aswin1906/github-advisory-2022 huggingface dataset:
Code injection in Apache Dubbo
Advisory: GHSA-7wfc-x4f7-gg2x
Aliases: CVE-2021-30180
Published: 2022-03-18T17:58:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Dubbo prior to 2.7.9 support Tag routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers may enable calling arbitrary constructors.
Cross-site Scripting in Nacos
Advisory: GHSA-4gr7-qw2q-jxh6
Aliases: CVE-2021-44667
Published: 2022-03-12T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo parameters.
Improper Restriction of XML External Entity Reference in Liquibase
Advisory: GHSA-jvfv-hrrc-6q72
Aliases: CVE-2022-0839
Published: 2022-03-05T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The XMLChangeLogSAXParser() function in Liquibase prior to version 4.8.0 contains an issue that may lead to to Improper Restriction of XML External Entity Reference.
Missing Authentication for Critical Function in Foreman Ansible
Advisory: GHSA-vvff-6wrr-4g7q
Aliases: CVE-2021-3589
Published: 2022-03-24T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

An authorization flaw was found in Foreman Ansible. An authenticated attacker with certain permissions to create and run Ansible jobs can access hosts through job templates. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Command injection in Parse Server through prototype pollution
Advisory: GHSA-p6h4-93qp-jhcm
Aliases: CVE-2022-24760
Published: 2022-03-11T23:53:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

### Impact
This is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js`, so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows.

### Patches
Upgrade to Parse Server >=4.10.7. If you are using a prerelease version of Parse Server 5.0 (alpha, beta) we will publish a timely fix for these. However, as a general reminder we do not consider prerelease versions to be suitable for production deployment.

Note that as part of the fix a new security feature scans for sensitive keywords in request data to prevent JavaScript prototype pollution. If such a keyword is found, the request is rejected with HTTP response code `400` and Parse Error `105` (`INVALID_KEY_NAME`). By default these keywords are: `{_bsontype: "Code"}`, `constructor`, `__proto__`. If you are using any of these keywords in your request data, you can override the default keywords by setting the new Parse Server option `requestKeywordDenylist` to `[]` and specify your own keywords as needed.

### Workarounds
Although the fix is more broad and includes several aspects of the vulnerability, a quick and targeted fix can be achieved by patching the MongoDB Node.js driver and disable BSON code execution. To apply the patch, add the following code to be executed before starting Parse Server, for example in `index.js`.

```
const BSON = require('bson');
 const internalDeserialize = BSON.prototype.deserialize;
 BSON.prototype.deserialize = (buffer, options = Object.create(null), ...others) => {
   if (options.constructor) {
     options = Object.assign(Object.create(null), options);
   }
   return internalDeserialize(buffer, options, ...others);
 };
 const internalDeserializeStream = BSON.prototype.deserializeStream;
 BSON.prototype.deserializeStream = (
   data,
   startIndex,
   numberOfDocuments,
   documents,
   docStartIndex,
   options = Object.create(null),
   ...others
 ) => {
   if (options.constructor) {
     options = Object.assign(Object.create(null), options);
   }
   return internalDeserializeStream(
     data,
     startIndex,
     numberOfDocuments,
     documents,
     docStartIndex,
     options,
     ...others
   );
 };
```

### References
- Original report on [huntr.dev](https://www.huntr.dev/bounties/ac24b343-e7da-4bc7-ab38-4f4f5cc9d099/)
Withdrawn: Cross-site Scripting in Kibana
Advisory: GHSA-m6gg-86c6-gfr9
Aliases: CVE-2022-23710
Published: 2022-03-04T00:00:15Z
Withdrawn: 2023-03-15T19:19:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

##Withdrawn: This advisory is for Kibana, not ElasticSearch as it was originally published, and is withdrawn as being out of scope of our supported ecosystems.

A cross-site-scripting (XSS) vulnerability was discovered in the Data Preview Pane (previously known as Index Pattern Preview Pane) which could allow arbitrary JavaScript to be executed in a victim's browser.
Remote CLI Command Execution Vulnerability in CodeIgniter4
Advisory: GHSA-xjp4-6w75-qrj7
Aliases: CVE-2022-24711
Published: 2022-03-01T21:44:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

### Impact
This vulnerability allows attackers to execute CLI routes via HTTP request.

### Patches
Upgrade to v4.1.9 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Firebase PHP-JWT key/algorithm type confusion
Advisory: GHSA-8xf4-w7qw-pjjw
Aliases: CVE-2021-46743
Published: 2022-03-30T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

In Firebase PHP-JWT before 6.0.0, an algorithm-confusion issue (e.g., RS256 / HS256) exists via the kid (aka Key ID) header, when multiple types of keys are loaded in a key ring. This allows an attacker to forge tokens that validate under the incorrect key. NOTE: this provides a straightforward way to use the PHP-JWT library unsafely, but might not be considered a vulnerability in the library itself.
Unrestricted XML files leading to cross-site scripting in Microweber
Advisory: GHSA-q3x2-jvp3-wj78
Aliases: CVE-2022-0963
Published: 2022-03-16T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Microweber prior to 1.2.12 allows unrestricted upload of XML files, which malicious actors can exploit to cause a stored cross-site scripting attack.
Path traversal in github.com/valyala/fasthttp
Advisory: GHSA-fx95-883v-4q4h
Aliases: CVE-2022-21221
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The package github.com/valyala/fasthttp before 1.34.0 is vulnerable to Directory Traversal via the ServeFile function, due to improper sanitization. It is possible to be exploited by using a backslash %5c character in the path. **Note:** This security issue impacts Windows users only.
Stored Cross-site Scripting vulnerability in Jenkins Tests Selector Plugin
Advisory: GHSA-q787-qgw2-j2qf
Aliases: CVE-2022-28159
Published: 2022-03-30T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Tests Selector Plugin 1.3.3 and earlier does not escape the Properties File Path option for Choosing Tests parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Cross-site Scripting in teampass
Advisory: GHSA-m2wv-m5pf-284r
Aliases: CVE-2022-26980
Published: 2022-03-29T00:01:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO. Someone must open a link for the Teampass Password Manager index page containing malicious payload.
Code injection in Stripe CLI on windows
Advisory: GHSA-4cx6-fj7j-pjx9
Aliases: CVE-2022-24753
Published: 2022-03-10T18:17:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

### Impact
A vulnerability in Stripe CLI exists on Windows when certain commands are run in a directory where an attacker has planted files. The commands are `stripe login`, `stripe config -e`, `stripe community`, and `stripe open`. MacOS and Linux are unaffected.

An attacker who successfully exploits the vulnerability can run arbitrary code in the context of the current user. The update addresses the vulnerability by throwing an error in these situations before the code can run.

There has been no evidence of exploitation of this vulnerability.

### Recommendation
Upgrade to Stripe CLI v1.7.13.

### Acknowledgments
Thanks to [trungpabc](https://hackerone.com/trungpabc) for reporting the issue.

### For more information
Email us at [security@stripe.com](mailto:security@stripe.com).
Missing permission check in Jenkins RocketChat Notifier Plugin
Advisory: GHSA-4p8f-2fwv-6xcw
Aliases: CVE-2022-28139
Published: 2022-03-30T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

RocketChat Notifier Plugin 1.4.10 and earlier does not perform a permission check in a method implementing form validation.  
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password.
Cross-site Scripting in ShowDoc
Advisory: GHSA-wg4r-q74r-p7c8
Aliases: CVE-2022-0941
Published: 2022-03-15T00:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Sandbox escape in notevil and argencoders-notevil
Advisory: GHSA-8g4m-cjm2-96wq
Aliases: CVE-2021-23771
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878). This package has been deprecated.
Exposure of Resource to Wrong Sphere in ThinkPHP Framework
Advisory: GHSA-69wp-xwm7-69wm
Aliases: CVE-2022-25481
Published: 2022-03-22T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters from index.php.
Server-Side Request Forgery in FUXA
Advisory: GHSA-9vp3-7qwq-83r9
Aliases: CVE-2021-45851
Published: 2022-03-17T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
Stored Cross-site Scripting in folder-auth plugin
Advisory: GHSA-5vjc-qx43-r747
Published: 2022-03-18T23:57:52Z

Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.

Folder-based Authorization Strategy Plugin 1.4 escapes the names of roles shown on the configuration form.

See https://www.jenkins.io/security/advisory/2022-03-15/#SECURITY-2646
Exposure of Sensitive information in httpie
Advisory: GHSA-6pc9-xqrg-wfqw
Aliases: CVE-2022-0430
Published: 2022-03-16T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N

httpie is a modern, user-friendly command-line HTTP client for the API era. Prior to version 3.1.0, all cookies saved to session storage are supercookies. At this time, there is no known workaround. Users are recommended to update to version 3.1.0.
Ansible discloses sensitive information in traceback error message
Advisory: GHSA-4r65-35qq-ch8j
Aliases: CVE-2021-3620
Published: 2022-03-04T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Ansible is an IT automation system that handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. A flaw was found in Ansible Engine's ansible-connection module where sensitive information, such as the Ansible user credentials, is disclosed by default in the traceback error message when Ansible receives an unexpected response from `set_options`. The highest threat from this vulnerability is confidentiality.
Incorrect Access Control in ImpressCMS
Advisory: GHSA-48p3-xfvw-g59c
Aliases: CVE-2021-26598
Published: 2022-03-29T00:01:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

ImpressCMS before 1.4.3 has Incorrect Access Control because include/findusers.php allows access by unauthenticated attackers (who are, by design, able to have a security token).
Sysctls applied to containers with host IPC or host network namespaces can affect the host
Advisory: GHSA-w2j5-3rcx-vx7x
Published: 2022-03-15T20:02:54Z

### Impact
Before setting the sysctls for a pod, the pods namespaces must be unshared (created). However, in cases where the pod is using a host network or IPC namespace, a bug in CRI-O caused the namespace creating tool [pinns](https://github.com/cri-o/cri-o/tree/main/pinns/) to configure the sysctls of the host. This allows a malicious user to set sysctls on the host, assuming they have access to hostNetwork and hostIPC.

Any CRI-O cluster after CRI-O 1.18 that drops the infra container
1.22 and 1.23 clusters drop infra container by default, and are thus vulnerable by default.

### Patches
CRI-O versions 1.24.0, 1.23.1, 1.22.2, 1.21.5, 1.20.6, 1.19.5 all have the patches.

### Workarounds
Users can set `manage_ns_lifecycle` to false, which causes the sysctls to be configured by the OCI runtime, which typically filter these cases. This option is available in 1.20 and 1.19. Newer versions don't have this option.
An admission webhook could also be created to deny pods that use host IPC or network namespaces and also attempt to configure sysctls related to that namespace.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CRI-O repo](http://github.com/cri-o/cri-o/issues)
* To make a report, email your vulnerability to the private
[cncf-crio-security@lists.cncf.io](mailto:cncf-crio-security@lists.cncf.io) list
with the security details and the details expected for [all CRI-O bug
reports](https://github.com/cri-o/cri-o/blob/main/.github/ISSUE_TEMPLATE/bug-report.yml).
Cross-site Scripting in showdoc/showdoc
Advisory: GHSA-rphc-h572-2x9f
Aliases: CVE-2022-0960
Published: 2022-03-15T00:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

ShowDoc is a tool greatly applicable for an IT team to share documents online. showdoc/showdoc allows .properties files to upload which lead to stored XSS in versions prior to 2.10.4. This allows attackers to execute malicious scripts in the user's browser. This issue was patched in version 2.10.4. There is currently no known workaround.
Spoofing attack in swagger-ui
Advisory: GHSA-cr3q-pqgq-m8c2
Aliases: CVE-2018-25031
Published: 2022-03-12T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
Denial of service in microweber
Advisory: GHSA-hrf4-hcpc-3345
Aliases: CVE-2022-0961
Published: 2022-03-16T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The post title input can be limited to 500 characters or max 1000 characters as a workaround.
Uncontrolled Resource Consumption in Apache DolphinScheduler
Advisory: GHSA-qg5x-66hp-cw5p
Aliases: CVE-2022-25598
Published: 2022-03-31T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.
Improper Restriction of XML External Entity Reference in trytond and proteus
Advisory: GHSA-cj78-rgw3-4h5p
Aliases: CVE-2022-26661
Published: 2022-03-11T00:02:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and 6.2.x through 6.2.1. An authenticated user can make the server parse a crafted XML SEPA file to access arbitrary files on the system.
Rate limit missing in microweber
Advisory: GHSA-7r79-mrp6-8mhq
Aliases: CVE-2022-0777
Published: 2022-03-02T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Microweber prior to version 1.3 does not rate limit password reset emails.
Unrestricted Upload of File with Dangerous Type in Microweber
Advisory: GHSA-j878-43hm-8gr5
Aliases: CVE-2022-0921
Published: 2022-03-12T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

In Microweber prior to 1.2.12, a malicious actor may abuse the Backup/Restore feature to achieve Remote Code Execution.
Spoofing attack in swagger-ui-dist
Advisory: GHSA-6c9x-mj3g-h47x
Aliases: CVE-2021-46708
Published: 2022-03-12T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim.
Open Redirect in CPython that affects users of OpenStack Nova
Advisory: GHSA-vqp6-j452-j6wp
Aliases: CVE-2021-3654
Published: 2022-03-04T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability was found in CPython which is used by openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Forwarding of confidentials headers to third parties in fluture-node
Advisory: GHSA-32x6-qvw6-mxj4
Aliases: CVE-2022-24719
Published: 2022-03-01T22:14:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

### Impact

Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing.

### Patches

The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin.

### Workarounds

Use a custom redirection strategy via the `followRedirectsWith` function. The custom strategy can be based on the new strategies available in fluture-node@4.0.2.

### References

- This vulnerability was discovered after the announcement of similar vulnerabilities in the `follow-redirects` package. There is more information there: https://github.com/advisories/GHSA-74fj-2j2h-c42q and https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db/
- Fixed in 125e4474f910c1507f8ec3232848626fbc0f55c4 and 0c99bc511533d48be17dc6bfe641f7d0aeb34d77
Missing permission checks in Jenkins kubernetes-cd Plugin allow enumerating credentials IDs
Advisory: GHSA-23x5-j68g-6jpw
Aliases: CVE-2022-27209
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

kubernetes-cd Plugin 2.3.1 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
Cross-site Scripting in ShowDoc
Advisory: GHSA-pccm-j6vj-jwwf
Aliases: CVE-2022-0962
Published: 2022-03-15T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.webma` file upload.
Path traversal in org.postgresql:postgresql
Advisory: GHSA-727h-hrw8-jg8q
Aliases: CVE-2022-26520
Published: 2022-03-11T00:02:02Z

In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the loggerFile and loggerLevel connection properties. An example situation is that an attacker could create an executable JSP file under a Tomcat web root. NOTE: the vendor's position is that there is no pgjdbc vulnerability; instead, it is a vulnerability for any application to use the pgjdbc driver with untrusted connection properties.
Old sessions not blocked by login enable function in Snipe-IT
Advisory: GHSA-636j-7x7r-gvw2
Aliases: CVE-2022-1155
Published: 2022-03-31T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using the KillAllSessions console command, clearing the contents of the storage/framework/sessions directory, or changing the cookie name, but all of those options logout ALL users, which could be kind of annoying. This issue is fixed in versions 6.0.0-RC-6 and 5.4.2.
Server-Side Request Forgery in calibreweb
Advisory: GHSA-h65g-jfqg-2w6m
Aliases: CVE-2022-0767
Published: 2022-03-08T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is a result of incomplete SSRF protection that can be bypassed via an HTTP redirect. An HTTP server set up to respond with a 302 redirect may redirect a request to `localhost`.
Cross-site Scripting in ShowDoc
Advisory: GHSA-q73m-3q7r-fpf7
Aliases: CVE-2022-0957
Published: 2022-03-16T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Improper Certificate Validation in OWASP ZAP
Advisory: GHSA-j7xg-5549-jr3j
Aliases: CVE-2022-27820
Published: 2022-03-25T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.
XML External Entity Reference in Jenkins Coverage/Complexity Scatter Plot Plugin
Advisory: GHSA-8rx6-v5q4-xw3j
Aliases: CVE-2022-28154
Published: 2022-03-30T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Jenkins Coverage/Complexity Scatter Plot Plugin 1.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Path traversal vulnerability on Windows in Jenkins Continuous Integration with Toad Edge Plugin
Advisory: GHSA-mc92-c859-jr66
Aliases: CVE-2022-28148
Published: 2022-03-30T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The file browser in Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier may interpret some paths to files as absolute on Windows, resulting in a path traversal vulnerability allowing attackers with Item/Read permission to obtain the contents of arbitrary files on Windows controllers.
Stored Cross-site Scripting vulnerability in Jenkins Environment Dashboard Plugin
Advisory: GHSA-35h9-h439-vvmr
Aliases: CVE-2022-27213
Published: 2022-03-16T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Environment Dashboard Plugin 1.1.10 and earlier does not escape the Environment order and the Component order configuration values in its views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
SQLinjection in falcon-plus
Advisory: GHSA-76j4-gggq-7rg9
Aliases: CVE-2022-26245
Published: 2022-03-28T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Falcon-plus v0.3 was discovered to contain a SQL injection vulnerability via the parameter grpName in /config/service/host.go.
Stored Cross-site Scripting in Microweber
Advisory: GHSA-8c76-mxv5-w4g8
Aliases: CVE-2022-0954
Published: 2022-03-16T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Microweber 1.2.11 and prior contains multiple stored cross-site scripting vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods.
Cross-site Scripting in Pimcore
Advisory: GHSA-q67f-3jq4-mww2
Aliases: CVE-2022-0831
Published: 2022-03-05T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.
SQL Injection in WordPress Zero Spam WordPress plugin
Advisory: GHSA-pq2f-3fg3-rw99
Aliases: CVE-2022-0254
Published: 2022-03-15T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The WordPress Zero Spam WordPress plugin before 5.2.13 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Cross-site Scripting in Cipi
Advisory: GHSA-vpmw-77vm-4mjg
Aliases: CVE-2022-26332
Published: 2022-03-02T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cipi 3.1.15 allows Add Server stored cross-site scripting via the /api/servers name field.
Cross-site Scripting in ShowDoc
Advisory: GHSA-qq74-vgcf-54c3
Aliases: CVE-2022-0946
Published: 2022-03-15T00:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc is vulnerable to stored cross-site scripting via viva cshtm file upload in in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Sandbox bypass leading to arbitrary code execution in Deno
Advisory: GHSA-838h-jqp6-cf2f
Aliases: CVE-2022-24783
Published: 2022-03-29T22:10:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

### Impact

The versions of Deno between release 1.18.0 and 1.20.2 (inclusive) are vulnerable to an attack where a malicious actor controlling the code executed in a Deno runtime could bypass permission checks and execute arbitrary shell code.

There is **no** evidence that this vulnerability has been exploited in the wild.

This vulnerability does **not** affect users of Deno Deploy.

### Patches

The vulnerability has been patched in Deno 1.20.3.

### Workarounds

There is no workaround. All users are recommended to upgrade to 1.20.3 immediately

---

The cause of this error was that certain FFI operations did not correctly check for permissions. The issue was fixed in [this](https://github.com/denoland/deno/pull/14115) pull request.
Missing permission checks in Jekins Bitbucket Server Integration Plugin
Advisory: GHSA-r5r6-v8qh-pmpq
Aliases: CVE-2022-28134
Published: 2022-03-30T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Jenkins Bitbucket Server Integration Plugin 3.1.0 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to create, view, and delete BitBucket Server consumers.
Cross-site Scripting in Pimcore
Advisory: GHSA-pc32-x737-74cv
Aliases: CVE-2022-0704
Published: 2022-03-17T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore 10.3.3 and prior is vulnerable to stored cross-site scripting. A patch is available on the 10.x branch and will likely be part of version 10.4.0.
Cross-site Scripting in BookStack
Advisory: GHSA-5rcc-6cmj-7728
Aliases: CVE-2022-0877
Published: 2022-03-09T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Iframe tags don't have a sandbox attribute, this makes an attacker able to execute malicious javascript via an iframe and perform phishing attacks. The sandbox attribute will block script execution and prevents the content to navigate its top-level browsing context which will stop this type of attack.
Stored Cross-site Scripting vulnerability in Jenkins List Git Branches Parameter Plugin
Advisory: GHSA-7756-56hr-2vcp
Aliases: CVE-2022-27212
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins List Git Branches Parameter Plugin 0.0.9 and earlier does not escape the name of the 'List Git branches (and more)' parameter, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
DQL injection through sorting parameters blocked
Advisory: GHSA-2xmm-g482-4439
Aliases: CVE-2022-24752
Published: 2022-03-15T19:09:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
Values added at the end of query sorting were passed directly to the DB. We don't know, if it could lead to direct SQL injections, however, we should not allow for easy injection of values there anyway.

### Patches
The issue is fixed in version 1.10.1 and in 1.11-rc.1

### Workarounds

You have to overwrite your `Sylius\Component\Grid\Sorting\Sorter.php` class:

```php
<?php

// src/App/Sorting/Sorter.php

declare(strict_types=1);

namespace App\Sorting;

use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
use Sylius\Component\Grid\Data\DataSourceInterface;
use Sylius\Component\Grid\Definition\Grid;
use Sylius\Component\Grid\Parameters;
use Sylius\Component\Grid\Sorting\SorterInterface;

final class Sorter implements SorterInterface
{
    public function sort(DataSourceInterface $dataSource, Grid $grid, Parameters $parameters): void
    {
        $enabledFields = $grid->getFields();
        $expressionBuilder = $dataSource->getExpressionBuilder();

        $sorting = $parameters->get('sorting', $grid->getSorting());
        $this->validateSortingParams($sorting, $enabledFields);

        foreach ($sorting as $field => $order) {
            $this->validateFieldNames($field, $enabledFields);

            $gridField = $grid->getField($field);
            $property = $gridField->getSortable();

            if (null !== $property) {
                $expressionBuilder->addOrderBy($property, $order);
            }
        }
    }

    private function validateSortingParams(array $sorting, array $enabledFields): void
    {
        foreach (array_keys($enabledFields) as $key) {
            if (array_key_exists($key, $sorting) && !in_array($sorting[$key], ['asc', 'desc'])) {
                throw new BadRequestHttpException(sprintf('%s is not valid, use asc or desc instead.', $sorting[$key]));
            }
        }
    }

    private function validateFieldNames(string $fieldName, array $enabledFields): void
    {
        $enabledFieldsNames = array_keys($enabledFields);

        if (!in_array($fieldName, $enabledFieldsNames, true)) {
            throw new BadRequestHttpException(sprintf('%s is not valid field, did you mean one of these: %s?', $fieldName, implode(', ', $enabledFieldsNames)));
        }
    }
}
```
and register it in your container: 

```yaml
# config/services.yaml
services:
    # ...
    sylius.grid.sorter:
        class: App\Sorting\Sorter
```

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Sylius issues](https://github.com/Sylius/Sylius/issues)
* Email us at [security@sylius.com](mailto:security@sylius.com)
Improper regex in htaccess file
Advisory: GHSA-mj6m-246h-9w56
Aliases: CVE-2022-25769
Published: 2022-03-01T22:05:34Z

### Impact
the default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application.

This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path.

### Patches
Please upgrade to 3.3.5 or 4.2.0 

### Workarounds
No

### References

- Release post: https://www.mautic.org/blog/community/mautic-4-2-one-small-step-mautic
- Internally tracked under MST-32

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Server-Side Request Forgery in calibreweb
Advisory: GHSA-2647-c639-qv2j
Aliases: CVE-2022-0766
Published: 2022-03-08T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

calibreweb prior to version 0.6.17 is vulnerable to server-side request forgery (SSRF). This is due to an incomplete fix for [CVE-2022-0339](https://github.com/advisories/GHSA-4w8p-x6g8-fv64). The blacklist does not check for `0.0.0.0`, which would result in a payload of `0.0.0.0` resolving to `localhost`.
Client Secret stored in plain text by Jenkins GitLab Authentication Plugin
Advisory: GHSA-hx3r-qwxv-5jw9
Aliases: CVE-2022-27206
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins GitLab Authentication Plugin 1.13 and earlier stores the GitLab client secret unencrypted in the global `config.xml` file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.

This client secret can be viewed by users with access to the Jenkins controller file system.
XML external entity (XXE) injection in Apache Nutch
Advisory: GHSA-fxhp-wrw9-3r97
Aliases: CVE-2021-23901
Published: 2022-03-18T17:46:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.  This issue is fixed in Apache Nutch 1.18.
Improper Verification of Cryptographic Signature in node-forge
Advisory: GHSA-cfm4-qjh2-4765
Aliases: CVE-2022-24771
Published: 2022-03-18T23:09:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### References

For more information, please see
["Bleichenbacher's RSA signature forgery based on implementation error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/)
by Hal Finney.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
NaN/INF in serverbound movement packets can crash clients and servers
Advisory: GHSA-fm35-jgg3-3grx
Published: 2022-03-18T17:54:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
A malicious client may send a `MovePlayerPacket` to the server whose position or rotation contains NaN or INF. Since neither the server nor vanilla client handles this properly, a number of interesting side effects come into play.

- The server may crash in various ways if this exploit is used, because some mathematical operations on NaN/INF generate PHP warnings, which are converted into exceptions.
- Clients may not be able to see other clients who have a NaN/INF rotation.
- Clients may also crash in such cases.

### Patches
A patch for this was included in the 3.18.1 release: https://github.com/pmmp/PocketMine-MP/commit/fb20bb38327b4c08ee3976640cd0dd547388a638

### Workarounds
Workarounds could be implemented as plugins using `DataPacketReceiveEvent` to block any inbound movement packets containing bogus values.

### For more information
If you have any questions or comments about this advisory:

- Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)
- Email us at [team@pmmp.io](mailto:team@pmmp.io)
Path traversal in Jenkins Phoenix AutoTest Plugin
Advisory: GHSA-6h2c-g688-q9qr
Aliases: CVE-2022-28156
Published: 2022-03-30T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to copy arbitrary files and directories from the Jenkins controller to the agent workspace.
Improper Authorization in org.cometd.oort
Advisory: GHSA-rjmq-6v55-4rjv
Aliases: CVE-2022-24721
Published: 2022-03-15T19:02:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

### Impact
Internal usage of Oort and Seti channels is improperly authorized, so any remote user could subscribe and publish to those channels.
By subscribing to those channels, a remote user may be able to watch cluster-internal traffic that contains other user's (possibly sensitive) data.
By publishing to those channels, a remote user may be able to create/modify/delete other user's data and modify the cluster structure.
The issue impacts any version up to 5.0.10, 6.0.5 and 7.0.5.

### Patches
The issue has been fixed in 5.0.11, 6.0.6 and 7.0.6.

### Workarounds
The workaround is to install a custom `SecurityPolicy` that forbids subscription and publishing to remote, non-Oort, sessions on Oort and Seti channels.
This workaround could be implemented in any affected version.

### References
cometd/cometd#1146

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@webtide.com](mailto:security@webtide.com)

### Credits
https://www.redteam-pentesting.de/
Shopware user session is not logged out if the password is reset via password recovery
Advisory: GHSA-w267-m9c4-8555
Aliases: CVE-2022-24744
Published: 2022-03-10T17:37:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

### Impact
User session is not logged out if the password is reset via password recovery

## Patches
Fixed in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Plaintext storage in Jenkins instant-messaging Plugin
Advisory: GHSA-hpm9-fx8v-w45v
Aliases: CVE-2022-28135
Published: 2022-03-30T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins instant-messaging Plugin 1.41 and earlier stores passwords for group chats unencrypted in the global configuration file of plugins based on Jenkins instant-messaging Plugin on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system.
Static Code Injection in Microweber
Advisory: GHSA-x28w-hvwc-mp75
Aliases: CVE-2022-0895
Published: 2022-03-11T00:02:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H

Microweber is a new generation CMS with drag and drop. Prior to version 1.3, Microweber is vulnerable to static code injection.
Possible filesystem space exhaustion by local users
Advisory: GHSA-chxf-fjcf-7fwp
Published: 2022-03-01T21:04:07Z

`fscrypt` through v0.3.2 creates a world-writable directory by default when setting up a filesystem, allowing unprivileged users to exhaust filesystem space. We recommend upgrading to `fscrypt` v0.3.3 or above and adjusting the permissions on existing `fscrypt` metadata directories where applicable.

For more details, see [CVE-2022-25326](https://www.cve.org/CVERecord?id=CVE-2022-25326) and https://github.com/google/fscrypt#setting-up-fscrypt-on-a-filesystem.
Incorrect Authorization in imgcrypt
Advisory: GHSA-8v99-48m9-c8pm
Aliases: CVE-2022-24778
Published: 2022-03-28T19:33:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Imgcrypt implements a function `CheckAuthorization()` that is supposed to check whether a user is authorized to access an encrypted image given the keys that the user has provided on the command line that would enable decryption of the image. The check is to prevent that a user can start a container from an image that has previously been decrypted by another user on the same system and therefore a decrypted version of the image layers may be already available in the cache locally.

The failure occurs when an image with a ManifestList is used and the architecture of the local host is not the first one in the ManifestList. In the version prior to the fix, only the first architecture in the list was tested, which may not have its layers available locally (were not pulled) since it cannot be run on the host architecture. Therefore, the verdict on unavailable layers was that the image could be run anticipating that image run failure would occur later due to the layers not being available. However, this verdict to allow the image to run lead to other architectures in the ManifestList be able to run an image without providing keys if that image had previously been decrypted. The fixed version now skips over irrelevant architectures and tests the Manifest of the local architecture, if available.

Known projects that use the `CheckAuthorization()` of imgcrypt is for example the ctr-enc client tool provided by imgcrypt. In this implementation, the call to `CheckAuthorization()` is used on the client side and could therefore also be easily circumvented by a modified client tool not calling this function.

In relation to the vulnerability in ctr-enc, affected environments would have to allow different users to invoke ctr-enc indirectly using some sort of management stack that gives user indirect access to ctr-enc.

The patch has been applied to imgcrypt v1.1.4. Workarounds may include usage of different namespaces for each remote user.
Unrestricted Upload of File with Dangerous Type in Gogs
Advisory: GHSA-5gjh-5j4f-cpwv
Aliases: CVE-2022-0415
Published: 2022-03-28T16:46:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

The malicious user is able to upload a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.

### Patches

Repository file uploads are prohibited to its `.git` directory. Users should upgrade to 0.12.6 or the latest 0.13.0+dev.

### Workarounds

[Disable repository files upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L128-L129).

### References

https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902/

### For more information

If you have any questions or comments about this advisory, please post on #6833.
Cross-site Scripting in microweber
Advisory: GHSA-3q55-66g3-p8xq
Aliases: CVE-2022-0926
Published: 2022-03-13T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Improper Authentication in FreeTAKServer
Advisory: GHSA-hggv-mcp4-vxc5
Aliases: CVE-2022-25508
Published: 2022-03-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

FreeTAKServer is an open source, lightweight Server for connect TAK clients. An access control issue in the component /ManageRoute/postRoute of FreeTAKServer version 1.9.8 allows unauthenticated attackers to cause a Denial of Service (DoS) via an unusually large amount of created routes, or create unsafe or false routes for legitimate users. There is currently no known workaround. This issue was fixed in version 1.9.8.5.
Unrestricted Upload of File with Dangerous Type in Zenario CMS
Advisory: GHSA-rgg3-3wh7-w935
Aliases: CVE-2021-42171
Published: 2022-03-15T00:00:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.
Gogs vulnerable to improper PAM authorization handling
Advisory: GHSA-gw5h-h6hj-f56g
Aliases: CVE-2022-0871
Published: 2022-03-14T22:58:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

### Impact

Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.

### Patches

Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. 

### References

https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.
Craft CMS Cross-site Scripting Vulnerability
Advisory: GHSA-h2rj-8wgg-mm43
Aliases: CVE-2021-32470
Published: 2022-03-18T17:53:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Craft CMS before 3.6.13 has an XSS vulnerability.
CSRF vulnerability in Jenkins Release Helper Plugin
Advisory: GHSA-m4x7-44c8-jg2x
Aliases: CVE-2022-27214
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Release Helper Plugin 1.3.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.