aswin1906/github-advisory-2022 huggingface dataset:
Code injection in Apache NiFi and NiFi Registry
Advisory: GHSA-77hf-23pq-2g7c
Aliases: CVE-2022-33140
Published: 2022-06-16T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The optional ShellUserGroupProvider in Apache NiFi 1.10.0 to 1.16.2 and Apache NiFi Registry 0.6.0 to 1.16.2 does not neutralize arguments for group resolution commands, allowing injection of operating system commands on Linux and macOS platforms. The ShellUserGroupProvider is not included in the default configuration. Command injection requires ShellUserGroupProvider to be one of the enabled User Group Providers in the Authorizers configuration. Command injection also requires an authenticated user with elevated privileges. Apache NiFi requires an authenticated user with authorization to modify access policies in order to execute the command. Apache NiFi Registry requires an authenticated user with authorization to read user groups in order to execute the command. The resolution removes command formatting based on user-provided arguments.
Code injection via SVG file in convert-svg-core
Advisory: GHSA-54px-mhwv-5v8x
Aliases: CVE-2022-24429
Published: 2022-06-11T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
Externally Controlled Reference to a Resource in Another Sphere in ruby-mysql
Advisory: GHSA-73pr-g6jj-5hc9
Aliases: CVE-2021-3779
Published: 2022-06-29T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

A malicious actor can read arbitrary files from a client that uses ruby-mysql to communicate to a rogue MySQL server and issue database queries. In these cases, the server has the option to create a database reply using the LOAD DATA LOCAL statement, which instructs the client to provide additional data from a local file readable by the client (and not a "local" file on the server).
Regular expression denial of service in Delight Nashorn Sandbox
Advisory: GHSA-38j3-6fm8-pfgc
Aliases: CVE-2021-40660
Published: 2022-06-15T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in Delight Nashorn Sandbox. There is an ReDoS vulnerability that can be exploited to launching a denial of service (DoS) attack.
Missing Authorization in Jenkins EasyQA Plugin
Advisory: GHSA-49j4-v37g-5gg2
Aliases: CVE-2022-34204
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins EasyQA Plugin 1.0 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server.
OS Command Injection in gogs
Advisory: GHSA-958j-443g-7mm7
Aliases: CVE-2022-1884
Published: 2022-06-02T20:50:21Z

### Impact

The malicious user is able to upload a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All Windows installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.

### Patches

Repository file uploads are prohibited to its `.git` directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.

### Workarounds

[Disable repository files upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L128-L129).

### References

https://www.huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b/

### For more information

If you have any questions or comments about this advisory, please post on #6968.
Cross-Site Request Forgery in Jenkins Jianliao Notification Plugin
Advisory: GHSA-q8v3-7h6q-g39q
Aliases: CVE-2022-34205
Published: 2022-06-24T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers to send HTTP POST requests to an attacker-specified URL.
Uncontrolled Recursion in rulex
Advisory: GHSA-v78m-2q7v-fjqp
Aliases: CVE-2022-31099
Published: 2022-06-22T17:52:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
When parsing untrusted rulex expressions, the stack may overflow, possibly enabling a Denial of Service attack. This happens when parsing an expression with several hundred levels of nesting, causing the process to abort immediately.

This is a security concern for you, if
- your service parses untrusted rulex expressions (expressions provided by an untrusted user), and
- your service becomes unavailable when the process running rulex aborts due to a stack overflow.

### Patches
The crash is fixed in version **0.4.3**. Affected users are advised to update to this version.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [rulex](https://github.com/rulex-rs/rulex/issues)
* Email me at [ludwig.stecher@gmx.de](mailto:ludwig.stecher@gmx.de)

### Credits

Credit for finding these bugs goes to

- [evanrichter](https://github.com/evanrichter)
- [ForAllSecure Mayhem](https://forallsecure.com/)
- [cargo fuzz](https://github.com/rust-fuzz/cargo-fuzz) and [afl.rs](https://github.com/rust-fuzz/afl.rs)
brotkrueml/schema fails to properly encode user input for output in HTML context, leading to XSS
Advisory: GHSA-374w-gwqr-fmxg
Aliases: CVE-2022-33154
Published: 2022-06-17T21:46:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
`read` on uninitialized buffer may cause UB (bite::read::BiteReadExpandedExt::read_framed_max)
Advisory: GHSA-72r2-rg28-47v9
Published: 2022-06-16T23:44:51Z

Affected versions of this crate calls a user provided `Read` implementation on an uninitialized buffer. `Read` on uninitialized buffer is defined as undefined behavior in Rust.
`array!` macro is unsound when its length is impure constant
Advisory: GHSA-7v4j-8wvr-v55r
Published: 2022-06-16T23:40:38Z

Affected versions of this crate did substitute the array length provided by an user at compile-time multiple times.

When an impure constant expression is passed as an array length (such as a result of an impure procedural macro), this can result in the initialization of an array with uninitialized types, which in turn can allow an attacker to execute arbitrary code.

The flaw was corrected in commit [d5b63f72](https://github.com/xfix/array-macro/commit/d5b63f72090f3809c21ac28f9cfd84f12559bf7d) by making sure that array length is substituted just once.
Cross-site Scripting in Jenkins Stash Branch Parameter Plugin
Advisory: GHSA-88r9-hfj2-54hv
Aliases: CVE-2022-34198
Published: 2022-06-24T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Stash Branch Parameter Plugin 0.3.0 and earlier does not escape the name and description of Stash Branch parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Non-aligned u32 read in Chacha20 encryption and decryption
Advisory: GHSA-pmcv-mgcf-rvxg
Published: 2022-06-16T23:51:32Z

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to `std::slice::from_raw_parts_mut`, which breaks the contract and introduces undefined behavior.

This affects Chacha20 encryption and decryption in crypto2.
Cross site scripting in Elefant CMS
Advisory: GHSA-5hfm-g799-wjw6
Aliases: CVE-2017-20058
Published: 2022-06-21T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability classified as problematic was found in Elefant CMS 1.3.12-RC. Affected by this vulnerability is an unknown functionality of the component Version Comparison. The manipulation leads to basic cross site scripting (Persistent). The attack can be launched remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
Cross site scripting in Elefant CMS
Advisory: GHSA-xwj7-29j7-rw76
Aliases: CVE-2017-20057
Published: 2022-06-21T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A vulnerability classified as problematic has been found in Elefant CMS 1.3.12-RC. Affected is an unknown function. The manipulation of the argument username leads to basic cross site scripting (Persistent). It is possible to launch the attack remotely. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
Ghost vulnerable to remote code execution in locale setting change
Advisory: GHSA-7v28-g2pq-ggg8
Published: 2022-06-17T01:16:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

### Impact

A [vulnerability](https://www.cve.org/CVERecord?id=CVE-2022-24785) in an upstream library means an authenticated attacker can abuse locale input to execute arbitrary commands from a file that has previously been uploaded using the file upload functionality in the post editor.

### Patches

Fixed in 5.2.3, all 5.x sites should update as soon as possible.
Fixed in 4.48.2, all 4.x sites should update as soon as possible.

### Workarounds

Patched versions of Ghost add validation to the locale input to prevent execution of arbitrary files. Updating Ghost is the quickest complete solution.

As a workaround, if for any reason you cannot update your Ghost instance, you can block the `POST /ghost/api/admin/settings/` endpoint, which will also disable updating settings for your site.

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@ghost.org](mailto:security@ghost.org)

### Credits

* devx00 - https://twitter.com/devx00
columnar: `Read` on uninitialized buffer may cause UB (ColumnarReadExt::read_typed_vec())
Advisory: GHSA-cxcc-q839-2cw9
Published: 2022-06-16T23:48:53Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation (`ColumnarReadExt::read_typed_vec()`).
Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Server-Side Template Injection in formio
Advisory: GHSA-52vj-mr2j-f8jh
Aliases: CVE-2020-28246
Published: 2022-06-03T00:00:58Z

A Server-Side Template Injection (SSTI) was discovered in Form.io 2.0.0. This leads to Remote Code Execution during deletion of the default Email template URL.
Parser creates invalid uninitialized value
Advisory: GHSA-f67m-9j94-qv9j
Published: 2022-06-16T23:59:29Z

Affected versions of this crate called `mem::uninitialized()` in the HTTP1 parser to create values of type `httparse::Header` (from the `httparse` crate).
This is unsound, since `Header` contains references and thus must be non-null.
 
The flaw was corrected by avoiding the use of `mem::uninitialized()`, using `MaybeUninit` instead.
Query predicate bypass in Zalando Skipper
Advisory: GHSA-qx2j-85q5-ffp8
Aliases: CVE-2022-34296
Published: 2022-06-24T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

In Zalando Skipper before 0.13.218, a query predicate could be bypassed via a prepared request.
ProxyAgent vulnerable to MITM
Advisory: GHSA-pgw7-wx7w-2w33
Aliases: CVE-2022-32210
Published: 2022-06-17T01:02:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N

### Description

`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy. This unexpectedly means that proxies can MitM all HTTPS traffic, and if the proxy's URL is HTTP then it also means that nominally HTTPS requests are actually sent via plain-text HTTP between Undici and the proxy server.

### Impact

This affects all use of HTTPS via HTTP proxy using **`Undici.ProxyAgent`**  with Undici or Node's global `fetch`. In this case, it removes all HTTPS security from all requests sent using Undici's `ProxyAgent`, allowing trivial MitM attacks by anybody on the network path between the client and the target server (local network users, your ISP, the proxy, the target server's ISP, etc).
This less seriously affects HTTPS via HTTPS proxies. When you send HTTPS via a proxy to a remote server, the proxy can freely view or modify all HTTPS traffic unexpectedly (but only the proxy). 

### Patches

This issue was patched in Undici v5.5.1.

### Workarounds

At the time of writing, the only workaround is to not use `ProxyAgent` as a dispatcher for TLS Connections.
Server-Side Request Forgery in dompdf/dompdf
Advisory: GHSA-pf6p-25r2-fx45
Aliases: CVE-2022-0085
Published: 2022-06-29T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Server-Side Request Forgery (SSRF) in GitHub repository dompdf/dompdf prior to 2.0.0.
Ill-formed headers may lead to unexpected behavior in Istio
Advisory: GHSA-xwx5-5c9g-x68x
Aliases: CVE-2022-31045
Published: 2022-06-10T19:53:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Ill-formed headers sent to Envoy in certain configurations can lead to unexpected memory access resulting in undefined behavior or crashing.

You are at most risk if you have an Istio ingress Gateway exposed to external traffic.

### Patches
1.12.8, 1.13.5, 1.14.1

### Workarounds
No.

### References
More details can be found in the [Istio Security Bulletin](https://istio.io/latest/news/security/istio-security-2022-05)

### For more information
If you have any questions or comments about this advisory, please email us at [istio-security-vulnerability-reports@googlegroups.com](mailto:istio-security-vulnerability-reports@googlegroups.com)
InputStream::read_exact : `Read` on uninitialized buffer causes UB
Advisory: GHSA-hmx9-jm3v-33hv
Published: 2022-06-16T23:46:08Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.
Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Cross-site Scripting in RosarioSIS
Advisory: GHSA-wjh9-344g-vc49
Aliases: CVE-2022-1997
Published: 2022-06-09T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.
Cross site scripting in Elefant CMS
Advisory: GHSA-hgm9-pww2-93pc
Aliases: CVE-2017-20061
Published: 2022-06-21T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A vulnerability has been found in Elefant CMS 1.3.12-RC and classified as problematic. This vulnerability affects unknown code of the file /admin/extended. The manipulation of the argument name with the input %3Cimg%20src=no%20onerror=alert(1)%3E leads to basic cross site scripting (Reflected). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.3.13 is able to address this issue. It is recommended to upgrade the affected component.
Uses of deprecated API can be used to cause DoS in user-facing endpoints
Advisory: GHSA-5q86-62xr-3r57
Aliases: CVE-2022-31054
Published: 2022-06-17T01:02:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
Several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service.

Eventsources susceptible to an out-of-memory denial-of-service attack:

- AWS SNS
- Bitbucket
- Bitbucket
- Gitlab
- Slack
- Storagegrid
- Webhook

### Patches
A patch for this vulnerability has been released in the following Argo Events version:

v1.7.1

### Credits
Disclosed by [Ada Logics](https://adalogics.com/) in a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information
Open an issue in the [Argo Events issue tracker](https://github.com/argoproj/argo-events/issues) or [discussions](https://github.com/argoproj/argo-events/discussions)
Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-events
Data race in `Iter` and `IterMut`
Advisory: GHSA-9hpw-r23r-xgm5
Published: 2022-06-17T00:25:46Z

In the affected version of this crate, `{Iter, IterMut}::next` used a weaker memory ordering when loading values than what was required, exposing a potential data race
when iterating over a `ThreadLocal`'s values.

Crates using `Iter::next`, or `IterMut::next` are affected by this issue.
Unsafe deserialisation in the PKI implementation scheme of NVFlare
Advisory: GHSA-rcxc-3w2m-mp8h
Aliases: CVE-2022-31604
Published: 2022-06-22T21:22:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
NVFLARE contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
All versions before 2.1.2 are affected.

CVSS Score = 9.8
[AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fnvd.nist.gov%2Fvuln-metrics%2Fcvss%2Fv3-calculator%3Fvector%3DAV%3AN%2FAC%3AL%2FPR%3AN%2FUI%3AN%2FS%3AU%2FC%3AH%2FI%3AH%2FA%3AH&data=05%7C01%7Cchesterc%40nvidia.com%7Ce9600bde16854b0b380008da4fc544f7%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C637910005925574215%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=5kBrXEmAbqp8R31JCH%2FG95MUly72UPVihnBwiRFmvBY%3D&reserved=0)



### Patches
The patch will be included in nvflare==2.1.2

### Workarounds
Replace pickle serialization with JSON and change the code accordingly

Additional information
Issue Found by: Oliver Sellwood (@Nintorac)
Potential Sensitive Cookie Exposure in NPM Packages @finastra/nestjs-proxy, @ffdc/nestjs-proxy
Advisory: GHSA-77mv-4rg7-r8qv
Aliases: CVE-2022-31070
Published: 2022-06-17T21:43:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

The nestjs-proxy library did not have a way to block sensitive cookies (e.g. session cookies) from being forwarded to backend services configured by the application developer. This could have led to sensitive cookies being inadvertently exposed to such services that should not see them.

The patched version now blocks cookies from being forwarded by default. However developers can configure an allow-list of cookie names by using the `allowedCookies` config setting. Further details of this feature can be found in the library's README on [Github](https://github.com/Finastra/finastra-nodejs-libs/tree/develop/libs/proxy) or [NPM](https://www.npmjs.com/package/@finastra/nestjs-proxy).

### Patches
- This issue has been fixed in version 0.7.0 of `@finastra/nestjs-proxy`.
- Users of `@ffdc/nestjs-proxy` are advised that this package has been deprecated and is no longer being maintained or receiving updates. Please update your package.json file to use `@finastra/nestjs-proxy` instead.

### References
- https://github.com/Finastra/finastra-nodejs-libs/pull/232
- https://github.com/Finastra/finastra-nodejs-libs/blob/master/libs/proxy/README.md
Cross site scripting in parse-url
Advisory: GHSA-jpp7-7chh-cf67
Aliases: CVE-2022-2218
Published: 2022-06-28T00:01:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0.
Code Injection in metacalc
Advisory: GHSA-5gc4-cx9x-9c43
Aliases: CVE-2022-21122
Published: 2022-06-09T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

The package metacalc before 0.0.2 is vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Reading on uninitialized buffer may cause UB ( `gfx_auxil::read_spirv()` )
Advisory: GHSA-28p5-7rg4-8v99
Published: 2022-06-16T23:59:12Z

Affected versions of this crate passes an uninitialized buffer to a user-provided `Read` implementation.
Arbitrary `Read` implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer.
Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
DoS through large manifest files in Argo CD
Advisory: GHSA-jhqp-vf4w-rpwq
Aliases: CVE-2022-31016
Published: 2022-06-21T22:51:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact

All versions of Argo CD starting with v0.7.0 are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the [repo-server](https://argo-cd.readthedocs.io/en/stable/operator-manual/architecture/#repository-server) service. The repo-server is a critical component of Argo CD, so crashing the repo-server effectively denies core Argo CD services (such as syncing Application updates).

To achieve denial of service, the attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. 

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.4.1
* v2.3.5
* v2.2.10
* v2.1.16

**The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production.** It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is `10M` per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.

If your organization uses directory-type Applications with very many manifests or very large manifests then **check the size of those manifests and tune the config parameter before deploying this change to production**. When testing, make sure to do a "hard refresh" in either the CLI or UI to test your directory-type App. That will make sure you're using the new max logic instead of relying on cached manifest responses from Redis.

### Workarounds

There is no workaround besides upgrading.

To mitigate the issue, carefully limit 1) who can configure repos (determined by [RBAC](https://argo-cd.readthedocs.io/en/stable/getting_started/)), 2) which repos are allowed (determined by [Project](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/) limitations), and 3) who has push access to those repos (determined by your SCM provider configuration).

### Credits

Disclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.

### For more information

* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Cross-Site Scripting in TYPO3's Form Framework
Advisory: GHSA-3r95-23jp-mhvg
Aliases: CVE-2022-31048
Published: 2022-06-17T20:55:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9)

### Problem
It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

### Credits
Thanks to Gabe Troyan who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2022-003](https://typo3.org/security/advisory/typo3-core-sa-2022-003)
Server-Side Request Forgery in kityminder
Advisory: GHSA-q56h-x9h5-q53c
Aliases: CVE-2022-31830
Published: 2022-06-10T00:00:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.
Uncontrolled Resource Consumption in Mattermost server
Advisory: GHSA-gwpf-95jc-63rv
Aliases: CVE-2022-1982
Published: 2022-06-03T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post.
Hybridsessions does not expire session id on logout
Advisory: GHSA-c7q8-m4xw-c674
Aliases: CVE-2022-24444
Published: 2022-06-29T22:09:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

When using the hybridsessions module is used without the session-manager module installed and sessions IDs are saved to disk, unexpired SessionIDs of logged out users can still be used to make authenticated requests.
Uncontrolled Resource Consumption in fast-string-search
Advisory: GHSA-4263-q746-94mw
Aliases: CVE-2022-22138
Published: 2022-06-18T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V8 to attempt reading from non-permitted locations and cause a segmentation fault due to the violation.
Window can read out of bounds if Read instance returns more bytes than buffer size
Advisory: GHSA-q579-9wp9-gfp2
Published: 2022-06-17T00:14:18Z

`rdiff` performs a diff of two provided strings or files. As part of its reading code it uses the return value of a `Read` instance to set the length of its internal character vector.

If the `Read` implementation claims that it has read more bytes than the length of the provided buffer, the length of the vector will be set to longer than its capacity. This causes `rdiff` APIs to return uninitialized memory in its API
methods.
Cross-site Scripting in Jenkins Image Tag Parameter Plugin
Advisory: GHSA-6923-546p-6rrc
Aliases: CVE-2022-34189
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Image Tag Parameter Plugin 1.10 and earlier does not escape the name and description of Image Tag parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Improper Handling of `callbackUrl` parameter in next-auth
Advisory: GHSA-g5fm-jp9v-2432
Aliases: CVE-2022-31093
Published: 2022-06-21T20:06:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

An attacker can send a request to an app using NextAuth.js with an invalid `callbackUrl` query parameter, which internally we convert to a `URL` object. The URL instantiation would fail due to a malformed URL being passed into the constructor, causing it to throw an unhandled error which led to our **API route handler timing out and logging in to fail**. This has been remedied in the following releases:

next-auth v3 users before version 3.29.5 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. See our [migration guide](https://next-auth.js.org/getting-started/upgrade-v4))

next-auth v4 users before version 4.5.0 are impacted.

### Patches

We've released patches for this vulnerability in:
  
- v3 - `3.29.5`
- v4 - `4.5.0`

You can do:

```sh
npm i next-auth@latest
```

or

```sh
yarn add next-auth@latest
```

or

```sh
pnpm add next-auth@latest
```

(This will update to the latest v4 version, but you can change  `latest` to `3` if you want to stay on v3. This is not recommended.)

### Workarounds

If for some reason you cannot upgrade, the workaround requires you to rely on [Advanced Initialization](https://next-auth.js.org/configuration/initialization#advanced-initialization). Here is an example:

**Before:**

```js
// pages/api/auth/[...nextauth].js
import NextAuth from "next-auth"

export default NextAuth(/* your config */)
```

**After:**

```js
// pages/api/auth/[...nextauth].js
import NextAuth from "next-auth"

function isValidHttpUrl(url) {
  try {
    return /^https?:/.test(url).protocol
  } catch {
    return false;
  }
}

export default async function handler(req, res) {
  if (
    req.query.callbackUrl &&
    !isValidHttpUrl(req.query.callbackUrl)
  ) {
   return res.status(500).send('');
  }
  
  return await NextAuth(req, res, /* your config */)
}
```


### References

This vulnerability was discovered not long after https://github.com/nextauthjs/next-auth/security/advisories/GHSA-q2mx-j4x2-2h74 was published and is very similar in nature.

Related documentation:

- https://next-auth.js.org/getting-started/client#specifying-a-callbackurl
- https://next-auth.js.org/configuration/callbacks#redirect-callback

A test case has been added so this kind of issue will be checked before publishing. See: https://github.com/nextauthjs/next-auth/commit/e498483b23273d1bfc81be68339607f88d411bd6

### For more information

If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability

### Timeline

The issue was reported 2022 June 10th, a response was sent out to the reporter in less than 2 hours, and a patch was published within 3 hours.
Cross-site Scripting in Jenkins Filesystem List Parameter Plugin
Advisory: GHSA-x95w-qf3m-pqpx
Aliases: CVE-2022-34187
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Filesystem List Parameter Plugin 0.0.7 and earlier does not escape the name and description of File system objects list parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Cross-site Scripting in Jenkins Hidden Parameter Plugin
Advisory: GHSA-jhfv-8936-g652
Aliases: CVE-2022-34188
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Hidden Parameter Plugin 0.0.4 and earlier does not escape the name and description of Hidden Parameter parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Login timing attack in ezsystems/ezplatform-kernel
Advisory: GHSA-342c-vcff-2ff2
Published: 2022-06-02T20:53:43Z

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replaces this with constant time functionality, configured in the new security.yml parameter 'ibexa.security.authentication.constant_auth_time'. It will log a warning if the constant time is exceeded. If this happens the setting should be increased.
Cross-site Scripting in Jenkins NS-ND Integration Performance Publisher Plugin
Advisory: GHSA-pv38-mqpp-v72h
Aliases: CVE-2022-34191
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.77 and earlier does not escape the name of NetStorm Test parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
XSS Vulnerability in Markdown Editor
Advisory: GHSA-85q9-7467-r53q
Published: 2022-06-17T21:51:45Z

### Impact

InvenTree uses [EasyMDE](https://github.com/Ionaru/easy-markdown-editor) for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models).

By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser.

*Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users*

### Solution

The solution here is two-fold:

- Enable data sanitization for the EasyMDE renderer - [#3205](https://github.com/inventree/InvenTree/pull/3205)
- Enforce cleaning of all data uploaded to the database via the API - [#3204](https://github.com/inventree/InvenTree/pull/3204) *(This will be ready for the 0.8.0 release)*

### Patches

- The issue is addressed in the upcoming 0.8.0 release
- This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.3 release

### Workarounds

There is no workaround for this issue without upgrading InvenTree to the specified version.

### References

- https://huntr.dev/bounties/ab296cf5-7a3e-4f49-8f63-5b35fc707f03/

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [github](http://github.com/inventree/inventree)
* Email us at [security@inventree.org](mailto:security@inventree.org)
Cross site scripting in francoisjacquet/rosariosis
Advisory: GHSA-4hpr-hh77-6q9p
Aliases: CVE-2022-2036
Published: 2022-06-10T00:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A Cross-site Scripting (XSS) vulnerability exists in in GitHub repository francoisjacquet/rosariosis prior to 9.1. HTML entities are not properly decoded from the URL.
Octopoller gem published with world-writable files
Advisory: GHSA-26qj-cr27-r5c4
Aliases: CVE-2022-31071
Published: 2022-06-15T21:24:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

### Impact

Version [0.2.0](https://rubygems.org/gems/octopoller/versions/0.2.0) of the octopoller gem was published containing world-writeable files. Specifically, the gem was packed with files having their permissions set to `-rw-rw-rw-` (i.e. 0666) instead of `rw-r--r--` (i.e. 0644). 

This means everyone who is not the owner (Group and Public) with access to the instance where this release had been installed could modify the world-writable files from this gem. 

Malicious code already present and running on your machine, separate from this package, could modify the gem’s files and change its behavior during runtime.

### Patches
* octopoller 0.3.0

### Workarounds
Users can use the previous version of the gem [v0.1.0](https://rubygems.org/gems/octopoller/versions/0.1.0). Alternatively, users can modify the file permissions manually until they are able to upgrade to the latest version.
Cross site scripting via cookies in gogs
Advisory: GHSA-pj96-4jhv-v792
Published: 2022-06-02T20:46:30Z

### Impact

There is no known practical impact other than it is just possible to manipulate CSRF cookie and XSS the malicious user self.

### Patches

Invalid characters of CSRF tokens are stripped after reading cookie. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.

### Workarounds

No need for workarounds.

### References

N/A

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6953.
Path traversal mitigation bypass in OctoRPKI
Advisory: GHSA-3jhm-87m6-x959
Published: 2022-06-25T07:12:08Z

### Impact
The existing URI path filters in OctoRPKI (version < 1.4.3) mitigating Path traversal vulnerability could be bypassed by an attacker. In case a malicious TAL file is parsed, it was possible to write files outside the base cache folder.

### Patches
The issue was fixed in version 1.4.3

### References
[CVE-2021-3907](https://www.cvedetails.com/cve/CVE-2021-3907/)
Code injection in grav
Advisory: GHSA-cxgw-r5jg-7xwq
Aliases: CVE-2022-2073
Published: 2022-06-30T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system.
JWS and JWT signature validation vulnerability with special characters
Advisory: GHSA-3fvg-4v2m-98jf
Aliases: CVE-2022-25898
Published: 2022-06-25T07:19:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

### Impact

Jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake.

For example, even if a string of non Base64URL encoding characters such as `!@$%` or `\11` is inserted into a valid JWS or JWT signature value string, it will still be a valid JWS or JWT signature by mistake.

When jsrsasign's JWS or JWT validation is used in OpenID connect or OAuth2, this vulnerability will affect to authentication or authorization.

By our internal assessment, CVSS 3.1 score will be 8.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

### Patches
Users validate JWS or JWT signatures should upgrade to 10.5.25.

### Workarounds
Validate JWS or JWT signature if it has Base64URL and dot safe string before
executing JWS.verify() or JWS.verifyJWT() method.

### ACKNOWLEDGEMENT

Thanks to Adi Malyanker and Or David for this vulnerability report. Also thanks for [Snyk security team](https://snyk.io/) for this coordination.

### References
https://github.com/kjur/jsrsasign/releases/tag/10.5.25
https://github.com/kjur/jsrsasign/security/advisories/GHSA-3fvg-4v2m-98jf kjur's advisories
https://github.com/advisories/GHSA-3fvg-4v2m-98jf github advisories
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25898
https://kjur.github.io/jsrsasign/api/symbols/KJUR.jws.JWS.html#.verifyJWT
https://kjur.github.io/jsrsasign/api/symbols/KJUR.jws.JWS.html#.verify
https://kjur.github.io/jsrsasign/api/symbols/global__.html#.isBase64URLDot
https://github.com/kjur/jsrsasign/wiki/Tutorial-for-JWS-verification
https://github.com/kjur/jsrsasign/wiki/Tutorial-for-JWT-verification
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122
Cross-site Scripting in Jenkins Date Parameter Plugin
Advisory: GHSA-5hh2-f4h9-446g
Aliases: CVE-2022-34185
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Date Parameter Plugin 0.0.4 and earlier does not escape the name and description of Date parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix. Additionally, several plugins have previously been updated to list parameters in a way that prevents exploitation by default, see [SECURITY-2617 in the 2022-04-12 security advisory for a list](https://www.jenkins.io/security/advisory/2022-04-12/#SECURITY-2617).
Link Following in Deno
Advisory: GHSA-67hm-27mx-9cg7
Aliases: CVE-2021-41641
Published: 2022-06-13T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Deno <=1.14.0 file sandbox does not handle symbolic links correctly. When running Deno with specific write access, the Deno.symlink method can be used to gain access to any directory.
Uncontrolled Resource Consumption in OPCFoundation.NetStandard.Opc.Ua.Core
Advisory: GHSA-vhfw-v69p-crcw
Aliases: CVE-2022-29864
Published: 2022-06-17T21:44:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability was discovered in the OPC UA .NET Standard Stack that allows a malicious client to cause a server to trigger an out of memory exception by sending a large number of message chunks.
Cross-site Scripting vulnerability in Jenkins
Advisory: GHSA-62wf-24c4-8r76
Aliases: CVE-2022-34170
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Since Jenkins 2.320 and LTS 2.332.1, help icon tooltips no longer escape the feature name, effectively undoing the fix for [SECURITY-1955](https://www.jenkins.io/security/advisory/2020-08-12/#SECURITY-1955).

This vulnerability is known to be exploitable by attackers with Job/Configure permission.

Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability, the feature name in help icon tooltips is now escaped.
SpEL Injection in Spring Data MongoDB
Advisory: GHSA-w24x-87mr-4r23
Aliases: CVE-2022-22980
Published: 2022-06-24T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
OS Command Injection in file editor in Gogs
Advisory: GHSA-67mx-jc2f-jgjm
Aliases: CVE-2022-1986
Published: 2022-06-08T22:34:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

The malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.

### Patches

File deletions are prohibited to repository's `.git` directory. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.

### Workarounds

N/A

### References

https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930/

### For more information

If you have any questions or comments about this advisory, please post on #7000.
Missing Authorization in Jenkins Jianliao Notification Plugin
Advisory: GHSA-v6h8-5cp2-j9w4
Aliases: CVE-2022-34206
Published: 2022-06-24T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Jianliao Notification Plugin 1.1 and earlier allows attackers with Overall/Read permission to send HTTP POST requests to an attacker-specified URL.
Cross Site Scripting vulnerability in django-jsonform's admin form.
Advisory: GHSA-x9jp-4w8m-4f3c
Published: 2022-06-10T19:51:18Z

### Description

django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the `safe` template filter. This opens up possibilities for XSS attacks.

This only affects the admin pages where the django-jsonform is rendered.

### Mitigation

Upgrade to django-jsonform version 2.10.1 or later.

### For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/bhch/django-jsonform/issues).
* Email the maintainer at `Bharat Chauhan <tell.bhch@gmail.com>`.