aswin1906/github-advisory-2022 huggingface dataset:
Jenkins Android Signing Plugin allows attackers to check whether attacker-specified file patterns match workspace contents
Advisory: GHSA-vp68-fm96-7v79
Aliases: CVE-2022-36915
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Android Signing Plugin 2.2.5 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
Undertow vulnerable to memory exhaustion due to buffer leak
Advisory: GHSA-fj7c-vg2v-ccrm
Aliases: CVE-2021-3690
Published: 2022-07-15T21:07:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Buffer leak on incoming WebSocket PONG message(s) in Undertow before 2.0.40 and 2.2.10 can lead to memory exhaustion and allow a denial of service.
Microweber before 1.2.21 vulnerable to reflected XSS
Advisory: GHSA-cfcg-2qgr-v243
Aliases: CVE-2022-2470
Published: 2022-07-23T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Microweber prior to 1.2.21 is vulnerable to reflected cross-site scripting (XSS).
otp-generator before v3.0.0 insecurely generates random one-time passwords
Advisory: GHSA-6x93-h9g3-9phr
Aliases: CVE-2021-23451
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package otp-generator before 3.0.0 are vulnerable to Insecure Randomness due to insecure generation of random one-time passwords, which may allow a brute-force attack.
openssl-src heap memory corruption with RSA private key operation
Advisory: GHSA-735f-pg76-fxc4
Aliases: CVE-2022-2274
Published: 2022-07-02T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happen during the computation. As a consequence of the memory corruption an attacker may be able to trigger a remote code execution on the machine performing the computation. SSL/TLS servers or other servers using 2048 bit RSA private keys running on machines supporting AVX512IFMA instructions of the X86_64 architecture are affected by this issue.
Jenkins GitHub plugin 1.34.4 uses weak webhook signature function
Advisory: GHSA-mxcc-7h5m-x57r
Aliases: CVE-2022-36885
Published: 2022-07-28T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins GitHub Plugin 1.34.4 and earlier uses a non-constant time comparison function when checking whether the provided and computed webhook signatures are equal, allowing attackers to use statistical methods to obtain a valid webhook signature. GitHub Plugin 1.34.5 uses a constant-time comparison when validating the webhook signature.
lxml NULL Pointer Dereference allows attackers to cause a denial of service
Advisory: GHSA-wrxv-2j5q-m38w
Aliases: CVE-2022-2309
Published: 2022-07-06T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.
AES OCB fails to encrypt some bytes
Advisory: GHSA-3wx7-46ch-7rq2
Aliases: CVE-2022-2097
Published: 2022-07-06T19:57:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimized implementation will not encrypt the entirety of the data under some circumstances.  This could reveal sixteen bytes of data that was pre-existing in the memory that wasn't written.  In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed.

Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected.
Whoogle Search Cross-site Scripting via string parameter
Advisory: GHSA-mxvc-fwgx-j778
Aliases: CVE-2022-25303
Published: 2022-07-15T15:37:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

The package whoogle-search before version 0.7.2 is vulnerable to Cross-site Scripting (XSS) via the query string parameter q. In the case where it does not contain the http string, it is used to build the error_message that is then rendered in the error.html template, using the [flask.render_template](https://flask.palletsprojects.com/en/2.1.x/api/flask.render_template) function. However, the error_message is rendered using the [| safe filter](https://jinja.palletsprojects.com/en/3.1.x/templates/working-with-automatic-escaping), meaning the user input is not escaped.
Passport vulnerable to session regeneration when a users logs in or out
Advisory: GHSA-v923-w3x8-wh69
Aliases: CVE-2022-25896
Published: 2022-07-02T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
set-deep-prop Prototype Pollution
Advisory: GHSA-v42q-78w8-8fcc
Aliases: CVE-2021-23373
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality.
opensearch-ruby 2.x before 2.0.2 vulnerable to unsafe YAML deserialization
Advisory: GHSA-977c-63xq-cgw3
Aliases: CVE-2022-31115
Published: 2022-07-05T20:41:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Impact
A YAML deserialization in opensearch-ruby 2.0.0 can lead to unsafe deserialization using YAML.load if the response is of type YAML.

### Patches
The problem has been patched in opensearch-ruby gem version 2.0.2.

### Workarounds
No viable workaround.  Please upgrade to 2.0.2

### References
https://github.com/opensearch-project/opensearch-ruby/pull/77
https://staaldraad.github.io/post/2021-01-09-universal-rce-ruby-yaml-load-updated/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [opensearch-ruby](https://github.com/opensearch-project/opensearch-ruby)
google-cloudstorage-commands Command Injection vulnerability
Advisory: GHSA-6367-p3v8-7mgw
Aliases: CVE-2020-28436
Published: 2022-07-26T00:01:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of the deprecated package google-cloudstorage-commands.
Apache Druid before 0.23.0 vulnerable to reflected XSS via unescaped URL parameters
Advisory: GHSA-8rmv-98m4-g5c6
Aliases: CVE-2021-44791
Published: 2022-07-08T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks. This issue is patched in version 0.23.0.
fs2-io skips mTLS client verification
Advisory: GHSA-2cpx-6pqp-wf35
Aliases: CVE-2022-31183
Published: 2022-07-29T22:24:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = true` is ignored, peer certificate verification is skipped, and the connection proceeds.

The vulnerability is limited to:
1. `fs2-io` running on Node.js. The JVM TLS implementation is completely independent.
2. `TLSSocket`s in server-mode. Client-mode `TLSSocket`s are implemented via a different API.
3. mTLS as enabled via `requestCert = true` in `TLSParameters`. The default setting is `false` for server-mode `TLSSocket`s.

It was introduced with the initial Node.js implementation of fs2-io in v3.1.0.

### Patches

A patch is released in v3.2.11. The `requestCert = true` parameter is respected and the peer certificate is verified. If verification fails, a `SSLException` is raised.

### Workarounds

If using an unpatched version on Node.js, do not use a server-mode `TLSSocket` with `requestCert = true` to establish a mTLS connection.

### References
- https://github.com/nodejs/node/issues/43994
- https://www.cloudflare.com/learning/access-management/what-is-mutual-tls/

### For more information
If you have any questions or comments about this advisory:
* [Open an issue.](https://github.com/typelevel/fs2/issues/new/choose)
* Contact the [Typelevel Security Team](https://github.com/typelevel/.github/blob/main/SECURITY.md).
Known v1.3.1 contains Insecure Direct Object Reference
Advisory: GHSA-4v4p-87m3-5423
Aliases: CVE-2022-30852
Published: 2022-07-09T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).

The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.
SQL Injection found in Dataease 
Advisory: GHSA-hmvw-66jm-h9fh
Aliases: CVE-2022-34114
Published: 2022-07-23T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter `dataSourceId`. Version 1.11.2 contains a fix.
ntesseract vulnerable to Command Injection
Advisory: GHSA-w868-4576-rv24
Aliases: CVE-2020-28446
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package ntesseract before 0.2.9 is vulnerable to Command Injection via lib/tesseract.js.
Active Record RCE bug with Serialized Columns
Advisory: GHSA-3hhc-qp5v-9p2j
Aliases: CVE-2022-32224
Published: 2022-07-12T19:39:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE.

There are no feasible workarounds for this issue, but other coders (such as JSON) are not impacted.
Jenkins Google Cloud Backup Plugin allows attackers with Overall/Read permission to request a manual backup.
Advisory: GHSA-9xhm-6w5p-335v
Aliases: CVE-2022-36917
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A missing permission check in Jenkins Google Cloud Backup Plugin 0.6 and earlier allows attackers with Overall/Read permission to request a manual backup.
Feehi CMS Cross-site Scripting
Advisory: GHSA-25q6-m425-9fqr
Aliases: CVE-2022-34140
Published: 2022-07-29T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability in `/index.php?r=site%2Fsignup` of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.
Microweber before v1.2.20 vulnerable to cross-site scripting
Advisory: GHSA-gmh3-x5w7-jg5m
Aliases: CVE-2022-2353
Published: 2022-07-10T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Prior to Microweber v1.2.20, due to improper neutralization of input, an attacker can steal tokens to perform cross-site request forgery (CSRF), fetch contents from same-site and redirect a user.
xopen is vulnerable to OS Command Injection in Exported Function xopen(filepath)
Advisory: GHSA-74wf-cwjg-9cf2
Aliases: CVE-2020-28447
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function `xopen(filepath)`.
file-type vulnerable to Infinite Loop via malformed MKV file
Advisory: GHSA-mhxj-85r3-2x55
Aliases: CVE-2022-36313
Published: 2022-07-22T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the file-type package from 13.0.0 until 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack when used on a web server.
Apache Superset allows authenticated users to access metadata they have no permission to
Advisory: GHSA-748r-5r8q-273m
Aliases: CVE-2021-37839
Published: 2022-07-07T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
Advisory: GHSA-w82x-xjjr-cjr5
Aliases: CVE-2022-32060
Published: 2022-07-08T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
Jenkins Repository Connector Plugin allows attackers with Overall/Read permission to enumerate credentials IDs
Advisory: GHSA-76pg-mr9v-5vwc
Aliases: CVE-2022-36903
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A missing permission check in Jenkins Repository Connector Plugin 2.2.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Jenkins Compuware Source Code Download is missing authorization
Advisory: GHSA-75fc-fv3p-xh82
Aliases: CVE-2022-36896
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.12 and earlier does not perform permission checks in several HTTP endpoints.

This allows attackers with Overall/Read permission to enumerate hosts and ports of Compuware configurations and credentials IDs of credentials stored in Jenkins. Those credentials IDs can be used as part of an attack to capture the credentials using another vulnerability.

BMC Compuware Source Code Download for Endevor, PDS, and ISPW Plugin 2.0.13 requires the appropriate permissions to enumerate hosts and ports of Compuware configurations and credentials IDs.
async-graphql / async-graphql - @DOS GraphQL Nested Fragments overflow
Advisory: GHSA-xq3c-8gqm-v648
Published: 2022-07-29T22:22:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

Executing deeply nested queries may cause stack overflow.

### Patches

Upgrade to `v4.0.6`
Use of Hard-coded Credentials in Nacos
Advisory: GHSA-2g86-r6w2-wqqr
Aliases: CVE-2021-43116
Published: 2022-07-06T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.
Jenkins rpmsign-plugin before 0.5.1 does not perform a permission check in a method implementing form validation
Advisory: GHSA-pw4g-jcp5-63m9
Aliases: CVE-2022-36893
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins rpmsign-plugin Plugin 0.5.0 and earlier does not perform a permission check in a method implementing form validation, allowing attackers with Item/Read permission but without Item/Workspace or Item/Configure permission to check whether attacker-specified file patterns match workspace contents.
undici before v5.8.0 vulnerable to uncleared cookies on cross-host / cross-origin redirect
Advisory: GHSA-q768-x9m6-m9qp
Aliases: CVE-2022-31151
Published: 2022-07-21T20:31:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact

Authorization headers are already cleared on cross-origin redirect in
https://github.com/nodejs/undici/blob/main/lib/handler/redirect.js#L189, based on https://github.com/nodejs/undici/issues/872.

However, cookie headers which are sensitive headers and are official headers found in the spec, remain uncleared. There also has been active discussion of implementing a cookie store https://github.com/nodejs/undici/pull/1441, which suggests that there are active users using cookie headers in undici.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.

### Patches

This was patched in v5.8.0.

### Workarounds

By default, this vulnerability is not exploitable.
Do not enable redirections, i.e. `maxRedirections: 0` (the default). 

### References

https://hackerone.com/reports/1635514
https://curl.se/docs/CVE-2018-1000007.html
https://curl.se/docs/CVE-2022-27776.html

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [undici repository](https://github.com/nodejs/undici/issues)
* To make a report, follow the [SECURITY](https://github.com/nodejs/node/blob/HEAD/SECURITY.md) document
Grails framework Remote Code Execution via Data Binding
Advisory: GHSA-6rh6-x8ww-9h97
Aliases: CVE-2022-35912
Published: 2022-07-21T21:38:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
A vulnerability has been discovered in the Grails data-binding logic which allows for Remote Code Execution in a Grails application. This exploit requires the application to be running on Java 8, either deployed as a WAR to a servlet container, or an executable JAR.  

### Patches
Grails framework versions 5.2.1, 5.1.9, 4.1.1, and 3.3.15

### References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-35912
https://grails.org/blog/2022-07-18-rce-vulnerability.html

### For more information
If you have any questions or comments about this advisory:
* https://grails.org/blog/2022-07-18-rce-vulnerability.html
*  https://github.com/grails/grails-core/issues/12626
* Email us at [info@grails.org](mailto:info@grails.org)

### Credit

This vulnerability was discovered by  [meizjm3i](https://github.com/meizjm3i) and [codeplutos](https://github.com/codeplutos) of AntGroup FG Security Lab
sonar-wrapper Command Injection vulnerability
Advisory: GHSA-wr4v-3f2h-6hhh
Aliases: CVE-2020-28443
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A command injection vulnerability affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.
Fava vulnerable to Reflected Cross-site Scripting before v1.22.2
Advisory: GHSA-q8hg-3vqv-f8v3
Aliases: CVE-2022-2523
Published: 2022-07-26T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2.
The `query_string` parameter of Fava is vulnerable to reflected cross-site scripting, for which a attacker can modify any information that the user is able to modify. This issue is fixed in version 1.22.2.
Stored XSS vulnerability in Jenkins Dynamic Extended Choice Parameter plugin
Advisory: GHSA-jvvx-hmmr-rhgg
Aliases: CVE-2022-36902
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Mistune vulnerable to catastrophic backtracking
Advisory: GHSA-fw3v-x4f2-v673
Aliases: CVE-2022-34749
Published: 2022-07-26T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

In Mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
KubeEdge Edge ServiceBus module DoS
Advisory: GHSA-vwm6-qc77-v2rh
Aliases: CVE-2022-31073
Published: 2022-07-11T21:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
The ServiceBus server on the edge side may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to it.
It is possible for the node to be exhausted of memory. The consequence of the exhaustion is that other services on the node, e.g. other containers, will be unable to allocate memory and thus causing a denial of service.
Malicious Apps which by accident pulled by users on the host and have the access to send HTTP requests to localhost may make an attack. It will be affected only when users enable the `ServiceBus` module in the config file `edgecore.yaml` as below:
```
modules:
  ...
  serviceBus:
    enable: true
```

### Patches
This bug has been fixed in Kubeedge 1.11.1, 1.10.2, 1.9.4. Users should update to these versions to resolve the issue.

### Workarounds
Disable the ServiceBus module in the config file `edgecore.yaml`.

### References
NA

### Credits
Thanks David Korczynski and Adam Korczynski of ADA Logics for responsibly disclosing this issue in accordance with the [kubeedge security policy](https://github.com/kubeedge/kubeedge/security/policy) during a security audit sponsored by CNCF and facilitated by OSTIF.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [KubeEdge repo](https://github.com/kubeedge/kubeedge/issues/new/choose)
* To make a vulnerability report, email your vulnerability to the private [cncf-kubeedge-security@lists.cncf.io](mailto:cncf-kubeedge-security@lists.cncf.io) list with the security details and the details expected for [KubeEdge bug reports](https://github.com/kubeedge/kubeedge/blob/master/.github/ISSUE_TEMPLATE/bug-report.md).
Apache Xalan Java XSLT library integer truncation issue when processing malicious XSLT stylesheets
Advisory: GHSA-9339-86wc-4qgf
Aliases: CVE-2022-34169
Published: 2022-07-20T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode.

A fix for this issue was published in September 2022 as part of an anticipated 2.7.3 release.
glob-parent 6.0.0 vulnerable to Regular Expression Denial of Service
Advisory: GHSA-cj88-88mr-972w
Aliases: CVE-2021-35065
Published: 2022-07-18T17:03:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

glob-parent 6.0.0 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1.

This vulnerability is separate from [GHSA-ww39-953v-wcq6](https://github.com/advisories/GHSA-ww39-953v-wcq6).
Missing permission checks in Jenkins openstack-heat Plugin
Advisory: GHSA-hm53-hrhh-gwfq
Aliases: CVE-2022-36912
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

openstack-heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified URL.
Cross-site Scripting in Jenkins Deployment Dashboard Plugin
Advisory: GHSA-7rrx-375m-j6cr
Aliases: CVE-2022-34795
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Deployment Dashboard Plugin 1.0.10 and earlier does not escape environment names on its Deployment Dashboard view, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.
Missing Authorization in Jenkins Recipe Plugin
Advisory: GHSA-j33r-cgm6-pv48
Aliases: CVE-2022-34794
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Missing permission checks in Jenkins Recipe Plugin 1.2 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.

Additionally, the plugin allows users to export the full configuration of jobs as part of a recipe, granting access to job configuration XML data to every user with Item/Read permission. The encrypted values of secrets stored in the job configuration are not redacted, as they would be by the config.xml API for users without Item/Configure permission.
CSRF vulnerability in Jenkins XebiaLabs XL Release Plugin allow capturing credentials
Advisory: GHSA-h7pf-h58r-mv93
Aliases: CVE-2022-34780
Published: 2022-07-01T00:01:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

XebiaLabs XL Release Plugin 22.0.0 and earlier does not perform permission checks in methods implementing form validation.

This allows attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

XebiaLabs XL Release Plugin 22.0.1 requires POST requests and Overall/Administer permission for the affected form validation methods.
Agent-to-controller security bypass in Jenkins BMC Compuware ISPW Operations plugin
Advisory: GHSA-57f2-52wj-7vj6
Aliases: CVE-2022-36899
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

BMC Compuware ISPW Operations Plugin defines a controller/agent message that retrieves Java system properties. BMC Compuware ISPW Operations Plugin 1.0.8 and earlier does not restrict execution of the controller/agent message to agents. This allows attackers able to control agent processes to retrieve Java system properties. This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3). BMC Compuware ISPW Operations plugin 1.0.9 does not allow the affected controller/agent message to be submitted by agents for execution on the controller.
Microsoft: CBC Padding Oracle in Azure Blob Storage Encryption Library
Advisory: GHSA-64x4-9hc6-r2h6
Aliases: CVE-2022-30187
Published: 2022-07-13T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

### Summary

The Azure Storage Encryption library in Java and other languages is vulnerable to a CBC Padding Oracle attack, similar to CVE-2020-8911. The library is not vulnerable to the equivalent of CVE-2020-8912, but only because it currently only supports AES-CBC as encryption mode. 

### Severity

Moderate - The vulnerability poses insider risks/privilege escalation risks, circumventing controls for stored data.

### Further Analysis
The Java Azure Blob Storage Encryption SDK is impacted by an issue that can result in loss of confidentiality and message forgery. The attack requires write access to the container in question, and that the attacker has access to an endpoint that reveals decryption failures (without revealing the plaintext) and that when encrypting the CBC option was chosen as content cipher.

This advisory describes the plaintext revealing vulnerabilities in the Java Azure Blob Storage Encryption SDK, with a similar issue in the other blob storage SDKs being present as well.

In the current version of the Azure Blob Storage crypto SDK, the only algorithm option that allows users to encrypt files is to AES-CBC, without computing a MAC on the data.

This exposes a padding oracle vulnerability: If the attacker has write access to the blob container bucket and can observe whether or not an endpoint with access to the key can decrypt a file (without observing the file contents that the endpoint learns in the process), they can reconstruct the plaintext with (on average) 128*length(plaintext) queries to the endpoint, by exploiting CBC's ability to manipulate the bytes of the next block and PKCS5 padding errors.

### Timeline
**Date reported**: March 29 2022
**Date preview**: June 16 2022
**Date GA**: July 11 2022
**Date disclosed**: July 17 2022
Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service
Advisory: GHSA-wgmr-mf83-7x4j
Aliases: CVE-2022-2048
Published: 2022-07-07T20:55:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Description
Invalid HTTP/2 requests (for example, invalid URIs) are incorrectly handled by writing a blocking error response directly from the selector thread.
If the client manages to exhaust the HTTP/2 flow control window, or TCP congest the connection, the selector thread will be blocked trying to write the error response.
If this is repeated for all the selector threads, the server becomes unresponsive, causing the denial of service.

### Impact
A malicious client may render the server unresponsive.

### Patches
The fix is available in Jetty versions 9.4.47. 10.0.10, 11.0.10.

### Workarounds
No workaround available within Jetty itself.
One possible workaround is to filter the requests before sending them to Jetty (for example in a proxy)

### For more information
If you have any questions or comments about this advisory:
* Email us at security@webtide.com.
jquery-validation Regular Expression Denial of Service due to arbitrary input to url2 method
Advisory: GHSA-ffmh-x56j-9rc3
Aliases: CVE-2022-31147
Published: 2022-07-05T22:56:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Incomplete fix of CVE-2021-43306: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the jquery-validation npm package, when an attacker is able to supply arbitrary input to the url2 method.
Microweber Stored Cross-site Scripting before v1.2.20
Advisory: GHSA-xg72-6c83-ghh4
Aliases: CVE-2022-2495
Published: 2022-07-23T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Microwerber prior to version 1.2.20 is vulnerable to stored Cross-site Scripting (XSS).
Strapi 4.1.12 Cross-site Scripting via crafted file
Advisory: GHSA-4vm8-j95f-j6v5
Aliases: CVE-2022-32114
Published: 2022-07-14T00:00:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to receive the XSS payload.
FlyteAdmin Insufficient AccessToken Expiration Check
Advisory: GHSA-qwrj-9hmp-gpxh
Aliases: CVE-2022-31145
Published: 2022-07-15T18:10:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

### Impact
Authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire.
Using flyteadmin as the OAuth2 Authorization Server is unaffected by this issue.

### Patches
1.1.30

### Workarounds
Rotating signing keys immediately will:
* Invalidate all open sessions,
* Force all users to attempt to obtain new tokens.

Continue to rotate keys until flyteadmin has been upgraded,

Hide flyteadmin deployment ingress url from the internet.

### References
https://github.com/flyteorg/flyteadmin/pull/455

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [flyte repo](https://github.com/flyteorg/flyte/issues)
* Email us at [flyte](mailto:admin@flyte.org)
Protected fields exposed via LiveQuery
Advisory: GHSA-crrq-vr9j-fxxh
Aliases: CVE-2022-31112
Published: 2022-07-06T19:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

### Impact

Parse Server LiveQuery does not remove protected fields in classes, passing them to the client.

### Patches
The LiveQueryController now removes protected fields from the client response.

### Workarounds
Use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.

### References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-crrq-vr9j-fxxh
- https://github.com/parse-community/parse-server

### For more information
If you have any questions or comments about this advisory:
- For questions or comments about this vulnerability visit our [community forum](http://community.parseplatform.org/) or [community chat](http://chat.parseplatform.org/)
- Report other vulnerabilities at [report.parseplatform.org](https://report.parseplatform.org/)
Django REST framework XSS Vulnerability
Advisory: GHSA-xqcf-hj92-967m
Aliases: CVE-2018-25045
Published: 2022-07-24T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.
SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation"
Advisory: GHSA-rpxg-hg79-h8q9
Aliases: CVE-2022-35628
Published: 2022-07-15T15:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.
Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings
Advisory: GHSA-32ff-4g79-vgfc
Aliases: CVE-2022-31177
Published: 2022-07-29T22:28:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

### Impact
An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users.

Only when using `AUTH_DB` database authentication option.

### Patches
Fixed on 4.1.3

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Shoutrrr util package DoS via sending 2000, 4000, or 6000 character messages
Advisory: GHSA-477v-w82m-634j
Aliases: CVE-2022-25891
Published: 2022-07-16T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package `github.com/containrrr/shoutrrr/pkg/util` before 0.6.0 are vulnerable to Denial of Service (DoS) via the `util.PartitionMessage` function. Exploiting this vulnerability is possible by sending exactly 2000, 4000, or 6000 characters messages.
@ianwalter/merge Prototype Pollution via `merge` function
Advisory: GHSA-42m6-g935-5vmq
Aliases: CVE-2021-23397
Published: 2022-07-26T00:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

All versions of package @ianwalter/merge are vulnerable to Prototype Pollution via the main (`merge`) function. @ianwalter/merge is [deprecated](https://github.com/ianwalter/merge/blob/master/README.md) and the maintainer suggests using [@generates/merger](https://github.com/generates/generates/tree/main/packages/merger) instead.
Cranelift vulnerable to miscompilation of constant values in division on AArch64
Advisory: GHSA-7f6x-jwh5-m9r4
Aliases: CVE-2022-31169
Published: 2022-07-21T22:34:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

There was a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors could result in incorrect division results at runtime. The translation rules for constants did not take into account whether sign- or zero-extension should happen, which resulted in an incorrect value being placed into a register when a division was encountered. For example, a constant 32-bit unsigned divisor of `0xfffffffe` would be incorrectly sign-extended to 64-bits to `0xfffffffffffffffe`. Any kind of division of operands smaller than 64 bits is implemented with a 64-bit division instruction which would then result in an incorrect result because the divisor was larger than expected.

The impact of this bug is that programs executing within the WebAssembly sandbox would not behave according to the WebAssembly specification. This means that it is hypothetically possible for execution within the sandbox to go awry and WebAssembly programs could produce unexpected results. This should not impact hosts executing WebAssembly, but does affect the correctness of guest programs.

This bug was found with differential fuzzing of Wasmtime against other engines on the AArch64 platform. Fuzzing on AArch64 is not regularly performed at this time and the Wasmtime team is investigating how best to continuously fuzz AArch64 in the same manner as x86_64.

### Patches

This bug has been patched and users should upgrade to Wasmtime version 0.38.2.

### Workarounds

If upgrading is not an option at this time, direct users of Cranelift that control the exact Cranelift instructions being compiled can avoid the vulnerability by explicitly extending constant divisors to 64 bits using either the `sextend.i64` or the `uextend.i64` operation.

Note, though, that this issue only affects the AArch64 targets. Other platforms are not affected.

### For more information

If you have any questions or comments about this advisory:

* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)
* Open an issue in [the bytecodealliance/wasmtime repository](https://github.com/bytecodealliance/wasmtime/)
Apache SkyWalking NodeJS Agent can lose availability if header includes illegal SkyWalking header
Advisory: GHSA-8gpg-466c-5cpj
Aliases: CVE-2022-36127
Published: 2022-07-19T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable if the OAP is unhealthy and NodeJS agent can't establish the connection.
CSRF vulnerability in Jenkins openstack-heat Plugin
Advisory: GHSA-fqhm-fjjv-7q8x
Aliases: CVE-2022-36911
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

openstack-heat Plugin 1.5 and earlier does not perform permission checks in methods implementing form validation.

This form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Workers for local Dask clusters mistakenly listened on public interfaces
Advisory: GHSA-hwqr-f3v9-hwxr
Published: 2022-07-15T21:56:08Z

Versions of `distributed` earlier than `2021.10.0` had a potential security vulnerability relating to single-machine Dask clusters.

Clusters started with `dask.distributed.LocalCluster` or `dask.distributed.Client()` (which defaults to using `LocalCluster`) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on `localhost`. A Dask cluster created using this method AND running on a machine that has these ports exposed could be used by a sophisticated attacker to enable remote code execution. Users running on machines with standard firewalls in place, or using clusters created via cluster objects other than `LocalCluster` (e.g. `dask_kubernetes.KubeCluster`) should not be affected. This vulnerability is documented in CVE-2021-42343, and was fixed in version `2021.10.0` (PR #5427).
Plaintext Storage of a Password in Jenkins Skype notifier Plugin
Advisory: GHSA-gvmr-mp5q-9wvw
Aliases: CVE-2022-34805
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Skype notifier Plugin 1.1.0 and earlier stores a password unencrypted in its global configuration file `hudson.plugins.skype.im.transport.SkypePublisher.xml` on the Jenkins controller as part of its configuration. This password can be viewed by users with access to the Jenkins controller file system.
Known v1.3.1 Cross-site Scripting
Advisory: GHSA-g688-7j3c-h9f3
Aliases: CVE-2022-31290
Published: 2022-07-09T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting (XSS) vulnerability in Known v1.3.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field.

The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x branch is currently on the `dev` branch of the idno/known repository.
Jenkins Compuware zAdviser API Plugin before 1.0.4 vulnerable to protection mechanism failure
Advisory: GHSA-5xp2-7qfc-fwgc
Aliases: CVE-2022-36900
Published: 2022-07-28T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Jenkins Compuware zAdviser API Plugin 1.0.3 and earlier does not restrict execution of a controller/agent message to agents, allowing attackers able to control agent processes to retrieve Java system properties.
Angular (deprecated package) Cross-site Scripting
Advisory: GHSA-prc3-vjfx-vhm9
Aliases: CVE-2022-25869
Published: 2022-07-16T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of `<textarea>` elements.

NPM package [angular](https://www.npmjs.com/package/angular) is deprecated. Those who want to receive security updates should use the actively maintained package [@angular/core](https://www.npmjs.com/package/@angular/core).
Incorrect Authorization in Jenkins Request Rename Or Delete Plugin
Advisory: GHSA-qhmj-29vh-8mjm
Aliases: CVE-2022-34814
Published: 2022-07-01T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Request Rename Or Delete Plugin 1.1.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view an administrative configuration page listing pending requests.
LTI 1.3 Tool Library's Nonce Claim Value not validated against nonce value sent in Authentication Request before v5.0
Advisory: GHSA-5p73-qg2v-383h
Aliases: CVE-2022-31158
Published: 2022-07-15T20:55:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact

Nonce Claim Value was not being validated against the nonce value sent in the Authentication Request.

### Patches

Users should upgrade to version 5.0 immediately

### Workarounds

None.
Denial of service in Open Policy Agent 
Advisory: GHSA-2m4x-4q9j-w97g
Aliases: CVE-2022-33082
Published: 2022-07-01T00:01:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue in the AST parser (ast/compile.go) of Open Policy Agent v0.10.2 allows attackers to cause a Denial of Service (DoS) via a crafted input.
git-archive vulnerable to Command Injection via exports function
Advisory: GHSA-vqgr-mfxm-47f3
Aliases: CVE-2020-28422
Published: 2022-07-26T00:01:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

All versions of package git-archive are vulnerable to Command Injection via the exports function.
Shopware vulnerable to persistent cross site scripting (XSS) in customer module
Advisory: GHSA-5834-xv5q-cgfw
Aliases: CVE-2022-31148
Published: 2022-07-27T22:06:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

### Impact
Persistent XSS in customer module

### Patches

We recommend updating to the current version 5.7.14. You can get the update to 5.7.14 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-07-2022
Lack of authentication mechanism in Jenkins Git Plugin webhook
Advisory: GHSA-v878-67xw-grw2
Aliases: CVE-2022-36883
Published: 2022-07-28T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Git Plugin provides a webhook endpoint at `/git/notifyCommit` that can be used to notify Jenkins of changes to an SCM repository. For its most basic functionality, this endpoint receives a repository URL, and Jenkins will schedule polling for all jobs configured with the specified repository. In Git Plugin 4.11.3 and earlier, this endpoint can be accessed with GET requests and without authentication. In addition to this basic functionality, the endpoint also accept a `sha1` parameter specifying a commit ID. If this parameter is specified, jobs configured with the specified repo will be triggered immediately, and the build will check out the specified commit. Additionally, the output of the webhook endpoint will provide information about which jobs were triggered or scheduled for polling, including jobs the user has no permission to access. This allows attackers with knowledge of Git repository URLs to trigger builds of jobs using a specified Git repository and to cause them to check out an attacker-specified commit, and to obtain information about the existence of jobs configured with this Git repository. Git Plugin 4.11.4 requires a `token` parameter which will act as an authentication for the webhook endpoint. While GET requests remain allowed, attackers would need to be able to provide a webhook token. For more information see [the plugin documentation](https://github.com/jenkinsci/git-plugin/#push-notification-from-repository).
grapesjs before 0.19.5 vulnerable to Cross-site Scripting
Advisory: GHSA-589f-c66p-hxr4
Aliases: CVE-2022-21802
Published: 2022-07-26T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The package grapesjs before 0.19.5 is vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.
WooCommerce WordPress plugin before 6.6.0 vulnerable to stored HTML injection
Advisory: GHSA-jwvf-28fg-g4xg
Aliases: CVE-2022-2099
Published: 2022-07-18T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
Insecure cookies in Openshift Origin
Advisory: GHSA-rqph-25q9-9jhp
Aliases: CVE-2015-3207
Published: 2022-07-08T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

In Openshift Origin the cookies being set in console have no 'secure', 'HttpOnly' attributes.