aswin1906/github-advisory-2022 huggingface dataset:
Jenkins Matrix Reloaded Plugin vulnerable to Stored XSS
Advisory: GHSA-2463-7265-h8r4
Aliases: CVE-2022-34788
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Matrix Reloaded Plugin 1.1.3 and earlier does not escape the agent name in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission.
Improper handling of email input
Advisory: GHSA-pgjx-7f9g-9463
Aliases: CVE-2022-31127
Published: 2022-07-06T19:27:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

### Impact

An attacker can pass a compromised input to the e-mail [signin endpoint](https://next-auth.js.org/getting-started/rest-api#post-apiauthsigninprovider) that contains some malicious HTML, tricking the e-mail server to send it to the user, so they can perform a phishing attack. Eg.: `balazs@email.com, <a href="http://attacker.com">Before signing in, claim your money!</a>`. This was previously sent to `balazs@email.com`, and the content of the email containing a link to the attacker's site was rendered in the HTML. This has been remedied in the following releases, by simply not rendering that e-mail in the HTML, since it should be obvious to the receiver what e-mail they used:

next-auth v3 users before version 3.29.8 are impacted. (We recommend upgrading to v4, as v3 is considered unmaintained. See our [migration guide](https://next-auth.js.org/getting-started/upgrade-v4))

next-auth v4 users before version 4.8.0 are impacted.

### Patches

We've released patches for this vulnerability in:
  
- v3 - `3.29.8`
- v4 - `4.9.0`

You can do:

```sh
npm i next-auth@latest
# or
yarn add next-auth@latest
#
pnpm add next-auth@latest
```

(This will update to the latest v4 version, but you can change  `latest` to `3` if you want to stay on v3. This is not recommended.)

### Workarounds

If for some reason you cannot upgrade, the workaround requires you to sanitize the `email` parameter that is passed to `sendVerificationRequest` and rendered in the HTML. If you haven't created a custom `sendVerificationRequest`, you only need to upgrade. Otherwise, make sure to either exclude `email` from the HTML body or efficiently sanitize it. Check out https://next-auth.js.org/providers/email#customizing-emails

### References


Related documentation:

- https://next-auth.js.org/providers/email#customizing-emails
- https://next-auth.js.org/getting-started/upgrade-v4

A test case has been added so this kind of issue will be checked before publishing. See: https://github.com/nextauthjs/next-auth/blob/cd6ccfde898037290ae949d500ace8a378376cd8/packages/next-auth/tests/email.test.ts

### For more information

If you have any concerns, we request responsible disclosure, outlined here: https://next-auth.js.org/security#reporting-a-vulnerability

### Timeline

The issue was reported 2022 June 29th, a response was sent out to the reporter in less than 1 hour, and after identifying the issue a patch was published within 4 working days.
Jenkins Job Configuration History Plugin does not require POST requests for several HTTP endpoints
Advisory: GHSA-j896-j72w-cr32
Aliases: CVE-2022-36887
Published: 2022-07-28T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Job Configuration History Plugin 1155.v28a_46a_cc06a_5 and earlier allows attackers to delete entries from job, agent, and system configuration history, or restore older versions of job, agent, and system configurations.
RuoYi 4.7.3 vulnerable to arbitrary file upload in background management module
Advisory: GHSA-6w2f-6wq3-rjvf
Aliases: CVE-2022-32065
Published: 2022-07-14T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

An arbitrary file upload vulnerability in the background management module of RuoYi v4.7.3 and below allows attackers to execute arbitrary code via a crafted HTML file.
Insufficiently Protected Credentials in Jenkins Deployment Dashboard Plugin
Advisory: GHSA-5mxg-p5qh-2gch
Aliases: CVE-2022-34796
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Jenkins Repository Connector Plugin does not perform a permission check in a method implementing form validation
Advisory: GHSA-fjpq-f574-jc45
Aliases: CVE-2022-36904
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Repository Connector Plugin 2.2.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
Properties-Reader before v2.2.0 vulnerable to prototype pollution
Advisory: GHSA-jxvf-m3x5-mxwq
Aliases: CVE-2020-28471
Published: 2022-07-19T14:28:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Properties-Reader prior to version 2.2.0 is vulnerable to prototype pollution. Version 2.2.0 contains a patch for this issue.
Insufficient Session Expiration in Nakama
Advisory: GHSA-xv59-gc3r-rf92
Aliases: CVE-2022-2306
Published: 2022-07-06T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Old session tokens can be used to authenticate to the application and send authenticated requests.
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding
Advisory: GHSA-5689-v88g-g6rv
Aliases: CVE-2022-32213
Published: 2022-07-15T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

The llhttp parser in the http module in Node.js v17.x does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).

Impacts:

- All versions of the nodejs 18.x, 16.x, and 14.x releases lines.
- llhttp v6.0.7 and llhttp v2.1.5 contains the fixes that were updated inside Node.js
Missing permission check in Jenkins OpenShift Deployer Plugin
Advisory: GHSA-78fg-pvgg-6g3r
Aliases: CVE-2022-36909
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

OpenShift Deployer Plugin 1.2.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system and to upload a SSH key file from the Jenkins controller file system to an attacker-specified URL.
Lucene-Search Plugin does not perform permission checks in several HTTP endpoints
Advisory: GHSA-m8w5-vwq3-gp8f
Aliases: CVE-2022-36910
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not perform a permission check in several HTTP endpoints, allowing attackers with Overall/Read permission to reindex the database and to obtain information about jobs otherwise inaccessible to them.
Lack of authentication mechanism in Jenkins Git Plugin webhook
Advisory: GHSA-449w-c77c-vmf6
Aliases: CVE-2022-36884
Published: 2022-07-28T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Git Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a `sha1` parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Additionally, this webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability. Git Plugin 4.11.4 requires a `token` parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see [the plugin documentation](https://github.com/jenkinsci/git-plugin/#push-notification-from-repository).
DOS and excessive memory usage when passing untrusted user input to to dag import
Advisory: GHSA-f2gr-7299-487h
Published: 2022-07-06T20:06:56Z

### Impact
go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running `ipfs dag import` on untrusted user inputs, for example, pinning services with a car ingest endpoint.
This include the corresponding [HTTP RPC API `v0/dag/import`](https://docs.ipfs.io/reference/http/api/#api-v0-dag-import) endpoint.

An attacker controlling the car file passed in can also make the node allocate arbitrary sized buffers creating memory exhaustion attacks.

### Patches
0.13.1, 0.14 and later.

#### Forks
For those running on forked versions of go-ipfs, simply updating the version of `github.com/ipld/go-car/v2` you are using to >= v2.4.0 should resolve the issue.

#### Libraries consumers
Any users of libraries within the go-ipfs ecosystem, even if not the go-ipfs package or binary itself, may be affected and should upgrade their dependency on go-car.

You can check if your Go module has a dependency on go-car by running a command such as `go mod graph | grep go-car`  in your module root.

Note: if you are using other libraries, some parts of go-car (`github.com/ipld/go-car/v2/index/...`) have not fully been fixed yet.  Please see [go-car's security advisory](https://github.com/ipld/go-car/security/advisories/GHSA-9x4h-8wgm-8xfg) for more information.  go-ipfs do not make use of this code.

### Workarounds
The best way to work around this is to control exposure to the [HTTP RPC API endpoint for CAR imports](https://docs.ipfs.io/reference/http/api/#api-v0-dag-import) to only work with trusted data.

You can also validate that the car will not crash go-ipfs by running `car verify` on it first (`go install github.com/ipld/go-car/cmd/car@latest`).

### References
See also the [go-car security advisory](https://github.com/ipld/go-car/security/advisories/GHSA-9x4h-8wgm-8xfg).

### For more information
If you have any questions or comments about this advisory:
1. Ask in the [IPFS Discourse](discuss.ipfs.io/)
1. Ask in the [IPFS Discord #ipld-chatter](https://discord.gg/ipfs)
1. Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)
Path Traversal in Beego
Advisory: GHSA-95f9-94vc-665h
Aliases: CVE-2022-31836
Published: 2022-07-06T00:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The `leafInfo.match()` function in Beego v2.0.3 and below uses `path.join()` to deal with wildcardvalues which can lead to cross directory risk.
KubeEdge Cloud AdmissionController component DoS
Advisory: GHSA-w52j-3457-q9wr
Aliases: CVE-2022-31074
Published: 2022-07-11T21:01:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

### Impact
Several endpoints including `/devicemodels`, `/rules`, `/ruleendpoints`, `/offlinemigration` in the Cloud Admissioncontroller may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it.
Only an authenticated user can cause this issue. It will be affected when users deploy a Cloud Admissioncontroller. The consequence of the exhaustion is that the Cloud Admissioncontroller will be in denial of service.

### Patches
This bug has been fixed in Kubeedge 1.11.1, 1.10.2, 1.9.4. Users should update to these versions to resolve the issue.

### Workarounds
At the time of writing, no workaround exists.

### References
NA

### Credits
Thanks David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [kubeedge security policy](https://github.com/kubeedge/kubeedge/security/policy) during a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [KubeEdge repo](https://github.com/kubeedge/kubeedge/issues/new/choose)
* To make a vulnerability report, email your vulnerability to the private [cncf-kubeedge-security@lists.cncf.io](mailto:cncf-kubeedge-security@lists.cncf.io) list with the security details and the details expected for [KubeEdge bug reports](https://github.com/kubeedge/kubeedge/blob/master/.github/ISSUE_TEMPLATE/bug-report.md).
skylot jadx affected by Incorrect Behavior Order in vulnerable dependency
Advisory: GHSA-fjh6-p566-wr6q
Published: 2022-07-21T22:35:12Z

### Impact
Vulnerable library protobuf-java 3.11.4 (CVE-2021-22569)

### Patches
Dependency updated in jadx 1.4.3

### References
According to the AquaSecurity report:
![05F1C52A666E4FCC844ABD085BD55124](https://user-images.githubusercontent.com/118523/177364939-087e2144-9a8a-4594-ae90-eb2acb0a2036.png)

Also, Maven repository have links to this and other vulnerabilities from dependencies:
https://mvnrepository.com/artifact/com.google.protobuf/protobuf-java/3.11.4
Ember.js Potential XSS Exploit When Binding `tagName` to User-Supplied Data
Advisory: GHSA-5m48-c37x-f792
Aliases: CVE-2013-4170
Published: 2022-07-01T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to user-supplied data, a specially-crafted payload could execute arbitrary JavaScript in the context of the current domain ("XSS"). This vulnerability only affects applications that assign or bind user-provided content to `tagName`.
Cross-site Scripting in Jenkins Validating Email Parameter Plugin
Advisory: GHSA-hqmp-vxj7-5wpq
Aliases: CVE-2022-34791
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Validating Email Parameter Plugin 1.10 and earlier does not escape the name and description of its parameter type. 

Additionally, it disables the security hardening added in Jenkins 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix that protects the \"Build With Parameters\" and \"Parameters\" pages from vulnerabilities like this by default.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Cleartext Storage of Sensitive Information in Jenkins Build Notifications Plugin
Advisory: GHSA-7298-w54j-q7wm
Aliases: CVE-2022-34801
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Build Notifications Plugin 1.5.0 and earlier transmits tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.
Lack of authentication mechanism in Jenkins Git Plugin webhook
Advisory: GHSA-8xwj-2wgh-gprh
Aliases: CVE-2022-36882
Published: 2022-07-28T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Git Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication.

This webhook endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Git Plugin 4.11.4 requires a `token` parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see [the plugin documentation](https://github.com/jenkinsci/git-plugin/#push-notification-from-repository).
Terser insecure use of regular expressions leads to ReDoS
Advisory: GHSA-4wf5-vphf-c2xc
Aliases: CVE-2022-25858
Published: 2022-07-16T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
Possible leak of key's raw field if declared length is incorrect
Advisory: GHSA-hm37-9xh2-q499
Aliases: CVE-2022-31124
Published: 2022-07-06T19:24:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact
If a field of a key is shorter than it is declared to be, the parser raises an error with a message containing the raw field value. An attacker able to modify the declared length of a key's sensitive field can thus expose the raw value of that field.

### Patches
Upgrade to version 0.0.6, which no longer includes the raw field value in the error message.

### Workarounds
N/A

### References
N/A

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [openssh_key_parser](https://github.com/scottcwang/openssh_key_parser)
aws-iam-authenticator allow-listed IAM identity may be able to modify their username, escalate privileges before v0.5.9
Advisory: GHSA-pp3f-98qg-5g75
Aliases: CVE-2022-2385
Published: 2022-07-13T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.
Cross-site Scripting in microweber
Advisory: GHSA-q6mp-562x-ggvv
Aliases: CVE-2022-2300
Published: 2022-07-05T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.19.
markdown-it-decorate vulnerable to cross-site scripting (XSS)
Advisory: GHSA-rhf5-2378-3w3w
Aliases: CVE-2020-28459
Published: 2022-07-19T14:16:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

markdown-it-decorate adds attributes, IDs and classes to Markdown, and the most recent version 1.2.2 was published in 2017. All versions are currently vulnerable to cross-site scripting (XSS) and there is no fixed version at this time
Dataease before 1.11.2 access control issue allows attackers to arbitrarily uninstall plugin
Advisory: GHSA-c2pj-rr68-pw94
Aliases: CVE-2022-34112
Published: 2022-07-23T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator. Version 1.11.2 contains a patch for this issue.
Jenkins Lucene-Search Plugin vulnerable to reflected (XSS) cross-site scripting
Advisory: GHSA-6954-h5c8-m29f
Aliases: CVE-2022-36922
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability.
Hardcoded JWT Token in Lin CMS Spring Boot
Advisory: GHSA-q72p-4w56-hx7h
Aliases: CVE-2022-32430
Published: 2022-07-22T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.
Jenkins Coverity Plugin vulnerable to cross-site request forgery (CSRF)
Advisory: GHSA-5x3f-7m52-9cgf
Aliases: CVE-2022-36920
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Svelte vulnerable to XSS when using objects during server-side rendering
Advisory: GHSA-wv8q-r932-8hc7
Aliases: CVE-2022-25875
Published: 2022-07-13T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The package svelte before 3.49.0 is vulnerable to Cross-site Scripting (XSS) due to improper input sanitization and to improper escape of attributes when using objects during SSR (Server-Side Rendering). Exploiting this vulnerability is possible via objects with a custom toString() function.
Java Melody vulnerable to cross-site scripting
Advisory: GHSA-cqhr-jqvc-qw9p
Aliases: CVE-2016-1000273
Published: 2022-07-20T01:36:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.
Jenkins RQM Plugin allows enumerating credentials IDs due to missing permission check
Advisory: GHSA-2348-ccqj-8p27
Aliases: CVE-2022-34810
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins RQM Plugin 2.8 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
Advisory: GHSA-qh9x-gcfh-pcrw
Aliases: CVE-2022-31170
Published: 2022-07-21T22:33:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

`ERC165Checker.supportsInterface` is designed to always successfully return a boolean, and under no circumstance revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-165 as expected, specifically if it returns a value other than 0 or 1.

The contracts that may be affected are those that use `ERC165Checker` to check for support for an interface and then handle the lack of support in a way other than reverting.

### Patches

The issue was patched in 4.7.1.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552

### For more information

If you have any questions or comments about this advisory, or need assistance deploying the fix, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).
Incorrect Authorization in Jenkins requests-plugin
Advisory: GHSA-6xhf-xx3j-75f5
Aliases: CVE-2022-34782
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

An incorrect permission check in Jenkins requests-plugin Plugin 2.2.16 and earlier allows attackers with Overall/Read permission to view the list of pending requests. requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests.

This is basically the same vulnerability as [SECURITY-1995](https://www.jenkins.io/security/advisory/2021-06-30/#SECURITY-1995), whose fix was ineffective.

requests-plugin Plugin 2.2.17 requires Overall/Administer permission to view the list of pending requests.
Plaintext Storage of a Password in Jenkins OpsGenie Plugin
Advisory: GHSA-273c-fjw8-v2w8
Aliases: CVE-2022-34803
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file and in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission (config.xml), or access to the Jenkins controller file system.
rpc.py vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-8rq8-f485-7v8x
Aliases: CVE-2022-35411
Published: 2022-07-09T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent. In other words, although JSON (not Pickle) is the default data format, an unauthenticated client can cause the data to be processed with unpickle.

[Per the maintainer](https://github.com/abersheeran/rpc.py/issues/22), rpc.py is not designed for an API that is open to the outside world, and external requests cannot reach rpc.py in real world use.

A [fix](https://github.com/abersheeran/rpc.py/commit/491e7a841ed9a754796d6ab047a9fb16e23bf8bd) exists on the `master` branch. As a workaround, use the following code to turn off pickle in older versions:
```
del SERIALIZER_NAMES[PickleSerializer.name]
del SERIALIZER_TYPES[PickleSerializer.content_type]
Mattermost users could access some sensitive information via API call
Advisory: GHSA-7ggc-5r84-xf54
Aliases: CVE-2022-2401
Published: 2022-07-15T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
Improper Restriction of Excessive Authentication Attempts
Advisory: GHSA-8r94-4h3c-939f
Aliases: CVE-2022-2321
Published: 2022-07-06T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nakama Console does not enforce any limit for the number of unsuccessful login attempts.
Jenkins Deployer Framework Plugin does not restrict application path of applications when configuring a deployment
Advisory: GHSA-j5qq-6rpm-qjgh
Aliases: CVE-2022-36889
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Deployer Framework Plugin 85.v1d1888e8c021 and earlier does not restrict the application path of the applications when configuring a deployment, allowing attackers with Item/Configure permission to upload arbitrary files from the Jenkins controller file system to the selected service.
OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor
Advisory: GHSA-6f85-3f8q-qc94
Published: 2022-07-15T19:25:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

# Impact
Due to insufficient class name validation in GrapeJS library it's possible to add executable JS code in class name through Selector Manager

# Relates to
 - [https://github.com/artf/grapesjs/issues/4411](https://github.com/artf/grapesjs/issues/4411)

# Patch
Update GrapeJS dependency to >=[v0.19.5](https://github.com/artf/grapesjs/releases/tag/v0.19.5)
Apache Spark UI can allow impersonation if ACLs enabled
Advisory: GHSA-4x9r-j582-cgr8
Aliases: CVE-2022-33891
Published: 2022-07-19T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The Apache Spark UI offers the possibility to enable ACLs via the configuration option `spark.acls.enable`. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

A previous version of this advisory incorrectly stated that version 3.1.3 was not vulnerable. Per [GHSA-59hw-j9g6-mfg3](https://github.com/advisories/GHSA-59hw-j9g6-mfg3), version 3.1.3 is vulnerable and vulnerable version ranges in this advisory have been changed to reflect the correct information.
Apache Tapestry 5.8.1 vulnerable to ReDoS via Content Types causing catastrophic backtracking
Advisory: GHSA-227g-7cvv-6ff3
Aliases: CVE-2022-31781
Published: 2022-07-14T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.
Apache Calcite Avatica JDBC driver arbitrary code execution
Advisory: GHSA-w7f5-jrpr-5c2m
Aliases: CVE-2022-36364
Published: 2022-07-29T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor.
Jetty SslConnection does not release pooled ByteBuffers in case of errors
Advisory: GHSA-8mpp-f3f7-xc28
Aliases: CVE-2022-2191
Published: 2022-07-07T20:55:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
`SslConnection` does not release `ByteBuffer`s in case of error code paths.
For example, TLS handshakes that require client-auth with clients that send expired certificates will trigger a TLS handshake errors and the `ByteBuffer`s used to process the TLS handshake will be leaked.

### Workarounds
Configure explicitly a `RetainableByteBufferPool` with `max[Heap|Direct]Memory` to limit the amount of memory that is leaked.
Eventually the pool will be full of "active" entries (the leaked ones) and will provide `ByteBuffer`s that will be GCed normally.

_With embedded-jetty_

``` java
int maxBucketSize = 1000;
long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB
long maxDirectMemory = 128 * 1024L * 1024L; // 128 MB
RetainableByteBufferPool rbbp = new ArrayRetainableByteBufferPool(0, -1, -1, maxBucketSize, maxHeapMemory, maxDirectMemory);

server.addBean(rbbp); // make sure the ArrayRetainableByteBufferPool is added before the server is started
server.start();
```

_With jetty-home/jetty-base_

Create a `${jetty.base}/etc/retainable-byte-buffer-config.xml`

``` xml
<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">

<Configure id="Server" class="org.eclipse.jetty.server.Server">
  <Call name="addBean">
    <Arg>
      <New class="org.eclipse.jetty.io.ArrayRetainableByteBufferPool">
        <Arg type="int"><Property name="jetty.byteBufferPool.minCapacity" default="0"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.factor" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxCapacity" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxBucketSize" default="1000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxHeapMemory" default="128000000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxDirectMemory" default="128000000"/></Arg>
      </New>
    </Arg>
  </Call>
</Configure>
```

And then reference it in `${jetty.base}/start.d/retainable-byte-buffer-config.ini`

```
etc/retainable-byte-buffer-config.xml
```


### References
https://github.com/eclipse/jetty.project/issues/8161

### For more information
* Email us at [security@webtide.com](mailto:security@webtide.com)
Cross-site Scripting in Jenkins Plot Plugin
Advisory: GHSA-hpf7-mmqw-g6vq
Aliases: CVE-2022-34783
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
OS Command Injection in awesome spawn
Advisory: GHSA-qpqw-mc85-qvm9
Aliases: CVE-2014-0156
Published: 2022-07-01T00:01:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Awesome spawn prior to version 1.2.0 contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.
OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers
Advisory: GHSA-4g63-c64m-25w9
Aliases: CVE-2022-31172
Published: 2022-07-21T22:33:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

`SignatureChecker.isValidSignatureNow` is not expected to revert. However, an incorrect assumption about Solidity 0.8's `abi.decode` allows some cases to revert, given a target contract that doesn't implement EIP-1271 as expected.

The contracts that may be affected are those that use `SignatureChecker` to check the validity of a signature and handle invalid signatures in a way other than reverting. We believe this to be unlikely.

### Patches

The issue was patched in 4.7.1.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3552

### For more information

If you have any questions or comments about this advisory, or need assistance deploying the fix, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).
Jenkins Files Found Trigger Plugin allows attackers to check for existence of attacker-specified file path on Jenkins controller file system
Advisory: GHSA-jj8j-6jq7-gmvh
Aliases: CVE-2022-36914
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Files Found Trigger Plugin 1.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.
undici before v5.8.0 vulnerable to CRLF injection in request headers
Advisory: GHSA-3cvr-822r-rqcc
Aliases: CVE-2022-31150
Published: 2022-07-21T20:30:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact

It is possible to inject CRLF sequences into request headers in Undici.

```js
const undici = require('undici')

const response = undici.request("http://127.0.0.1:1000", {
  headers: {'a': "\r\nb"}
})
```

The same applies to `path` and `method`

### Patches

Update to v5.8.0

### Workarounds

Sanitize all HTTP headers from untrusted sources to eliminate `\r\n`.

### References

https://hackerone.com/reports/409943
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12116

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [undici repository](https://github.com/nodejs/undici/issues)
* To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document
Missing Authorization in Jenkins XPath Configuration Viewer Plugin
Advisory: GHSA-3fj7-78h2-w98x
Aliases: CVE-2022-34813
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins XPath Configuration Viewer Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to create and delete XPath expressions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in pycares
Advisory: GHSA-c58j-88f5-h53f
Published: 2022-07-05T22:08:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

### Impact

pycares versions < 4.2.0 are affected by [CVE-2021-3672](https://nvd.nist.gov/vuln/detail/CVE-2021-3672).

### Patches

Update to version 4.2.0.
SatyaLab opendiamond 10.1.1 vulnerable to path traversal because Flask send_file function used unsafely
Advisory: GHSA-x2pc-fqrw-hc7f
Aliases: CVE-2022-31506
Published: 2022-07-12T00:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. A patch is available on the `master` branch of the repository.
Jenkins Coverity Plugin allows attackers with Overall/Read permission to enumerate credentials IDs
Advisory: GHSA-x7w4-vfrh-fc3h
Aliases: CVE-2022-36919
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Coverity Plugin 1.11.4 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
XML External Entity Reference in Eclipse Lyo
Advisory: GHSA-6296-mvgp-27hp
Aliases: CVE-2021-41042
Published: 2022-07-08T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.
LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0
Advisory: GHSA-768m-5w34-2xf5
Aliases: CVE-2022-31157
Published: 2022-07-15T20:55:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

The function used to generate random nonces was not sufficiently cryptographically complex. As a result values may be predictable and tokens may be forgable.

### Patches

Users should upgrade to version 5.0 immediately

### Workarounds

None.
Moment.js vulnerable to Inefficient Regular Expression Complexity
Advisory: GHSA-wc69-rhjr-hc9g
Aliases: CVE-2022-31129
Published: 2022-07-06T18:38:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

* using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs
* noticeable slowdown is observed with inputs above 10k characters
* users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks

### Patches
The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking.

### Workarounds
In general, given the proliferation of ReDoS attacks, it makes sense to limit the length of the user input to something sane, like 200 characters or less. I haven't seen legitimate cases of date-time strings longer than that, so all moment users who do pass a user-originating string to constructor are encouraged to apply such a rudimentary filter, that would help with this but also most future ReDoS vulnerabilities.

### References
There is an excellent writeup of the issue here: https://github.com/moment/moment/pull/6015#issuecomment-1152961973=

### Details
The issue is rooted in the code that removes legacy comments (stuff inside parenthesis) from strings during rfc2822 parsing. `moment("(".repeat(500000))` will take a few minutes to process, which is unacceptable.
KubeEdge DoS when signing the CSR from EdgeCore
Advisory: GHSA-x3px-2p95-f6jr
Aliases: CVE-2022-31075
Published: 2022-07-11T21:04:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

### Impact
EdgeCore may be susceptible to a DoS attack on CloudHub if an attacker was to send a well-crafted HTTP request to `/edge.crt`.
If an attacker can send a well-crafted HTTP request to CloudHub, and that request has a very large body, that request could crash the HTTP service through a memory exhaustion vector. The request body is being read into memory, and a body that was larger than the available memory could lead to a successful attack.
Because the request would have to make it through authorization, only authorized users could perform this attack. The consequence of the exhaustion is that CloudHub will be in denial of service. It will be affected only when users enable the CloudHub module in the file `cloudcore.yaml` as below:
```
modules:
  ...
  cloudHub:
    enable: true
```

### Patches
This bug has been fixed in Kubeedge 1.11.1, 1.10.2, 1.9.4. Users should update to these versions to resolve the issue.

### Workarounds
Disable the CloudHub module in the config file `cloudcore.yaml`.

### References
NA

### Credits
Thanks David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [kubeedge security policy](https://github.com/kubeedge/kubeedge/security/policy) during a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [KubeEdge repo](https://github.com/kubeedge/kubeedge/issues/new/choose)
* To make a vulnerability report, email your vulnerability to the private [cncf-kubeedge-security@lists.cncf.io](mailto:cncf-kubeedge-security@lists.cncf.io) list with the security details and the details expected for [KubeEdge bug reports](https://github.com/kubeedge/kubeedge/blob/master/.github/ISSUE_TEMPLATE/bug-report.md).
Jenkins rhnpush-plugin does not perform a permission check in a method implementing form validation
Advisory: GHSA-w8gx-4r6w-3rx9
Aliases: CVE-2022-36892
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins rhnpush-plugin Plugin 0.5.1 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
conf-cfg-ini Prototype Pollution via malicious INI file before v1.2.2
Advisory: GHSA-m6mg-jvjf-w44x
Aliases: CVE-2020-28441
Published: 2022-07-26T00:01:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This affects the package conf-cfg-ini before 1.2.2. If an attacker submits a malicious INI file to an application that parses it with decode, they will pollute the prototype on the application. This can be exploited further depending on the context.
ChainerRL Visualizer 0.1.1 vulnerable to Path Traversal via unsafe use of send_file function
Advisory: GHSA-687h-86vc-5x59
Aliases: CVE-2022-31573
Published: 2022-07-12T00:00:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Jenkins Compuware Xpediter Code Coverage Plugin Missing Authorization
Advisory: GHSA-hxf7-9rv9-88v6
Aliases: CVE-2022-36897
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Compuware Xpediter Code Coverage Plugin 1.0.7 and earlier allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins.
Cross-Site Request Forgery in Jenkins Recipe Plugin
Advisory: GHSA-hv54-cc8f-42jq
Aliases: CVE-2022-34792
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins Recipe Plugin 1.2 and earlier allows attackers to send an HTTP request to an attacker-specified URL and parse the response as XML.
Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization.
Advisory: GHSA-v3p8-j597-3xg8
Aliases: CVE-2021-34538
Published: 2022-07-17T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Hive before 3.1.3 `CREATE` and `DROP` function operations do not check for necessary authorization of involved entities in the query. It was found that an unauthorized user can manipulate an existing UDF without having the privileges to do so. This allowed unauthorized or underprivileged users to drop and recreate UDFs pointing them to new jars that could be potentially malicious.
Hyperledger Fabric vulnerable to Improper Input Validation in orderer/common/cluster consensus request
Advisory: GHSA-72x4-cq6r-jp4p
Aliases: CVE-2022-31121
Published: 2022-07-08T17:06:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
If a consensus client sends a malformed consensus request to an orderer it may crash the orderer node.
This fix checks for the malformed consensus request and returns an error to the consensus client.

### Patches
Fixed in v2.2.7 and v2.4.5.

### Workarounds
None, users must upgrade to v2.2.7 or v2.4.5.

### References
https://github.com/hyperledger/fabric/releases/tag/v2.2.7
https://github.com/hyperledger/fabric/releases/tag/v2.4.5

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Hyperledger Fabric repository](https://github.com/hyperledger/fabric/issues)

### Credits
Thank you to Haosheng Wang of OPPO ZIWU Security Lab for this disclosure.
Arbitrary file write vulnerability in Jenkins CLIF Performance Testing plugin
Advisory: GHSA-6xf5-c3cx-67pv
Aliases: CVE-2022-36894
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An arbitrary file write vulnerability in Jenkins CLIF Performance Testing Plugin 64.vc0d66de1dfb_f and earlier allows attackers with Overall/Read permission to create or replace arbitrary files on the Jenkins controller file system with attacker-specified content.
Plaintext Storage of a Password in Jenkins Deployment Dashboard Plugin
Advisory: GHSA-56hc-wf49-2h96
Aliases: CVE-2022-34799
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Deployment Dashboard Plugin 1.0.10 and earlier stores a password unencrypted in its global configuration file `de.codecentric.jenkins.dashboard.DashboardView.xml` on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file system.
WMAgent arbitrary code execution via a crafted dbs-client package
Advisory: GHSA-4vq7-8699-4xgc
Aliases: CVE-2022-34558
Published: 2022-07-29T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.