aswin1906/github-advisory-2022 huggingface dataset:
Magento 2 Community Edition Cross-site Scripting Vulnerability
Advisory: GHSA-rj8f-g5gm-jw5c
Aliases: CVE-2019-7887
Published: 2022-05-24T16:52:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled.
Stored XSS vulnerability in Jenkins Git Plugin
Advisory: GHSA-gghc-g8cj-4vfv
Aliases: CVE-2021-21684
Published: 2022-05-24T19:16:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Git Plugin 4.8.2 and earlier does not escape the Git SHA-1 checksum parameters provided to commit notifications when displaying them in a build cause.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted commit notifications to the `/git/notifyCommit` endpoint.

Git Plugin 4.8.3 rejects Git SHA-1 checksum parameters that do not match the expected format. Existing values are sanitized when displayed on the UI.

This vulnerability is only exploitable in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#SECURITY-2452).
ChakraCore RCE Vulnerability
Advisory: GHSA-vwqh-cmvp-6694
Aliases: CVE-2018-8286
Published: 2022-05-13T01:20:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8280, CVE-2018-8290, CVE-2018-8294.
xdlocalstorage does not verify request origin
Advisory: GHSA-mr5m-2385-2vcp
Aliases: CVE-2020-11610
Published: 2022-05-24T17:13:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An issue was discovered in xdLocalStorage through 2.0.5. The `postData()` function in `xdLocalStoragePostMessageApi.js` specifies the wildcard (`*`) as the targetOrigin when calling the `postMessage()` function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and receive the messages that the "magical iframe" sends.
Apache OpenMeetings vulnerable to Cross-Site Request Forgery
Advisory: GHSA-m5pm-rgvf-vg22
Aliases: CVE-2017-7666
Published: 2022-05-17T02:28:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Apache OpenMeetings 1.0.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks, XSS attacks, click-jacking, and MIME based attacks. The issue is fixed in version 3.3.0.
Apache XML-RPC vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-4gqp-296r-j5mq
Aliases: CVE-2016-5003
Published: 2022-05-14T01:53:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.
DotNetNuke (DNN) Open redirect vulnerability 
Advisory: GHSA-mj48-f959-pqph
Aliases: CVE-2013-7335
Published: 2022-05-17T04:49:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

Open redirect vulnerability in DotNetNuke (DNN) before 6.2.9 and 7.x before 7.1.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Plone Cross-site scripting Vulnerability
Advisory: GHSA-5whw-5cmm-9jw4
Aliases: CVE-2012-5504
Published: 2022-05-17T04:32:23Z

Cross-site scripting (XSS) vulnerability in widget_traversal.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Improper Authentication in pyftpdlib
Advisory: GHSA-q6w2-jxcm-2crj
Aliases: CVE-2008-7263
Published: 2022-05-17T05:47:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

ftpserver.py in pyftpdlib before 0.5.0 does not delay its response after receiving an invalid login attempt, which makes it easier for remote attackers to obtain access via a brute-force attack.
librsvg DoS via Cyclic References
Advisory: GHSA-j984-q4qc-6qxf
Aliases: CVE-2015-7558
Published: 2022-05-17T03:50:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

librsvg before 2.40.12 allows context-dependent attackers to cause a denial of service (infinite loop, stack consumption, and application crash) via cyclic references in an SVG document.
RCE vulnerability in Jenkins OpenShift Pipeline Plugin
Advisory: GHSA-264w-xrr7-6qqg
Aliases: CVE-2020-2167
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to OpenShift Pipeline Plugin’s build step. OpenShift Pipeline Plugin 1.0.57 configures its YAML parser to only instantiate safe types.
Chakra Core Privilege Escalation
Advisory: GHSA-43qp-hphf-5rjw
Aliases: CVE-2017-11871
Published: 2022-05-17T00:19:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, and CVE-2017-11873.
Missing permission check in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials
Advisory: GHSA-6mpp-cm3v-23vv
Aliases: CVE-2021-21663
Published: 2022-05-24T19:04:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A missing permission check in Jenkins XebiaLabs XL Deploy Plugin 7.5.8 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.
Jenkins Maven Release Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-79rm-f26g-296p
Aliases: CVE-2019-10360
Published: 2022-05-24T16:51:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Maven Release Plug-in Plugin did not properly escape variables in multiple views, resulting in a stored cross-site scripting vulnerability.

Variables on affected views are now escaped.
Jenkins Build Pipeline Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-cx5r-p4vj-2mqh
Aliases: CVE-2019-10373
Published: 2022-05-24T16:52:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Build Pipeline Plugin does not properly escape variables in views, resulting in a stored cross-site scripting vulnerability exploitable by users with permission to configure build pipelines.

This vulnerability is only exploitable on Jenkins releases older than 2.146 or 2.138.2 due to the security hardening implemented in those releases.

As of publication of this advisory, there is no fix.
Out-of-bounds Read and Out-of-bounds Write in Facebook Hermes
Advisory: GHSA-pf27-929j-9pmm
Aliases: CVE-2020-1912
Published: 2022-05-24T17:27:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Jenkins Cucumber Living Documentation Plugin Cross-site Scripting vulnerability
Advisory: GHSA-q7jx-r75r-hgj2
Aliases: CVE-2018-1000144
Published: 2022-05-14T03:23:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross site scripting vulnerability exists in Jenkins Cucumber Living Documentation Plugin 1.0.12 and older in CukedoctorBaseAction#doDynamic that disables the Content-Security-Policy protection for archived artifacts and workspace files, allowing attackers able to control the content of these files to attack Jenkins users. This has been addressed in version 1.1.0 of the plugin, and it will now request that users change the Content-Security-Policy option in Jenkins.
Centreon SQL Injection
Advisory: GHSA-79hg-357g-rrgv
Aliases: CVE-2018-19271
Published: 2022-05-14T00:55:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Centreon 3.4.x (fixed in Centreon 18.10.0 and Centreon web 2.8.28) allows SQL Injection via the main.php searchH parameter.
CSRF vulnerability in Jenkins Pipeline Maven Integration Plugin allow capturing credentials
Advisory: GHSA-c2hg-2jj6-h8vh
Aliases: CVE-2020-2235
Published: 2022-05-24T17:25:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Pipeline Maven Integration Plugin 3.8.2 and earlier does not perform a permission check in a method implementing form validation.

This allows users with Overall/Read access to Jenkins to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Pipeline Maven Integration Plugin 3.8.3 requires POST requests and Job/Configure permission for the affected form validation method.
Business Logic Errors in Para
Advisory: GHSA-4793-8wwh-jxxr
Aliases: CVE-2022-1848
Published: 2022-05-25T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Paraara prior to version 1.46.0 is vulnerable to business logic errors. A user can create more than one app, even after they reach the app limit.
CSRF vulnerability in Pipeline GitHub Notify Step Plugin allows capturing credentials
Advisory: GHSA-qhxf-m7jm-jc57
Aliases: CVE-2020-2116
Published: 2022-05-24T17:08:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin 1.0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
ThinkPHP SQLi Vulnerability
Advisory: GHSA-7xfj-4jpg-58vf
Aliases: CVE-2018-18530
Published: 2022-05-14T01:53:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ThinkPHP 5.1.25 has SQL Injection via the count parameter because the library/think/db/Query.php aggregate function mishandles the aggregate variable. NOTE: a backquote character is required in the attack URI.
Craft CMS XSS Vulnerability
Advisory: GHSA-w5q4-q7wp-qww6
Aliases: CVE-2019-12823
Published: 2022-05-24T16:48:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS.
ChakraCore RCE Vulnerability
Advisory: GHSA-5whg-j5fv-xcm2
Aliases: CVE-2016-7200
Published: 2022-05-14T02:22:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.
Cross-site Scripting in Apache Atlas
Advisory: GHSA-236h-r3w7-c85c
Aliases: CVE-2017-3151
Published: 2022-05-13T01:30:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Stored Cross-Site Scripting in the edit-tag functionality.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-x55p-6526-xmmp
Aliases: CVE-2017-2603
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Jenkins before versions 2.44 and 2.32.2 is vulnerable to a user data leak in disconnected agents' config.xml API. This could leak sensitive data such as API tokens (SECURITY-362).
glot-code-runner RCE
Advisory: GHSA-vj95-2f9q-x7h6
Aliases: CVE-2018-15747
Published: 2022-05-24T16:48:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The default configuration of glot-www through 2018-05-19 allows remote attackers to execute arbitrary code because glot-code-runner supports os.system within a "python" "files" "content" JSON file.
RCE vulnerability in Jenkins Azure Container Service Plugin
Advisory: GHSA-5qff-7944-vq4f
Aliases: CVE-2020-2168
Published: 2022-05-24T17:12:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types. This results in a remote code execution (RCE) vulnerability exploitable by users able to provide YAML input files to Azure Container Service Plugin’s build step.

Azure Container Service Plugin 1.0.2 configures its YAML parser to only instantiate safe types.
Auth0 Passport-SharePoint does not validate JWT signature
Advisory: GHSA-45fh-g845-pj9w
Aliases: CVE-2019-13483
Published: 2022-05-24T16:51:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Auth0 Passport-SharePoint before 0.4.0 does not validate the JWT signature of an Access Token before processing. This allows attackers to forge tokens and bypass authentication and authorization mechanisms.
Python Requests Session Fixation
Advisory: GHSA-pg2w-x9wp-vw92
Aliases: CVE-2015-2296
Published: 2022-05-13T01:11:23Z

The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.
Subrion CMS XSS
Advisory: GHSA-c8mg-wp7h-f2pf
Aliases: CVE-2018-14835
Published: 2022-05-14T02:57:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.
keycloak-httpd-client-install symlink attack vulnerability
Advisory: GHSA-vqf9-v3hc-wr54
Aliases: CVE-2017-15111
Published: 2022-05-14T00:55:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.
Denial of service in JBoss resteasy
Advisory: GHSA-wxvr-vqfp-9cqw
Aliases: CVE-2016-6346
Published: 2022-05-14T01:03:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.
Missing Initialization of Resource in Apache Arrow
Advisory: GHSA-cjw4-2w9r-r8mv
Aliases: CVE-2019-12410
Published: 2022-05-24T17:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

While investigating UBSAN errors in https://github.com/apache/arrow/pull/5365 it was discovered Apache Arrow versions 0.12.0 to 0.14.1, left memory Array data uninitialized when reading RLE null data from parquet. This affected the C++, Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.
Sandbox bypass vulnerability in Jenkins Script Security Plugin
Advisory: GHSA-3pv3-jj4h-p528
Aliases: CVE-2019-1003040
Published: 2022-05-13T01:15:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
Cross site scripting in publify
Advisory: GHSA-wmh9-x28j-c6gr
Aliases: CVE-2021-25974
Published: 2022-05-24T22:29:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Publify, versions v8.0 to v9.2.4 are vulnerable to stored XSS. A user with a “publisher” role is able to inject and execute arbitrary JavaScript code while creating a page/article.
ASP.NET Core Denial of Service Vulnerability
Advisory: GHSA-f8qx-mjcq-wfgx
Aliases: CVE-2020-1597
Published: 2022-05-24T17:26:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka `ASP.NET Core Denial of Service Vulnerability`.
Incorrect Permission Assignment for Critical Resource in NPM
Advisory: GHSA-ph34-pc88-72gc
Aliases: CVE-2018-7408
Published: 2022-05-13T01:53:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.
Django ReDoS in validators.URLValidator
Advisory: GHSA-cqf7-ff9h-7967
Aliases: CVE-2015-5145
Published: 2022-05-17T00:48:30Z

`validators.URLValidator` in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.
Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin
Advisory: GHSA-vwq9-cmqr-3c8c
Aliases: CVE-2019-10343
Published: 2022-05-24T16:51:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked (i.e. replaced with asterisks) in that log to prevent accidental disclosure.

Between Configuration as Code Plugin 0.8-alpha and 1.0, log messages contained values if the values were specified using properties in the YAML file (SECURITY-929).

Since Configuration as Code Plugin 1.1, log messages in Configuration as Code Plugin instead mask values of type `Secret`, which is used in Jenkins to store the values encrypted on disk. This did not work in many instances, as plugins could use the `Secret` type to store credentials encrypted on disk while not having the Secret type appear in their Java API.

Configuration as Code Plugin now inspects the type and looks for a field, getter, or constructor argument corresponding to the property, making the secret detection much more robust for the purpose of log message masking.

As a workaround, administrators can configure the logging level of the logger `io.jenkins.plugins.casc.Attribute` to a level that does not include `INFO` messages. See the logging documentation for details.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-vx7m-v8v2-fhwm
Aliases: CVE-2019-8131
Published: 2022-05-24T17:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into code field of an inventory source.
XXE vulnerability in Jenkins Nerrvana Plugin
Advisory: GHSA-wcrg-92wp-4h28
Aliases: CVE-2020-2298
Published: 2022-05-24T17:30:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Nerrvana Plugin 1.02.06 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with Overall/Read permission to have Jenkins parse a crafted HTTP request with XML data that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Additionally, XML parsing is exposed as a form validation endpoint that does not require POST requests, allowing exploitation by users without Overall/Read permission via CSRF.
Improper Access Control in Telerik Extensions
Advisory: GHSA-8h7p-qjv8-9mp4
Aliases: CVE-2018-17060
Published: 2022-05-13T01:19:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Telerik Extensions for ASP.NET MVC (all versions) does not whitelist requests, which can allow a remote attacker to access files inside the server's web directory.  NOTE: this product has been obsolete since June 2013.
Stored XSS vulnerability in Jenkins Active Choices Plugin
Advisory: GHSA-rp4x-h577-chvq
Aliases: CVE-2021-21699
Published: 2022-05-24T19:20:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Active Choices Plugin 2.5.7 escapes references to parameter names.
Remote code execution in vscode-npm-script
Advisory: GHSA-r84v-qff8-jv5g
Aliases: CVE-2021-26700
Published: 2022-05-24T17:43:20Z

Visual Studio Code npm-script Extension Remote Code Execution Vulnerability
Exposure of Sensitive Information to an Unauthorized Actor in RESTEasy
Advisory: GHSA-g4jg-gpwv-p7wv
Aliases: CVE-2011-5245
Published: 2022-05-17T01:50:09Z

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
silverstripe-advancedreports vulnerable to XSS
Advisory: GHSA-8f2x-hv9r-mh9r
Aliases: CVE-2020-25102
Published: 2022-05-24T17:27:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

silverstripe-advancedreports (aka the Advanced Reports module for SilverStripe) 1.0 through 2.0 is vulnerable to Cross-Site Scripting (XSS) because it is possible to inject and store malicious JavaScript code. The affects `admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item` (aka report preview) when an SVG document is provided in the Description parameter.
TYPO3 Improper Access Control vulnerability
Advisory: GHSA-r674-mc9p-hvw5
Aliases: CVE-2013-7081
Published: 2022-05-17T04:54:37Z

The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6 allows remote authenticated editors to generate arbitrary HMAC signatures and bypass intended access restrictions via unspecified vectors.
Improper Access Control in Apache Tomcat
Advisory: GHSA-4c43-cwvx-9crh
Aliases: CVE-2014-7810
Published: 2022-05-14T01:10:17Z

The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
Apache Geode configuration request authorization vulnerability
Advisory: GHSA-g569-49wg-jx5f
Aliases: CVE-2017-15696
Published: 2022-05-14T03:37:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

When an Apache Geode cluster before v1.4.0 is operating in secure mode, the Geode configuration service does not properly authorize configuration requests. This allows an unprivileged user who gains access to the Geode locator to extract configuration data and previously deployed application code.
Cross-Site Request Forgery in XXL-Job
Advisory: GHSA-v3c9-w6g2-hjg3
Aliases: CVE-2022-29002
Published: 2022-05-24T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.
Observable Discrepancy in Apache Tomcat
Advisory: GHSA-wxcp-f2c8-x6xv
Aliases: CVE-2016-0762
Published: 2022-05-13T01:02:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-p783-gj6m-9r88
Aliases: CVE-2019-8150
Published: 2022-05-24T17:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout.
Plone Open Redirect Vulnerability
Advisory: GHSA-82j9-wfcf-9v2h
Aliases: CVE-2020-7936
Published: 2022-05-24T17:07:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.
Path Traversal in scout-browser
Advisory: GHSA-694v-63fq-fmr4
Aliases: CVE-2022-1554
Published: 2022-05-04T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L

Scout is a Variant Call Format (VCF) visualization interface. The Pypi package `scout-browser` is vulnerable to path traversal due to `send_file` call in versions prior to 4.52.
Symfony XSS Vulnerabilities
Advisory: GHSA-4c5w-qqfg-grf3
Aliases: CVE-2015-8766
Published: 2022-05-13T01:13:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in `content/content.systempreferences.php` in Symphony CMS before 2.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) `email_sendmail[from_name]`, (2) `email_sendmail[from_address]`, (3) `email_smtp[from_name]`, (4) `email_smtp[from_address]`, (5) `email_smtp[host]`, (6) `email_smtp[port]`, (7) `jit_image_manipulation[trusted_external_sites]`, or (8) `maintenance_mode[ip_whitelist]` parameters to system/preferences.
Improper Restriction of Operations within the Bounds of a Memory Buffer in python-cjson
Advisory: GHSA-cqmh-mpx2-g633
Aliases: CVE-2010-1666
Published: 2022-05-17T05:49:38Z

Buffer overflow in Dan Pascu python-cjson 1.0.5, when UCS-4 encoding is enabled, allows context-dependent attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors involving crafted Unicode input to the cjson.encode function.
Arbitrary file overwrite in OpenStack Nova
Advisory: GHSA-xc4g-7vw8-924h
Aliases: CVE-2012-3447
Published: 2022-05-17T01:44:00Z

virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.
net-ldap has weak salt when generating passwords
Advisory: GHSA-qwgm-mxm4-3q2c
Aliases: CVE-2014-0083
Published: 2022-05-24T22:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

The Ruby net-ldap gem before 0.16.2 uses a weak salt when generating SSHA passwords.
Plone is vulnerable to File System Path Exposure
Advisory: GHSA-mm32-jw73-9227
Aliases: CVE-2013-4194
Published: 2022-05-17T04:49:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.
Cobbler Improper Validation of Security Tokens
Advisory: GHSA-f88q-22g8-frcg
Aliases: CVE-2018-1000226
Published: 2022-05-13T01:48:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API (/cobbler_api) that can result in Privilege escalation, data manipulation or exfiltration, LDAP credential harvesting. This attack appear to be exploitable via "network connectivity". Taking advantage of improper validation of security tokens in API endpoints. Please note this is a different issue than CVE-2018-10931.
Rundeck Community Edition vulnerable to Cross-site Scripting
Advisory: GHSA-4262-wr7p-gpcj
Aliases: CVE-2019-6804
Published: 2022-05-13T01:06:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.
Sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin
Advisory: GHSA-x74x-qf5j-35jh
Aliases: CVE-2019-1003041
Published: 2022-05-13T01:15:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.
Incorrect Permission Assignment for Critical Resource in Jenkins
Advisory: GHSA-wf9g-rh76-6jvr
Aliases: CVE-2017-2612
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

In Jenkins before versions 2.44, 2.32.2 low privilege users were able to override JDK download credentials (SECURITY-392), resulting in future builds possibly failing to download a JDK.
Apache Tomcat Cross-site scripting (XSS) vulnerability
Advisory: GHSA-q74x-qqhr-f8rx
Aliases: CVE-2008-1232
Published: 2022-05-01T23:37:49Z

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
Missing permission checks in Jenkins Database Plugin
Advisory: GHSA-hj36-v72x-cc6j
Aliases: CVE-2020-2242
Published: 2022-05-24T17:27:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

A missing permission check in Jenkins database Plugin 1.6 and earlier allows attackers with Overall/Read access to Jenkins to connect to an attacker-specified database server using attacker-specified credentials.

Database Plugin 1.7 requires Overall/Administer permission for the affected form validation method.
Cross Site Scripting (XSS) in LavaLite 5.8.0
Advisory: GHSA-6r6h-vhg7-53x7
Aliases: CVE-2020-28124
Published: 2022-05-24T17:47:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.
Jenkins Kubernetes CI/CD Plugin vulnerable to Cross-Site Request Forgery
Advisory: GHSA-vx6r-w45x-q3h6
Aliases: CVE-2019-10468
Published: 2022-05-24T16:59:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. 

## Note: Jenkins has suspended distribution of this plugin.
DNN File Upload Vulnerability
Advisory: GHSA-vjcm-j85r-7p68
Aliases: CVE-2020-5188
Published: 2022-05-24T17:09:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

DNN (formerly DotNetNuke) through 9.4.4 has a File upload vulnerability via bypassing client-side file extension check
Improper Input Validation in Apache CXF
Advisory: GHSA-38x2-fp9m-87mx
Aliases: CVE-2014-0034
Published: 2022-05-13T01:09:20Z

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.
Djiblets Cross-site scripting Vulnerability via JSON Objects
Advisory: GHSA-w7rq-8f2g-jvqr
Aliases: CVE-2014-3994
Published: 2022-05-17T03:50:02Z

A cross-site scripting (XSS) vulnerability in `util/templatetags/djblets_js.py` in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.
Django Reuses Cached CSRF Token
Advisory: GHSA-89hj-xfx5-7q66
Aliases: CVE-2014-0473
Published: 2022-05-17T03:07:04Z

The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.
PHPMailer susceptible to arbitrary code execution
Advisory: GHSA-v5c9-mmw9-829q
Aliases: CVE-2008-5619
Published: 2022-05-14T02:39:43Z

html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10, RoundCube Webmail (roundcubemail) 0.2-1.alpha and 0.2-3.beta, Mahara, and AtMail Open 1.03, allows remote attackers to execute arbitrary code via crafted input that is processed by the preg_replace function with the eval switch.
Apache OpenMeetings Cross-site Scripting vulnerability
Advisory: GHSA-633w-w2pf-x84r
Aliases: CVE-2016-3089
Published: 2022-05-14T02:46:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in the SWF panel in Apache OpenMeetings before 3.1.2 allows remote attackers to inject arbitrary web script or HTML via the swf parameter.
RubyGems vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-mqwr-4qf2-2hcv
Aliases: CVE-2017-0903
Published: 2022-05-13T01:38:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution. The issue has been patched in 2.6.14.
Kafo allows local users to obtain passwords and other sensitive information by reading default_values.yaml
Advisory: GHSA-hxvp-655x-xxqv
Aliases: CVE-2014-0135
Published: 2022-05-17T04:44:31Z

Kafo before 0.3.17 and 0.4.x before 0.5.2, as used by Foreman, uses world-readable permissions for `default_values.yaml`, which allows local users to obtain passwords and other sensitive information by reading the file.
ChakraCore RCE via Out-of-bounds write
Advisory: GHSA-fxrx-5j36-pwg5
Aliases: CVE-2019-1051
Published: 2022-05-24T22:00:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1052.
Ignite Realtime Openfire vulnerable to cross-site scripting
Advisory: GHSA-jphj-5g3m-w7x6
Aliases: CVE-2018-11688
Published: 2022-05-14T00:57:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Ignite Realtime Openfire before 3.9.2 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
PHP OpenID Library Denial of Service vulnerability
Advisory: GHSA-5qp6-78pr-gv8c
Aliases: CVE-2013-4701
Published: 2022-05-17T03:46:28Z

Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via XRDS data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Croogo vulnerable to XSS in title field
Advisory: GHSA-v6q8-8wgx-8hm7
Aliases: CVE-2019-7171
Published: 2022-05-14T01:38:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8.
Cross-site Scripting in Jenkins
Advisory: GHSA-r69c-5j7c-vm6q
Aliases: CVE-2017-2601
Published: 2022-05-13T01:02:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins before versions 2.44 and 2.32.2 is vulnerable to a persisted cross-site scripting in parameter names and descriptions (SECURITY-353). Users with the permission to configure jobs were able to inject JavaScript into parameter names and descriptions.
Password stored in plain text by Jenkins AppSpider Plugin
Advisory: GHSA-rm7r-xv53-xwc3
Aliases: CVE-2020-2314
Published: 2022-05-24T17:33:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AppSpider Plugin 1.0.12 and earlier stores a password unencrypted in its global configuration file `com.rapid7.jenkinspider.PostBuildScan.xml` on the Jenkins controller as part of its configuration.

This password can be viewed by users with access to the Jenkins controller file system.

AppSpider Plugin 1.0.13 stores a password encrypted once its configuration is saved again.
phpMyAdmin CSRF Vulnerability
Advisory: GHSA-jvxx-8xxf-5495
Aliases: CVE-2016-9866
Published: 2022-05-17T02:36:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in phpMyAdmin. When the arg_separator is different from its default & value, the CSRF token was not properly stripped from the return URL of the preference import action. All 4.6.x versions (prior to 4.6.5), 4.4.x versions (prior to 4.4.15.9), and 4.0.x versions (prior to 4.0.10.18) are affected.
libxslt Type Confusion vulnerability that affects Nokogiri
Advisory: GHSA-cf46-6xxh-pc75
Aliases: CVE-2019-13118
Published: 2022-05-24T16:49:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In `numbers.c` in libxslt 1.1.33, a type holding grouping characters of an `xsl:number` instruction was too narrow and an invalid character/length combination could be passed to `xsltNumberFormatDecimal`, leading to a read of uninitialized stack data.

Nokogiri prior to version 1.10.5 used a vulnerable version of libxslt. Nokogiri 1.10.5 updated libxslt to version 1.1.34 to address this and other vulnerabilities in libxslt.
Cross-Site Request Forgery in Jenkins
Advisory: GHSA-vcr8-h8qp-qj8h
Aliases: CVE-2019-10384
Published: 2022-05-24T16:55:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.
ChakraCore RCE Vulnerability
Advisory: GHSA-5f5r-65pm-r3wr
Aliases: CVE-2017-11916
Published: 2022-05-17T00:11:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11918, and CVE-2017-11930.
Remote code execution in Microsoft.WindowsDesktop.App.Ref
Advisory: GHSA-r4mw-gxf7-vxr9
Aliases: CVE-2020-0606
Published: 2022-05-24T17:06:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.
Crafter CMS Crafter Studio vulnerable to Improper Control of Dynamically-Managed Code Resources
Advisory: GHSA-r6fx-55x3-f9x6
Aliases: CVE-2021-23267
Published: 2022-05-17T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker static methods.
Credentials stored in plain text by Jenkins Copr Plugin
Advisory: GHSA-4wx5-c723-xvwv
Aliases: CVE-2020-2177
Published: 2022-05-24T17:15:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Copr Plugin 0.3 and earlier stores credentials unencrypted in job `config.xml` files as part of its configuration. These credentials can be viewed by users with Extended Read permission or access to the Jenkins controller file system.

Copr Plugin 0.6.1 stores these credentials encrypted. This change is effective once the job configuration is saved the next time.
OpenStack Swift Cross-site Scriping vulnerability
Advisory: GHSA-66vj-393f-hxfv
Aliases: CVE-2014-3497
Published: 2022-05-17T04:04:46Z

Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or HTML via the WWW-Authenticate header.
Improper Control of Generation of Code in HawtJNI
Advisory: GHSA-49j7-qghp-5wj8
Aliases: CVE-2013-2035
Published: 2022-05-17T04:17:07Z

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.
Directory traversal in Mort Bay Jetty
Advisory: GHSA-9986-w5h5-vw59
Aliases: CVE-2009-1523
Published: 2022-05-02T03:26:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
Pterodactyl vulnerable to 2FA Sniffing
Advisory: GHSA-fg52-xjfc-9rh8
Aliases: CVE-2019-1020002
Published: 2022-05-24T16:51:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

**Pterodactyl version 0.7.13 and lower - 2FA Sniffing**

Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields.

### Impact
Users who have enabled 2FA protections on their account can unintentionally have their account's existence sniffed by malicious users who enter random credentials into the login fields.

A logical mistake was made when the original code was written that would wait to verify the user's password until they had provided 2FA credentials if it was enabled on their account. However, because of this you could enter a bad password for a known email and determine if the account exists if you got redirected to a 2FA page.

### For more information
If you have any questions or comments about this advisory please react out on Discord or email dane@[project name].io.
Improper Authentication in Apache CXF
Advisory: GHSA-xf9f-32gh-h2w4
Aliases: CVE-2012-5633
Published: 2022-05-13T01:09:21Z

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.
Path traversal vulnerability in Jenkins Subversion Plugin allows reading arbitrary files
Advisory: GHSA-q58j-fhj7-j6fg
Aliases: CVE-2021-21698
Published: 2022-05-24T19:19:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Subversion Plugin 2.15.0 and earlier does not restrict the name of a file when looking up a subversion key file on the controller from an agent.

This allows attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.

Subversion Plugin 2.15.1 checks for the presence of and prohibits directory separator characters as part of the file name, restricting it to the intended directory.
Mongrel vulnerable to directory traversal via double-encoded sequences
Advisory: GHSA-m7r6-43v2-49vf
Aliases: CVE-2007-6612
Published: 2022-05-01T18:44:39Z

Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 (1.0.3 and prior are not affected) and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (`.%252e`).
Spring Framework and Spring Security vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-f866-m9mv-2xr3
Aliases: CVE-2011-2894
Published: 2022-05-14T02:54:56Z

Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
Improper Input Validation in Mortbay Jetty 
Advisory: GHSA-mq4x-8whh-jx73
Aliases: CVE-2006-2759
Published: 2022-05-01T07:02:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations.
Improper Restriction of XML External Entity Reference in Elasticsearch
Advisory: GHSA-ccmr-qj26-845g
Aliases: CVE-2018-17247
Published: 2022-05-13T01:34:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.