3fvw-g6mr-w247
Aliases: CVE-2018-8130
Published: 2022-05-13T01:20:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0943, CVE-2018-8133, CVE-2018-8145, CVE-2018-8177.
Eclipse Vorto resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS
Advisory: GHSA-fg2q-v428-2gph
Aliases: CVE-2019-10248
Published: 2022-05-24T16:44:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.
Covert Timing Channel in Apache CXF
Advisory: GHSA-qc2p-q7x9-v64p
Aliases: CVE-2017-3156
Published: 2022-05-13T01:09:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.
Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Advisory: GHSA-7c3v-vc3x-x789
Aliases: CVE-2019-10367
Published: 2022-05-24T16:52:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked (i.e. replaced with asterisks) in that log to prevent accidental disclosure. Configuration as Code Plugin inspects the type and looks for a field, getter, or constructor argument corresponding to the property, making the secret detection much more robust for the purpose of log message masking. This was implemented in the [fix for SECURITY-1279 in the 2019-07-31 security advisory](https://www.jenkins.io/security/advisory/2019-07-31/#SECURITY-1279).

That fix was incomplete and did not cover a log message written to the logger `io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator`.

Configuration as Code Plugin now uses the same secret detection for these log messages.

As a workaround, administrators can configure the logging level of the logger `io.jenkins.plugins.casc.impl.configurators.DataBoundConfigurator` to a level that does not include these messages. Configuration as Code Plugin 1.25 and earlier logs these messages at the `INFO` level, Configuration as Code Plugin 1.26 logs them at `FINE`. See the logging documentation for details.
phpBB Open Redirect
Advisory: GHSA-hwq7-cvp8-6hm3
Aliases: CVE-2015-3880
Published: 2022-05-17T00:47:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Credentials stored in plain text by debian-package-builder Plugin
Advisory: GHSA-64jr-ggw8-h9jc
Aliases: CVE-2020-2125
Published: 2022-05-24T17:08:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

debian-package-builder Plugin 1.6.11 and earlier stores a GPG passphrase unencrypted in its global configuration file `ru.yandex.jenkins.plugins.debuilder.DebianPackageBuilder.xml` on the Jenkins controller. This credential can be viewed by users with access to the Jenkins controller file system.
Jenkins Zulip Plugin vulnerable to Insufficiently Protected Credentials
Advisory: GHSA-hfjr-m75m-wmh7
Aliases: CVE-2019-10476
Published: 2022-05-24T16:59:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Zulip Plugin prior to 1.1.1 stored credentials unencrypted in its global configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
baserCMS arbitrary file upload vulnerability
Advisory: GHSA-3mcp-6rv6-c69g
Aliases: CVE-2018-0571
Published: 2022-05-14T03:06:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers with a site operator privilege to upload arbitrary files.
Cross-domain cookie leakage in Guzzle
Advisory: GHSA-cwmx-hcrq-mhc3
Aliases: CVE-2022-29248
Published: 2022-05-25T18:09:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

### Impact

Previous version of Guzzle contain a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the `Set-Cookie` header, allowing a malicious server to set cookies for unrelated domains. For example an attacker at `www.example.com` might set a session cookie for `api.example.net`, logging the Guzzle client into their account and retrieving private API requests from the security log of their account.

Note that our cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with `['cookies' => true]` are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability.

### Patches

Affected Guzzle 7 users should upgrade to Guzzle 7.4.3 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.6 or 7.4.3.

### Workarounds

If you do not need support for cookies, turn off the cookie middleware. It is already off by default, but if you have turned it on and no longer need it, turn it off.

### References

* [RFC6265 Section 5.3](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3)
* [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx)

### For more information

If you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy).
Improper Input Validation in Apache Tomcat
Advisory: GHSA-9ggm-7897-x4mg
Aliases: CVE-2011-2526
Published: 2022-05-14T01:17:03Z

Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application.
HashBrown CMS Directory Traversal
Advisory: GHSA-q7hx-mrv5-6mrp
Aliases: CVE-2020-5840
Published: 2022-05-24T17:05:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in HashBrown CMS before 1.3.2. `Server/Entity/Resource/Connection.js` allows an attacker to reach a parent directory via a crafted name or ID field.
Exposure of Sensitive Information in Apache Tomcat
Advisory: GHSA-w227-xcfx-3pj8
Aliases: CVE-2009-0580
Published: 2022-05-02T03:16:43Z

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
Missing validation causes denial of service via `Conv3DBackpropFilterV2`
Advisory: GHSA-hx9q-2mx4-m4pg
Aliases: CVE-2022-29204
Published: 2022-05-24T22:12:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.UnsortedSegmentJoin`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/unsorted_segment_join_op.cc#L83-L148) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

tf.strings.unsorted_segment_join(
  inputs=['123'],
  segment_ids=[0],
  num_segments=-1)
```

The code assumes `num_segments` is a positive scalar but there is no validation:

```cc
const Tensor& num_segments_tensor = context->input(2);
auto num_segments = num_segments_tensor.scalar<NUM_SEGMENTS_TYPE>()();
// ...
Tensor* output_tensor = nullptr;
TensorShape output_shape =
    GetOutputShape(input_shape, segment_id_shape, num_segments);
```

Since this value is used to allocate the output tensor, a negative value would result in a `CHECK`-failure (assertion failure), as per [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md).

### Patches 
We have patched the issue in GitHub commit [84563f265f28b3c36a15335c8b005d405260e943](https://github.com/tensorflow/tensorflow/commit/84563f265f28b3c36a15335c8b005d405260e943) and GitHub commit [20cb18724b0bf6c09071a3f53434c4eec53cc147](https://github.com/tensorflow/tensorflow/commit/20cb18724b0bf6c09071a3f53434c4eec53cc147).
  
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.
      
### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
                       
### Attribution 
This vulnerability has been reported externally via a [GitHub issue](https://github.com/tensorflow/tensorflow/issues/55305).
Gophish XSS Vulnerability
Advisory: GHSA-9h9f-9q8g-6764
Aliases: CVE-2019-16146
Published: 2022-05-24T16:55:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Gophish through 0.8.0 allows XSS via a username.
Mattermost Server Sensitive Data Exposure
Advisory: GHSA-j2h2-cvwh-cr64
Aliases: CVE-2020-14457
Published: 2022-05-24T17:21:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An issue was discovered in Mattermost Server before 5.20.0. Non-members can receive broadcasted team details via the `update_team` WebSocket event, aka MMSA-2020-0012.
Jenkins NeoLoad Plugin stores credentials in cleartext
Advisory: GHSA-98p6-6428-77v7
Aliases: CVE-2019-10440
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins NeoLoad Plugin prior to version 2.2.6 stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Plone Open Redirection vulnerability via next parameter
Advisory: GHSA-56p3-rrp4-2j82
Aliases: CVE-2013-4200
Published: 2022-05-14T02:54:25Z

The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property,  redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login.
mastercactapus proxyprotocol vulnerable to denial of service
Advisory: GHSA-85c5-ccm8-vr96
Aliases: CVE-2019-14243
Published: 2022-05-24T16:51:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

headerv2.go in mastercactapus proxyprotocol before 0.0.2, as used in the mastercactapus caddy-proxyprotocol plugin through 0.0.2 for Caddy, allows remote attackers to cause a denial of service (webserver panic and daemon crash) via a crafted HAProxy PROXY v2 request with truncated source/destination address data.
ChakraCore Memory Corruption Vulnerability
Advisory: GHSA-5rq3-9wc9-m9c3
Aliases: CVE-2019-0829
Published: 2022-05-13T01:21:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806, CVE-2019-0810, CVE-2019-0812, CVE-2019-0860, CVE-2019-0861.
Pimcore XSS Vulnerability
Advisory: GHSA-65p8-5423-fw3x
Aliases: CVE-2019-18656
Published: 2022-05-24T17:00:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Pimcore 6prior to 6.3.0 has XSS in the translations grid because `bundles/AdminBundle/Resources/public/js/pimcore/settings/translations.js` mishandles certain HTML elements.
Jenkins Sonar Quality Gates Plugin transmits credentials in plain text during configuration
Advisory: GHSA-6fh3-xhwg-7hfh
Aliases: CVE-2020-2150
Published: 2022-05-24T17:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Sonar Quality Gates Plugin stores credentials in its global configuration file `org.quality.gates.jenkins.plugin.GlobalConfig.xml` on the Jenkins controller as part of its configuration. While the credentials are stored encrypted on disk, they are transmitted in plain text as part of the configuration form by Sonar Quality Gates Plugin 1.3.1 and earlier. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.
Zend Framework Allows SQL Injection
Advisory: GHSA-p9hp-3gpv-52w3
Aliases: CVE-2016-6233
Published: 2022-05-14T02:19:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework before 1.12.19 might allow remote attackers to conduct SQL injection attacks via vectors related to use of the character pattern `[\w]*` in a regular expression.
ChakraCore RCE Vulnerability
Advisory: GHSA-3c78-m682-8wp9
Aliases: CVE-2017-11796
Published: 2022-05-17T00:32:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
OpenSymphony XWork vulnerable to improper input validation
Advisory: GHSA-h7mf-qrm9-2848
Aliases: CVE-2007-4556
Published: 2022-05-01T18:24:47Z

XWork is an command-pattern framework that is used to power WebWork as well as other applications. Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character. 

Note: Version 2.0.4 marks the change from `opensymphony:xwork` to `com.opensymphony:xwork`.
Apache OpenMeetings displays Tomcat version and detailed error stack trace
Advisory: GHSA-4v67-wg88-37p9
Aliases: CVE-2017-7683
Published: 2022-05-17T02:28:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Apache OpenMeetings 1.0.0 displays Tomcat version and detailed error stack trace, which is not secure. The issue is fixed in version 3.3.0.
Jenkins GitHub Pull Request Builder Plugin credential capture vulnerability
Advisory: GHSA-92rv-mvmj-47qh
Aliases: CVE-2018-1000186
Published: 2022-05-14T03:13:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

A exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin 1.41.0 and older in GhprbGitHubAuth.java that allows attackers with Overall/Read access to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. Additionally, these form validation methods did not require POST requests, resulting in a CSRF vulnerability. As of version 1.42.0, these form validation methods require POST requests and Overall/Administer permissions.
Stored XSS vulnerability in Jenkins FindBugs Plugin
Advisory: GHSA-24g8-35x9-fv8r
Aliases: CVE-2020-2317
Published: 2022-05-24T17:33:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins FindBugs Plugin 5.0.0 and earlier does not escape the annotation message in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide report files to Jenkins FindBugs Plugin's post build step.
Exposure of Sensitive Information in Plone
Advisory: GHSA-wprr-mc54-c62q
Aliases: CVE-2012-5508
Published: 2022-05-17T04:30:15Z

The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors.  NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG reseeding issue in Zope.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-mf6x-7766-5cg8
Aliases: CVE-2019-7936
Published: 2022-05-24T16:52:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify content block titles to inject malicious javascript.
System Property Disclosure in Apache Tomcat
Advisory: GHSA-2rvf-329f-p99g
Aliases: CVE-2016-6794
Published: 2022-05-13T01:02:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, 6.0.0 to 6.0.45 the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.
Matrix Synapse Authorization Error
Advisory: GHSA-ch5v-fhg8-7gv9
Aliases: CVE-2018-12423
Published: 2022-05-13T01:49:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In Synapse before 0.31.2, unauthorised users can hijack rooms when there is no `m.room.power_levels` event in force.
Duplicate Advisory: Kerberos for NodeJS allows DLL Injection
Advisory: GHSA-f478-xwv9-p93q
Published: 2022-05-24T17:18:00Z
Withdrawn: 2023-08-21T19:55:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m2mx-rfpw-jghv. This link is maintained to preserve external references.

## Original Description
The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerberos_sspi LoadLibrary() method, because of a DLL path search.
Magento 2 Community Edition Cross-site Scripting Vulnerability
Advisory: GHSA-gg96-8w9x-7rx9
Aliases: CVE-2019-7921
Published: 2022-05-24T16:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the product catalog form of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the product catalog to inject malicious javascript.
Urllib3 Incorrect Certificate Validation
Advisory: GHSA-v4w5-p2hg-8fh6
Aliases: CVE-2016-9015
Published: 2022-05-17T03:05:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
Cross-site Scripting in RabbitMQ
Advisory: GHSA-9pf7-f47q-mwpq
Aliases: CVE-2019-11291
Published: 2022-05-24T17:01:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Pivotal RabbitMQ, 3.7 versions prior to v3.7.20 and 3.8 version prior to v3.8.1, and RabbitMQ for PCF, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain two endpoints, federation and shovel, which do not properly sanitize user input. A remote authenticated malicious user with administrative access could craft a cross site scripting attack via the vhost or node name fields that could grant access to virtual hosts and policy management information.
OMERO-web Sensitive Data Exposure
Advisory: GHSA-vwxv-frj6-fhc9
Aliases: CVE-2020-7932
Published: 2022-05-24T17:20:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

OMERO.web before 5.6.3 optionally allows sensitive data elements (e.g., a session key) to be passed as URL query parameters. If an attacker tricks a user into clicking a malicious link in OMERO.web, the information in the query parameters may be exposed in the Referer header seen by the target. Information in the URL path such as object IDs may also be exposed.
Several Zend Products Vulnerable to XXE and XEE attacks
Advisory: GHSA-gp39-h9c2-qw79
Aliases: CVE-2014-2682
Published: 2022-05-14T00:56:24Z

Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5657.
Apache Drill vulnerable to Cross-site Scripting
Advisory: GHSA-xp4g-5xj6-6vpr
Aliases: CVE-2017-12630
Published: 2022-05-14T03:53:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Apache Drill 1.11.0 and earlier, when submitting form from Query page, users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.
ThinkPHP SQLi Vulnerability
Advisory: GHSA-78q9-24gv-g288
Aliases: CVE-2018-18529
Published: 2022-05-14T01:53:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ThinkPHP 3.2.4 has SQL Injection via the count parameter because the `Library/Think/Db/Driver/Mysql.class.php` `parseKey` function mishandles the key variable. NOTE: a backquote character is not required in the attack URI.
Jenkins Git Changelog Plugin has Insufficiently Protected Credentials
Advisory: GHSA-h27g-72mh-9m33
Aliases: CVE-2019-10414
Published: 2022-05-24T16:56:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Git Changelog Plugin stored MediaWiki and Jira passwords unencrypted in job `config.xml` files on the Jenkins controller. These passwords could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Git Changelog Plugin now stores these passwords encrypted. Existing jobs need to have their configuration saved for existing plain text passwords to be overwritten.
HashiCorp Consul Cross-site Scripting vulnerability
Advisory: GHSA-8xmx-h8rq-h94j
Aliases: CVE-2020-25864
Published: 2022-05-24T17:48:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
Magento 2 Community Edition RCE Vulnerability via CSRF
Advisory: GHSA-x72m-p4qc-p7rv
Aliases: CVE-2019-8109
Published: 2022-05-24T17:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft a malicious CSRF payload that can result in arbitrary command execution.
Umbraco CMS vulnerable to CSRF
Advisory: GHSA-5f6p-4hxq-rjxm
Aliases: CVE-2015-8814
Published: 2022-05-17T02:56:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Umbraco before 7.4.0 allows remote attackers to bypass anti-forgery security measures and conduct cross-site request forgery (CSRF) attacks as demonstrated by editing user account information in the `templates.asmx.cs` file.
Centreon RCE Vulnerability
Advisory: GHSA-c8qc-cp8v-prpx
Aliases: CVE-2018-11587
Published: 2022-05-14T03:02:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.
Stored XSS vulnerability in Jenkins on new item page
Advisory: GHSA-mj7q-cmf3-mg7h
Aliases: CVE-2021-21611
Published: 2022-05-24T17:39:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.274 and earlier, LTS 2.263.1 and earlier does not escape display names and IDs of item types shown on the New Item page.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to specify display names or IDs of item types.

As of the publication of this advisory, the Jenkins security team is not aware of any plugins published via the Jenkins project update center that allow doing this.\n\nJenkins 2.275, LTS 2.263.2 escapes display names and IDs of item types shown on the New Item page.
Passwords stored in plain text by Jenkins Jabber (XMPP) notifier and control Plugin
Advisory: GHSA-79r5-rhrw-7pvh
Aliases: CVE-2021-21634
Published: 2022-05-24T17:45:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jabber (XMPP) notifier and control Plugin 1.41 and earlier stores passwords unencrypted in its global configuration file `hudson.plugins.jabber.im.transport.JabberPublisher.xml` on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.

Jabber (XMPP) notifier and control Plugin 1.42 stores passwords encrypted once its configuration is saved again.
Magento 2 Community Edition Cross-site Scripting Vulnerability
Advisory: GHSA-8578-mmf4-f327
Aliases: CVE-2019-7873
Published: 2022-05-24T16:52:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule.
Improper Authentication in Jenkins
Advisory: GHSA-r57f-7xw3-q2r9
Aliases: CVE-2017-1000354
Published: 2022-05-14T03:44:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to a login command which allowed impersonating any Jenkins user. The `login` command available in the remoting-based CLI stored the encrypted user name of the successfully authenticated user in a cache file used to authenticate further commands. Users with sufficient permission to create secrets in Jenkins, and download their encrypted values (e.g. with Job/Configure permission), were able to impersonate any other Jenkins user on the same instance.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-hg6g-jj7g-x6v2
Aliases: CVE-2019-10401
Published: 2022-05-24T22:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:expandableTextBox form control interpreted its content as HTML when expanded, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).
slixmpp Incorrect Access Control
Advisory: GHSA-4g62-mfwx-4q48
Aliases: CVE-2019-1000021
Published: 2022-05-13T01:21:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin (Persistent Storage of Private Data via PubSub) options profile, used for the configuration of default access model that can result in all of the contacts of the victim can see private data having been published to a PEP node. This attack appears to be exploitable if the user of this library publishes any private data on PEP, the node isn't configured to be private. This vulnerability appears to have been fixed in commit 7cd73b594e8122dddf847953fcfc85ab4d316416 which is included in slixmpp 1.4.2.
Denial of Service in Apache POI
Advisory: GHSA-jqx5-h2hw-5q4f
Aliases: CVE-2012-0213
Published: 2022-05-04T00:28:50Z

The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
Arbitrary file write vulnerability in Storable Configs Plugin
Advisory: GHSA-qv6q-4jwx-7j5c
Aliases: CVE-2020-2278
Published: 2022-05-24T17:28:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Jenkins Storable Configs Plugin 1.0 and earlier does not restrict the user-specified file name, allowing attackers with Job/Configure permission to replace any other '.xml' file on the Jenkins controller with a job config.xml file's content.
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
Advisory: GHSA-237q-6hjp-pchq
Aliases: CVE-2014-3655
Published: 2022-05-17T19:57:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

JBoss KeyCloak is vulnerable to soft token deletion via CSRF. This issue is fixed in Keycloak 1.0.2.Final.
Keycloak Authentication Error
Advisory: GHSA-xvv8-8wh9-9fh2
Aliases: CVE-2018-10894
Published: 2022-05-13T01:34:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
Typo3 Backend XSS Vulnerabilities
Advisory: GHSA-7wwr-p84q-qr3q
Aliases: CVE-2012-1606
Published: 2022-05-17T05:23:54Z

Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors.
Reflected XSS vulnerability in Jenkins gitlab-hook Plugin
Advisory: GHSA-8696-836p-c8qp
Aliases: CVE-2020-2096
Published: 2022-05-24T17:06:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the `build_now` endpoint, resulting in a reflected XSS vulnerability.
Extbase for TYPO3 allows RCE
Advisory: GHSA-jxg5-35fj-ccwf
Aliases: CVE-2016-5091
Published: 2022-05-17T03:02:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
Django Cross-site scripting (XSS) vulnerability via is_safe_url function 
Advisory: GHSA-9cwg-mhxf-hh59
Aliases: CVE-2013-6044
Published: 2022-05-17T00:23:23Z

The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.
Weblate user account enumeration via reset password form
Advisory: GHSA-j24g-gm76-j829
Aliases: CVE-2017-5537
Published: 2022-05-17T02:54:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with an account, which allows remote attackers to enumerate user accounts via a series of requests.
Improper Authentication in Jenkins Active Directory Plugin
Advisory: GHSA-rf92-3vjr-w628
Aliases: CVE-2020-2299
Published: 2022-05-24T17:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jenkins Active Directory Plugin implements two separate modes: Integration with ADSI on Windows, and an OS agnostic LDAP-based mode.

The LDAP-based mode in Active Directory Plugin starting in version 1.44 and prior to versions 2.16.1 and 2.20 shares code between user lookup and user authentication and distinguishes these behaviors through the use of a magic constant used in place of a real password. This allows attackers to log in as any user if the magic constant is used as the password in Active Directory Plugin prior to 2.16.1 and 220.

Active Directory Plugin 2.16.1 and 2.20 no longer uses a magic constant to distinguish between user lookup and user authentication.
Jenkins Bitbucket OAuth Plugin contains Insufficiently Protected Credentials
Advisory: GHSA-84h6-jf8x-ff2j
Aliases: CVE-2019-10460
Published: 2022-05-24T16:59:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Bitbucket OAuth Plugin prior to 0.10 stores credentials unencrypted in the global config.xml configuration file on the Jenkins master where they could be viewed by users with access to the master file system.
Jenkins Reverse Proxy Auth Plugin allows attackers with local file system access to obtain a list of authorities for logged in users
Advisory: GHSA-m9j2-grqf-fg26
Aliases: CVE-2018-1000150
Published: 2022-05-14T03:23:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users. Reverse Proxy Auth Plugin 1.6.0 and newer no longer store the cache of granted authorities on disk.
baserCMS Access Control Bypass 
Advisory: GHSA-33fq-qm4m-cjw3
Aliases: CVE-2018-0573
Published: 2022-05-13T01:48:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

baserCMS (baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions) allows remote attackers to bypass access restriction for a content to view a file which is uploaded by a site user via unspecified vectors.
Apache Syncope uses a weak PNRG
Advisory: GHSA-4c72-mrhf-23cg
Aliases: CVE-2014-3503
Published: 2022-05-14T02:52:41Z

Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.
Missing validation causes denial of service via `StagePeek`
Advisory: GHSA-h48f-q7rw-hvr7
Aliases: CVE-2022-29195
Published: 2022-05-24T22:07:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.StagePeek`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/stage_op.cc#L261) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

index = tf.constant([], shape=[0], dtype=tf.int32)
tf.raw_ops.StagePeek(index=index, dtypes=[tf.int32])
```
  
The code assumes `index` is a scalar but there is no validation for this before accessing its value:
  
```cc
std::size_t index = ctx->input(0).scalar<int>()();
``` 

### Patches
We have patched the issue in GitHub commit [cebe3c45d76357d201c65bdbbf0dbe6e8a63bbdb](https://github.com/tensorflow/tensorflow/commit/cebe3c45d76357d201c65bdbbf0dbe6e8a63bbdb).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Moodle contains CSRF vulnerability
Advisory: GHSA-3jrj-x6cj-97cp
Aliases: CVE-2021-43559
Published: 2022-05-24T19:21:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. The "delete related badge" functionality did not include the necessary token check to prevent a CSRF risk.
Stored Cross-site Scripting vulnerabilities in Jenkins promoted Builds (Simple) plugin providing additional parameter types
Advisory: GHSA-7j66-wvhr-m83x
Aliases: CVE-2022-30965
Published: 2022-05-18T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Promoted Builds (Simple) Plugin 1.9 and earlier does not escape the name and description of Promotion Level parameters on views displaying parameters. This results in stored cross-site scripting (XSS) vulnerabilities exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
phpMyAdmin Open Redirect
Advisory: GHSA-5h5m-fj48-qpjw
Aliases: CVE-2017-1000013
Published: 2022-05-14T01:19:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to an open redirect weakness
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-jxp3-mmw7-8285
Aliases: CVE-2019-7897
Published: 2022-05-24T16:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to customer configurations to inject malicious javascript.
Undertow vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-vjxc-frw4-jmh5
Aliases: CVE-2019-14888
Published: 2022-05-24T17:07:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was found in the Undertow HTTP server in versions before 2.0.29 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
Shopware SQL Injection
Advisory: GHSA-42gv-77f4-r3j9
Aliases: CVE-2018-20713
Published: 2022-05-14T01:39:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Shopware before 5.4.3 allows SQL Injection by remote authenticated users, aka SW-21404.
Improper Restriction of XML External Entity Reference in Apace Derby
Advisory: GHSA-wr69-g62g-2r9h
Aliases: CVE-2015-1832
Published: 2022-05-13T01:14:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in place, allows context-dependent attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving XmlVTI and the XML datatype.
ChakraCore RCE Vulnerability
Advisory: GHSA-hfhr-xxxq-vg7g
Aliases: CVE-2018-8542
Published: 2022-05-13T01:20:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8541, CVE-2018-8543, CVE-2018-8551, CVE-2018-8555, CVE-2018-8556, CVE-2018-8557, CVE-2018-8588.
Apache Tomcat SendMailServlet XSS
Advisory: GHSA-wjwr-3jch-479j
Aliases: CVE-2007-3383
Published: 2022-05-01T18:13:14Z

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (`examples/jsp/mail/sendmail.jsp`) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
Improper Input Validation in Apache CXF
Advisory: GHSA-v8q2-94f6-6xq2
Aliases: CVE-2010-2076
Published: 2022-05-13T01:09:23Z

Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
Chakra Scripting Engine and ChakraCore Vulnerable to Memory Corruption
Advisory: GHSA-jgrp-6qqq-3284
Aliases: CVE-2021-42279
Published: 2022-05-24T19:20:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Chakra Scripting Engine and ChakraCore are vulnerable to memory corruption due to an out-of-bounds write. The Microsoft advisory for CVE-2021-42279 was modified in August 2022 to include Microsoft.ChakraCore as an affected product.
Moodle Vulnerable to Reflected Cross-site Scripting
Advisory: GHSA-xhfx-rm8q-c3xv
Aliases: CVE-2021-20183
Published: 2022-05-24T17:40:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

It was found in Moodle before version 4.0.0-beta that some search inputs were vulnerable to reflected Cross-site Scripting (XSS) due to insufficient escaping of search queries.