aswin1906/github-advisory-2022 huggingface dataset:
Camaleon CMS vulnerable to Stored Cross-site Scripting
Advisory: GHSA-7f84-9cqf-g4j9
Aliases: CVE-2018-18260
Published: 2022-05-13T01:05:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In the 2.4 version of Camaleon CMS, Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via `/admin/media/upload?actions=false`.
ChakraCore RCE Vulnerability
Advisory: GHSA-6mw4-phmc-x477
Aliases: CVE-2017-11807
Published: 2022-05-17T00:32:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ChakraCore and Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11792, CVE-2017-11793, CVE-2017-11796, CVE-2017-11797, CVE-2017-11798, CVE-2017-11799, CVE-2017-11800, CVE-2017-11801, CVE-2017-11802, CVE-2017-11804, CVE-2017-11805, CVE-2017-11806, CVE-2017-11808, CVE-2017-11809, CVE-2017-11810, CVE-2017-11811, CVE-2017-11812, and CVE-2017-11821.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-6m27-3r8q-c7f7
Aliases: CVE-2019-8146
Published: 2022-05-24T17:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores.
ChakraCore RCE Vulnerability
Advisory: GHSA-68cp-h96v-gg3x
Aliases: CVE-2017-0224
Published: 2022-05-17T02:44:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238.
Apache Hadoop's LinuxContainerExecutor runs docker commands as root with insufficient input validation
Advisory: GHSA-h24p-qwf4-84q8
Aliases: CVE-2017-7669
Published: 2022-05-17T02:41:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

In Apache Hadoop 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root. This issue is fixed in versions 2.8.1 and 3.0.0-alpha3.
Improper Privilege Management in Spring Framework
Advisory: GHSA-gfwj-fwqj-fp3v
Aliases: CVE-2021-22118
Published: 2022-05-24T19:03:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
Deserialization of Untrusted Data in Jenkins
Advisory: GHSA-fwqr-3pvp-pjwq
Aliases: CVE-2017-2608
Published: 2022-05-13T01:36:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).
Improper Neutralization of Input During Web Page Generation in Apache Sling
Advisory: GHSA-rxvx-44w5-44r7
Aliases: CVE-2015-2944
Published: 2022-05-13T01:10:58Z

Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
Exposure of Sensitive Information to an Unauthorized Actor in Oracle MySQL Connectors Java
Advisory: GHSA-pwh7-92h3-mqr6
Aliases: CVE-2017-3586
Published: 2022-05-13T01:45:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 5.1.41 and earlier. Easily "exploitable" vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Connectors. While the vulnerability is in MySQL Connectors, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of MySQL Connectors accessible data as well as unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.0 Base Score 6.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N).
Hashicorp Nomad Access Control Issues
Advisory: GHSA-2w2v-xcr9-mj4m
Aliases: CVE-2019-12618
Published: 2022-05-24T16:53:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver.
ChakraCore information disclosure vulnerability
Advisory: GHSA-xphq-3x6q-q2qq
Aliases: CVE-2018-8145
Published: 2022-05-13T01:53:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge, Internet Explorer 10. This CVE ID is unique from CVE-2018-0943, CVE-2018-8130, CVE-2018-8133, CVE-2018-8177.
Improper Control of Generation of Code ('Code Injection') in Spring Framework
Advisory: GHSA-vpr3-f594-mg5g
Aliases: CVE-2010-1622
Published: 2022-05-17T03:28:34Z

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
Improper Restriction of XML External Entity Reference in Apache Batik
Advisory: GHSA-qwgx-59jw-qfg9
Aliases: CVE-2017-5662
Published: 2022-05-13T01:14:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
PyAMF vulnerable to XML external entity (XXE)
Advisory: GHSA-m7m4-4vm8-55wg
Aliases: CVE-2015-8549
Published: 2022-05-24T17:06:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

PyAMF provides Action Message Format (AMF) support for Python that is compatible with the Adobe Flash Player. It includes integration with Python web frameworks like Django, Pylons, Twisted, SQLAlchemy, web2py and more. XML external entity (XXE) vulnerability in PyAMF before 0.8.0 allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.
Moodle improper access control
Advisory: GHSA-m7cc-6vhg-39wr
Aliases: CVE-2015-5331
Published: 2022-05-13T01:12:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Moodle 2.9.x before 2.9.3 does not properly check the contact list before authorizing message transmission, which allows remote authenticated users to bypass intended access restrictions and conduct spam attacks via the messaging API.
Magento 2 Community Edition RCE Vulnerability
Advisory: GHSA-j63v-wcf9-c9hm
Aliases: CVE-2019-8119
Published: 2022-05-24T17:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these manipulations can lead to remote code execution.
Missing validation crashes `QuantizeAndDequantizeV4Grad`
Advisory: GHSA-h2wq-prv9-2f56
Aliases: CVE-2022-29192
Published: 2022-05-24T22:06:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.QuantizeAndDequantizeV4Grad`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/quantize_and_dequantize_op.cc#L148-L226) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

tf.raw_ops.QuantizeAndDequantizeV4Grad(
  gradients=tf.constant(1, shape=[2,2], dtype=tf.float64),
  input=tf.constant(1, shape=[2,2], dtype=tf.float64),
  input_min=tf.constant([], shape=[0], dtype=tf.float64),
  input_max=tf.constant(-10, shape=[], dtype=tf.float64),
  axis=-1)
```

The code assumes `input_min` and `input_max` are scalars but there is no validation for this.

### Patches
We have patched the issue in GitHub commit [098e7762d909bac47ce1dbabe6dfd06294cb9d58](https://github.com/tensorflow/tensorflow/commit/098e7762d909bac47ce1dbabe6dfd06294cb9d58).
    
The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Microweber Insufficient Session Expiry
Advisory: GHSA-g7r3-jwhw-2wfv
Aliases: CVE-2020-23136
Published: 2022-05-24T17:33:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Microweber v1.1.18 is affected by no session expiry after log-out.
Improper Restriction of XML External Entity Reference in Mulesoft APIkit
Advisory: GHSA-jffq-528j-mp6c
Aliases: CVE-2020-10991
Published: 2022-05-24T17:12:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mulesoft APIkit through 1.3.0 allows XXE because of validation/RestXmlSchemaValidator.java
CSRF vulnerability in Jenkins promoted builds Plugin
Advisory: GHSA-5cxw-8v65-76vf
Aliases: CVE-2021-21641
Published: 2022-05-24T17:46:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

promoted builds Plugin 3.9 and earlier does not require POST requests for HTTP endpoints implementing promotion (regular, forced, and re-execute), resulting in cross-site request forgery (CSRF) vulnerabilities.

These vulnerabilities allow attackers to promote builds.

promoted builds Plugin 3.9.1 requires POST requests for the affected HTTP endpoints.

A security hardening since Jenkins 2.287 and LTS 2.277.2 prevents exploitation of this vulnerability.
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in pyftpdlib
Advisory: GHSA-62xg-239j-vxg7
Aliases: CVE-2009-5011
Published: 2022-05-02T04:00:27Z

Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the getpeername function having an ENOTCONN error, a different vulnerability than CVE-2010-3494.
Spree allows remote attackers to obtain sensitive information
Advisory: GHSA-hwrx-wc75-mgh7
Aliases: CVE-2010-3978
Published: 2022-05-14T02:42:49Z

Spree 0.11.x before 0.11.2 and 0.30.x before 0.30.0 exchanges data using JavaScript Object Notation (JSON) without a mechanism for validating requests, which allows remote attackers to obtain sensitive information via vectors involving (1) `admin/products.json`, (2) `admin/users.json`, or (3) `admin/overview/get_report_data`, related to a "JSON hijacking" issue.
OS command injection in CryptoMove Plugin
Advisory: GHSA-p5x5-jg3j-2jcj
Aliases: CVE-2020-2159
Published: 2022-05-24T17:10:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS command on the Jenkins controller.
Apache OpenMeetings vulnerable to Uncontrolled Resource Consumption
Advisory: GHSA-g3vq-f35v-vhgm
Aliases: CVE-2017-7684
Published: 2022-05-13T01:47:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Apache OpenMeetings 1.0.0 doesn't check contents of files being uploaded. An attacker can cause a denial of service by uploading multiple large files to the server.
Moodle contains Stored XSS via ID number user profile field
Advisory: GHSA-h7h6-fwpv-ggvx
Aliases: CVE-2021-20279
Published: 2022-05-24T17:44:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a .php file
Advisory: GHSA-r7p6-fr3x-r877
Aliases: CVE-2011-3712
Published: 2022-05-17T05:31:33Z

CakePHP 1.3.7 allows remote attackers to obtain sensitive information via a direct request to a `.php` file, which reveals the installation path in an error message, as demonstrated by `dispatcher.php` and certain other files.
Crash when decoding malformed HTTP requests or malformed JSON payload
Advisory: GHSA-95q3-pppp-r683
Aliases: CVE-2018-1330
Published: 2022-05-14T01:38:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

When parsing a malformed JSON payload, libprocess in Apache Mesos versions 1.4.0 to 1.5.0 might crash due to an uncaught exception. Parsing chunked HTTP requests with trailers can lead to a libprocess crash too because of the mistakenly planted assertion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
Typo3 Open Redirect In Frontend Rendering
Advisory: GHSA-v6xv-rmqc-wcc8
Aliases: CVE-2014-9508
Published: 2022-05-17T03:45:52Z

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains.

An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option `config.prefixLocalAnchors` is used with any possible value. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. As an additional pre-condition, URL rewriting must be enabled in the web server (which it typically is) when using extensions like realurl or cooluri.

Installations where `config.absRefPrefix` is additionally set to any value are not affected by this vulnerability.

Example of affected configuration:

```php
config.absRefPrefix =
config.prefixLocalAnchors = all 
page = PAGE 
page.10 = TEXT 
page.10.value = <a href="#skiplinks">Skiplinks</a> 
.htaccess:

RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d 
RewriteCond %{REQUEST_FILENAME} !-l 
RewriteRule .* index.php [L] 
```
CSRF vulnerability in Jenkins Database Plugin
Advisory: GHSA-9rvw-7mx7-h53x
Aliases: CVE-2020-2241
Published: 2022-05-24T17:27:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

A cross-site request forgery (CSRF) vulnerability in Jenkins database Plugin 1.6 and earlier allows attackers to connect to an attacker-specified database server using attacker-specified credentials.

Database Plugin 1.7 requires POST requests for the affected form validation method.
ChakraCore RCE Vulnerability
Advisory: GHSA-7c7v-g484-j4cf
Aliases: CVE-2018-0993
Published: 2022-05-13T01:18:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0980, CVE-2018-0990, CVE-2018-0994, CVE-2018-0995, CVE-2018-1019.
lean-ruport allows local users to obtain sensitive information by listing the process
Advisory: GHSA-5g7f-p7jg-v6mv
Aliases: CVE-2014-4998
Published: 2022-05-14T03:47:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

`test/tc_database.rb` in the lean-ruport gem 0.3.8 for Ruby places the mysql user password on the mysqldump command line, which allows local users to obtain sensitive information by listing the process.
Arbitrary file deletion in gitea
Advisory: GHSA-g7p7-x6w7-w6qg
Aliases: CVE-2022-27313
Published: 2022-05-04T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file.
Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP
Advisory: GHSA-57q5-x8jf-g7h8
Aliases: CVE-2017-7561
Published: 2022-05-13T01:47:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Red Hat JBoss EAP version 3.0.7.Final until 3.0.25.Final, 3.5.0.CR1, and 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.
CSRF vulnerability in Jenkins XebiaLabs XL Deploy Plugin allows capturing credentials
Advisory: GHSA-38pm-74xc-phcw
Aliases: CVE-2021-21665
Published: 2022-05-24T19:04:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins XebiaLabs XL Deploy Plugin 10.0.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing Username/password credentials stored in Jenkins.

XebiaLabs XL Deploy Plugin 10.0.2 requires POST requests and Overall/Administer permission for the affected form validation method.
Jenkins REST APIs vulnerable to clickjacking
Advisory: GHSA-7xp8-7wqx-5hqx
Aliases: CVE-2020-2105
Published: 2022-05-24T17:07:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Jenkins 2.218 and earlier, LTS 2.204.1 and earlier does not serve the `X-Frame-Options: deny` HTTP header on REST API responses to protect against clickjacking attacks. An attacker could exploit this by routing the victim through a specially crafted web page that embeds a REST API endpoint in an iframe and tricking the user into performing an action which would allow for the attacker to learn the content of that REST API endpoint.

Jenkins 2.219, LTS 2.204.2 now adds the `X-Frame-Options: deny` HTTP header to REST API responses, which prevents these types of clickjacking attacks.
ChakraCore RCE Vulnerability
Advisory: GHSA-9pvj-pgg9-pvqq
Aliases: CVE-2018-0859
Published: 2022-05-13T01:18:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.
Stored XSS vulnerability in chosen-views-tabbar Plugin
Advisory: GHSA-226h-qrg4-8236
Aliases: CVE-2020-2269
Published: 2022-05-24T17:28:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins chosen-views-tabbar Plugin 1.2 and earlier does not escape view names in the dropdown to select views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with the ability to configure views.
Ignite Realtime Openfire allows Cross-site Scripting
Advisory: GHSA-wx2w-8pqw-vp4g
Aliases: CVE-2019-20528
Published: 2022-05-24T17:11:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter. This issue was fixed in version 4.4.2.
katello Improper Privilege Management vulnerability
Advisory: GHSA-cpv6-pfq6-j2v7
Aliases: CVE-2017-2662
Published: 2022-05-13T01:36:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.
Arbitrary code execution in Apache Struts 2
Advisory: GHSA-gqqm-564f-vvxq
Aliases: CVE-2013-2134
Published: 2022-05-14T01:57:02Z

Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
Improper Authentication in Apache Tomcat
Advisory: GHSA-6m48-jxwx-76q7
Aliases: CVE-2013-2067
Published: 2022-05-14T01:10:35Z

java/org/apache/catalina/authenticator/FormAuthenticator.java in the form authentication feature in Apache Tomcat 6.0.21 through 6.0.36 and 7.x before 7.0.33 does not properly handle the relationships between authentication requirements and sessions, which allows remote attackers to inject a request into a session by sending this request during completion of the login form, a variant of a session fixation attack.
Duplicate advisory: Configuration exposure in github.com/coreos/ignition
Advisory: GHSA-mjqc-5c9x-xfcc
Published: 2022-05-18T00:00:34Z
Withdrawn: 2022-06-08T22:35:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

## Duplicate Advisory
This advisory is a duplicate of [GHSA-hj57-j5cw-2mwp](https://github.com/advisories/GHSA-hj57-j5cw-2mwp). This link is preserved to maintain external references.

## Original Description
A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.
Subrion CMS Cross-site Scripting
Advisory: GHSA-vhqr-3gr2-7px9
Aliases: CVE-2018-14840
Published: 2022-05-14T02:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

`uploads/.htaccess` in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block, for example, .htm file uploads).
Apache Superset allowed for database connections password leak for authenticated users
Advisory: GHSA-42q4-9xf9-f67x
Aliases: CVE-2021-41972
Published: 2022-05-24T19:20:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a non-trivial way.
Gem in a Box vulnerable to Cross-site Scripting
Advisory: GHSA-98hq-3qvg-pg78
Aliases: CVE-2017-14506
Published: 2022-05-13T01:31:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

geminabox (aka Gem in a Box) before 0.13.6 is vulnerable to Cross-site Scripting (XSS), as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.
phpMyAdmin cross-site scripting Vulnerability via ENUM value
Advisory: GHSA-wv8g-fx9j-q2jg
Aliases: CVE-2014-7217
Published: 2022-05-17T03:57:46Z

Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.4, 4.1.x before 4.1.14.5, and 4.2.x before 4.2.9.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted ENUM value that is improperly handled during rendering of the (1) table search or (2) table structure page, related to `libraries/TableSearch.class.php` and `libraries/Util.class.php`.
ProxyScotch is vulnerable to a server-side Request Forgery (SSRF)
Advisory: GHSA-5hjh-c26m-xw8w
Aliases: CVE-2022-25850
Published: 2022-05-03T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

ProxyScotch is a simple proxy server created for hoppscotch.io. The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server.
Support bundles can include user session IDs in Jenkins Support Core Plugin
Advisory: GHSA-92pg-8g57-hqpx
Aliases: CVE-2021-21621
Published: 2022-05-24T17:43:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Support Core Plugin 2.72 and earlier provides the serialized user authentication as part of the \"About user (basic authentication details only)\" information (`user.md`).

In some configurations, this can include the session ID of the user creating the support bundle. Attackers with access to support bundle content and the Jenkins instance could use this information to impersonate the user who created the support bundle.\n\nSupport Core Plugin 2.72.1 no longer provides the serialized user authentication as part of the \"About user (basic authentication details only)\" information.

As a workaround, deselecting \"About user (basic authentication details only)\" before creating a support bundle will exclude the affected information from the bundle.
CSRF vulnerability in ElasTest Plugin
Advisory: GHSA-66rm-wg7m-8pgv
Aliases: CVE-2020-2273
Published: 2022-05-24T17:28:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins ElasTest Plugin 1.2.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials.
Plone python code injection
Advisory: GHSA-w6pw-5gh5-4952
Aliases: CVE-2012-5495
Published: 2022-05-17T04:32:00Z

python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."
Incorrect Authorization in Jenkins
Advisory: GHSA-wmr8-25ff-ggpj
Aliases: CVE-2018-1999004
Published: 2022-05-13T01:01:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

A Improper authorization vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in SlaveComputer.java that allows attackers with Overall/Read permission to initiate agent launches, and abort in-progress agent launches.
Croogo vulnerable to XSS in Blog field
Advisory: GHSA-9f9r-w3xq-f722
Aliases: CVE-2019-7168
Published: 2022-05-14T01:38:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored-self XSS exists in Croogo through v3.0.5, allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to `/admin/nodes/nodes/add/blog`.
Angular Redactor XSS Vulnerability
Advisory: GHSA-88fh-8979-q2rr
Aliases: CVE-2018-13339
Published: 2022-05-14T03:04:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035.
Improper Validation of Certificate with Host Mismatch in Not Yet Commons SSL
Advisory: GHSA-cmxj-wx9v-52qr
Aliases: CVE-2014-3604
Published: 2022-05-14T03:59:54Z

Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Jenkins z/OS Connector Plugin allows local attacker to retrieve configured password
Advisory: GHSA-5fq9-x9f4-x2r2
Aliases: CVE-2018-1000608
Published: 2022-05-13T01:48:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A exposure of sensitive information vulnerability exists in Jenkins z/OS Connector Plugin 1.2.6.1 and earlier in SCLMSCM.java that allows an attacker with local file system access or control of a Jenkins administrator's web browser (e.g. malicious extension) to retrieve the configured password. IBM z/OS Connector Plugin 2.0.0 and newer integrates with Credentials Plugin, no longer storing credentials itself.
System command execution vulnerability in Selection tasks Jenkins Plugin
Advisory: GHSA-79h8-7735-v3f9
Aliases: CVE-2020-2276
Published: 2022-05-24T17:28:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as.
ChakraCore RCE Vulnerability
Advisory: GHSA-5wrx-85mr-7hrg
Aliases: CVE-2018-8266
Published: 2022-05-13T01:20:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8380, CVE-2018-8381, CVE-2018-8384.
Subrion CMS XSS
Advisory: GHSA-xvgx-668j-f67p
Aliases: CVE-2019-20389
Published: 2022-05-24T17:17:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the `v[language_switch]` parameter (within multipart/form-data), which is reflected back within a user's browser without proper output encoding.
Exposure of Sensitive Information in eventsource
Advisory: GHSA-6h5x-7c5m-7cr7
Aliases: CVE-2022-1650
Published: 2022-05-13T00:01:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

When fetching an url with a link to an external site (Redirect), the users Cookies & Autorisation headers are leaked to the third party application. According to the same-origin-policy, the header should be "sanitized."
Exposure of Sensitive Information to an Unauthorized Actor in Jenkins
Advisory: GHSA-2pp9-r4rv-6p6j
Aliases: CVE-2018-1999006
Published: 2022-05-14T01:05:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

A exposure of sensitive information vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in Plugin.java that allows attackers to determine the date and time when a plugin HPI/JPI file was last extracted, which typically is the date of the most recent installation/upgrade.
WEBRick vulnerable to HTTP Request/Response Smuggling
Advisory: GHSA-gwfg-cqmg-cf8f
Aliases: CVE-2020-25613
Published: 2022-05-24T17:30:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in Ruby through 2.5.8, 2.6.x through 2.6.6, and 2.7.x through 2.7.1. WEBrick, a simple HTTP server bundled with Ruby, had not checked the transfer-encoding header value rigorously. An attacker may potentially exploit this issue to bypass a reverse proxy (which also has a poor header check), which may lead to an HTTP Request Smuggling attack.
Magento 2 Community Edition XSS Vulnerability
Advisory: GHSA-jjmg-xmq2-g6ff
Aliases: CVE-2019-8152
Published: 2022-05-24T17:00:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the `blockDirective()` function and inject malicious javascript in the cache of the admin dashboard.
Shopware vulnerable to SSRF
Advisory: GHSA-5vmg-x99g-396q
Aliases: CVE-2020-13970
Published: 2022-05-24T17:24:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Shopware before 6.2.3 is vulnerable to a Server-Side Request Forgery (SSRF) in its "Mediabrowser upload by URL" feature. This allows an authenticated user to send HTTP, HTTPS, FTP, and SFTP requests on behalf of the Shopware platform server.
Jenkins Kubernetes CI/CD Plugin vulnerable to Credential Enumeration
Advisory: GHSA-7jf5-p556-75pr
Aliases: CVE-2019-10470
Published: 2022-05-24T16:59:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

## Note: Jenkins has suspended distribution of this plugin.
Salt Improper Access Control
Advisory: GHSA-vqh4-crjf-jjxx
Aliases: CVE-2016-1866
Published: 2022-05-14T02:11:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Salt 2015.8.x before 2015.8.4 does not properly handle clear messages on the minion, which allows man-in-the-middle attackers to execute arbitrary code by inserting packets into the minion-master data stream.
Pimcore 2FA Vulnerable to Brute Forcing
Advisory: GHSA-hf62-5vxh-jpwj
Aliases: CVE-2019-18985
Published: 2022-05-24T17:01:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
Jenkins Configuration as Code Plugin has Insufficiently Protected Credentials
Advisory: GHSA-8486-h39x-cx2f
Aliases: CVE-2018-1000610
Published: 2022-05-13T01:48:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in DataBoundConfigurator.java, Attribute.java, BaseConfigurator.java, ExtensionConfigurator.java that allows attackers with access to Jenkins log files to obtain the passwords configured using Configuration as Code Plugin.
ADOdb Library SQL Injection
Advisory: GHSA-3fj4-q72x-x2g9
Aliases: CVE-2016-7405
Published: 2022-05-17T02:37:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The `qstr` method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injection attacks via vectors related to incorrect quoting.
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Advisory: GHSA-6qr6-x7jm-x2q6
Aliases: CVE-2015-5174
Published: 2022-05-14T01:10:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
Apache Tomcat is vulnerable to HTTP request-smuggling
Advisory: GHSA-j448-j653-r3vj
Aliases: CVE-2013-4286
Published: 2022-05-14T01:10:36Z

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Advisory: GHSA-w6q7-ww2x-7gm3
Aliases: CVE-2010-1157
Published: 2022-05-02T06:19:37Z

Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
Jenkins vSphere Plugin Cross-Site Request Forgery vulnerability
Advisory: GHSA-2g32-2j8w-2qgf
Aliases: CVE-2018-1000153
Published: 2022-05-14T03:23:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A cross-site request forgery vulnerability exists in Jenkins vSphere Plugin 2.16 and older in Clone.java, CloudSelectorParameter.java, ConvertToTemplate.java, ConvertToVm.java, Delete.java, DeleteSnapshot.java, Deploy.java, ExposeGuestInfo.java, FolderVSphereCloudProperty.java, PowerOff.java, PowerOn.java, Reconfigure.java, Rename.java, RenameSnapshot.java, RevertToSnapshot.java, SuspendVm.java, TakeSnapshot.java, VSphereBuildStepContainer.java, vSphereCloudProvisionedSlave.java, vSphereCloudSlave.java, vSphereCloudSlaveTemplate.java, VSphereConnectionConfig.java, vSphereStep.java that allows attackers to perform form validation related actions, including sending numerous requests to the configured vSphere server, potentially resulting in denial of service, or send credentials stored in Jenkins with known ID to an attacker-specified server ("test connection"). Additionally, these form validation methods did not require POST requests, resulting in a CSRF vulnerability. As of version 2.17, these form validation methods require POST requests and appropriate user permissions.
golang.org/x/net/http/httpguts vulnerable to Uncontrolled Recursion
Advisory: GHSA-h86h-8ppg-mxmh
Aliases: CVE-2021-31525
Published: 2022-05-24T19:03:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

net/http in Go before 1.15.12 and 1.16.x before 1.16.4 allows remote attackers to cause a denial of service (panic) via a large header to ReadRequest or ReadResponse. Server, Transport, and Client can each be affected in some configurations.
omniauth-facebook Improper Authentication vulnerability
Advisory: GHSA-33vg-hpx5-pfxg
Aliases: CVE-2013-4593
Published: 2022-05-05T00:29:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

RubyGem omniauth-facebook has an access token security vulnerability.
Improper handling of equivalent directory names on Windows in Jenkins
Advisory: GHSA-6q4g-84f3-mw74
Aliases: CVE-2021-21682
Published: 2022-05-24T19:16:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Jenkins stores jobs and other entities on disk using their name shown on the UI as file and folder names.

On Windows, when specifying a file or folder with a trailing dot character (`example.`), the file or folder will be treated as if that character was not present (`example`). As both are legal names for jobs and other entities in Jenkins 2.314 and earlier, LTS 2.303.1 and earlier, this could allow users with the appropriate permissions to change or replace configurations of jobs and other entities.

Jenkins 2.315, LTS 2.303.2 does not allow names of jobs and other entities to end with a dot character.
Incorrect Authorization in Undertow
Advisory: GHSA-cp7v-vmv7-6x2q
Aliases: CVE-2017-12196
Published: 2022-05-13T01:38:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Undertow before versions 1.4.18.SP1 (not findable in Maven), 2.0.2.Final, and 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker to cause a MITM attack and access the desired content on the server.
Publify vulnerable to code injection
Advisory: GHSA-w78q-4w34-jrjx
Aliases: CVE-2022-0578
Published: 2022-05-17T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Code Injection in GitHub repository publify/publify prior to 9.2.8.
golang.org/x/net/http vulnerable to a reset flood
Advisory: GHSA-39qc-96h7-956f
Aliases: CVE-2019-9514
Published: 2022-05-24T16:53:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

### Specific Go Packages Affected
golang.org/x/net/http2
ChakraCore RCE Vulnerability
Advisory: GHSA-p3rw-88pp-w4jh
Aliases: CVE-2017-0236
Published: 2022-05-17T02:34:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, and CVE-2017-0238.
Jenkins Data Theorem Mobile Security: CI/CD Plugin has Insufficiently Protected Credentials
Advisory: GHSA-jjmv-6fv4-85vf
Aliases: CVE-2019-10413
Published: 2022-05-24T16:56:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Data Theorem Mobile Security: CI/CD Plugin stored a proxy password unencrypted in job `config.xml` files on the Jenkins controller. This password could be viewed by users with Extended Read permission, or access to the Jenkins controller file system.

Data Theorem Mobile Security: CI/CD Plugin now stores the proxy password encrypted. Existing jobs need to have their configuration saved for existing plain text proxy passwords to be overwritten.
Reflected XSS vulnerability in Jenkins Queue cleanup Plugin
Advisory: GHSA-m7pr-m4cx-6m22
Aliases: CVE-2020-2169
Published: 2022-05-24T17:12:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A form validation HTTP endpoint in Queue cleanup Plugin 1.3 and earlier does not escape a query parameter displayed in an error message. This results in a reflected cross-site scripting vulnerability (XSS).

Queue cleanup Plugin 1.4 correctly escapes the query parameter.
Kubernetes in OpenShift3 Access Control Misconfiguration
Advisory: GHSA-2h9c-34v6-3qmr
Aliases: CVE-2015-7561
Published: 2022-05-13T01:09:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.
Symfony Vulnerable to Timing Attack
Advisory: GHSA-g97c-jfx6-xvxh
Aliases: CVE-2015-8125
Published: 2022-05-17T03:25:24Z

Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timing attack involving the (1) `Symfony/Component/Security/Http/RememberMe/PersistentTokenBasedRememberMeServices` or (2) `Symfony/Component/Security/Http/Firewall/DigestAuthenticationListener` class in the Symfony Security Component, or (3) legacy CSRF implementation from the `Symfony/Component/Form/Extension/Csrf/CsrfProvider/DefaultCsrfProvider` class in the Symfony Form component.
Missing validation causes denial of service via `Conv3DBackpropFilterV2`
Advisory: GHSA-5v77-j66x-4c4g
Aliases: CVE-2022-29196
Published: 2022-05-24T22:07:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.Conv3DBackpropFilterV2`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/conv_grad_ops_3d.cc) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

tf.raw_ops.Conv3DBackpropFilterV2(
  input=tf.constant(.5053710941, shape=[2,2,2,2,1], dtype=tf.float16),
  filter_sizes=tf.constant(0, shape=[], dtype=tf.int32),
  out_backprop=tf.constant(.5053710941, shape=[2,2,2,2,1], dtype=tf.float16),
  strides=[1, 1, 1, 1, 1],
  padding="VALID",
  data_format="NDHWC",
  dilations=[1, 1, 1, 1, 1])
```
  
The code does not validate that the `filter_sizes` argument is a vector.
  
### Patches
We have patched the issue in GitHub commit [174c5096f303d5be7ed2ca2662b08371bff4ab88](https://github.com/tensorflow/tensorflow/commit/174c5096f303d5be7ed2ca2662b08371bff4ab88).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.
    
### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.
Missing validation causes denial of service via `GetSessionTensor`
Advisory: GHSA-fv25-wrff-wf86
Aliases: CVE-2022-29191
Published: 2022-05-24T22:05:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

### Impact
The implementation of [`tf.raw_ops.GetSessionTensor`](https://github.com/tensorflow/tensorflow/blob/f3b9bf4c3c0597563b289c0512e98d4ce81f886e/tensorflow/core/kernels/session_ops.cc#L94-L112) does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack:

```python
import tensorflow as tf

handle = tf.constant("[]", shape=[0], dtype=tf.string)
tf.raw_ops.GetSessionTensor(handle=handle)
```
  
The code assumes `handle` is a scalar but there is no validation for this:
  
```cc
    const Tensor& handle = ctx->input(0);
    const string& name = handle.scalar<tstring>()();
```

### Patches
We have patched the issue in GitHub commit [48305e8ffe5246d67570b64096a96f8e315a7281](https://github.com/tensorflow/tensorflow/commit/48305e8ffe5246d67570b64096a96f8e315a7281).

The fix will be included in TensorFlow 2.9.0. We will also cherrypick this commit on TensorFlow 2.8.1, TensorFlow 2.7.2, and TensorFlow 2.6.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Neophytos Christou from Secure Systems Lab at Brown University.