aswin1906/github-advisory-2022 huggingface dataset:
Cross-site Scripting in microweber
Advisory: GHSA-jjp3-m93h-5jm4
Aliases: CVE-2022-0928
Published: 2022-03-12T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Microweber drag and drop website builder and CMS with e-commerce. Cross-site Scripting (XSS) discovered in microweber prior to 1.2.12. There is currently no known workaround, users are recommended to update to version 1.2.12.
Duplicate Advisory: Incorrect Authorization in Gerapy
Advisory: GHSA-29vr-79w7-p649
Aliases: CVE-2021-44597
Published: 2022-03-11T00:02:00Z
Withdrawn: 2023-07-31T20:36:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9w7f-m4j4-j3xw. This link is maintained to preserve external references.

## Original Description
An Access Control vunerabiity exists in Gerapy v 0.9.7 via the spider parameter in project_configure function.
Command Injection in CasaOS
Advisory: GHSA-jh63-28gx-7p26
Aliases: CVE-2022-24193
Published: 2022-03-11T00:02:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CasaOS before v0.2.7 was discovered to contain a command injection vulnerability via the component leave or join zerotier api.
Authentication Bypass in keycloak
Advisory: GHSA-m9cj-v55f-8x26
Aliases: CVE-2020-27826
Published: 2022-03-18T17:55:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.
Inconsistent storage layout for ERC2771ContextUpgradeable
Advisory: GHSA-7j52-6fjp-58gr
Published: 2022-03-14T23:22:27Z

### Impact

The storage layout of the ERC2771ContextUpgradeable is not constant between versions. 
- versions `4.0.0`, `4.1.0` and `4.2.0`, the contract has a length of 51 slots. 
- since `4.3.0`, the contract has a length of 50 slots
- future versions will continue using 50 slots. 

This difference in layout could result in breaking upgrades if someone upgrades from an affected version to a non-affected version. It is thus recommended to be extremely careful when upgrading from a contract that uses ERC2771ContextUpgradeable `<4.3.0` to a newer version that uses `>=4.3.0`.

We've assessed the instances of this contract found on chain (with publicly verified source code) and notified the corresponding teams of the risk that an upgrade could cause.

### Workarounds

Potentially breaking upgrades would be caught by the OpenZeppelin Upgrades Plugins for Hardhat and Truffle. It is recommended to use this tooling for all your upgrades.

If you need to upgrade to a newer version of the Upgradeable Contracts library, we recommend copying the previous implementation ERC2771ContextUpgradeable (available in the `release-4.2` branch) and packaging it with your code.

### Reference

https://github.com/OpenZeppelin/openzeppelin-transpiler/pull/86

### For more information

If you have any questions, comments, or need assistance regarding this advisory, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).

To submit security reports please use [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).
Stored Cross-site Scripting in showdoc
Advisory: GHSA-3pg8-c473-w6rr
Aliases: CVE-2022-0967
Published: 2022-03-16T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

ShowDoc is a tool for an IT team to share documents online. showdoc contains a stored cross-site scripting vulnerability in the File Library page when uploading a file in .ofd format in versions prior to 2.10.4. At this time, there is no known workaround. Users should update to version 2.10.4.
Permissions bypass in SmallRye
Advisory: GHSA-54fx-gm74-q676
Aliases: CVE-2020-1729
Published: 2022-03-18T17:55:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data confidentiality. This is fixed in SmallRye 1.6.2
Leading white space bypasses protocol validation
Advisory: GHSA-gmv4-r438-p67f
Aliases: CVE-2022-24723
Published: 2022-03-03T19:23:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact
Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.

### Patches
Patched in 1.19.9

### Workarounds
Remove leading whitespace from values before passing them to URI.parse (e.g. via `.href(value)` or `new URI(value)`), e.g. by using

```js
function remove_whitespace(url){
     const whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
     url = url.replace(whitespace, '')
     return url
}
```

### References
* https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [medialize/URI.js](https://github.com/medialize/URI.js/)
Possibility for Denial of Service by overwriting PHP files with language exports
Advisory: GHSA-3fvf-2gp4-89wq
Published: 2022-03-18T23:17:15Z

### Impact
Laravel Translation Manager didn't check the locale name, which allowed directory traversal when exporting files. The content would be a PHP file returning an array of translations, but this could lead to unexpected results, like denial of service. Access to the Laravel Translation Manager is required, because a new locale would have to be added and published.

### Patches
Version 0.6.2 fixes this issue.

### Workarounds
Only allow trusted admins to publish/edit translations.

### References
https://github.com/barryvdh/laravel-translation-manager/pull/417

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/barryvdh/laravel-translation-manager
* Email me (see Github profile)

### Credits
Found and reported by [Natalia Trojanowska](https://www.linkedin.com/in/trojanowskanatalia/)
Race Condition in Paramiko
Advisory: GHSA-f8q4-jwww-x3wv
Aliases: CVE-2022-24302
Published: 2022-03-19T00:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
Incomplete validation in `SparseSparseMinimum`
Advisory: GHSA-gv26-jpj9-c8gq
Aliases: CVE-2021-29607
Published: 2022-03-18T17:52:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

### Impact
Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data:

```python 
import tensorflow as tf

a_indices = tf.ones([45, 92], dtype=tf.int64)
a_values = tf.ones([45], dtype=tf.int64)
a_shape = tf.ones([1], dtype=tf.int64)
b_indices = tf.ones([1, 1], dtype=tf.int64)
b_values = tf.ones([1], dtype=tf.int64)
b_shape = tf.ones([1], dtype=tf.int64)
                    
tf.raw_ops.SparseSparseMinimum(a_indices=a_indices,
    a_values=a_values,
    a_shape=a_shape,
    b_indices=b_indices,
    b_values=b_values,
    b_shape=b_shape)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/sparse_sparse_binary_op_shared.cc) has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of `*_indices` matches the size of corresponding `*_shape`. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation.

### Patches 
We have patched the issue in GitHub commit [ba6822bd7b7324ba201a28b2f278c29a98edbef2](https://github.com/tensorflow/tensorflow/commit/ba6822bd7b7324ba201a28b2f278c29a98edbef2) followed by GitHub commit [f6fde895ef9c77d848061c0517f19d0ec2682f3a](https://github.com/tensorflow/tensorflow/commit/f6fde895ef9c77d848061c0517f19d0ec2682f3a).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Improperly checked metadata on tools/armour itemstacks received from the client
Advisory: GHSA-46c5-pfj8-fv65
Published: 2022-03-18T22:36:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Due to a workaround applied in 1.13, an attacker may send a negative damage/meta value in a tool or armour item's NBT, which `TypeConverter` then blindly uses as if it was valid without being checked.

When this invalid metadata value reaches `Durable->setDamage()`, an exception is thrown because the metadata is not within the expected range for damage values.

This can be reproduced with either a too-large damage value, or a negative one.

### Patches
c8e1cfcbee4945fd4b63d2a7e96025c59744d4f1

### Workarounds
In theory this can be checked by plugins using a custom `TypeConverter`, but this is likely to be very cumbersome.

### For more information
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Cross-site Scripting in microweber
Advisory: GHSA-5fxf-x22x-5q38
Aliases: CVE-2022-0929
Published: 2022-03-13T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.12.
openssl-src's infinite loop in `BN_mod_sqrt()` reachable when parsing certificates
Advisory: GHSA-x3mh-jvjw-3xwx
Aliases: CVE-2022-0778
Published: 2022-03-16T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).
Poetry before v1.1.9 contains Untrusted Search Path
Advisory: GHSA-xr2c-5w89-63pv
Aliases: CVE-2022-26184
Published: 2022-03-23T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Poetry prior to v1.1.9 was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
Path traversal in FreeTAKServer-UI
Advisory: GHSA-7cr9-rmqr-fpqp
Aliases: CVE-2022-25511
Published: 2022-03-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An issue in the ?filename= argument of the route /DataPackageTable in FreeTAKServer-UI v1.9.8 allows attackers to place arbitrary files anywhere on the system.
Missing permission check in Jenkins Job and Node ownership Plugin
Advisory: GHSA-25f2-wgxj-ph29
Aliases: CVE-2022-28151
Published: 2022-03-30T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Job and Node ownership Plugin 0.13.0 and earlier allows attackers with Item/Read permission to change the owners and item-specific permissions of a job.
Missing permission Phoenix AutoTest Plugin
Advisory: GHSA-4c7h-f2j9-9c46
Aliases: CVE-2022-28158
Published: 2022-03-30T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A missing permission check in Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
XXE vulnerability in Jenkins Flaky Test Handler Plugin
Advisory: GHSA-v4rr-65x6-g69f
Aliases: CVE-2022-28140
Published: 2022-03-30T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Jenkins Flaky Test Handler Plugin 1.2.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
Arbitrary shell execution
Advisory: GHSA-mhfv-8rc9-w38c
Published: 2022-03-26T00:06:00Z

Uses of shell_exec() and exec() were not escaping filenames and configuration settings in most cases
Arbitrary file write in nats-server
Advisory: GHSA-6h3m-36w8-hv68
Aliases: CVE-2022-26652
Published: 2022-03-10T22:07:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

(This document is canonically: <https://advisories.nats.io/CVE/CVE-2022-26652.txt>)

## Background

NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing.

JetStream is the optional RAFT-based resilient persistent feature of NATS.


## Problem Description

The JetStream streams can be backed up and restored via NATS. The backup format is a tar archive file.  Inadequate checks on the filenames within the archive file permit a so-called "Zip Slip" attack in the stream restore.

NATS nats-server through 2022-03-09 (fixed in release 2.7.4) did not correctly sanitize elements of the archive file, thus a user of NATS
could cause the NATS server to write arbitrary content to an attacker-controlled filename.


## Affected versions

NATS Server:
 * 2.2.0 up to and including 2.7.3.
   + Introduced with JetStream Restore functionality
 * Fixed with nats-io/nats-server: 2.7.4
 * Docker image:  nats <https://hub.docker.com/_/nats>
 * NB users of OS package files from our releases: a change in goreleaser defaults, discovered late in the release process, moved the install directory from /usr/local/bin to /usr/bin; we are evaluating the correct solution for subsequent releases, but not recutting this release.

NATS Streaming Server
 * 0.15.0 up to and including 0.24.2
 * Fixed with nats-io/nats-streaming-server: 0.24.3
 * Embeds a nats-server, but this server is the old approach which JetStream replaces, so unlikely (but not impossible) to be
   configured with JS support


## Workarounds

 * Disable JetStream for untrusted users.
 * If only one NATS account uses JetStream, such that cross-user attacks are not an issue, and any user in that account with access to the JetStream API is fully trusted anyway, then appropriate sandboxing techniques will prevent exploit.
   + Eg, with systemd, the supplied util/nats-server-hardened.service example configuration demonstrates that NATS runs fine as an unprivileged user under ProtectSystem=strict and PrivateTmp=true restrictions; by only opening a ReadWritePaths hole for the JetStream storage area, the impact of this vulnerability is limited.


## Solution

Upgrade the NATS server to at least 2.7.4.

We fully support the util/nats-server-hardened.service configuration for running a NATS server and encourage this approach.


## Credits

This issue was reported (on 2022-03-07) to the NATS Maintainers by
Yiming Xiang, TIANJI LAB of NSFOCUS.  
Thank you / 谢谢你！
Exposure of home directory through shescape on Unix with Bash
Advisory: GHSA-446w-rrm4-r47f
Aliases: CVE-2022-24725
Published: 2022-03-03T19:26:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact

The issue allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected.

```javascript
const cp = require("child_process");
const shescape = require("shescape");

const payload = "home_directory=~";
const options = { interpolation: true };
console.log(cp.execSync(`echo ${shescape.escape(payload, options)}`));
// home_directory=/home/user
```

Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_.

### Patches

The issue was patched in `v1.5.1`.

### Workarounds

Manually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, "\\~")`.

### References

See GitHub issue https://github.com/ericcornelissen/shescape/issues/169.
Cross-site Scripting in Fork CMS
Advisory: GHSA-qf2g-q4mc-w7rr
Aliases: CVE-2022-0145
Published: 2022-03-25T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fork CMS prior to 5.11.1 is vulnerable to stored cross-site scripting. When uploading a new module, the description of the module can contain JavaScript code. The JavaScript code may be executed after uploading the new module and looking at the `Details` page.
Path traversal in Pillow
Advisory: GHSA-9j59-75qj-795w
Aliases: CVE-2022-24303
Published: 2022-03-11T23:10:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Incorrect Authentication in shopware
Advisory: GHSA-83vp-6jqg-6cmr
Aliases: CVE-2022-24748
Published: 2022-03-10T18:02:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

### Impact
Modify Customers, create Orders without App Permission

## Patches
We recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Prototype Pollution in minimist
Advisory: GHSA-xvch-5gv4-984h
Aliases: CVE-2021-44906
Published: 2022-03-18T00:01:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Minimist prior to 1.2.6 and 0.2.4 is vulnerable to Prototype Pollution via file `index.js`, function `setKey()` (lines 69-95).
Unrestricted file upload leads to stored cross-site scripting in Microweber
Advisory: GHSA-hf4q-52x6-4p57
Aliases: CVE-2022-0906
Published: 2022-03-11T00:02:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Microweber prior to version 1.2.12 allows unrestricted file upload, which could lead to stored cross-site scripting.
Improper Input Validation in url-js
Advisory: GHSA-rf54-44jr-q5vf
Aliases: CVE-2022-25839
Published: 2022-03-12T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The package url-js before 2.1.0 is vulnerable to Improper Input Validation due to improper parsing, which makes it is possible for the hostname to be spoofed. http://\\\\\\\\localhost and http://localhost are the same URL. However, the hostname is not parsed as localhost, and the backslash is reflected as it is.
Improper Restriction of XML External Entity Reference in Any23
Advisory: GHSA-2rmm-87v7-34rj
Aliases: CVE-2022-25312
Published: 2022-03-06T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions < 2.7. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Any23 2.7.
Stored Cross-site Scripting in ShowDoc
Advisory: GHSA-vpwq-6cp4-ffqc
Aliases: CVE-2022-0945
Published: 2022-03-16T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to version 2.10.4 is vulnerable to stored cross-site scripting viva `axd` and `cshtml` file upload.
XML external entity (XXE) attacks in Jenkins Xcode integration Plugin
Advisory: GHSA-wfxp-4qgw-qp3c
Aliases: CVE-2021-21656
Published: 2022-03-18T17:52:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Jenkins Xcode integration Plugin 2.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
File Upload Restriction Bypass leading to Cross-site Scripting in ShowDoc
Advisory: GHSA-j6jg-w79c-7p8v
Aliases: CVE-2022-0951
Published: 2022-03-16T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to 2.10.4 is vulnerable to a file upload restriction bypass leading to stored cross-site scripting.
Path traversal in Phoenix AutoTest Plugin
Advisory: GHSA-62hc-f8qj-5xc3
Aliases: CVE-2022-28157
Published: 2022-03-30T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Jenkins Pipeline: Phoenix AutoTest Plugin 1.3 and earlier allows attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller via FTP to an attacker-specified FTP server.
Cross-site Scripting in Pimcore
Advisory: GHSA-6qcc-whgp-pjj2
Aliases: CVE-2022-0832
Published: 2022-03-05T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore version 10.3.2 and prior is vulnerable to stored cross-site scripting. A patch is available and anticipated to be part of version 10.3.3.
Arbitrary shell execution
Advisory: GHSA-3988-h75v-hwf6
Published: 2022-03-26T00:06:45Z

A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option
Deserialization of Untrusted Data in Apache Dubbo
Advisory: GHSA-5mc7-m686-p6jg
Aliases: CVE-2021-30179
Published: 2022-03-18T17:57:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Dubbo prior to 2.6.9 and 2.7.10 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
SSL/TLS certificate validation globally disabled by Jenkins Proxmox Plugin
Advisory: GHSA-fhhx-r983-44xc
Aliases: CVE-2022-28142
Published: 2022-03-30T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Jenkins Proxmox Plugin 0.6.0 and earlier disables SSL/TLS certificate validation globally for the Jenkins controller JVM when configured to ignore SSL/TLS issues.
node-ipc behavior change
Advisory: GHSA-3mpp-xfvh-qh37
Published: 2022-03-16T23:54:35Z

node-ipc version 11.0.0 and newer include a message from the maintainer that is written to the user’s desktop. Please review the version changes before proceeding.
Unrestricted Upload of File with Dangerous Type in Croogo
Advisory: GHSA-4pww-fqgh-36hj
Aliases: CVE-2021-44673
Published: 2022-03-11T00:02:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2 via admin/file-manager/attachments, which lets a malicious user upload a web shell script.
Improper Verification of Cryptographic Signature in `node-forge`
Advisory: GHSA-2r2c-g63r-vccr
Aliases: CVE-2022-24773
Published: 2022-03-18T23:10:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact

RSA PKCS#1 v1.5 signature verification code is not properly checking `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
Open Redirect
Advisory: GHSA-4r8q-gv9j-3xx6
Aliases: CVE-2021-32645
Published: 2022-03-18T17:55:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

### Impact
In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL.
This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`)

### Patches
Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to.

### Workarounds
There is a simple way to work around the security issue
- Set the `force_https` to every tenant to `false`

### References
https://nvd.nist.gov/vuln/detail/CVE-2018-11784

### For more information
If you have any questions or comments about this advisory:
* Contact us in Discord: https://tenancy.dev/chat
Prototype Pollution in Sails.js
Advisory: GHSA-8v3j-jfg3-v3fv
Aliases: CVE-2021-44908
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Sails.js <= 1.5.2 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). A [patch](https://github.com/balderdashy/sails/commit/7c5379a656bb305c958df1dcc2b51a9668830358) is available in the `master` branch of Sails.js's GItHub repository.
Code injection in dolibarr/dolibarr
Advisory: GHSA-42qm-c3cf-9wv2
Aliases: CVE-2022-0819
Published: 2022-03-03T00:00:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper php function sanitization, lead to an ability to inject arbitrary PHP code and run arbitrary commands on file system. In the function "dol_eval" in file "dolibarr/htdocs/core/lib/functions.lib.php" dangerous PHP functions are sanitized using "str_replace" and can be bypassed using following code in $s parameter
Denial of Service in Go-Ethereum
Advisory: GHSA-vmf7-hmh6-vv57
Aliases: CVE-2022-23328
Published: 2022-03-05T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A design flaw in all versions of Go-Ethereum allows an attacker node to send 5120 pending transactions of a high gas price from one account that all fully spend the full balance of the account to a victim Geth node, which can purge all of pending transactions in a victim node's memory pool and then occupy the memory pool to prevent new transactions from entering the pool, resulting in a denial of service (DoS).
Arbitrary code execution in post-loader
Advisory: GHSA-66ww-999q-mffq
Aliases: CVE-2022-0748
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

post-loader is webpack loader for blog posts written in Markdown. The package post-loader from 0.0.0 is vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed. At this time, there is no known workaround or patch available.
Command injection in Weblate
Advisory: GHSA-h2g5-2rhx-ffgj
Aliases: CVE-2022-24727
Published: 2022-03-05T00:00:44Z

Weblate is a web based localization tool with tight version control integration. Prior to version 4.11.1, Weblate didn't properly sanitize some arguments passed to Git and Mercurial, allowing them to change their behavior in an unintended way. Instances where untrusted users cannot create new components are not affected. The issues were fixed in the 4.11.1 release.
Insecure Temporary File in SWHKD
Advisory: GHSA-p4jg-pccf-h82c
Aliases: CVE-2022-27815
Published: 2022-03-31T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SWHKD is a display protocol-independent hotkey daemon made in Rust. In SWHKD versions 1.1.5 and prior, SWHKD uses the /tmp/swhkd.pid pathname. As /tmp is accessible to all users, there can be an information leak or denial of service. No known workarounds exist. A patch is available on the `1.1.0` branch of the repository.
Stored Cross-site Scripting vulnerability in Jenkins Folder-based Authorization Strategy Plugin
Advisory: GHSA-chr6-386q-4m3v
Aliases: CVE-2022-27200
Published: 2022-03-16T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Jenkins Folder-based Authorization Strategy Plugin 1.3 and earlier does not escape the names of roles shown on the configuration form, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Cross-site Scripting in vditor
Advisory: GHSA-pq37-4c4g-v38c
Aliases: CVE-2022-0341
Published: 2022-03-15T00:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

vditor prior to version 3.8.11 is vulnerable to cross-site scripting.
Use of Externally-Controlled Format String in wire-avs
Advisory: GHSA-2j6v-xpf3-xvrv
Aliases: CVE-2021-41193
Published: 2022-03-01T18:58:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
A remote format string vulnerability allowed an attacker to cause a denial of service or possibly execute arbitrary code.

### Patches
* The issue has been fixed in wire-avs 7.1.12 and is already included on all Wire products (currently used version is 8.0.x)

### Workarounds
* No workaround known

### References
* Fixed in commit https://github.com/wireapp/wire-avs/commit/40d373ede795443ae6f2f756e9fb1f4f4ae90bbe

### For more information

If you have any questions or comments about this advisory feel free to email us at [vulnerability-report@wire.com](mailto:vulnerability-report@wire.com)
Personal tokens stored in plain text by Jenkins incapptic connect uploader Plugin
Advisory: GHSA-8g9w-5jv6-7m4x
Aliases: CVE-2022-27218
Published: 2022-03-16T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Cross-site Scripting in Keycloak
Advisory: GHSA-xpgc-j48j-jwv9
Aliases: CVE-2021-20323
Published: 2022-03-26T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak version 15. The issue was fixed in version 17.0.0.
OS Command Injection in GenieACS
Advisory: GHSA-2877-693q-pj33
Aliases: CVE-2021-46704
Published: 2022-03-07T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). The vulnerability arises from insufficient input validation combined with a missing authorization check.
Gitea Missing Authorization vulnerability
Advisory: GHSA-jr9c-h74f-2v28
Aliases: CVE-2022-0905
Published: 2022-03-11T00:02:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Gitea 1.16.3 and prior is vulnerable to missing authorization. A patch is available as part of the 1.16.4 release.
Twig Sandbox Information Disclosure
Advisory: GHSA-vxrc-68xx-x48g
Aliases: CVE-2019-9942
Published: 2022-03-26T00:25:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

A sandbox information disclosure exists in Twig before 1.38.0 and 2.x before 2.7.0 because, under some circumstances, it is possible to call the `__toString()` method on an object even if not allowed by the security policy in place.
Cross-site Scripting in CKEditor4
Advisory: GHSA-4fc4-4p5g-6w89
Aliases: CVE-2022-24728
Published: 2022-03-16T22:47:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

### Affected packages
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.

### Impact
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.18.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.18.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank GHSL team member Kevin Backhouse ([@kevinbackhouse](https://github.com/kevinbackhouse)) for recognizing and reporting this vulnerability.
Deserializer tampering in Apache Dubbo
Advisory: GHSA-v2rg-8cwr-75g8
Aliases: CVE-2021-25641
Published: 2022-03-18T17:56:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
HTTP Request Smuggling in waitress
Advisory: GHSA-4f7p-27jc-3c36
Aliases: CVE-2022-24761
Published: 2022-03-18T19:00:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

When using Waitress behind a proxy that does not properly validate the incoming HTTP request matches the RFC7230 standard, Waitress and the frontend proxy may disagree on where one request starts and where it ends.

This would allow requests to be smuggled via the front-end proxy to waitress and later behavior.

There are two classes of vulnerability that may lead to request smuggling that are addressed by this advisory:

- The use of Python's `int()` to parse strings into integers, leading to `+10` to be parsed as `10`, or `0x01` to be parsed as `1`, where as the standard specifies that the string should contain only digits or hex digits.
- Waitress does not support chunk extensions, however it was discarding them without validating that they did not contain illegal characters

### Patches

This has been fixed in Waitress 2.1.1

### Workarounds

When deploying a proxy in front of waitress, turning on any and all functionality to make sure that the request matches the RFC7230 standard. Certain proxy servers may not have this functionality though and users are encouraged to upgrade to the latest version of waitress instead.

### References

- https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [the Github issue tracker](https://github.com/Pylons/waitress/issues) (if not security related/sensitive)
* Email us at [pylons-project-security@googlegroups.com](mailto:pylons-project-security@googlegroups.com) (If security related or sensitive)
Cross-site Scripting in ShowDoc
Advisory: GHSA-9fcc-7g44-mxrj
Aliases: CVE-2022-0942
Published: 2022-03-16T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via uploading files with files in `.xsd`, `.asa`, and `.aspx` formats.
Cross-site Scripting in Pimcore Datahub
Advisory: GHSA-vc5r-xfc4-4x22
Aliases: CVE-2022-0955
Published: 2022-03-25T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Pimcore Datahub prior to 1.2.4 is vulnerable to stored cross-site scripting. An admin user accessing Datahub triggers the attack, which may result in the user's cookie being stolen.
Deeply nested json in jackson-databind
Advisory: GHSA-57j2-w4cx-62h2
Aliases: CVE-2020-36518
Published: 2022-03-12T00:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

jackson-databind is a data-binding package for the Jackson Data Processor. jackson-databind allows a Java stack overflow exception and denial of service via a large depth of nested objects.
Nokogiri affected by zlib's Out-of-bounds Write vulnerability
Advisory: GHSA-jc36-42cf-vqwj
Aliases: CVE-2018-25032
Published: 2022-03-26T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

zlib 1.2.11 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
SQL Injection in Moodle
Advisory: GHSA-h2fw-93qx-vrcq
Aliases: CVE-2022-0983
Published: 2022-03-26T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
Command injection in simple-git
Advisory: GHSA-3f95-r44v-8mrg
Aliases: CVE-2022-24433
Published: 2022-03-12T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The package simple-git before 3.3.0 is vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options, it was possible to get arbitrary command execution.
Open Redirect in Flask-AppBuilder
Advisory: GHSA-2ccw-7px8-vmpf
Aliases: CVE-2022-24776
Published: 2022-03-25T19:27:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Flask-AppBuilder](https://github.com/dpgaspar/Flask-AppBuilder)
Stored Cross-site Scripting vulnerability in Jenkins Dashboard View Plugin
Advisory: GHSA-6fg4-36v7-xv32
Aliases: CVE-2022-27197
Published: 2022-03-16T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Dashboard View Plugin 2.18 and earlier does not perform URL validation for the Iframe Portlet's Iframe source URL, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure views.

Dashboard View Plugin 2.18.1 performs URL validation for the Iframe Portlet’s Iframe source URL.
Additionally, Dashboard View Plugin 2.18.1 sets the sandbox attribute for the iframe to restrict the included page.

In case of problems, the [Java system property](https://www.jenkins.io/doc/book/managing/system-properties/) `hudson.plugins.view.dashboard.core.IframePortlet.sandboxAttributeValue` can be used to customize the sandbox attribute value. The Java system property `hudson.plugins.view.dashboard.core.IframePortlet.doNotUseSandbox` can be used to disable the sandbox completely.
Prototype Pollution in bodymen
Advisory: GHSA-vhxc-fhm5-qcp9
Aliases: CVE-2022-25296
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

The package bodymen from 0.0.0 are vulnerable to Prototype Pollution via the handler function which could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload. **Note:** This vulnerability derives from an incomplete fix to [CVE-2019-10792](https://security.snyk.io/vuln/SNYK-JS-BODYMEN-548897)
Cross-site Scripting in ShowDoc
Advisory: GHSA-v94v-pxqp-5qgj
Aliases: CVE-2022-0950
Published: 2022-03-16T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The upload feature of ShowDoc prior to version 2.10.4 allows files with the extension `.*html`, which leads to stored cross-site scripting.
Improper Input Validation and Allocation of Resources Without Limits or Throttling in poi-scratchpad
Advisory: GHSA-mqvp-7rrg-9jxc
Aliases: CVE-2022-26336
Published: 2022-03-05T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.
Improper random number generation in github.com/coredns/coredns
Advisory: GHSA-gv9j-4w24-q7vx
Published: 2022-03-01T21:03:11Z

### Impact

CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

### Patches
The problem has been fixed in 1.6.6+.

### References
- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)

### For more information
Please consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.
Denial of service via insufficient metadata validation
Advisory: GHSA-p93v-m2r2-4387
Published: 2022-03-01T21:05:01Z

The PAM module for `fscrypt` through v0.3.2 doesn't adequately validate `fscrypt` metadata files, allowing users to create malicious metadata files that prevent other users from logging in. A local user can cause a denial of service by creating a `fscrypt` metadata file that prevents other users from logging into the system. We recommend upgrading to v0.3.3 or above.

For more details, see [CVE-2022-25327](https://www.cve.org/CVERecord?id=CVE-2022-25327).
Cross-Site Request Forgery (CSRF) Protection Bypass Vulnerability in CodeIgniter4
Advisory: GHSA-4v37-24gm-h554
Aliases: CVE-2022-24712
Published: 2022-03-01T21:47:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L

### Impact
This vulnerability might allow remote attackers to bypass the CodeIgniter4 CSRF protection mechanism. 

### Patches
Upgrade to v4.1.9 or later.

### Workarounds
These are workarounds for this vulnerability, but **you will still need to code as these after upgrading to v4.1.9**.
Otherwise, the CSRF protection may be bypassed.

#### When Auto-Routing is Enabled
1. Check the request method in the controller method before processing.

E.g.:
```php
        if (strtolower($this->request->getMethod()) !== 'post') {
            return $this->response->setStatusCode(405)->setBody('Method Not Allowed');
        }
```

#### When Auto-Routing is Disabled
Do one of the following:
1. Do not use `$routes->add()`, and [use HTTP verbs in routes](https://codeigniter4.github.io/userguide/incoming/routing.html#using-http-verbs-in-routes).
2. Check the request method in the controller method before processing.

E.g.:
```php
        if (strtolower($this->request->getMethod()) !== 'post') {
            return $this->response->setStatusCode(405)->setBody('Method Not Allowed');
        }
```

### References
- [CodeIgniter4 CSRF protection](https://codeigniter4.github.io/userguide/libraries/security.html#cross-site-request-forgery-csrf)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Cross-site Scripting in FreeTAKServer-UI
Advisory: GHSA-gjh6-wvhq-h4qx
Aliases: CVE-2022-25507
Published: 2022-03-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

FreeTAKServer-UI v1.9.8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Callsign parameter.
Passwords stored in plain text by Jenkins dbCharts Plugin
Advisory: GHSA-x75r-g63m-82wj
Aliases: CVE-2022-27216
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins dbCharts Plugin 0.5.2 and earlier stores JDBC connection passwords unencrypted in its global configuration file `hudson.plugins.dbcharts.DbChartPublisher.xml` on the Jenkins controller as part of its configuration.

These passwords can be viewed by users with access to the Jenkins controller file system.
Path Traversal in Gitea
Advisory: GHSA-h3q4-vmw4-cpr5
Aliases: CVE-2021-29134
Published: 2022-03-16T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The avatar middleware in Gitea before 1.13.6 allows Directory Traversal via a crafted URL.
Cross-site Scripting in ShowDoc
Advisory: GHSA-mw75-qvfr-hpmr
Aliases: CVE-2022-0938
Published: 2022-03-15T00:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc is vulnerable to stored cross-site scripting through file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.