aswin1906/github-advisory-2022 huggingface dataset:
Django User Enumeration Vulnerability
Advisory: GHSA-fp6p-5xvw-m74f
Aliases: CVE-2016-2513
Published: 2022-05-17T01:09:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

The password hasher in `contrib/auth/hashers.py` in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-2w4x-rxp7-grg7
Aliases: CVE-2018-1000192
Published: 2022-05-13T01:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A information exposure vulnerability exists in Jenkins 2.120 and older, LTS 2.107.2 and older in AboutJenkins.java, ListPluginsCommand.java that allows users with Overall/Read access to enumerate all installed plugins.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-x6jw-2f23-mc5j
Aliases: CVE-2018-1000068
Published: 2022-05-13T01:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

An improper input validation vulnerability exists in Jenkins versions 2.106 and earlier, and LTS 2.89.3 and earlier, that allows an attacker to access plugin resource files in the META-INF and WEB-INF directories that should not be accessible, if the Jenkins home directory is on a case-insensitive file system.
Apache Geode unsafe deserialization of application objects
Advisory: GHSA-95m2-p98f-24r5
Aliases: CVE-2017-15693
Published: 2022-05-14T03:35:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Geode before v1.4.0, the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.
OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests
Advisory: GHSA-p258-xmh3-72pv
Aliases: CVE-2014-0167
Published: 2022-05-17T04:41:34Z

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Apache Sentry may allow attacker to access/remove data from Sentry protected table
Advisory: GHSA-6xhj-p29v-82j8
Aliases: CVE-2018-8028
Published: 2022-05-13T01:53:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table.
Script security sandbox bypass in Jenkins Email Extension Plugin
Advisory: GHSA-qwm8-vgm6-f86p
Aliases: CVE-2019-1003032
Published: 2022-05-13T01:15:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Jenkins Email Extension Plugin 2.64 and earlier in pom.xml, src/main/java/hudson/plugins/emailext/ExtendedEmailPublisher.java, src/main/java/hudson/plugins/emailext/plugins/content/EmailExtScript.java, src/main/java/hudson/plugins/emailext/plugins/content/ScriptContent.java, src/main/java/hudson/plugins/emailext/plugins/trigger/AbstractScriptTrigger.java that allows attackers with Job/Configure permission to execute arbitrary code on the Jenkins master JVM.
Missing permission check in Jenkins Pipeline Maven Integration Plugin allow capturing credentials
Advisory: GHSA-mrr8-fcg7-p2wg
Aliases: CVE-2020-2234
Published: 2022-05-24T17:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Pipeline Maven Integration Plugin 3.8.2 and earlier does not perform a permission check in a method implementing form validation.

This allows users with Overall/Read access to Jenkins to connect to an attacker-specified JDBC URL using attacker-specified credentials IDs obtained through another method, potentially capturing credentials stored in Jenkins.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Pipeline Maven Integration Plugin 3.8.3 requires POST requests and Job/Configure permission for the affected form validation method.
ChakraCore RCE Vulnerability
Advisory: GHSA-g67x-mgrv-m3gv
Aliases: CVE-2020-0812
Published: 2022-05-24T17:10:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka Chakra Scripting Engine Memory Corruption Vulnerability. This CVE ID is unique from CVE-2020-0811.
OpenStack Keystone does not check signature TTL of the EC2 credential auth method
Advisory: GHSA-rqw2-hhrf-7936
Aliases: CVE-2020-12692
Published: 2022-05-24T17:17:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
Web2py Cross-Site Request Forgery vulnerability
Advisory: GHSA-gp69-xcm6-ffqj
Aliases: CVE-2016-4808
Published: 2022-05-17T03:03:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H

Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged-in administrator into performing unwanted actions i.e An attacker can trick a victim into disable the installed application just by visiting a URL.
Magento 2 Community Cryptographic Flaw
Advisory: GHSA-2w26-gmqm-mc5p
Aliases: CVE-2019-7855
Published: 2022-05-24T16:52:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation.
Gleez CMS Stored XSS
Advisory: GHSA-m2r2-qc49-gqw4
Aliases: CVE-2018-7035
Published: 2022-05-14T03:25:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode in an Add Blog action.
Silverstripe CMS XSS Vulnerability
Advisory: GHSA-gvc8-xjfp-6569
Aliases: CVE-2015-8606
Published: 2022-05-13T01:13:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.0 before 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the (1) Locale or (2) FailedLoginCount parameter to `admin/security/EditForm/field/Members/item/new/ItemEditForm`.
SiteServer CMS RCE via unsafe file upload
Advisory: GHSA-ff4w-8chr-w2x9
Aliases: CVE-2019-11401
Published: 2022-05-24T16:44:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A issue was discovered in SiteServer CMS prior to version 6.12. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension `.aassp`, which is converted to `.asp` because the "as" substring is deleted.
Magento 2 Community Edition SQLi Vulnerability
Advisory: GHSA-2x2q-2xpv-mcf9
Aliases: CVE-2019-8127
Published: 2022-05-24T17:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation.
RubyGem openshift-origin-controller is vulnerable to command injection
Advisory: GHSA-77xq-7c6p-6xp6
Aliases: CVE-2013-2095
Published: 2022-05-05T00:29:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection
phpMyAdmin DoS Vulnerability
Advisory: GHSA-qf3f-7x69-qfv3
Aliases: CVE-2016-6622
Published: 2022-05-14T03:14:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in phpMyAdmin. An unauthenticated user is able to execute a denial-of-service (DoS) attack by forcing persistent connections when phpMyAdmin is running with `$cfg['AllowArbitraryServer']=true`. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.
Cross-site Scripting in Graylog Server
Advisory: GHSA-38hf-xjmx-jrh8
Aliases: CVE-2018-14380
Published: 2022-05-14T02:59:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Graylog before 2.4.6, XSS was possible in typeahead components, related to components/common/TypeAheadInput.jsx and components/search/QueryInput.ts.
Jenkins Swarm Plugin Client vulnerable to man-in-the-middle attacks
Advisory: GHSA-pj45-8vhc-mh2f
Aliases: CVE-2017-1000402
Published: 2022-05-14T03:45:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Jenkins Swarm Plugin Client 3.4 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks.
Stored XSS vulnerability in Jenkins RapidDeploy Plugin
Advisory: GHSA-f4gq-7hvf-fjm3
Aliases: CVE-2020-2170
Published: 2022-05-24T17:12:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

RapidDeploy Plugin 4.2 and earlier does not escape package names in its displayed table of packages obtained from a remote server. This results in a stored cross-site scripting (XSS) vulnerability exploitable by users able to configure jobs.

RapidDeploy Plugin 4.2.1 escapes package names.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-56hf-w8gm-448q
Aliases: CVE-2019-8092
Published: 2022-05-24T17:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via email template preview.
Exposure of Sensitive Information in Jenkins Kubernetes Plugin
Advisory: GHSA-fqg2-c97r-rqcj
Aliases: CVE-2018-1999040
Published: 2022-05-13T01:50:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.
Missing validation causes denial of service via `DeleteSessionTensor`
Advisory: GHSA-h5g4-ppwx-48q2
Aliases: CVE-2022-29194
Published: 2022-05-24T22:06:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.DeleteSessionTensor`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L128-L144) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

handle = tf.constant("[]", shape=[0], dtype=tf.string)
tf.raw_ops.DeleteSessionTensor(handle=handle)
```
  
The code assumes `handle` is a scalar but there is no validation for this:
  
```cc
    const Tensor& handle = ctx->input(0);
    const string& name = handle.scalar<tstring>()();
```

### Patches
We have patched the issue in GitHub commit [cff267650c6a1b266e4b4500f69fbc49cdd773c5](https://github.com/tensorflow/tensorflow/commit/cff267650c6a1b266e4b4500f69fbc49cdd773c5).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Moodle remote code execution via quiz questions
Advisory: GHSA-3m99-h3hp-w9j7
Aliases: CVE-2014-3545
Published: 2022-05-13T01:12:40Z

Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.
Cleartext Storage of Sensitive Information in Jenkins Extensive Testing Plugin
Advisory: GHSA-8x6c-375h-pm4f
Aliases: CVE-2019-10448
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Extensive Testing Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
Cross-site Scripting in Apache Atlas 
Advisory: GHSA-q586-7p8w-9pg8
Aliases: CVE-2017-3155
Published: 2022-05-17T01:17:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to cross frame scripting.
Improper Neutralization of Input During Web Page Generation in IPython
Advisory: GHSA-q326-jhw3-699g
Aliases: CVE-2015-4706
Published: 2022-05-17T00:36:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path.
jQuery vulnerable to Cross-Site Scripting (XSS)
Advisory: GHSA-579v-mp3v-rrw5
Aliases: CVE-2011-4969
Published: 2022-05-14T01:09:51Z

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.
ChakraCore RCE Vulnerability
Advisory: GHSA-5j48-826p-2w9r
Aliases: CVE-2018-0834
Published: 2022-05-13T01:18:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
Centreon Privilege Escalation 
Advisory: GHSA-f24j-f97w-65h8
Aliases: CVE-2018-21025
Published: 2022-05-24T16:57:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files.
Red Hat Wildfly DoS
Advisory: GHSA-p4xg-cpr9-vwvj
Aliases: CVE-2016-9589
Published: 2022-05-13T01:38:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers" (default 200) * "max-header-size" (default 1MB) per active TCP connection.
Apache Struts Access Control Redirect
Advisory: GHSA-vq79-mgpx-2wx4
Aliases: CVE-2016-4431
Published: 2022-05-17T02:16:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Apache Struts 2 2.3.20 through 2.3.28.1 allows remote attackers to bypass intended access restrictions and conduct redirection attacks by leveraging a default method.
Roundup sensitive data disclosure vulnerability
Advisory: GHSA-j556-q367-2gw6
Aliases: CVE-2014-6276
Published: 2022-05-17T03:56:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote authenticated users to obtain sensitive user information by viewing user details.
Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java
Advisory: GHSA-rm7v-gqfg-p2wc
Aliases: CVE-2014-3603
Published: 2022-05-14T01:11:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Keycloak Reflected XSS
Advisory: GHSA-v38p-mqq3-m6v5
Aliases: CVE-2017-12158
Published: 2022-05-13T01:38:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Sling
Advisory: GHSA-cxwh-vmhg-39r2
Aliases: CVE-2013-2254
Published: 2022-05-17T01:36:04Z

The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
Mulesoft Mule Unsafe Deserialization
Advisory: GHSA-cvcf-w75c-gw5r
Aliases: CVE-2019-13116
Published: 2022-05-24T16:58:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The MuleSoft Mule runtime engine before 3.8.0 allows remote attackers to execute arbitrary code because of Java Deserialization, related to Apache Commons Collections.
OpenNMS Horizon RCE via JEXL2 expression
Advisory: GHSA-c3mp-9vx3-2rvv
Aliases: CVE-2021-3396
Published: 2022-05-24T17:42:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

OpenNMS Meridian 2016, 2017, 2018 before 2018.1.25, 2019 before 2019.1.16, and 2020 before 2020.1.5, Horizon 1.2 through 27.0.4, and Newts <1.5.3 has Incorrect Access Control, which allows local and remote code execution using JEXL expressions.
Rancher Privilege Escalation Vulnerability
Advisory: GHSA-gc62-j469-9gjm
Aliases: CVE-2019-12274
Published: 2022-05-24T16:47:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Rancher 1 and 2 through 2.2.3, unprivileged users (if allowed to deploy nodes) can gain admin access to the Rancher management plane because node driver options intentionally allow posting certain data to the cloud. The problem is that a user could choose to post a sensitive file such as /root/.kube/config or /var/lib/rancher/management-state/cred/kubeconfig-system.yaml.
Password in config file in KIE server
Advisory: GHSA-pjw3-c74j-m9fj
Aliases: CVE-2016-7043
Published: 2022-05-24T16:45:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deployed on the same server would have access to these properties, thus granting access to ther services.
PySAML2 XML external entity attack
Advisory: GHSA-m269-wj6g-c459
Aliases: CVE-2016-10127
Published: 2022-05-17T02:56:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response.
Improper Validation of Integrity Check Value in go-tuf
Advisory: GHSA-66x3-6cw3-v5gj
Aliases: CVE-2022-29173
Published: 2022-05-24T20:50:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

### Impact

[go-tuf](https://github.com/theupdateframework/go-tuf) does not correctly implement the [client workflow](https://theupdateframework.github.io/specification/v1.0.28/index.html#detailed-client-workflow) for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software which the client previously knew to be available, and may include software with known vulnerabilities.

In more detail, the client code of go-tuf has several issues in regards to preventing rollback attacks:
1. It does not take into account the content of any previously trusted metadata, if available, before proceeding with updating roles other than the root role (i.e., steps 5.4.3.1 and 5.5.5 of the detailed client workflow). This means that any form of version verification done on the newly-downloaded metadata is made using the default value of zero, which always passes. 
1. For both timestamp and snapshot roles, go-tuf saves these metadata files as trusted before verifying if the version of the metafiles they refer to is correct (i.e., steps 5.5.4 and 5.6.4 of the detailed client workflow).

### Patches

A fix is available in version 0.3.0 or newer.

### Workarounds

No workarounds are known for this issue apart from upgrading.

### References

* Commit resolving the issue https://github.com/theupdateframework/go-tuf/commit/ed6788e710fc3093a7ecc2d078bf734c0f200d8d
* TUF specification version against which this vulnerability is observed is [v.1.0.28](https://theupdateframework.github.io/specification/v1.0.28/index.html#detailed-client-workflow). For more details, refer to Section 5.
* Codebase that is affected is [go-tuf@f0c3294f63b9145029464164f9bce49553b77cbb](https://github.com/theupdateframework/go-tuf/tree/f0c3294f63b9145029464164f9bce49553b77cbb)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-tuf](https://github.com/theupdateframework/go-tuf/issues)
* Email us at TUF's [mailing list](mailto:theupdateframework@googlegroups.com)
* The [#tuf](https://cloud-native.slack.com/archives/C8NMD3QJ3) channel on [CNCF Slack](https://slack.cncf.io/).
Incorrect Authorization in Jenkins Script Security Plugin
Advisory: GHSA-62pm-mgrh-7p69
Aliases: CVE-2019-16538
Published: 2022-05-24T17:01:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.
CSRF vulnerability in Jenkins Fortify on Demand Plugin
Advisory: GHSA-p364-xfp2-f9rr
Aliases: CVE-2020-2203
Published: 2022-05-24T17:22:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A cross-site request forgery vulnerability in Jenkins Fortify on Demand Plugin 5.0.1 and earlier allows attackers to connect to the globally configured Fortify on Demand endpoint using attacker-specified credentials IDs.

This form validation method requires appropriate permission in Fortify on Demand Plugin 6.0.0.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-mp9r-rh95-f8f8
Aliases: CVE-2019-7885
Published: 2022-05-24T16:52:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Insufficient input validation in the config builder of the Elastic search module could lead to remote code execution in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This vulnerability could be abused by an authenticated user with the ability to configure the catalog search.
Reflected XSS vulnerability in Jenkins JSGames Plugin
Advisory: GHSA-7hf3-h28p-q6gx
Aliases: CVE-2020-2248
Published: 2022-05-24T17:27:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Jenkins JSGames Plugin 0.2 and earlier evaluates part of a URL as code, resulting in a reflected cross-site scripting (XSS) vulnerability.
Improper Access Control in Elasticsearch
Advisory: GHSA-fj32-6v7m-57pg
Aliases: CVE-2019-7611
Published: 2022-05-13T01:14:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used . If the elasticsearch.yml file has xpack.security.dls_fls.enabled set to false, certain permission checks are skipped when users perform one of the actions mentioned above, to make existing data available under a new index/alias name. This could result in an attacker gaining additional permissions against a restricted index.
StackStorm st2 Infinite Loop Condition
Advisory: GHSA-39mj-fpg2-3jrg
Aliases: CVE-2021-28667
Published: 2022-05-24T17:44:46Z
Withdrawn: 2023-08-07T20:56:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

StackStorm before 3.4.1, in some situations, has an infinite loop that consumes all available memory and disk space. This can occur if Python 3.x is used, the locale is not utf-8, and there is an attempt to log Unicode data (from an action or rule name).
Apache Archiva vulnerable to Cross Site Request Forgery
Advisory: GHSA-hf4p-mhc8-x2gp
Aliases: CVE-2017-5657
Published: 2022-05-14T01:09:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Several REST service endpoints of Apache Archiva are not protected against Cross Site Request Forgery (CSRF) attacks. A malicious site opened in the same browser as the archiva site, may send an HTML response that performs arbitrary actions on archiva services, with the same rights as the active archiva session (e.g. administrator rights).
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-wqv4-9gr3-3qgh
Aliases: CVE-2017-1000395
Published: 2022-05-14T01:04:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins 2.73.1 and earlier, 2.83 and earlier provides information about Jenkins user accounts which is generally available to anyone with Overall/Read permissions via the /user/(username)/api remote API. This included e.g. Jenkins users' email addresses if the Mailer Plugin is installed. The remote API now no longer includes information beyond the most basic (user ID and name) unless the user requesting it is a Jenkins administrator.
Jenkins Cadence vManager Plugin disables SSL/TLS and hostname verification 
Advisory: GHSA-5j9f-5wmp-7f8h
Aliases: CVE-2019-10446
Published: 2022-05-24T16:58:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Jenkins Cadence vManager Plugin prior to version 2.7.1 disables SSL/TLS and hostname verification globally for the Jenkins master JVM. This issue is patched in 2.7.1
Sandbox bypass vulnerability through implicitly allowlisted platform Groovy files in Jenkins Pipeline: Groovy Plugin
Advisory: GHSA-2xvx-rw9p-xgfc
Aliases: CVE-2022-30945
Published: 2022-05-18T00:00:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Pipeline: Groovy Plugin allows pipelines to load Groovy source files. This is intended to be used to allow Global Shared Libraries to execute without sandbox protection.

In Pipeline: Groovy Plugin 2689.v434009a_31b_f1 and earlier, any Groovy source files bundled with Jenkins core and plugins could be loaded this way and their methods executed. If a suitable Groovy source file is available on the classpath of Jenkins, sandbox protections can be bypassed.

The Jenkins security team has been unable to identify any Groovy source files in Jenkins core or plugins that would allow attackers to execute dangerous code. While the severity of this issue is declared as High due to the potential impact, successful exploitation is considered very unlikely.

Pipeline: Groovy Plugin 2692.v76b_089ccd026 restricts which Groovy source files can be loaded in Pipelines.

Groovy source files in public plugins intended to be executed in sandboxed pipelines have been identified and added to an allowlist. The new extension point `org.jenkinsci.plugins.workflow.cps.GroovySourceFileAllowlist` allows plugins to add specific Groovy source files to that allowlist if necessary, but creation of plugin-specific Pipeline DSLs is strongly discouraged.
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
Advisory: GHSA-5qpp-v56f-mqfm
Aliases: CVE-2013-4294
Published: 2022-05-17T04:58:57Z

The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Keycloak Authentication Error
Advisory: GHSA-fv4q-wm8c-wjg4
Aliases: CVE-2019-14909
Published: 2022-05-24T17:02:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.
Moodle XSS Vulnerability
Advisory: GHSA-p7v9-gjrh-563x
Aliases: CVE-2018-10891
Published: 2022-05-13T01:14:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the question preview that is displayed to execute JavaScript that is written into the question bank.
Plone denial of service via Caching Bypass
Advisory: GHSA-97rj-p794-wq6m
Aliases: CVE-2012-5498
Published: 2022-05-17T04:01:59Z

queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.
HashiCorp Consul can use cleartext agent-to-agent RPC communication
Advisory: GHSA-4qvx-qq5w-695p
Aliases: CVE-2018-19653
Published: 2022-05-14T01:36:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the `verify_outgoing` setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.
OpenStack Compute (Nova) Exposure of Sensitive Information to an Unauthorized Actor vulnerability
Advisory: GHSA-xjmj-p278-4jp5
Aliases: CVE-2014-3517
Published: 2022-05-14T01:58:50Z

api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.
Cross-site Scripting in Jenkins Blue Ocean Plugin
Advisory: GHSA-7fjr-5hph-c2mh
Aliases: CVE-2019-1003013
Published: 2022-05-13T01:31:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting vulnerability exists in Jenkins Blue Ocean Plugins 1.10.1 and earlier that allows attackers with permission to edit a user's description in Jenkins to have Blue Ocean render arbitrary HTML when using it as that user.
This vulnerability is found in:
- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/Export.java 
- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/ExportConfig.java
- blueocean-commons/src/main/java/io/jenkins/blueocean/commons/stapler/export/JSONDataWriter.java
- blueocean-rest-impl/src/main/java/io/jenkins/blueocean/service/embedded/UserStatePreloader.java
- blueocean-web/src/main/resources/io/jenkins/blueocean/PageStatePreloadDecorator/header.jelly
Camaleon CMS vulnerable to Uncaught Exception
Advisory: GHSA-r2w2-h6r8-3r53
Aliases: CVE-2021-25971
Published: 2022-05-24T19:18:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

In Camaleon CMS, versions 2.0.1 through 2.6.0 are vulnerable to an Uncaught Exception. The app's media upload feature crashes permanently when an attacker with a low privileged access uploads a specially crafted .svg file.
Improper masking of some secrets in Jenkins Credentials Binding Plugin
Advisory: GHSA-7ff8-qfwx-8gx5
Aliases: CVE-2020-2182
Published: 2022-05-24T17:17:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Credentials Binding Plugin allows specifying passwords and other secrets as environment variables, and will hide them from console output in builds. As a side effect of the fix for [SECURITY-698](https://www.jenkins.io/security/advisory/2018-02-05/#credentials-binding), `$` characters in secrets are escaped to `$$`. This will then be expanded to $ again once the secret is passed to (post) build steps.

Credentials Binding Plugin 1.22 and earlier does not mask the escaped form of the secret (containing `$$`). This occurs for example in the \"Execute Maven top-level targets\" build step included in Jenkins.\n\nCredentials Binding Plugin 1.23 now masks secrets both in their original form and with escaped `$` characters, so they will be masked even if printed before value expansion.
CSRF vulnerability in Jenkins Configuration Slicing Plugin
Advisory: GHSA-42mm-x828-56c7
Aliases: CVE-2021-21617
Published: 2022-05-24T17:43:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Configuration Slicing Plugin 1.51 and earlier does not require POST requests for the form submission endpoint reconfiguring slices, resulting in a cross-site request forgery (CSRF) vulnerability.

This vulnerability allows attackers to apply different slice configurations to attacker-specified jobs.

Configuration Slicing Plugin 1.52 requires POST requests for the affected HTTP endpoint.
ChakraCore RCE Vulnerability
Advisory: GHSA-77qc-gp37-hr26
Aliases: CVE-2016-7243
Published: 2022-05-14T02:22:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7202, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, and CVE-2016-7242.
Command Injection in VIVO Vitro
Advisory: GHSA-hgq9-q8g2-3jmg
Aliases: CVE-2019-6986
Published: 2022-05-13T01:22:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SPARQL Injection in VIVO Vitro v1.10.0 allows a remote attacker to execute arbitrary SPARQL via the uri parameter, leading to a regular expression denial of service (ReDoS), as demonstrated by crafted use of FILTER%20regex in a /individual?uri= request.
Logic error in Matrix SDK for Android
Advisory: GHSA-jjmc-4p83-pp26
Aliases: CVE-2021-40824
Published: 2022-05-24T19:14:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

A logic error in the room key sharing functionality of Element Android before 1.2.2 and matrix-android-sdk2 (aka Matrix SDK for Android) before 1.2.2 leads to a situation where identity verification is inadequate and thus a key-requesting device can be impersonated.
Jenkins Denial of Service vulnerability
Advisory: GHSA-r5m2-g5gc-q43r
Aliases: CVE-2014-3661
Published: 2022-05-17T03:53:42Z

Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to cause a denial of service (thread consumption) via vectors related to a CLI handshake.
hexo-admin plugin for Node.js XSS Vulnerability
Advisory: GHSA-g784-q3p3-26rm
Aliases: CVE-2019-17606
Published: 2022-05-24T16:59:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.
Insecure temporary file usage in Jenkins Git Client Plugin
Advisory: GHSA-fcxw-hhxq-48wx
Aliases: CVE-2017-1000242
Published: 2022-05-17T00:21:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Git Client Plugin 2.4.2 and earlier creates temporary file with insecure permissions resulting in information disclosure
Jenkins GitHub Pull Request Builder Plugin 
Advisory: GHSA-876j-4q73-7f56
Aliases: CVE-2018-1000143
Published: 2022-05-14T03:23:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

GitHub Pull Request Builder Plugin stored the webhook secret shared between Jenkins and GitHub in plain text. This allowed users with Jenkins controller local file system access and Jenkins administrators to retrieve the stored password. The latter could result in exposure of the passwords through browser extensions, cross-site scripting vulnerabilities, and similar situations. GitHub Pull Request Builder Plugin 1.32.1 and newer stores the webhook secret encrypted on disk.
python-apt Does Not Check Hash Signature
Advisory: GHSA-pj65-3pf6-c5q4
Aliases: CVE-2019-15796
Published: 2022-05-24T17:12:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Python-apt doesn't check if hashes are signed in `Version.fetch_binary()` and `Version.fetch_source()` of apt/package.py or in `_fetch_archives()` of apt/cache.py in version 1.9.3ubuntu2 and earlier. This allows downloads from unsigned repositories which shouldn't be allowed and has been fixed in verisions 1.9.5, 1.9.0ubuntu1.2, 1.6.5ubuntu0.1, 1.1.0~beta1ubuntu0.16.04.7, 0.9.3.5ubuntu3+esm2, and 0.8.3ubuntu7.5.
PyDio Stored XSS Vulnerability
Advisory: GHSA-5ghg-233h-7j79
Aliases: CVE-2019-10047
Published: 2022-05-24T16:46:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be used to access the uploaded file. If a malicious user shares an uploaded HTML file containing JavaScript code with another user of the application, and tricks an authenticated victim into accessing a URL that results in the HTML code being interpreted by the web browser, then the included JavaScript code is executed under the context of the victim user session.
Improper authorization due to caching in Jenkins Role-based Authorization Strategy Plugin
Advisory: GHSA-25g4-p347-x748
Aliases: CVE-2020-2286
Published: 2022-05-24T17:30:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Role-based Authorization Strategy Plugin 2.12 and newer uses a cache to speed up permission lookups. Role-based Authorization Strategy Plugin 3.0 and earlier this cache is not invalidated properly when an administrator changes the permission configuration. This can result in permissions being granted long after the configuration was changed to no longer grant them. Role-based Authorization Strategy Plugin 3.1 properly invalidates the cache on configuration changes.
Deserialization of Untrusted Data in JYaml
Advisory: GHSA-4qhr-q7wf-94xp
Aliases: CVE-2020-8441
Published: 2022-05-24T17:09:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-q6q9-83xw-mp6p
Aliases: CVE-2019-10402
Published: 2022-05-24T22:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

In Jenkins 2.196 and earlier, LTS 2.176.3 and earlier, the f:combobox form control interpreted its item labels as HTML, resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.
Observable Timing Discrepancy in totp-rs
Advisory: GHSA-8vxv-2g8p-2249
Aliases: CVE-2022-29185
Published: 2022-05-24T21:33:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N

### Impact
Token comparison was not constant time, and could theorically be used to guess value of an TOTP token, and thus reuse it in the same time window. The attacker would have to know the password beforehand nonetheless.

### Patches
Library now used constant-time comparison.

### Workarounds
No.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [totp-rs](https://github.com/constantoine/totp-rs)
* Email us at [cleo.rebert@gmail.com](mailto:cleo.rebert@gmail.com)
Ansible Arbitrary File Overwrite Vulnerability
Advisory: GHSA-pcqv-c46v-2p4v
Aliases: CVE-2013-4260
Published: 2022-05-14T02:03:36Z

lib/ansible/playbook/__init__.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.
RCE in SiteServer CMS
Advisory: GHSA-q469-j32f-h7vm
Aliases: CVE-2022-28118
Published: 2022-05-04T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SiteServer CMS  v7.x, which SiteServer UI relies on, allows attackers to execute arbitrary code via a crafted plug-in.
XWiki XSS Vulnerability
Advisory: GHSA-6mvr-cq72-f66v
Aliases: CVE-2018-16277
Published: 2022-05-14T01:59:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The Image Import function in XWiki through 10.7 has XSS.
Lack of type validation in agent related REST API in Jenkins
Advisory: GHSA-pvwx-3jx5-24r2
Aliases: CVE-2021-21639
Published: 2022-05-24T17:46:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins 2.286 and earlier, LTS 2.277.1 and earlier does not validate the type of object created after loading the data submitted to the `config.xml` REST API endpoint of a node.

This allows attackers with Computer/Configure permission to replace a node with one of a different type.

Jenkins 2.287, LTS 2.277.2 validates the type of object created and rejects objects of unexpected types.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-x3p3-929j-pq66
Aliases: CVE-2015-7536
Published: 2022-05-17T03:53:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in Jenkins before 1.640 and LTS before 1.625.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors related to workspaces and archived artifacts.
Ignite Realtime Openfire directory traversal vulnerability
Advisory: GHSA-59h8-h34r-q9cv
Aliases: CVE-2019-18393
Published: 2022-05-24T16:59:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability. Version 4.5.0-beta contains a fix for the issue.
Code injection in Apache Struts
Advisory: GHSA-7ghm-rpc7-p7g5
Aliases: CVE-2013-2115
Published: 2022-05-13T01:16:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks.

both the s:url and s:a tag provide an includeParams attribute.

The main scope of that attribute is to understand whether includes http request parameter or not.

The allowed values of includeParams are:

    none - include no parameters in the URL (default)
    get - include only GET parameters in the URL
    all - include both GET and POST parameters in the URL

A request that included a specially crafted request parameter could be used to inject arbitrary OGNL code into the stack, afterward used as request parameter of an URL or A tag , which will cause a further evaluation.

The second evaluation happens when the URL/A tag tries to resolve every parameters present in the original request.
This lets malicious users put arbitrary OGNL statements into any request parameter (not necessarily managed by the code) and have it evaluated as an OGNL expression to enable method execution and execute arbitrary methods, bypassing Struts and OGNL library protections.

The issue was originally addressed by Struts 2.3.14.1 and Security Announcement [S2-013](https://cwiki.apache.org/confluence/display/WW/S2-013). However, the solution introduced with 2.3.14.1 did not address all possible attack vectors, such that every version of Struts 2 before 2.3.14.2 is still vulnerable to such attacks.
Exposure of Sensitive Information to an Unauthorized Actor in Elasticsearch
Advisory: GHSA-r9fv-qpm9-rj4g
Aliases: CVE-2018-3831
Published: 2022-05-13T01:27:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.
Silverstripe has Incorrect Default Permissions 
Advisory: GHSA-589q-75r3-mfq4
Aliases: CVE-2020-6165
Published: 2022-05-24T17:23:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited (e.g., through pagination), resulting in records that should have failed a permission check being added to the final result set. GraphQL endpoints are configured by default (e.g., for assets), but the admin/graphql endpoint is access protected by default. This limits the vulnerability to all authenticated users, including those with limited permissions (e.g., where viewing records exposed through admin/graphql requires administrator permissions). However, if custom GraphQL endpoints have been configured for a specific implementation (usually under /graphql), this vulnerability could also be exploited through unauthenticated requests. This vulnerability only applies to reading records; it does not allow unauthorised changing of records.
Nokogiri implementation of libxslt vulnerable to heap corruption
Advisory: GHSA-vmfx-gcfq-wvm2
Aliases: CVE-2019-5815
Published: 2022-05-24T17:03:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type confusion in `xsltNumberFormatGetMultipleLevel` prior to libxslt 1.1.33 could allow attackers to potentially exploit heap corruption via crafted XML data.

Nokogiri prior to version 1.10.5 contains a vulnerable version of libxslt. Nokogiri version 1.10.5 upgrades the dependency to libxslt 1.1.34, which contains a patch for this issue.