aswin1906/github-advisory-2022 huggingface dataset:
Path traversal in ginadmin
Advisory: GHSA-9pg5-3pjc-f8wm
Aliases: CVE-2022-30427
Published: 2022-05-26T00:01:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In ginadmin through 05-10-2022 the incoming path value is not filtered, resulting in directory traversal. A [patch](https://github.com/gphper/ginadmin/commit/726109f01ad23523715f36f7d272958064666a30) is available on the `master` branch of the repository.
Improper Neutralization of Input During Web Page Generation in LXML
Advisory: GHSA-xp26-p53h-6h2p
Aliases: CVE-2018-19787
Published: 2022-05-13T01:13:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by "j a v a s c r i p t:" in Internet Explorer. This is a similar issue to CVE-2014-3146.
OS command execution vulnerability in Perfecto Plugin
Advisory: GHSA-jq84-6fmm-6qv6
Aliases: CVE-2020-2261
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Perfecto Plugin allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations.

This command is executed on the Jenkins controller in Perfecto Plugin 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller.

Perfecto Plugin 1.18 executes the specified commands on the agent the build is running on.
Improper Certificate Validation in OkHttp
Advisory: GHSA-4hc2-jh7r-wrc3
Aliases: CVE-2016-2402
Published: 2022-05-13T01:11:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.
Sandbox bypass vulnerability in Script Security Plugin
Advisory: GHSA-gj3q-p8cm-26rm
Aliases: CVE-2020-2134
Published: 2022-05-24T17:10:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Sandbox protection in Script Security Plugin 1.70 and earlier can be circumvented through:
- Crafted constructor calls and bodies (due to an incomplete fix of [SECURITY-582](https://www.jenkins.io/security/advisory/2017-08-07/#super-constructor-calls))
- Crafted method calls on objects that implement `GroovyInterceptable`

This allows attackers able to specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins controller JVM.

Script Security Plugin 1.71 has additional restrictions and sanity checks to ensure that super constructors cannot be constructed without being intercepted by the sandbox. In addition, it also intercepts method calls on objects that implement `GroovyInterceptable` as calls to `GroovyObject#invokeMethod(String, Object)`, which is on the list of dangerous signatures and should not be approved for use in the sandbox.
Keycloak vulnerable to Server-Side Request Forgery
Advisory: GHSA-jh7q-5mwf-qvhw
Aliases: CVE-2020-10770
Published: 2022-05-24T17:36:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter `request_uri`. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.
Jenkins Groovy Postbuild Plugin vulnerable to Cross-site Scripting
Advisory: GHSA-38ch-x695-m794
Aliases: CVE-2018-1000202
Published: 2022-05-14T03:13:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A persisted cross-site scripting vulnerability exists in Jenkins Groovy Postbuild Plugin 2.3.1 and older in various Jelly files that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user performs some UI actions.
Podman Elevated Container Privileges
Advisory: GHSA-wp7w-vx86-vj9h
Aliases: CVE-2018-10856
Published: 2022-05-13T01:34:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.
XML External Entity Reference vulnerability in Jenkins Config File Provider Plugin
Advisory: GHSA-q7xg-hh3q-hc68
Aliases: CVE-2021-21642
Published: 2022-05-24T17:48:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Config File Provider Plugin 3.7.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers with the ability to define Maven configuration files to have Jenkins parse a crafted configuration file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Config File Provider Plugin 3.7.1 disables external entity resolution for its XML parser.
ChakraCore RCE Vulnerability
Advisory: GHSA-5q2v-52gc-4w7p
Aliases: CVE-2018-0925
Published: 2022-05-13T01:18:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0876, CVE-2018-0889, CVE-2018-0893, and CVE-2018-0935.
Cross-site Scripting in LimeSurvey
Advisory: GHSA-fr47-r224-c36m
Aliases: CVE-2019-16172
Published: 2022-05-24T16:55:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to, for example, SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.
Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API
Advisory: GHSA-m643-2pfv-xwm8
Aliases: CVE-2018-19413
Published: 2022-05-14T01:43:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A vulnerability in the API of SonarSource SonarQube before 7.4 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the externalIdentity field to non-administrator users. The attacker could use this information in subsequent attacks against the system.
Integer Overflow or Wraparound in JBCrypt
Advisory: GHSA-9h6p-92jq-888x
Aliases: CVE-2015-0886
Published: 2022-05-13T01:05:53Z

Integer overflow in the crypt_raw method in the key-stretching implementation in JBCrypt before 0.4 makes it easier for remote attackers to determine cleartext values of password hashes via a brute-force attack against hashes associated with the maximum exponent.
XXE vulnerability in Jenkins RapidDeploy Plugin
Advisory: GHSA-g7w4-r4mg-gvhx
Aliases: CVE-2020-2171
Published: 2022-05-24T17:12:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

RapidDeploy Plugin 4.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows a user able to control the input files for the 'RapidDeploy deployment package build' build or post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller, server-side request forgery, or denial-of-service attacks.

RapidDeploy Plugin 4.2.1 disables external entity resolution for its XML parser.
Magento 2 Community Edition Weak PRNG
Advisory: GHSA-8v9h-m7pj-hx7c
Aliases: CVE-2019-7860
Published: 2022-05-24T16:52:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
CakePHP allows remote attackers to spoof their IP
Advisory: GHSA-j8p3-8m69-2hqq
Aliases: CVE-2016-4793
Published: 2022-05-14T02:19:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The `clientIp` function in CakePHP 3.2.4 and earlier allows remote attackers to spoof their IP via the `CLIENT-IP HTTP` header.
RubyGems Regular Expression Denial of Service
Advisory: GHSA-9qvm-2vhf-q649
Aliases: CVE-2013-4363
Published: 2022-05-17T00:16:50Z

Algorithmic complexity vulnerability in `Gem::Version::ANCHORED_VERSION_PATTERN` in `lib/rubygems/version.rb` in RubyGems before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to cause a denial of service (CPU consumption) via a crafted gem version that triggers a large amount of backtracking in a regular expression.  NOTE: this issue is due to an incomplete fix for CVE-2013-4287.
.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability
Advisory: GHSA-g5vf-38cp-4px9
Aliases: CVE-2020-1147
Published: 2022-05-24T17:22:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability'.
Apache Superset Stored XSS on Dashboard markdown
Advisory: GHSA-w358-rj93-r5qv
Aliases: CVE-2021-27907
Published: 2022-05-24T22:29:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code.
Improper Authentication in Mortbay Jetty
Advisory: GHSA-fvh3-4v5r-cvvc
Aliases: CVE-2007-5614
Published: 2022-05-01T18:35:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Mortbay Jetty before 6.1.6rc1 does not properly handle "certain quote sequences" in HTML cookie parameters, which allows remote attackers to hijack browser sessions via unspecified vectors.
Apache OpenMeetings Cross-site Scripting vulnerability
Advisory: GHSA-gw38-mxr2-rm8r
Aliases: CVE-2016-2163
Published: 2022-05-14T02:46:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross-site scripting (XSS) vulnerability in Apache OpenMeetings before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via the event description when creating an event.
Improper Authentication in Jenkins
Advisory: GHSA-q4cq-r7hg-pxqq
Aliases: CVE-2018-1999045
Published: 2022-05-14T01:04:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A improper authentication vulnerability exists in Jenkins 2.137 and earlier, 2.121.2 and earlier in SecurityRealm.java, TokenBasedRememberMeServices2.java that allows attackers with a valid cookie to remain logged in even if that feature is disabled.
Subrion CMS CSRF Vulnerability
Advisory: GHSA-g8j7-w673-4mjp
Aliases: CVE-2018-21037
Published: 2022-05-24T17:11:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Subrion CMS 4.1.5 (and possibly earlier versions) allow CSRF to change the administrator password via the `panel/members/edit/1` URI.
Infinite Loop in Jenkins Core
Advisory: GHSA-8qpf-fv36-h4r8
Aliases: CVE-2018-1999044
Published: 2022-05-13T01:50:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

A Cron expression form validation could enter infinite loop, potentially resulting in denial of service. The form validation for cron expressions (e.g. "Poll SCM", "Build periodically") could enter infinite loops when cron expressions only matching certain rare dates were entered, blocking request handling threads indefinitely.
phpMyAdmin Multiple cross-site scripting (XSS) vulnerabilities 
Advisory: GHSA-5gh4-v2ch-pcx4
Aliases: CVE-2013-4997
Published: 2022-05-17T05:07:14Z

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in (1) an anchor identifier to setup/index.php or (2) a chartTitle (aka chart title) value.
PrestaShop Stored Cross-Site Scripting Vulnerability
Advisory: GHSA-crpg-2mm2-jjqf
Aliases: CVE-2013-4791
Published: 2022-05-05T00:29:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

PrestaShop before 1.4.11 allows Logistician, translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.
NULL Pointer Dereference in HyperLedger Fabric
Advisory: GHSA-vjj6-5m9f-wqjw
Aliases: CVE-2021-43667
Published: 2022-05-25T19:23:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.1.0. This bug can be leveraged by constructing a message whose payload is nil and sending this message with the method 'forwardToLeader'. This bug has been admitted and fixed by the developers of Fabric. If leveraged, any leader node will crash.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-6967-9vvv-4cmm
Aliases: CVE-2017-2606
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an information exposure in the internal API that allows access to item names that should not be visible (SECURITY-380). This only affects anonymous users (other users legitimately have access) that were able to get a list of items via an UnprotectedRootAction.
Improper `Sync` implementation on `FuturesUnordered` in futures-utils can cause data corruption
Advisory: GHSA-5r9g-j7jj-hw6c
Aliases: CVE-2020-35908
Published: 2022-05-24T17:37:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the futures-util crate before 0.3.2 for Rust. FuturesUnordered can lead to data corruption because Sync is mishandled.
Improper Input Validation in libpam4j
Advisory: GHSA-x9rg-q5fx-fx66
Aliases: CVE-2017-12197
Published: 2022-05-13T01:38:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

It was found that libpam4j prior to 1.10 did not properly validate user accounts when authenticating. A user with a valid password for a disabled account would be able to bypass security restrictions and possibly access sensitive information.
Exposure of Sensitive Information in Jenkins Datadog plugin
Advisory: GHSA-hf7w-f4h4-9xp8
Aliases: CVE-2017-1000114
Published: 2022-05-17T00:33:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

The Datadog Plugin stores an API key to access the Datadog service in the global Jenkins configuration. While the API key is stored encrypted on disk, it was transmitted in plain text as part of the configuration form. This could result in exposure of the API key for example through browser extensions or cross-site scripting vulnerabilities. The Datadog Plugin now encrypts the API key transmitted to administrators viewing the global configuration form.
Deserialization of Untrusted Data in topthink/framework
Advisory: GHSA-3fpv-54ff-wqfj
Aliases: CVE-2021-23592
Published: 2022-05-07T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package topthink/framework before version 6.0.12 is vulnerable to Deserialization of Untrusted Data due to insecure `unserialize` method in the `Driver` class.
Apache Tomcat Discloses MS-DOS Pathname
Advisory: GHSA-x89r-2wjq-mj7x
Aliases: CVE-2005-4703
Published: 2022-05-01T02:29:50Z

Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by `lpt9.xtp` using Nikto.
Improper Neutralization of Input During Web Page Generation in Jenkins
Advisory: GHSA-jff5-55xj-4jcq
Aliases: CVE-2017-2610
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names (SECURITY-388).
Incorrect Authorization in Jenkins Core
Advisory: GHSA-3857-xm38-jmq2
Aliases: CVE-2016-3722
Published: 2022-05-14T03:57:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Jenkins before 2.3 and LTS before 1.651.2 allow remote authenticated users with multiple accounts to cause a denial of service (unable to login) by editing the "full name."
Kubernetes arbitrary file overwrite
Advisory: GHSA-2jq6-ffph-p4h8
Aliases: CVE-2018-1002100
Published: 2022-05-13T01:35:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files.
Protection Mechanism Failure in Jenkins Script Security Plugin
Advisory: GHSA-784j-h234-m56x
Aliases: CVE-2019-1003000
Published: 2022-05-13T01:15:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CakePHP might allow remote attackers to bypass CSRF protection mechanism via the _method parameter
Advisory: GHSA-556q-h4vr-pgh2
Aliases: CVE-2015-8379
Published: 2022-05-14T02:47:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CakePHP 2.x and 3.x before 3.1.5 might allow remote attackers to bypass the CSRF protection mechanism via the `_method` parameter.
Improper Restriction of XML External Entity Reference in Jenkins JUnit Plugin
Advisory: GHSA-4rj6-9pjh-882r
Aliases: CVE-2018-1000056
Published: 2022-05-14T03:40:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H

Jenkins JUnit Plugin 1.23 and earlier processes XML external entities in files it parses as part of the build process, allowing attackers with user permissions in Jenkins to extract secrets from the Jenkins master, perform server-side request forgery, or denial-of-service attacks.
ChakraCore RCE Vulnerability
Advisory: GHSA-85j8-g29g-m326
Aliases: CVE-2018-8371
Published: 2022-05-13T01:20:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.
Missing Authorization in Jenkins
Advisory: GHSA-p8x8-p473-mmmv
Aliases: CVE-2017-1000400
Published: 2022-05-13T01:18:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

The Jenkins 2.73.1 and earlier, 2.83 and earlier remote API at /job/(job-name)/api contained information about upstream and downstream projects. This included information about tasks that the current user otherwise has no access to, e.g. due to lack of Item/Read permission. This has been fixed, and the API now only lists upstream and downstream projects that the current user has access to.
ChakraCore RCE Vulnerability
Advisory: GHSA-fv8m-p45w-gf38
Aliases: CVE-2018-0818
Published: 2022-05-13T01:48:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft ChakraCore allows an attacker to bypass Control Flow Guard (CFG) in conjunction with another vulnerability to run arbitrary code on a target system, due to how the Chakra scripting engine handles accessing memory, aka "Scripting Engine Security Feature Bypass".
Jenkins HTML Publisher Plugin path traversal vulnerability
Advisory: GHSA-4x63-3p7q-xmh7
Aliases: CVE-2018-1000175
Published: 2022-05-14T03:18:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

A path traversal vulnerability exists in Jenkins HTML Publisher Plugin 1.15 and older in HtmlPublisherTarget.java that allows attackers able to configure the HTML Publisher build step to override arbitrary files on the Jenkins master. In version 1.16, non-alphanumeric characters in report names are escaped for use as part of a URL and as a directory name.
XSS vulnerability in Jenkins useMango Runner Plugin
Advisory: GHSA-5x89-75r7-8rjh
Aliases: CVE-2020-2176
Published: 2022-05-24T17:13:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Multiple form validation endpoints in useMango Runner Plugin 1.4 and earlier do not escape values received from the useMango service.

This results in a cross-site scripting (XSS) vulnerability exploitable by users able to control the values returned from the useMango service.

useMango Runner Plugin 1.5 escapes all values received from the useMango service in form validation messages.
XXE vulnerability in Jenkins Parasoft Findings Plugin
Advisory: GHSA-2rh4-xgmq-63jp
Aliases: CVE-2020-2178
Published: 2022-05-24T17:15:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Parasoft Findings Plugin implements a static analysis parser for various Parasoft products and integrates with [Warnings Plugin](https://plugins.jenkins.io/warnings) (10.4.1 and earlier) and [Warnings NG Plugin](https://plugins.jenkins.io/warnings-ng) (10.4.2 and newer).

Parasoft Findings Plugin 10.4.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for the Parasoft Findings parser to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

Parasoft Findings Plugin 10.4.4 disables external entity resolution for its XML parser.
ChakraCore RCE Vulnerability
Advisory: GHSA-9hjg-j983-mqcc
Aliases: CVE-2020-1065
Published: 2022-05-24T17:18:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'.
Apache Shindig PHP Sensitive Information Disclosure
Advisory: GHSA-6jvw-rpw4-gj4x
Aliases: CVE-2013-4295
Published: 2022-05-17T04:59:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Improper Authentication in Spring Security
Advisory: GHSA-gv9v-c375-hvmg
Aliases: CVE-2014-0097
Published: 2022-05-13T01:01:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

The ActiveDirectoryLdapAuthenticator in Spring Security 3.2.0 to 3.2.1 and 3.1.0 to 3.1.5 does not check the password length. If the directory allows anonymous binds then it may incorrectly authenticate a user who supplies an empty password.
ChakraCore Remote Code Execution Vulnerability
Advisory: GHSA-8xv4-c7rq-j577
Aliases: CVE-2020-1037
Published: 2022-05-24T17:18:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra Scripting Engine Memory Corruption Vulnerability'.
Rambox RCE Vulnerability
Advisory: GHSA-2gc6-2h2g-ph48
Aliases: CVE-2019-17625
Published: 2022-05-24T16:58:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron, such as an exec of OS commands within the onerror attribute of an IMG element.
MyBatis PageHelper vulnerable to time-blind SQL injection via orderBy parameter
Advisory: GHSA-w559-623p-vfg8
Aliases: CVE-2022-28111
Published: 2022-05-05T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MyBatis PageHelper versions 3.5.x through 5.3.x were discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter.
spring-integration-zip Arbitrary File Write
Advisory: GHSA-87vg-5pgx-pggh
Aliases: CVE-2018-1263
Published: 2022-05-13T01:07:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-53jp-gmwc-jwf6
Aliases: CVE-2018-1000410
Published: 2022-05-14T01:04:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An information exposure vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier, and the Stapler framework used by these releases, in core/src/main/java/org/kohsuke/stapler/RequestImpl.java, core/src/main/java/hudson/model/Descriptor.java that allows attackers with Overall/Administer permission or access to the local file system to obtain credentials entered by users if the form submission could not be successfully processed.
futures_task::waker may cause a use-after-free if used on a type that isn't 'static
Advisory: GHSA-r93v-9p5q-vhpf
Aliases: CVE-2020-35906
Published: 2022-05-24T17:37:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions of the crate did not properly implement a 'static lifetime bound on the waker function. This resulted in a use-after-free if Waker::wake() is called after original data had been dropped.

The flaw was corrected by adding 'static lifetime bound to the data waker takes.
ChakraCore RCE Vulnerability
Advisory: GHSA-7gjv-9m33-chg8
Aliases: CVE-2018-0858
Published: 2022-05-13T01:18:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
ChakraCore RCE Vulnerability
Advisory: GHSA-8g43-4g4j-g9r5
Aliases: CVE-2016-3269
Published: 2022-05-14T02:24:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3265.
Django DoS in django.views.static.serve
Advisory: GHSA-jhjg-w2cp-5j44
Aliases: CVE-2015-0221
Published: 2022-05-17T03:20:50Z

The `django.views.static.serve` view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.
Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF)
Advisory: GHSA-vv6j-5x58-q2c3
Aliases: CVE-2008-1285
Published: 2022-05-01T23:38:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
matrix-sydent and matrix-synapse Use Cryptographically Weak PRNG
Advisory: GHSA-gwf7-vfjf-wf6x
Aliases: CVE-2019-11842
Published: 2022-05-24T16:45:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.
Symfony collectionCascaded and collectionCascadedDeeply fields security bypass
Advisory: GHSA-q8j7-fjh7-25v5
Aliases: CVE-2013-4751
Published: 2022-05-05T00:28:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

When using the Validator component, if `Symfony\\Component\\Validator\\Mapping\\Cache\\ApcCache` is enabled (or any other cache implementing `Symfony\\Component\\Validator\\Mapping\\Cache\\CacheInterface`), some information is lost during serialization (the `collectionCascaded` and the `collectionCascadedDeeply` fields).

As a consequence, arrays or traversable objects stored in fields using the `@Valid` constraint are not traversed by the validator as soon as the validator configuration is loaded from the cache.
baserCMS Cross Site Request Forgery vulnerability
Advisory: GHSA-fg52-rc36-jp43
Aliases: CVE-2016-4878
Published: 2022-05-17T02:45:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site request forgery (CSRF) vulnerability in baserCMS version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.
Prototype Pollution in protobufjs
Advisory: GHSA-g954-5hwp-pp24
Aliases: CVE-2022-25878
Published: 2022-05-28T00:00:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The package protobufjs is vulnerable to Prototype Pollution, which can allow an attacker to add/modify properties of the Object.prototype. Versions after and including 6.10.0 until 6.10.3 and after and including 6.11.0 until 6.11.3 are vulnerable.

This vulnerability can occur in multiple ways:
1. by providing untrusted user input to util.setProperty or to ReflectionObject.setParsedOption functions
2. by parsing/loading .proto files
baserCMS SQL Injection vulnerability
Advisory: GHSA-jc94-wp59-pq4f
Aliases: CVE-2017-10842
Published: 2022-05-14T01:22:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SQL injection vulnerability in the baserCMS 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-85xw-3hp5-6fmc
Aliases: CVE-2019-8138
Published: 2022-05-24T17:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event.
XXE vulnerability in Jenkins OWASP Dependency-Check Plugin
Advisory: GHSA-mj5v-ggjc-48p5
Aliases: CVE-2021-43577
Published: 2022-05-24T19:20:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

OWASP Dependency-Check Plugin 5.1.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

This allows attackers able to control workspace contents to have Jenkins parse a crafted XML file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.
Improper Certificate Validation in Jenkins
Advisory: GHSA-fq9f-9wv9-rfmg
Aliases: CVE-2017-1000396
Published: 2022-05-14T01:04:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used as a transitive dependency in Jenkins plugins. The fix for CVE-2012-6153 was backported to the version of commons-httpclient that is bundled in core and made available to plugins.
Open redirect in Apache Struts
Advisory: GHSA-rpj9-r897-wc6q
Aliases: CVE-2013-2248
Published: 2022-05-17T03:13:10Z

The Struts 2 DefaultActionMapper used to support a method for short-circuit navigation state changes by prefixing parameters with "redirect:" or "redirectAction:", followed by a desired redirect target expression. This mechanism was intended to help with attaching navigational information to buttons within forms. Attackers could use this to redirect to arbitrary web sites and conduct phishing attacks.

In Struts 2 before 2.3.15.1 the information following "redirect:" or "redirectAction:" can easily be manipulated to redirect to an arbitrary location.
phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence
Advisory: GHSA-2wxv-3g4v-p76p
Aliases: CVE-2006-3360
Published: 2022-05-01T07:08:17Z

Directory traversal vulnerability in index.php in phpSysInfo prior to 3.2.5 allows remote attackers to determine the existence of arbitrary files via a .. (dot dot) sequence and a trailing null (%00) byte in the lng parameter, which will display a different error message if the file exists.
Local Information Disclosure Vulnerability in io.netty:netty-codec-http
Advisory: GHSA-269q-hmxg-m83q
Aliases: CVE-2022-24823
Published: 2022-05-10T08:46:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Description ###
[GHSA-5mcr-gq6c-3hq2](https://github.com/netty/netty/security/advisories/GHSA-5mcr-gq6c-3hq2) (CVE-2021-21290) contains an insufficient fix for the vulnerability identified.

### Impact ###

When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled.

This only impacts applications running on Java version 6 and lower. Additionally, this vulnerability impacts code running on Unix-like systems, and very old versions of Mac OSX and Windows as they all share the system temporary directory between all users.

### Vulnerability Details ###

To fix the vulnerability the code was changed to the following:

```java
    @SuppressJava6Requirement(reason = "Guarded by version check")
    public static File createTempFile(String prefix, String suffix, File directory) throws IOException {
        if (javaVersion() >= 7) {
            if (directory == null) {
                return Files.createTempFile(prefix, suffix).toFile();
            }
            return Files.createTempFile(directory.toPath(), prefix, suffix).toFile();
        }
        if (directory == null) {
            return File.createTempFile(prefix, suffix);
        }
        File file = File.createTempFile(prefix, suffix, directory);
        // Try to adjust the perms, if this fails there is not much else we can do...
        file.setReadable(false, false);
        file.setReadable(true, true);
        return file;
    }
```

Unfortunately, this logic path was left vulnerable:

```java
        if (directory == null) {
            return File.createTempFile(prefix, suffix);
        }
```

This file is still readable by all local users.

### Patches ###

Update to 4.1.77.Final

### Workarounds ###

Specify your own `java.io.tmpdir` when you start the JVM or use `DefaultHttpDataFactory.setBaseDir(...)` to set the directory to something that is only readable by the current user or update to Java 7 or above.

### References ###

 - [CWE-378: Creation of Temporary File With Insecure Permissions](https://cwe.mitre.org/data/definitions/378.html)
 - [CWE-379: Creation of Temporary File in Directory with Insecure Permissions](https://cwe.mitre.org/data/definitions/379.html)


### For more information ###

If you have any questions or comments about this advisory:

Open an issue in [netty](https://github.com/netty/netty)
Improper Authentication in Jenkins Blue Ocean Plugin
Advisory: GHSA-qgjq-m78x-4gm8
Aliases: CVE-2017-1000106
Published: 2022-05-13T01:40:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N

Blue Ocean allows the creation of GitHub organization folders that are set up to scan a GitHub organization for repositories and branches containing a Jenkinsfile, and create corresponding pipelines in Jenkins. Its SCM content REST API supports the pipeline creation and editing feature in Blue Ocean. The SCM content REST API did not check the current user's authentication or credentials. If the GitHub organization folder was created via Blue Ocean, it retained a reference to its creator's GitHub credentials. This allowed users with read access to the GitHub organization folder to create arbitrary commits in the repositories inside the GitHub organization corresponding to the GitHub organization folder with the GitHub credentials of the creator of the organization folder. Additionally, users with read access to the GitHub organization folder could read arbitrary file contents from the repositories inside the GitHub organization corresponding to the GitHub organization folder if the branch contained a Jenkinsfile (which could be created using the other part of this vulnerability), and they could provide the organization folder name, repository name, branch name, and file name.
Typo3 Extbase Framework Unsafe Deserialization
Advisory: GHSA-7jfm-px59-99w8
Aliases: CVE-2012-1605
Published: 2022-05-17T05:23:50Z

The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument."
Pimcore Access Control Issues
Advisory: GHSA-jhcf-j4hg-v64r
Aliases: CVE-2019-18981
Published: 2022-05-24T17:01:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
Insecure cookie storage in Apache Atlas 
Advisory: GHSA-wvmq-w7m8-g9xm
Aliases: CVE-2017-3150
Published: 2022-05-17T01:18:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating use cookies that could be accessible to client-side script.
Minion identity not validated in saltstack
Advisory: GHSA-jmv9-5gx8-7xpf
Aliases: CVE-2013-4439
Published: 2022-05-17T04:58:30Z

Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.
Plone DoS via Crafted URL
Advisory: GHSA-gx6w-hcw3-5r37
Aliases: CVE-2012-5496
Published: 2022-05-17T04:32:20Z

kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-92mr-4w2q-4578
Aliases: CVE-2017-1000362
Published: 2022-05-17T02:25:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The re-key admin monitor was introduced in Jenkins 1.498 and re-encrypted all secrets in JENKINS_HOME with a new key. It also created a backup directory with all old secrets, and the key used to encrypt them. These backups were world-readable and not removed afterwards. Jenkins now deletes the backup directory, if present. Upgrading from before 1.498 will no longer create a backup directory. Administrators relying on file access permissions in their manually created backups are advised to check them for the directory $JENKINS_HOME/jenkins.security.RekeySecretAdminMonitor/backups, and delete it if present.
Chameleon in Plone allows Authentication Bypass
Advisory: GHSA-6h8x-73fx-q2h9
Aliases: CVE-2016-4043
Published: 2022-05-17T02:57:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.
Improper Neutralization of Input During Web Page Generation in Apache ActiveMQ
Advisory: GHSA-mfhr-3xmc-r2gg
Aliases: CVE-2013-1879
Published: 2022-05-17T01:36:25Z

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
Podman Path Traversal Vulnerability leads to arbitrary file read/write
Advisory: GHSA-rh5f-2w6r-q7vj
Aliases: CVE-2019-10152
Published: 2022-05-24T16:51:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.
phpMyAdmin DoS Vulnerability
Advisory: GHSA-9hrc-rwrq-v6mh
Aliases: CVE-2017-1000014
Published: 2022-05-14T01:19:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

phpMyAdmin 4.0, 4.4, and 4.6 are vulnerable to a DOS weakness in the table editing functionality
Path traversal in Gitblit
Advisory: GHSA-2c65-rq62-fqhq
Aliases: CVE-2022-31268
Published: 2022-05-22T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
Apache OpenMeetings allows remote attackers to read arbitrary files by attempting to upload a file
Advisory: GHSA-f6vf-465r-h42p
Aliases: CVE-2016-2164
Published: 2022-05-14T02:46:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The (1) FileService.importFileByInternalUserId and (2) FileService.importFile SOAP API methods in Apache OpenMeetings before 3.1.1 improperly use the Java URL class without checking the specified protocol handler, which allows remote attackers to read arbitrary files by attempting to upload a file.
Improper Neutralization of Input During Web Page Generation in JavaMelody
Advisory: GHSA-p4mx-p49m-8rw4
Aliases: CVE-2013-4378
Published: 2022-05-17T05:02:46Z

Cross-site scripting (XSS) vulnerability in HtmlSessionInformationsReport.java in JavaMelody 1.46 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted X-Forwarded-For header.
Incomplete exclude pattern in Apache Struts
Advisory: GHSA-q2cg-xf9p-h457
Aliases: CVE-2015-1831
Published: 2022-05-17T00:50:08Z

The default exclude patterns (excludeParams) in Apache Struts 2.3.20 allow remote attackers to "compromise internal state of an application" via unspecified vectors. In Struts 2.3.20.1 a better set of exlude patterns was defined.
Moodle does not revoke role capabilities correctly
Advisory: GHSA-g9m2-c2x5-fr2v
Aliases: CVE-2019-14879
Published: 2022-05-24T17:05:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

A vulnerability was found in Moodle versions 3.7.x before 3.7.3, 3.6.x before 3.6.7 and 3.5.x before 3.5.9. When a cohort role assignment was removed, the associated capabilities were not being revoked (where applicable).
Missing Authorization in Jenkins WMI Windows Agents plugin
Advisory: GHSA-p566-wpxx-574m
Aliases: CVE-2022-30951
Published: 2022-05-18T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

WMI Windows Agents Plugin 1.8 and earlier includes the Windows Remote Command library. It provides a general-purpose remote command execution capability that Jenkins uses to check if Java is available, and if not, to install it.

This library has a buffer overflow vulnerability that may allow users able to connect to a named pipe to execute commands on the Windows agent machine.

Additionally, while the processes are started as the user who connects to the named pipe, no access control takes place, potentially allowing users to start processes even if they’re not allowed to log in.

WMI Windows Agents Plugin 1.8.1 no longer includes the Windows Remote Command library. A Java runtime is expected to be available on agent machines and WMI Windows Agents Plugin 1.8.1 does not install a JDK automatically otherwise.
Prototype Pollution in sds
Advisory: GHSA-ph28-wwfj-fv7f
Aliases: CVE-2022-25862
Published: 2022-05-14T00:01:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to CVE-2020-7618
ChakraCore RCE Vulnerability
Advisory: GHSA-rhwh-jw9h-4m49
Aliases: CVE-2017-11821
Published: 2022-05-17T00:32:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11807, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, and CVE-2017-11812.
Improper Input Validation in RESTEasy
Advisory: GHSA-63cq-ppq8-cw6g
Aliases: CVE-2020-1695
Published: 2022-05-24T22:01:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.
ChakraCore RCE Vulnerability
Advisory: GHSA-q6mv-8vh9-4ggj
Aliases: CVE-2016-3248
Published: 2022-05-14T02:24:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 9 through 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3259.
github.com/gofiber/fiber/v2 vulnerable to Origin Validation Error
Advisory: GHSA-927h-x4qj-r242
Aliases: CVE-2018-20744
Published: 2022-05-14T01:33:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

The Olivier Poitrey Go CORS handler through 1.3.0 actively converts a wildcard CORS policy into reflecting an arbitrary Origin header value, which is incompatible with the CORS security design, and could lead to CORS misconfiguration security problems.