aswin1906/github-advisory-2022 huggingface dataset:
Uncontrolled Resource Consumption in Matrix Synapse
Advisory: GHSA-4822-jvwx-w47h
Aliases: CVE-2022-41952
Published: 2022-04-01T18:16:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

### Impact

Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection time. Connections will only be terminated after `max_spider_size` (default: 10M) bytes have been downloaded, which can in some cases lead to long-lived connections towards the streaming media server (for instance, Icecast).

This can cause excessive traffic and connections toward such servers if their stream URL is, for example, posted to a large room with many Synapse instances with URL preview enabled.

### Patches
1.52.0 implements a timeout mechanism which will terminate URL preview connections after 30 seconds. Since generating URL previews for media streams is not supported and always fails, 1.53.0 additionally implements an allow list for content types for which Synapse will even attempt to generate a URL preview.

We recommend upgrading to 1.53.0 to fully resolve the issue.

### Workarounds
Turn off URL preview functionality by setting `url_preview_enabled: false` in the Synapse configuration file.

### References
- Patch (timeout): https://github.com/matrix-org/synapse/pull/11784
- Patch (content type allow list): https://github.com/matrix-org/synapse/pull/11936

### For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Allocation of Resources Without Limits or Throttling in Spring Framework
Advisory: GHSA-558x-2xjg-6232
Aliases: CVE-2022-22950
Published: 2022-04-03T00:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In Spring Framework versions 5.3.0 - 5.3.16, 5.2.0.RELEASE - 5.2.19.RELEASE, and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.
Multiple valid tokens for password reset in Shopware
Advisory: GHSA-3qrq-r688-vvh4
Aliases: CVE-2022-24892
Published: 2022-04-28T21:02:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

### Impact
Multiple tokens for password reset could be requested. All tokens could be used to change the password.
This makes it possible for an attacker to take over the victims account if s/he gains access to the victims email account and finds unused password reset token in the emails within the time frame of two hours.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Object state limitation has no effect
Advisory: GHSA-w8qp-hmh5-4v9v
Published: 2022-04-29T16:22:58Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Woodpecker allows cross-site scripting (XSS) via build logs
Advisory: GHSA-vmp5-c5hp-6c65
Aliases: CVE-2022-29947
Published: 2022-04-30T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Woodpecker before 0.15.1 allows XSS via build logs because web/src/components/repo/build/BuildLog.vue lacks escaping.
Cross-site Scripting in OWASP AntiSamy
Advisory: GHSA-3pqg-4rqg-pg9g
Aliases: CVE-2022-28367
Published: 2022-04-23T00:03:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

OWASP AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.
Improper Authentication in django-mfa3
Advisory: GHSA-3r7g-wrpr-j5g4
Aliases: CVE-2022-24857
Published: 2022-04-22T20:48:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

### Impact

django-mfa3 is a library that implements multi factor authentication for the django web framework. It achieves this by modifying the regular login view. Django however has a second login view for its admin area. This second login view was not modified, so the multi factor authentication can be bypassed.

You are affected if you have activated both django-mfa3 (< 0.5.0) and django.contrib.admin and have not taken any other measures to prevent users from accessing the admin login view.

### Patches

The issue has been fixed in django-mfa3 0.5.0.

### Workarounds

It is possible to work around the issue by overwriting the admin login route, e.g. by adding the following URL definition *before* the admin routes:

    url('admin/login/', lambda request: redirect(settings.LOGIN_URL)

### References

- [django-mfa3 changelog](https://github.com/xi/django-mfa3/blob/main/CHANGES.md#050-2022-04-15)
Incorrect Comparison in Vyper
Advisory: GHSA-7vrm-3jc8-5wwm
Published: 2022-04-04T21:40:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

### Impact
bytestrings can have dirty bytes in them, resulting in the word-for-word comparison to give incorrect results, e.g.
```vyper
b1: Bytes[32] = b"abcdef"
b1 = slice(b1, 0, 1)
b2: Bytes[32] = b"abcdef"
t: bool = b1 == b2  # incorrectly evaluates to True
```
even without dirty nonzero bytes, because there is no comparison of the length, two bytestrings can compare to equal if one ends with `"\x00"`.
```vyper
b1: Bytes[32] = b"abc\0"
b2: Bytes[32] = b"abc"
t: bool = b1 == b2  # incorrectly evaluates to True
```

### Patches
fixed in https://github.com/vyperlang/vyper/commit/2c73f8352635c0a433423a5b94740de1a118e508
Object state limitation has no effect
Advisory: GHSA-gvj8-4cj4-h776
Published: 2022-04-29T15:40:48Z

Object state limitation is a policy you can use in your roles to limit access to content based on specific object state values. Due to a flawed earlier update, these limitations were ineffective in releases made since February 16th 2022. They would grant access to the given content regardless of the object state. Depending on how your frontent is designed, knowing the URL to the content may or may not be required to access it. If you are using object state limitations in your roles, this issue is critical. Please apply the fix as soon as possible.
Potential Captcha Validate Bypass in flask-session-captcha
Advisory: GHSA-7r87-cj48-wj45
Aliases: CVE-2022-24880
Published: 2022-04-26T21:19:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact
flask-session-captcha is a package which allows users to extend Flask by adding an image based captcha stored in a server side session.

The `captcha.validate()` function would return `None` if passed no value (e.g. by submitting a request with an empty form).

If implementing users were checking the return value to be **False**, the captcha verification check could be bypassed.

Sample vulnerable code:
```python
if captcha.validate() == False:
    ... # abort
else:
   ... # do stuff
```

### Patches
A new version (1.2.1) is available that fixes the issue.

### Workarounds
Users can workaround the issue by not explicitly checking that the value is False. 

Checking the return value less explicitly should still work. 

```python
if not captcha.validate():
    ... # abort
else:
   ... # do stuff
```

```python
if captcha.validate():
    ... # do stuff
else:
   ... # abort
```

### References
https://github.com/Tethik/flask-session-captcha/pull/27

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the github repo](https://github.com/Tethik/flask-session-captcha)
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
Advisory: GHSA-97jg-43c9-q6pf
Aliases: CVE-2022-24819
Published: 2022-04-08T21:53:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.
Nokogiri Inefficient Regular Expression Complexity
Advisory: GHSA-crjr-9rc5-ghw8
Aliases: CVE-2022-24836
Published: 2022-04-11T21:18:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

## Summary

Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents.

## Mitigation

Upgrade to Nokogiri `>= 1.13.4`.


## Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.1)](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).


## References

[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html) Inefficient Regular Expression Complexity


## Credit

This vulnerability was reported by HackerOne user ooooooo_q (ななおく).
Prototype Pollution in nconf
Advisory: GHSA-6xwr-q98w-rvg7
Aliases: CVE-2022-21803
Published: 2022-04-13T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Open redirect in wwbn/avideo
Advisory: GHSA-34hv-f45p-4qfq
Aliases: CVE-2022-27463
Published: 2022-04-06T00:01:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page. A patch is available on the `master` branch of the repository.
Cross site scripting in valine
Advisory: GHSA-6xvq-2gj8-4276
Aliases: CVE-2020-28847
Published: 2022-04-06T00:01:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

valine is a fast, simple & powerful comment system. Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment. A fix was released in version 1.4.15.
Improper Access Control in Shopware
Advisory: GHSA-9wrv-g75h-8ccc
Aliases: CVE-2022-24872
Published: 2022-04-22T21:04:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Shopware 6 is an open commerce platform based on Symfony Framework and Vue and supported by a worldwide community and more than 1.500 community extensions. Permissions set to sales channel context by admin-api are still useable within normal user session. We recommend updating to the current version 6.4.10.1. You can get the update to 6.4.10.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Denial of service
Advisory: GHSA-5653-437f-5hmc
Aliases: CVE-2019-16764
Published: 2022-04-12T21:29:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The use of `String.to_atom/1` in PowAssent is susceptible to denial of service attacks. In `PowAssent.Phoenix.AuthorizationController` a value is fetched from the user provided params, and `String.to_atom/1` is used to convert the binary value to an atom so it can be used to fetch the provider configuration value. This is unsafe as it is user provided data, and can be used to fill up the whole atom table of ~1M which will cause the app to crash.
Cross-site Scripting Vulnerability in Action Pack
Advisory: GHSA-mm33-5vfq-3mm3
Aliases: CVE-2022-22577
Published: 2022-04-27T22:28:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been
assigned the CVE identifier CVE-2022-22577.

Versions Affected:  >= 5.2.0
Not affected:       < 5.2.0
Fixed Versions:     7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1

## Impact

CSP headers were only sent along with responses that Rails considered as
"HTML" responses.  This left API requests without CSP headers, which could
possibly expose users to XSS attacks.

## Releases

The FIXED releases are available at the normal locations.

## Workarounds

Set a CSP for your API responses manually.
SVG with embedded scripts can lead to cross-site scripting attacks in xml2rfc
Advisory: GHSA-cf4q-4cqr-7g7w
Published: 2022-04-22T20:25:53Z

xml2rfc allows `script` elements in SVG sources.
In HTML output having these script elements can lead to XSS attacks.

Sample XML snippet:
```
<artwork type="svg" src="data:image/svg+xml,%3Csvg viewBox='0 0 10 10' xmlns='http://www.w3.org/2000/svg'%3E%3Cscript%3E window.alert('Test Alert'); %3C/script%3E%3C/svg%3E">
</artwork>
```

### Impact
This vulnerability impacts website that publish HTML drafts and RFCs.

### Patches
This has been fixed in version [3.12.4](https://github.com/ietf-tools/xml2rfc/releases/tag/v3.12.4).

### Workarounds
If SVG source is self-contained within the XML, scraping `script` elements from SVG files.

### References
* https://developer.mozilla.org/en-US/docs/Web/SVG/Element/script

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [xml2rfc](https://github.com/ietf-tools/xml2rfc/)
* Email us at [operational-vulnerability@ietf.org](mailto:operational-vulnerability@ietf.org)
* [Infrastructure and Services Vulnerability Disclosure](https://www.ietf.org/about/administration/policies-procedures/vulnerability-disclosure/)
Session fixation
Advisory: GHSA-v2wf-c3j6-wpvw
Aliases: CVE-2020-5205
Published: 2022-04-12T21:27:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N

### Impact

The use of `Plug.Session` in `Pow.Plug.Session` is susceptible to session fixation attacks if a persistent session store is used for `Plug.Session`, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.

### Workarounds

Call `Plug.Conn.configure_session(conn, renew: true)` periodically and after privilege change. A custom authorization plug can be written where the `create/3` method should return the `conn` only after `Plug.Conn.configure_session/2` have been called on it.

### References
https://github.com/danschultzer/pow/commit/578ffd3d8bb8e8a26077b644222186b108da474f  
https://www.owasp.org/index.php/Session_fixation
Command Injection Vulnerability with Mercurial in VCS
Advisory: GHSA-6635-c626-vj4r
Aliases: CVE-2022-21235
Published: 2022-04-01T14:05:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

URLs and local file paths passed to the Mercurial (hg) APIs that are specially crafted can contain commands which are executed by Mercurial if it is installed on the host operating system. The `vcs` package uses the underly version control system, in this case `hg`, to implement the needed functionality. When `hg` is executed, argument strings are passed to `hg` in a way that additional flags can be set. The additional flags can be used to perform a command injection. Other version control systems with an implemented interface may also be vulnerable. The issue has been fixed in version 1.13.2. A work around is to sanitize data passed to the `vcs` package APIs to ensure it does not contain commands or unexpected data. This is important for user input data that is passed directly to the package APIs.
Unrestricted Upload of File with Dangerous Type in Strapi
Advisory: GHSA-9qgm-w87q-hx89
Aliases: CVE-2022-27263
Published: 2022-04-13T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
Prototype Pollution in fullpage.js
Advisory: GHSA-vpgw-ffh3-648h
Aliases: CVE-2022-1295
Published: 2022-04-12T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

fullPage utils are available to developers using window.fp_utils. They can use these utils for their own use-case (other than fullPage) as well. However, one of the utils deepExtend is vulnerable to Prototype Pollution vulnerability.

Javascript is "prototype" language which means when a new "object" is created, it carries the predefined properties and methods of an "object" with itself like toString, constructor etc. By using prototype-pollution vulnerability, an attacker can overwrite/create the property of that "object" type. If the victim developer has used that property anywhere in the code, then it will have severe effect on the application.
Buffer length underflow in LoginPacket causing unchecked exceptions to be thrown
Advisory: GHSA-5jfw-35xp-5m42
Published: 2022-04-05T17:53:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
`LoginPacket` uses `BinaryStream->getLInt()` to read the lengths of JSON payloads it wants to decode. Unfortunately, `BinaryStream->getLInt()` returns a signed integer, meaning that a malicious client can craft a packet with a large uint32 value for payload buffer size (which would be interpreted as a negative signed int32), causing `BinaryStream->get()` to throw an exception.

In the context of PocketMine-MP, this leads to a server crash when the vulnerability is exploited.

### Patches
e3fce7632b94e83fd6a518a87dcaf6a11681c4ac

### Workarounds
This can be worked around by registering a custom `LoginPacket` implementation into `PacketPool` which overrides [this code](https://github.com/pmmp/BedrockProtocol/blob/47532c95ea37d5f0365b23f734d70d943ff95295/src/LoginPacket.php#L54) to patch it.

### For more information
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Cross-Site Request Forgery in YOURLS
Advisory: GHSA-gx7g-wjxg-jwwj
Aliases: CVE-2022-0088
Published: 2022-04-04T00:00:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

YOURLS versions 1.8.2 and prior are vulnerable to Cross-Site Request Forgery.
Stored Cross-site Scripting vulnerability in Jenkins Job Generator Plugin
Advisory: GHSA-f3jq-9c79-j65m
Aliases: CVE-2022-29042
Published: 2022-04-13T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Job Generator Plugin 1.22 and earlier does not escape the name and description of Generator Parameter and Generator Choice parameters on Job Generator jobs' Build With Parameters views, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of this vulnerability requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix.
Cross-site Scripting in TastyIgniter
Advisory: GHSA-cjw5-f2x5-r4q5
Aliases: CVE-2022-0602
Published: 2022-04-06T00:01:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

TastyIgniter prior to version 3.3.0 is vulnerable to Document Object Model (DOM) based Cross-site Scripting (XSS).
Cross-site Scripting in org.owasp.esapi:esapi
Advisory: GHSA-q77q-vx4q-xx6q
Aliases: CVE-2022-24891
Published: 2022-04-27T21:09:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Impact
There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause URLs with the "javascript:" scheme to NOT be sanitized. See the reference below for full details.

### Patches
Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below.

### Workarounds
Manually edit your **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression as per remediation instructions in the reference below.

### References
[Security Bulletin 8](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf)

### For more information
If you have any questions or comments about this advisory:
* Email one of the project co-leaders. See email addresses listed on  the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under "Leaders".
* Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.
Stored Cross-site Scripting vulnerability in Jenkins Gerrit Trigger Plugin
Advisory: GHSA-455j-8hg5-8576
Aliases: CVE-2022-29039
Published: 2022-04-13T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Gerrit Trigger Plugin 2.35.2 and earlier does not escape the name and description of parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.

Exploitation of these vulnerabilities requires that parameters are listed on another page, like the \"Build With Parameters\" and \"Parameters\" pages provided by Jenkins (core), and that those pages are not hardened to prevent exploitation. Jenkins (core) has prevented exploitation of vulnerabilities of this kind on the \"Build With Parameters\" and \"Parameters\" pages since 2.44 and LTS 2.32.2 as part of the [SECURITY-353 / CVE-2017-2601](https://www.jenkins.io/security/advisory/2017-02-01/#persisted-cross-site-scripting-vulnerability-in-parameter-names-and-descriptions) fix.
Private key stored in plain text by Jenkins Google Compute Engine Plugin
Advisory: GHSA-vhxq-9mpv-gj87
Aliases: CVE-2022-29052
Published: 2022-04-13T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Google Compute Engine Plugin 4.3.8 and earlier stores private keys unencrypted in cloud agent `config.xml` files on the Jenkins controller where they can be viewed by users with Agent/Extended Read permission, or access to the Jenkins controller file system.
Denial of Service vulnerability in @podium/layout and @podium/proxy
Advisory: GHSA-3hjg-vc7r-rcrw
Aliases: CVE-2022-24822
Published: 2022-04-07T15:20:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
An attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server.
All Podium layouts that include podlets with proxy endpoints are affected.

### Patches
`@podium/layout` which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.
`@podium/proxy` which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable.

### Workarounds
It is not easily possible to work around this issue without upgrading. We recommend upgrading `@podium/layout` and/or `@podium/proxy` as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [podium-lib/issues](https://github.com/podium-lib/issues)

### Credits
The vulnerability was reported by [krynos](https://hackerone.com/krynos) from [Ercoli Consulting](https://www.ercoliconsulting.eu/) via FINN.no's private bug bounty program
Mailman Cross-site scripting (XSS) vulnerability 
Advisory: GHSA-82rm-28q9-435p
Aliases: CVE-2003-0038
Published: 2022-04-29T01:25:43Z

Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.
Apache Tomcat Allows Source Disclosure
Advisory: GHSA-x445-mmpw-7r4f
Aliases: CVE-2001-0590
Published: 2022-04-30T18:16:22Z

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
OIDC Logout redirect in keycloak
Advisory: GHSA-rvjg-gxwx-j5gf
Aliases: CVE-2020-10734
Published: 2022-04-28T17:13:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability.
Buffer Overflow in vyper
Advisory: GHSA-4mrx-6fxm-8jpg
Aliases: CVE-2022-24788
Published: 2022-04-20T20:31:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

### Impact
Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun.

### Patches
0.3.2 (as of https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b)

### Workarounds
Use .vy interfaces.
Use of a Broken or Risky Cryptographic Algorithm  in Apache WSS4J
Advisory: GHSA-4qqf-hmv6-r6wh
Aliases: CVE-2011-2487
Published: 2022-04-22T00:24:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
Apache James Denial of Service
Advisory: GHSA-92j7-34x9-f3jw
Aliases: CVE-2004-2650
Published: 2022-04-29T03:01:51Z

Spooler in Apache Foundation James before 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
Prototype Pollution in async
Advisory: GHSA-fwr7-v2mv-hh25
Aliases: CVE-2021-43138
Published: 2022-04-07T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the `mapValues()` method.
Mailman Sensitive Information Disclosure
Advisory: GHSA-hj4h-vqpq-95wg
Aliases: CVE-2004-0412
Published: 2022-04-29T02:57:41Z

Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server.
SQL Injection when creating an application with Reactive SQL backend 
Advisory: GHSA-qjmq-8hjr-qcv6
Aliases: CVE-2022-24815
Published: 2022-04-07T15:18:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. 

If you have generated a microservice Gateway using the affected version, you might be impacted as Gateways are reactive by default.

Currently, SQL injection is possible in the `findAllBy(Pageable pageable, Criteria criteria)` method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria.

## Impacted applications
- Monolith and microservice applications with SQL database and reactive with Spring WebFlux combination (other combinations are not affected and the issue is only present when you generate entities)
- Gateway applications with SQL database (issue will appear only when generating entities)

### Patches
Patched in v7.8.1

The `findAllBy(Pageable pageable, Criteria criteria)` method has been removed from the entity repositories and `org.springframework.data.relational.core.query.Criteria` support in the underlying methods has been replaced with `org.springframework.data.relational.core.sql.Condition`. This means you won't be able to do custom filtering in the generated applications.

If you have existing reactive applications generated by the impacted version, we advise you to audit for use of `Criteria` and take appropriate actions.

### Workarounds

The problem lies in the `EntityManager.java` class when creating the where clause via `Conditions.just(criteria.toString())`.

`just` accepts the literal string provided. Criteria's `toString` method returns a plain string and this combination is vulnerable to sql injection as the string is not sanitized and will contain whatever used passed as input using any plain SQL

So be careful when combining criterias and conditions. As a workaround we have removed the possibility to pass any user-provided criteria to the `createSelect` method of `EntityManager`.

### Example 

```java
Criteria criteria = Criteria.where("name").is("foobar';DROP TABLE example;--"); // parameter is user provided input
criteria.toString(); // --> "'foobar';DROP TABLE example;--'"
```

### References
[More details in this Issue report](https://github.com/jhipster/generator-jhipster/issues/18269)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JHipster issue tracker](https://github.com/jhipster/generator-jhipster/issues)
Nokogiri is vulnerable to XML External Entity (XXE) attack
Advisory: GHSA-6wj9-77wq-jq7p
Aliases: CVE-2012-6685
Published: 2022-04-23T00:40:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Nokogiri before 1.5.4 is vulnerable to XXE attacks.
Cross-site Scripting in microweber
Advisory: GHSA-6xj3-fhrf-rjgc
Aliases: CVE-2022-1504
Published: 2022-04-28T00:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
Moodle backs up private files
Advisory: GHSA-358r-g2xw-7c83
Aliases: CVE-2012-1156
Published: 2022-04-23T00:40:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Moodle before 2.2.2, 2.1.5, and 2.0.8 had users' private files included in course backups unnecessarily.
Spring Cloud Function Code Injection with a specially crafted SpEL as a routing expression
Advisory: GHSA-6v73-fgf6-w5j7
Aliases: CVE-2022-22963
Published: 2022-04-03T00:00:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
Command injection in npm-dependency-versions
Advisory: GHSA-m7xq-8jp8-rj2c
Aliases: CVE-2022-29080
Published: 2022-04-13T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key, and there are shell metacharacters in a value.
Path traversal in Hadoop
Advisory: GHSA-gx2c-fvhc-ph4j
Aliases: CVE-2022-26612
Published: 2022-04-08T00:00:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In Apache Hadoop, The unTar function uses unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. As a result, a TAR entry may create a symlink under the expected extraction directory which points to an external directory. A subsequent TAR entry may extract an arbitrary file into the external directory using the symlink name. This however would be caught by the same targetDirPath check on Unix because of the getCanonicalPath call. However on Windows, getCanonicalPath doesn't resolve symbolic links, which bypasses the check. unpackEntries during TAR extraction follows symbolic links which allows writing outside expected base directory on Windows. This was addressed in Apache Hadoop 3.2.3
Weak password hash in LiveHelperChat
Advisory: GHSA-vx8v-g3p3-88vg
Aliases: CVE-2022-1235
Published: 2022-04-06T00:01:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities ( 1.099.511.627.776 ). The SHA1 of the secret can be obtained via a captcha string and brute-forced offline with an GPU.
Jakarta Apache Tomcat Reveals Physical Paths
Advisory: GHSA-qg4g-6jcq-rw93
Aliases: CVE-2000-0759
Published: 2022-04-30T18:14:15Z

Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
Automatic named constructor discovery in Valinor
Advisory: GHSA-xhr8-mpwq-2rr2
Published: 2022-04-01T13:39:45Z

## Design issue - automatic constructor discovery

The issue arises when upgrading from `cuyz/valinor:0.3.0` to a newer system on an existing application, which broke due to the wrong constructor being picked.

Still, a bigger security concern is problematic, and it is akin to https://github.com/rails/rails/issues/5228.

## Example exploit

Take following DTO example:

```php
final class UserDTO
{
    public function __construct(
        public int $id,
        public string $name
    ) {}
    public static function fromDb(
        PDO $connection,
        int $id
    ): self { /* ... code to fetch the DTO here ... */ }
}
```

There is nothing inherently unsafe about the above `UserDTO`, but when mixed with `cuyz/valinor:^0.5.0` ( specifically https://github.com/CuyZ/Valinor/commit/718d3c1bc2ea7d28b4b1f6c062addcd1dde8660b ), it is an explosive mix:

```php
// this could be coming from user input:
$maliciousPayload = [
    'connection' => [
      'dsn' => 'mysql:host=some-host;database=some-database',
      'username' => 'root',
      'password' => 'root',
      'options' => [
        // PDO::MYSQL_ATTR_INIT_COMMAND === 1002
        1002 => 'DROP DATABASE all-the-moneys'
      ]
    ],
    'id' => 123,
];

$treeMapper->map(
  UserDTO::class,
  $maliciousPayload
); // your DB is gone :D
```

The above payload is represented in PHP form, but may as well be input JSON, HTML or x-form-urlencoded.

## Mitigation

Version 0.7.0 contains a patch for this issue.

Automatic named constructor resolution should be disabled - only explicitly mapped named constructors should be used/discovered.
Inconsistent Interpretation of HTTP Requests in twisted.web
Advisory: GHSA-c2jg-hw38-jrqq
Aliases: CVE-2022-24801
Published: 2022-04-04T21:29:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

The Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230:

1. The Content-Length header value could have a `+` or `-` prefix.
2. Illegal characters were permitted in chunked extensions, such as the LF (`\n`) character.
3. Chunk lengths, which are expressed in hexadecimal format, could have a prefix of `0x`.
4. HTTP headers were stripped of all leading and trailing ASCII whitespace, rather than only space and HTAB (`\t`).

This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling.

### Impact

You may be affected if:

1. You use Twisted Web's HTTP 1.1 server and/or proxy
2. You also pass requests through a different HTTP server and/or proxy

The specifics of the other HTTP parser matter. The original report notes that some versions of Apache Traffic Server and HAProxy have been vulnerable in the past. HTTP request smuggling may be a serious concern if you use a proxy to perform request validation or access control.

The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected.

### Patches

The issue has been addressed in Twisted 22.4.0rc1 and later.

### Workarounds

Other than upgrading Twisted, you could:

* Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them
* Filter malformed requests by other means, such as configuration of an upstream proxy

### Credits

This issue was initially reported by [Zhang Zeyu](https://github.com/zeyu2001).
mailman Cross-site scripting (XSS) vulnerability 
Advisory: GHSA-rh6c-jh4c-9fg3
Aliases: CVE-2004-1177
Published: 2022-04-29T02:59:06Z

Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.
Hadoop symlink vulnerability
Advisory: GHSA-v5c9-98f7-2h54
Aliases: CVE-2012-2945
Published: 2022-04-23T00:40:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Hadoop 1.0.3 contains a symlink vulnerability as a result of storing pid files in the shared `/tmp` directory by default.
SQL injection in ImpressCMS
Advisory: GHSA-f99r-jjgr-f373
Aliases: CVE-2022-26986
Published: 2022-04-06T00:01:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SQL Injection in ImpressCMS 1.4.3 and earlier allows remote attackers to inject into the code in unintended way, this allows an attacker to read and modify the sensitive information from the database used by the application. If misconfigured, an attacker can even upload a malicious web shell to compromise the entire system.
Integer bounds error in Vyper
Advisory: GHSA-j2x6-9323-fp7h
Aliases: CVE-2022-24845
Published: 2022-04-22T20:24:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Impact
in the following code, the return of `<iface>.returns_int128()` is not validated to fall within the bounds of `int128`. as of v0.3.0, `<iface>.returns_int128()` is validated in simple expressions, but not complex expressions.
```vyper
interface iface:
    def returns_int128() -> int128: view
    def returns_Bytes33() -> Bytes[33]: view

x: iface
 
@external
def call_out():
    x: int128 = self.x.returns_int128()  # affected, <0.3.0
    y: uint256 = convert(self.x.returns_int128(), uint256)  # affected, <0.3.2
    z: Bytes[33] = concat(self.x.returns_Bytes33(), b"")  # affected >= 0.3.0, <0.3.2
```

### Patches
0.3.2 (as of https://github.com/vyperlang/vyper/commit/049dbdc647b2ce838fae7c188e6bb09cf16e470b)

### Workarounds
Break up operations involving external calls into multiple statements. For instance, instead of the example above, use
```
x: int128 = self.x.returns_int128()
y: uint256 = convert(x, uint256)
```
SQL Injection in Dolibarr
Advisory: GHSA-vrgp-3ph6-2wwq
Aliases: CVE-2021-36625
Published: 2022-04-01T00:00:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An SQL Injection vulnerability exists in Dolibarr ERP/CRM 13.0.2 (fixed version is 14.0.0) via a POST request to the country_id parameter in an UPDATE statement.
ECP SAML binding bypasses authentication flows
Advisory: GHSA-4pc7-vqv5-5r3v
Aliases: CVE-2021-3827
Published: 2022-04-27T21:25:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

### Description
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
Insecure plugin handling in Mattermost
Advisory: GHSA-32rp-q37p-jg6w
Aliases: CVE-2022-1384
Published: 2022-04-20T00:00:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated and an authorized user to install and exploit an old plugin version from the Marketplace which might have known vulnerabilities.
Non-empty default inheritable capabilities for linux container in Buildah
Advisory: GHSA-c3g4-w6cv-6v7h
Aliases: CVE-2022-27651
Published: 2022-04-01T13:56:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

A bug was found in Buildah where containers were created with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).

This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set.
Cross site scripting in facturascripts
Advisory: GHSA-8wp2-vxpg-xcvp
Aliases: CVE-2022-1457
Published: 2022-04-26T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

facturasripts is an open source ERP software. Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Remote code execution in Subrion
Advisory: GHSA-g54x-29xv-58h5
Aliases: CVE-2021-43464
Published: 2022-04-05T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Subrion is an open source php content management system. A Remiote Code Execution (RCE) vulnerability exiss in Subrion CMS 4.2.1 via modified code in a background field; when the information is modified, the data in it will be executed through eval().
Apache Tomcat allows webmasters to insert xss into error messages
Advisory: GHSA-58hj-575g-5j25
Aliases: CVE-2001-0829
Published: 2022-04-30T18:16:47Z

A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
Smokescreen SSRF via deny list bypass
Advisory: GHSA-gcj7-j438-hjj2
Aliases: CVE-2022-24825
Published: 2022-04-07T22:10:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverage the behavior of applications to connect to or scan internal infrastructure.

Smokescreen also offers an option to deny access to additional (e.g., external) URLs by way of a deny list. There was an issue in Smokescreen that made it possible to bypass the deny list feature by appending a dot to the end of user-supplied URLs, or by providing input in a different letter case.

### Recommendation
Upgrade Smokescreen to version 0.0.3 or later.

### Acknowledgements
Thanks to [Grzegorz Niedziela](https://twitter.com/gregxsunday) for reporting the issue.

### For more information
Email us at security@stripe.com
element-plus vulnerable to cross-site scripting (XSS) via el-table-column
Advisory: GHSA-rjvg-8v36-xv9r
Aliases: CVE-2022-27103
Published: 2022-04-26T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

element-plus below 2.0.5 is vulnerable to Cross Site Scripting (XSS) when attribute `show-tooltips-overflow` of `el-table-column` is true. The mouseover action will make the text of this column render as html.
XSS in HEEx class attributes
Advisory: GHSA-j3gg-r6gp-95q2
Published: 2022-04-12T20:22:57Z

The `class` attribute was not protected against XSS attacks when using HEEx.
Prototype Pollution in convict
Advisory: GHSA-x2w5-725j-gf2g
Aliases: CVE-2022-22143
Published: 2022-04-20T16:21:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

* An attacker can inject attributes that are used in other components
* An attacker can override existing attributes with ones that have incompatible type, which may lead to a crash.

The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.

### Patches

The problem is patched in `convict@6.2.3`. Users should upgrade to `convict@6.2.3`.

### Workarounds

No way for users to fix or remediate the vulnerability without upgrading

### References

* https://www.huntr.dev/bounties/1-npm-convict/
* #384
* 3b86be087d8f14681a9c889d45da7fe3ad9cd880
* 1ea0ab19c5208f66509e1c43b0d0f21c1fd29b75

### For more information

If you have any questions or comments about this advisory: 
add your question as a comment in #384
XSS Injection Vulnerability
Advisory: GHSA-wf98-vxv9-jqfv
Published: 2022-04-05T18:31:51Z

### Impact

Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.

### Patches

This has been patched in Craft 3.7.29.

### References

* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18

### For more information

If you have any questions or comments about this advisory, email us at [support@craftcms.com](mailto:support@craftcms.com)

----------

Credits: https://github.com/noobpk
Reflected Cross-site Scripting in Shopware storefront
Advisory: GHSA-4g29-fccr-p59w
Aliases: CVE-2022-24873
Published: 2022-04-28T20:59:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

### Impact
Not-stored XSS in storefront.
Request parameter were directly assigned to the template, so that malicious code could be send via an URL.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Privilege escalation in beego
Advisory: GHSA-ffjp-66mx-3qpj
Aliases: CVE-2021-27116
Published: 2022-04-06T00:01:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in file profile.go. The MemProf and GetCPUProfile functions do not correctly check whether the created file exists. As a result attackers can launch attacks symlink attacks locally. Attackers can use this vulnerability to escalate privileges.
Resource exhaustion in Mattermost
Advisory: GHSA-f37q-q7p2-ccfc
Aliases: CVE-2022-1337
Published: 2022-04-14T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

The image proxy component in Mattermost version 6.4.1 and earlier allocates memory for multiple copies of a proxied image, which allows an authenticated attacker to crash the server via links to very large image files.