aswin1906/github-advisory-2022 huggingface dataset:
Reflected cross-site scripting (XSS) vulnerability
Advisory: GHSA-hrgx-7j6v-xj82
Aliases: CVE-2022-0087
Published: 2022-01-12T21:55:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the `@keystone-6/auth` package.

#### Impact
The vulnerability can impact users of the administration user interface when following an untrusted link to the `signin` or `init` page.
This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability.

## Vulnerability mitigation
Please upgrade to `@keystone-6/auth >= 1.0.2`, where this vulnerability has been closed.
If you are using `@keystone-next/auth`,  we **strongly** recommend you upgrade to `@keystone-6`.

### Workarounds
If for some reason you cannot upgrade the dependencies in software, you could alternatively

- disable the administration user interface, or 
- if using a reverse-proxy, strip query parameters when accessing the administration interface

### References
https://owasp.org/www-community/attacks/xss/

Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability
Deserialization of Untrusted Data in Apache Heron
Advisory: GHSA-hjgm-f7vx-m5g7
Aliases: CVE-2020-1964
Published: 2022-01-06T19:44:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

It was noticed that Apache Heron 0.20.2-incubating, Release 0.20.1-incubating, and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).
Prototype Pollution in js-data
Advisory: GHSA-c6h4-gc3f-hgjq
Aliases: CVE-2021-23574
Published: 2022-01-06T21:58:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
Observable Discrepancy and Observable Timing Discrepancy in Jenkins Configuration as Code Plugin
Advisory: GHSA-fpj7-9xm6-8hgr
Aliases: CVE-2022-23106
Published: 2022-01-21T23:38:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Jenkins Configuration as Code Plugin prior to 1.55.1, 1.54.1, 1.53.1, and 1.47.1 does not use a constant-time comparison when checking whether two authentication tokens are equal.

This could potentially allow attackers to use statistical methods to obtain a valid authentication token.

Configuration as Code Plugin 1.55.1, 1.54.1, 1.53.1, and 1.47.1 now uses a constant-time comparison when validating authentication tokens.
A potential Denial of Service issue in protobuf-java
Advisory: GHSA-wrvw-hg22-4m67
Aliases: CVE-2021-22569
Published: 2022-01-07T22:31:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Summary

A potential Denial of Service issue in protobuf-java was discovered in the parsing procedure for binary data.

Reporter: [OSS-Fuzz](https://github.com/google/oss-fuzz)

Affected versions: All versions of Java Protobufs (including Kotlin and JRuby) prior to the versions listed below. Protobuf "javalite" users (typically Android) are not affected.

## Severity

[CVE-2021-22569](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22569) **High** - CVSS Score: 7.5,  An implementation weakness in how unknown fields are parsed in Java. A small (~800 KB) malicious payload can occupy the parser for several minutes by creating large numbers of short-lived objects that cause frequent, repeated GC pauses.

## Proof of Concept

For reproduction details, please refer to the oss-fuzz issue that identifies the specific inputs that exercise this parsing weakness.

## Remediation and Mitigation

Please update to the latest available versions of the following packages:

- protobuf-java (3.16.1, 3.18.2, 3.19.2) 
- protobuf-kotlin (3.18.2, 3.19.2)
- google-protobuf [JRuby  gem only] (3.19.2)
Path traversal in Apache James
Advisory: GHSA-c38m-7h53-g9v4
Aliases: CVE-2021-40525
Published: 2022-01-21T23:36:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any file. This vulnerability had been patched in Apache James 3.6.1 and higher. We recommend the upgrade. Distributed and Cassandra based products are also not impacted.
Deserialization of Untrusted Data in Log4j 1.x
Advisory: GHSA-w9p3-5cr8-m3jj
Aliases: CVE-2022-23302
Published: 2022-01-21T23:27:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Advisory: GHSA-hx77-5p88-f92r
Aliases: CVE-2021-4131
Published: 2022-01-05T20:33:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Arbitrary File Upload in Mingsoft MCMS
Advisory: GHSA-77hh-p7r6-66pv
Aliases: CVE-2022-22929
Published: 2022-01-22T00:00:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file.
Authentication Bypass in ADOdb/ADOdb
Advisory: GHSA-65mj-7c86-79jf
Aliases: CVE-2021-3850
Published: 2022-01-27T15:23:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

### Impact

An attacker can inject values into a PostgreSQL connection string by providing a parameter surrounded by single quotes.

Depending on how the library is used in the client software, this may allow an attacker to bypass the login process, gain access to the server's IP address, etc.

### Patches

The vulnerability is fixed in ADOdb versions 5.20.21 (952de6c4273d9b1e91c2b838044f8c2111150c29) and 5.21.4 or later (b4d5ce70034c5aac3a1d51d317d93c037a0938d2).

The simplest patch is to delete line 29 in `drivers/adodb-postgres64.inc.php`:

```php
diff --git a/drivers/adodb-postgres64.inc.php b/drivers/adodb-postgres64.inc.php
index d04b7f67..729d7141 100644
--- a/drivers/adodb-postgres64.inc.php
+++ b/drivers/adodb-postgres64.inc.php
@@ -26,7 +26,6 @@ function adodb_addslashes($s)
 {
    $len = strlen($s);
    if ($len == 0) return "''";
-   if (strncmp($s,"'",1) === 0 && substr($s,$len-1) == "'") return $s; // already quoted
 
    return "'".addslashes($s)."'";
 }
```

### Workarounds

Ensure the parameters passed to *ADOConnection::connect()* or related functions (_nConnect()_, _pConnect()_) are not surrounded by single quotes.

### Credits

Thanks to **Emmet Leahy** (@meme-lord) of Sorcery Ltd for reporting this vulnerability, and to the [huntr](https://huntr.dev/) team for their support.

### References

- Original issue report https://huntr.dev/bounties/bdf5f216-4499-4225-a737-b28bc6f5801c/
- ADOdb reference issue #793 

### For more information

If you have any questions or comments about this advisory:
* Add a note in issue #793
* Contact the maintainers on [Gitter](https://gitter.im/adodb/adodb)
Business Logic Errors in pimcore
Advisory: GHSA-54hw-mhgh-x4vc
Aliases: CVE-2021-4146
Published: 2022-01-26T22:09:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In pimcore versions prior to 10.2.9 discounts could be negative resulting in unintended behavior.
Stored XSS vulnerability in Jenkins Badge Plugin
Advisory: GHSA-5qx5-vg5w-5mx3
Aliases: CVE-2022-23108
Published: 2022-01-13T00:00:54Z

Jenkins Badge Plugin 1.9 and earlier does not escape the description and does not check for allowed protocols when creating a badge, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
Missing Authentication for Critical Function in Apache NiFi
Advisory: GHSA-3pp3-77j6-8ph6
Aliases: CVE-2020-9487
Published: 2022-01-06T20:41:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Apache NiFi 1.0.0 to 1.11.4, the NiFi download token (one-time password) mechanism used a fixed cache size and did not authenticate a request to create a download token, only when attempting to use the token to access the content. An unauthenticated user could repeatedly request download tokens, preventing legitimate users from requesting download tokens.
Incorrect Calculation in the MSR JavaScript Cryptography Library
Advisory: GHSA-9x9j-836w-8f55
Aliases: CVE-2020-1026
Published: 2022-01-06T19:44:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library's Elliptic Curve Cryptography (ECC) implementation.An attacker could potentially abuse these bugs to learn information about a server's private ECC key (a key leakage attack) or craft an invalid ECDSA signature that nevertheless passes as valid.The security update addresses the vulnerability by fixing the bugs disclosed in the ECC implementation, aka `MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability`.
Cross-site Scripting in microweber
Advisory: GHSA-prff-6j8q-vrv7
Aliases: CVE-2022-0379
Published: 2022-01-28T22:15:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

There is a persistent XSS Vulnerability exsists in the checkout page where we can able to execute any javascription in the last name field
Uncontrolled Resource Consumption in markdown-it
Advisory: GHSA-6vfc-qv3f-vr6c
Aliases: CVE-2022-21670
Published: 2022-01-12T22:20:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact

Special patterns with length > 50K chars can slow down parser significantly.

```js
const md = require('markdown-it')();

md.render(`x ${' '.repeat(150000)} x  \nx`);
```


### Patches

Upgrade to v12.3.2+

### Workarounds

No.

### References

Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
Use of Uninitialized Resource in csv-sniffer.
Advisory: GHSA-9783-42pm-x5jq
Aliases: CVE-2021-45686
Published: 2022-01-06T22:13:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected versions of this crate passes an uninitialized buffer to a user-provided Read implementation (within fn preamble_skipcount()).

Arbitrary Read implementations can read from the uninitialized buffer (memory exposure) and also can return incorrect number of bytes written to the buffer. Reading from uninitialized memory produces undefined values that can quickly invoke undefined behavior.
Use of Uninitialized Resource in messagepack-rs.
Advisory: GHSA-jqjj-r4qp-x2gh
Aliases: CVE-2021-45693
Published: 2022-01-06T22:12:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string_primitive may read from uninitialized memory locations.
Execution with Unnecessary Privileges in ipython
Advisory: GHSA-pq7m-3gw7-gq5x
Aliases: CVE-2022-21699
Published: 2022-01-21T18:55:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

We’d like to disclose an arbitrary code execution vulnerability in IPython that stems from IPython executing untrusted files in CWD. This vulnerability allows one user to run code as another.
 
Proof of concept

User1:
```
mkdir -m 777 /tmp/profile_default
mkdir -m 777 /tmp/profile_default/startup
echo 'print("stealing your private secrets")' > /tmp/profile_default/startup/foo.py
```

User2:
```
cd /tmp
ipython
```

 

User2 will see:
```
Python 3.9.7 (default, Oct 25 2021, 01:04:21)
Type 'copyright', 'credits' or 'license' for more information
IPython 7.29.0 -- An enhanced Interactive Python. Type '?' for help.
stealing your private secrets
```


## Patched release and documentation

See https://ipython.readthedocs.io/en/stable/whatsnew/version8.html#ipython-8-0-1-cve-2022-21699, 

Version 8.0.1, 7.31.1 for current Python version are recommended. 
Version 7.16.3 has also been published for Python 3.6 users, 
Version 5.11 (source only, 5.x branch on github) for older Python versions.
pimcore is vulnerable to Cross-site Scripting
Advisory: GHSA-57hg-26h7-9qgv
Aliases: CVE-2022-0256
Published: 2022-01-21T23:48:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Panic mishandled in libpulse-binding
Advisory: GHSA-xvcg-2q82-r87j
Aliases: CVE-2019-25055
Published: 2022-01-06T22:18:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the libpulse-binding crate before 2.6.0 for Rust. It mishandles a panic that crosses a Foreign Function Interface (FFI) boundary.
Cross-site Scripting Vulnerability in CodeIgniter4
Advisory: GHSA-7528-7jg5-6g62
Aliases: CVE-2022-21715
Published: 2022-01-27T15:09:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

### Impact
Cross-Site Scripting (XSS) vulnerability was found in `API\ResponseTrait` in Codeigniter4.
Attackers can do XSS attacks if you are using `API\ResponseTrait`.

### Patches
Upgrade to v4.1.8 or later.

### Workarounds
Do one of the following:
1. Do not use `API\ResponseTrait` nor `ResourceController`
2. Disable Auto Route and [Use Defined Routes Only](https://codeigniter4.github.io/userguide/incoming/routing.html#use-defined-routes-only)

### References
- [Cross Site Scripting (XSS) Software Attack | OWASP Foundation](https://owasp.org/www-community/attacks/xss/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Denial of service in CBOR library
Advisory: GHSA-fj2w-wfgv-mwq6
Published: 2022-01-21T23:21:48Z

### Impact
Due to this library's use of an inefficient algorithm, it is vulnerable to a denial of service attack when a maliciously crafted input is passed to `DecodeFromBytes` or other CBOR decoding mechanisms in this library.  

Affected versions _include_ versions 4.0.0 through 4.5.0.

This vulnerability was privately reported to me.

### Patches
This issue has been fixed in version 4.5.1.  Users should use the latest version of this library.  (The latest version is not necessarily 4.5.1.  Check the README for [this library's repository](https://github.com/peteroupc/CBOR-Java) to see the latest version's version number.)

### Workarounds

Again, users should use the latest version of this library.

In the meantime, note that the inputs affected by this issue are all CBOR maps or contain CBOR maps.  An input that decodes to a single CBOR object is not capable of containing a CBOR map if&mdash;

- it begins with a byte other than 0x80 through 0xDF, or
- it does not contain a byte in the range 0xa0 through 0xBF.

Such an input is not affected by this vulnerability and an application can choose to perform this check before passing it to a CBOR decoding mechanism.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the CBOR repository](https://github.com/peteroupc/CBOR-Java).
golang.org/x/net/http2 allows uncontrolled memory consumption
Advisory: GHSA-vc3p-29h2-gpcp
Aliases: CVE-2021-44716
Published: 2022-01-02T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests.
Open Redirect in Grav
Advisory: GHSA-wrxc-mr2w-cjpv
Aliases: CVE-2020-11529
Published: 2022-01-07T00:20:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Common/Grav.php in Grav before 1.6.23 has an Open Redirect.
jsx-slack insufficient patch for CVE-2021-43838 ReDoS
Advisory: GHSA-hp68-xhvj-x6j6
Aliases: CVE-2021-43843
Published: 2022-01-06T18:34:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

We found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient to save from Regular Expression Denial of Service (ReDoS) attack.

This vulnerability affects to jsx-slack v4.5.1 and earlier versions.

### Impact

If attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

```javascript
/** @jsxImportSource jsx-slack */
import { Section } from 'jsx-slack'

console.log(
  <Section>
    <blockquote>
      {[...Array(40)].map(() => (
        <p>亜</p>
      ))}
    </blockquote>
  </Section>
)
```

v4.5.1 has released by passing the test against ASCII characters but missed the case of multibyte characters.
https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q

### Patches

jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.

### References

- https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29ecc

### Credits

Thanks to @hieki for finding out this vulnerability.
Cookie Prefix Spoofing in CGI::Cookie.parse
Advisory: GHSA-4vf4-qmvg-mh7h
Aliases: CVE-2021-41819
Published: 2022-01-21T23:22:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem prior to versions 0.3.1, 0.2.1, 0.1.1, and 0.1.0.1 for Ruby.
RPC call failure in ckb
Advisory: GHSA-8gjm-h3xj-mp6w
Aliases: CVE-2021-45698
Published: 2022-01-06T22:10:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the ckb crate before 0.40.0 for Rust. A get_block_template RPC call may fail in situations where it is supposed to select a Nervos CKB blockchain transaction with a higher fee rate than another transaction.
Path Traversal in nemo-toolkit
Advisory: GHSA-9hg3-hmmf-c3gr
Aliases: CVE-2022-22821
Published: 2022-01-11T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

NVIDIA NeMo before 1.6.0 contains a vulnerability in ASR WebApp, in which ../ Path Traversal may lead to deletion of any directory when admin privileges are available.
ReDOS in Vfsjfilechooser2
Advisory: GHSA-c7fh-chf7-jr5x
Aliases: CVE-2021-29061
Published: 2022-01-06T18:44:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 which occurs when the application attempts to validate crafted URIs.
Denial of Service in soketi
Advisory: GHSA-86ch-6w7v-v6xf
Aliases: CVE-2022-21667
Published: 2022-01-08T00:24:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
_What kind of vulnerability is it? Who is impacted?_

There was a wrong behavior when reading POST requests, making the server crash if it couldn't read the body. In case a POST request was sent to any endpoint of the server with an empty body, **even unauthenticated with the Pusher Protocol**, it would simply just crash the server for trying to send a response after the request closed.

All users that run the server are affected by it and it's highly recommended to upgrade to the latest patch.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Updating to at least 0.24.1 or the latest version.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No. Upgrading is the only solution.

### References
_Are there any links users can visit to find out more?_

https://github.com/soketi/soketi/releases/tag/0.24.1

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issues board](https://github.com/soketi/soketi/issues)
* Email us at [alex@renoki.org](mailto:alex@renoki.org)
Withdrawn: Code Injection in loguru
Advisory: GHSA-cvp7-c586-cmf4
Aliases: CVE-2022-0329
Published: 2022-01-28T22:01:45Z
Withdrawn: 2022-02-01T15:17:33Z

# Withdrawn

This advisory has been withdrawn after the maintainers of loguru noted this issue is not a security vulnerability and the CVE has been revoked. We have [stopped](https://github.com/Delgan/loguru/issues/563#issuecomment-1025223732) Dependabot alerts regarding this issue.

## Original Description

In versions of loguru up to and including 0.5.3 a lack of sanitization on log serialization can lead to arbitrary code execution. The maintainer disputes the issue, but has altered behavior of the library in commit 4b0070a4f30cbf6d5e12e6274b242b62ea11c81b. See https://github.com/Delgan/loguru/issues/563 for further discussion of the issue. The function in question is intended for internal use only, but is not restricted. This has been patched in version 0.6.0.
Improper Authorization in Keycloak
Advisory: GHSA-83x4-9cwr-5487
Aliases: CVE-2021-4133
Published: 2022-01-06T18:32:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.
Agent-to-controller security bypass in Jenkins Conjur Secrets Plugin allows decrypting secrets
Advisory: GHSA-g7fx-mmjc-r7gv
Aliases: CVE-2022-23116
Published: 2022-01-13T00:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Jenkins Conjur Secrets Plugin 1.0.9 and earlier implements functionality that allows attackers able to control agent processes to decrypt secrets stored in Jenkins obtained through another method.
Cross-site Scripting in calibreweb
Advisory: GHSA-h56g-v4vp-q9q6
Aliases: CVE-2022-0352
Published: 2022-01-29T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

calibreweb prior to version 0.6.16 contains a cross-site scripting vulnerability.
snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Advisory: GHSA-4w23-c97g-fq5v
Aliases: CVE-2021-4130
Published: 2022-01-05T20:33:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF)
Denial of Service in graphql-go
Advisory: GHSA-mh3m-8c74-74xh
Aliases: CVE-2022-21708
Published: 2022-01-27T15:28:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
This is a DoS vulnerability that is possible due to a bug in the library that would allow an attacker with specifically designed queries to cause stack overflow panics. Any user with access to the GraphQL handler can send these queries and cause stack overflows. This in turn could potentially compromise the ability of the server to serve data to its users. To make things worse the only mitigation in affected versions creates opportunities for other attacks. This issue is only available if you are using `graphql.MaxDepth` option in your schema (which is highly recommended in most cases).

### Patches
The issue has been patched in version `v1.3.0`. We have been trying to maintain backwards compatibility and avoid breaking changes so upgrading should not be problematic. 

### Workarounds
The best workaround is to patch to a version greater than or equal to `v1.3.0`. 
Otherwise, the only workaround in versions prior to `v1.3.0` is to disable the `graphql.MaxDepth` option from your schema. Unfortunately, this could potentially create opportunities for other attacks.

### References
There are no references or links. This issue was reported privately and was fixed before creating this Security Advisory.

### For more information
If you have any questions or comments feel free to reach out to @pavelnikolov or @tony on the Gopher Slack.
Authorization Bypass Through User-Controlled Key in LiveHelperChat
Advisory: GHSA-c7fm-jx59-wjf6
Aliases: CVE-2022-0266
Published: 2022-01-21T18:50:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
Missing Initialization of Resource in pnet
Advisory: GHSA-24g6-5rx7-58wj
Aliases: CVE-2019-25054
Published: 2022-01-06T22:18:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the pnet crate before 0.27.2 for Rust. There is a segmentation fault (upon attempted dereference of an uninitialized descriptor) because of an erroneous IcmpTransportChannelIterator compiler optimization.
Use of Uninitialized Resource in messagepack-rs
Advisory: GHSA-jwfh-j623-m97h
Aliases: CVE-2021-45691
Published: 2022-01-06T22:12:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_string may read from uninitialized memory locations.
Path Traversal in http-server-node
Advisory: GHSA-hj3m-v758-jwx5
Aliases: CVE-2021-23797
Published: 2022-01-05T15:02:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

All versions of package http-server-node are vulnerable to Directory Traversal via use of `--path-as-is`.
Use After Free in libpulse-binding
Advisory: GHSA-jqpv-jm4m-86j9
Aliases: CVE-2018-25028
Published: 2022-01-06T22:17:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions contained a pair of use-after-free issues with the objects returned by the get_format_info and get_context methods of Stream objects. These objects were mistakenly being constructed without setting an important flag to prevent destruction of the underlying C objects they reference upon their own destruction.
uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)
Advisory: GHSA-x8rq-rc7x-5fg5
Aliases: CVE-2022-0086
Published: 2022-01-06T22:24:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.
Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS
Advisory: GHSA-x7xf-253v-x3w8
Aliases: CVE-2016-8739
Published: 2022-05-13T01:09:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.
ChakraCore RCE Vulnerability
Advisory: GHSA-67x3-36j7-pj4g
Aliases: CVE-2018-8385
Published: 2022-05-13T01:20:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8389, CVE-2018-8390.
Apache Directory Studio Command Injection
Advisory: GHSA-p9qj-4rjp-j3w9
Aliases: CVE-2015-5349
Published: 2022-05-13T01:07:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.
Plone Zope cross-site scripting (XSS) vulnerability
Advisory: GHSA-4793-w44w-m7xm
Aliases: CVE-2013-7062
Published: 2022-05-05T00:29:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.
Improper Restriction of XML External Entity Reference in Apache FOP
Advisory: GHSA-5hg8-r9vq-gjqp
Aliases: CVE-2017-5661
Published: 2022-05-13T01:07:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
Stored XSS vulnerability in Jenkins Active Choices Plugin
Advisory: GHSA-4f6x-g5vh-8jm5
Aliases: CVE-2021-21616
Published: 2022-05-24T17:43:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission.

Active Choices Plugin 2.5.3 escapes reference parameter values.
Phusion Passenger Race Condition Allows Privilege Escalation
Advisory: GHSA-jjcj-fgfm-9g9r
Aliases: CVE-2018-12029
Published: 2022-05-14T01:27:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but before it was chowned, leads to the target of the link being chowned via the path. Targeting sensitive files such as root's crontab file allows privilege escalation.
Command injection in Apache Maven maven-shared-utils
Advisory: GHSA-rhgr-952r-6p8q
Aliases: CVE-2022-29599
Published: 2022-05-24T00:01:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
Pivotal RabbitMQ is vulnerable to a denial of service attack
Advisory: GHSA-hrfh-7j5f-8ccr
Aliases: CVE-2019-11287
Published: 2022-05-24T17:01:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be leveraged to insert a malicious Erlang format string that will expand and consume the heap, resulting in the server crashing.
Firefly III vulnerable to stored XSS
Advisory: GHSA-5hpw-vcj2-prwg
Aliases: CVE-2019-13645
Published: 2022-05-24T16:50:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing.
RubyGems has Origin Validation Error vulnerability
Advisory: GHSA-73w7-6w9g-gc8w
Aliases: CVE-2017-0902
Published: 2022-05-13T01:38:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.
XML External Entity Reference in Apache NiFi
Advisory: GHSA-qj7f-j6h9-g5rq
Aliases: CVE-2017-12623
Published: 2022-05-17T00:26:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

An authorized user could upload a template which contained malicious code and accessed sensitive files via an XML External Entity (XXE) attack. The fix to properly handle XML External Entities was applied on the Apache NiFi 1.4.0 release. Users running a prior 1.x release should upgrade to the appropriate release.
Umbraco CMS vulnerable to stored XSS
Advisory: GHSA-95qr-67rx-9pgh
Aliases: CVE-2020-5809
Published: 2022-05-24T17:37:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor, as TinyMCE is configured to allow iframes by default in Umbraco CMS.
XML External Entity processing vulnerability in Pipeline Maven Integration Jenkins Plugin
Advisory: GHSA-6755-jgp4-8q7h
Aliases: CVE-2019-10327
Published: 2022-05-24T22:00:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

An XML external entities (XXE) vulnerability in Jenkins Pipeline Maven Integration Plugin 1.7.0 and earlier allowed attackers able to control a temporary directory's content on the agent running the Maven build to have Jenkins parse a maliciously crafted XML file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.
ChakraCore RCE Vulnerability
Advisory: GHSA-72gm-pp6q-gpx5
Aliases: CVE-2017-11905
Published: 2022-05-14T04:04:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Hadoop
Advisory: GHSA-8r28-r8cp-g6cp
Aliases: CVE-2016-5001
Published: 2022-05-13T01:08:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

This is an information disclosure vulnerability in Apache Hadoop before 2.6.4 and 2.7.x before 2.7.2 in the short-circuit reads feature of HDFS. A local user on an HDFS DataNode may be able to craft a block token that grants unauthorized read access to random files by guessing certain fields in the token.
Hostname verification in Apache HttpClient 4.3 was disabled by default
Advisory: GHSA-pqwh-44jj-p5rm
Aliases: CVE-2013-4366
Published: 2022-05-13T01:25:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.
ChakraCore RCE Vulnerability
Advisory: GHSA-67xp-4726-4978
Aliases: CVE-2020-0710
Published: 2022-05-24T17:08:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0711, CVE-2020-0712, CVE-2020-0713, CVE-2020-0767.
OpenRefine Directory Traversal
Advisory: GHSA-f6fv-fjg8-4m6w
Aliases: CVE-2018-19859
Published: 2022-05-14T01:14:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

OpenRefine before 3.2 beta allows directory traversal via a relative pathname in a ZIP archive.
Shell command injection in gitea
Advisory: GHSA-p5f9-c9j9-g8qx
Aliases: CVE-2022-30781
Published: 2022-05-17T00:01:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Gitea before 1.16.7 does not escape the shell out for `git fetch remote` allowing for shell command injection
Missing permission check in Jenkins GitLab Plugin
Advisory: GHSA-5phj-qv74-pv4w
Aliases: CVE-2022-30955
Published: 2022-05-18T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins GitLab Plugin 1.5.31 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. An enumeration of credentials IDs in GitLab Plugin 1.5.32 requires the appropriate permissions.
graphite-web is vulnerable to Remote Code Execution
Advisory: GHSA-ch3j-w953-hfcm
Aliases: CVE-2013-5942
Published: 2022-05-17T05:03:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to (1) remote_storage.py, (2) storage.py, (3) render/datalib.py, and (4) whitelist/views.py, a different vulnerability than CVE-2013-5093.
ChakraCore information disclosure vulnerability
Advisory: GHSA-xgcc-r2f3-rq6p
Aliases: CVE-2018-0939
Published: 2022-05-13T01:18:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0891.
Apache Karaf vulnerable to relative path traversal
Advisory: GHSA-fjw4-39pg-vf4f
Aliases: CVE-2019-0226
Published: 2022-05-24T16:45:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Apache Karaf Config service provides a install method (via service or MBean) that could be used to travel in any directory and overwrite existing file. The vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf version before 4.2.5 is impacted. User should upgrade to Apache Karaf 4.2.5 or later.
Arbitrary command execution in Minidoc
Advisory: GHSA-f7ff-xf87-f22q
Aliases: CVE-2022-29637
Published: 2022-05-27T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file.
Grafana Cross-site Scripting vulnerability
Advisory: GHSA-7phr-6cc9-4m5q
Aliases: CVE-2019-13068
Published: 2022-05-24T16:49:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

`public/app/features/panel/panel_ctrl.ts` in Grafana before 6.2.5 allows HTML Injection in panel drilldown links (via the Title or url field).
Apache Ambari Improper Access Control
Advisory: GHSA-j76q-99x2-v7vq
Aliases: CVE-2016-6807
Published: 2022-05-17T02:51:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.
OpenStack Keystone Logs Passwords
Advisory: GHSA-jwpw-ppj5-7h4w
Aliases: CVE-2015-3646
Published: 2022-05-13T01:26:10Z

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
GitHub Git LFS Improper Input Validation vulnerability
Advisory: GHSA-w4xh-w33p-4v29
Aliases: CVE-2017-17831
Published: 2022-05-14T00:55:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

GitHub Git LFS before 2.1.1 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname, located on a `url =` line in a `.lfsconfig` file within a repository.
Apache Jackrabbit Authentication Hijacking Vulnerability
Advisory: GHSA-9fc7-rhq3-wm7x
Aliases: CVE-2016-6801
Published: 2022-05-17T03:48:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
Moodle CSRF Vulnerability
Advisory: GHSA-wv9c-pfpm-4wc5
Aliases: CVE-2019-10186
Published: 2022-05-24T16:52:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sesskey (CSRF) token was not being utilised by the XML loading/unloading admin tool.
Exposure of Sensitive Information in Jenkins Core
Advisory: GHSA-jmw7-ph6p-33cc
Aliases: CVE-2016-0791
Published: 2022-05-14T03:58:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force approach.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-298q-wv2h-v5vw
Aliases: CVE-2019-8142
Published: 2022-05-24T17:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via title of an order when configuring sales payment methods for a store.
Improper Input Validation in Jenkins
Advisory: GHSA-j8qv-mj4r-6fw4
Aliases: CVE-2018-1999001
Published: 2022-05-13T01:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A unauthorized modification of configuration vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in User.java that allows attackers to provide crafted login credentials that cause Jenkins to move the config.xml file from the Jenkins home directory. If Jenkins is started without this file present, it will revert to the legacy defaults of granting administrator access to anonymous users.
Moodle sensitive information disclosure
Advisory: GHSA-wmvq-q9h8-7j4g
Aliases: CVE-2018-10889
Published: 2022-05-13T01:34:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain details of other users who interacted with the requester.
ChakraCore RCE Vulnerability
Advisory: GHSA-g8q3-rcf9-qx4q
Aliases: CVE-2019-1024
Published: 2022-05-24T22:00:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1051, CVE-2019-1052.
Apache XML-RPC XXE Vulnerability
Advisory: GHSA-wp35-6jqv-r33m
Aliases: CVE-2016-5002
Published: 2022-05-14T01:53:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

XML external entity (XXE) vulnerability in the Apache XML-RPC (aka ws-xmlrpc) library 3.1.3, as used in Apache Archiva, allows remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted DTD.
phpMyAdmin CSRF Vulnerability
Advisory: GHSA-mfr9-pcm3-6mwc
Aliases: CVE-2019-12616
Published: 2022-05-24T16:47:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

An issue was discovered in phpMyAdmin before 4.9.0. A vulnerability was found that allows an attacker to trigger a CSRF attack against a phpMyAdmin user. The attacker can trick the user, for instance through a broken `<img>` tag pointing at the victim's phpMyAdmin database, and the attacker can potentially deliver a payload (such as a specific INSERT or DELETE statement) to the victim.
Missing permission check in Jenkins Build Failure Analyzer Plugin
Advisory: GHSA-x9gc-p2qp-4p7v
Aliases: CVE-2019-16554
Published: 2022-05-24T17:03:47Z

A missing permission check in Jenkins Build Failure Analyzer Plugin 1.24.1 and earlier allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.
Cross-site Scripting in Jirafeau
Advisory: GHSA-j2xf-p274-g8cc
Aliases: CVE-2022-30110
Published: 2022-05-18T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The file preview functionality in Jirafeau < 4.4.0, which is enabled by default, could be exploited for cross site scripting. An attacker could upload image/svg+xml files containing JavaScript. When someone visits the File Preview URL for this file, the JavaScript inside of this image/svg+xml file will be executed in the users' browser.
OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity
Advisory: GHSA-x8xr-rm9r-7mvf
Aliases: CVE-2015-0259
Published: 2022-05-14T01:58:45Z

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.
Apache James Privilege Escalation
Advisory: GHSA-xj7q-q94c-6wr3
Aliases: CVE-2017-12628
Published: 2022-05-17T00:25:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.