aswin1906/github-advisory-2022 huggingface dataset:
Server-Side Request Forgery (SSRF) in rudloff/alltube
Advisory: GHSA-r5hc-wm3g-hjw6
Aliases: CVE-2022-0768
Published: 2022-03-01T22:01:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

### Impact
Releases prior to 3.0.2 are vulnerable to a Server-Side Request Forgery vulnerability that allows an attacker to send a request to an internal hostname.

### Patches
3.0.2 contains a fix for this vulnerability.
(The 1.x and 2.x releases are not maintained anymore.)

Part of the fix requires applying [a patch](https://github.com/Rudloff/alltube/blob/148a171b240e7ceb076b9e198bef412de14ac55d/patches/youtube-dl-redirect.diff) to youtube-dl to prevent it from following HTTP redirects. If you are using the version of youtube-dl bundled with 3.0.2, it is already patched.
However, if you are using your own unpatched version of youtube-dl **you might still be vulnerable**.

### References
* https://github.com/Rudloff/alltube/commit/3a4f09dda0a466662a4e52cde674749e0c668e8d
* https://github.com/Rudloff/alltube/commit/1b099bb9836a3ce7c427a41722a7ab5a3d1c1b2d
* https://huntr.dev/bounties/9b14cc46-ec08-4940-83cc-9f986b2a5903/
* https://nvd.nist.gov/vuln/detail/CVE-2022-0768
* https://github.com/ytdl-org/youtube-dl/issues/30691
Cross-site Scripting in intelliants/subrion
Advisory: GHSA-pcwq-7wrw-r8jv
Aliases: CVE-2020-18325
Published: 2022-03-05T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel.
Insertion of Sensitive Information into Log File in ansible
Advisory: GHSA-fh5v-5f35-2rv2
Aliases: CVE-2021-20180
Published: 2022-03-17T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Path Traversal in @finastra/ssr-pages
Advisory: GHSA-w6cx-qg2q-rvq8
Aliases: CVE-2022-24718
Published: 2022-03-01T22:09:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

A path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function.

### References
- https://github.com/Finastra/ssr-pages/pull/1
- https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780
Exposure of Sensitive Information to an Unauthorized Actor in FreeTAKServer-UI
Advisory: GHSA-9988-f88m-mr42
Aliases: CVE-2022-25512
Published: 2022-03-12T00:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

FreeTAKServer-UI v1.9.8 was discovered to leak sensitive API and Websocket keys.
Cross-site Scripting in Pimcore
Advisory: GHSA-g795-4hxx-qqwm
Aliases: CVE-2022-0893
Published: 2022-03-16T00:00:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore prior to 10.4.0 is vulnerable to stored cross-site scripting.
Improper Privilege Management in Open Web Analytics
Advisory: GHSA-pr9q-v585-qv2w
Aliases: CVE-2022-24637
Published: 2022-03-19T00:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Code injection in Apache Dubbo
Advisory: GHSA-qmfc-6www-fjqw
Aliases: CVE-2021-30181
Published: 2022-03-18T17:57:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Apache Dubbo prior to 2.6.9 and 2.7.10 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in view_component
Advisory: GHSA-cm9w-c4rj-r2cf
Aliases: CVE-2022-24722
Published: 2022-03-02T22:24:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

This is an XSS vulnerability that has the potential to impact anyone using translations with the view_component gem. Data received via user input and passed as an interpolation argument to the `translate` method is not properly sanitized before display.

Versions 2.29.1 and 2.49.1 have been released and fully mitigate the vulnerability.

Avoid passing user input to the `translate` function, or sanitize the inputs before passing them.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [github/view_component](http://github.com/github/view_component) project
Sensitive parameter values captured in build metadata files by Jenkins Parameterized Trigger Plugin
Advisory: GHSA-5mpf-hw8f-86w9
Aliases: CVE-2022-27195
Published: 2022-03-16T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Parameterized Trigger Plugin 2.43 and earlier captures environment variables passed to builds triggered using Jenkins Parameterized Trigger Plugin, including password parameter values, in their `build.xml` files. These values are stored unencrypted and can be viewed by users with access to the Jenkins controller file system.

Existing `build.xml` files are not automatically updated to remove captured environment variables. They need to be manually cleaned up. To help with this, the plugin will report environment variables stored in `build.xml` as unloadable data in the Old Data Monitor, that allows discarding this data. Build records are only loaded from disk when needed however, so some builds stored in Jenkins may not immediately appear there.
SQL Injection in ImpressCMS
Advisory: GHSA-jc4v-vvg6-xg78
Aliases: CVE-2021-26599
Published: 2022-03-29T00:01:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ImpressCMS before 1.4.3 allows include/findusers.php groups SQL Injection.
SQL injection in net.mingsoft:ms-mcms
Advisory: GHSA-p94q-9q2m-pfh2
Aliases: CVE-2022-23898
Published: 2022-03-04T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
Stored Cross-site Scripting vulnerability in Jenkins global-build-stats Plugin
Advisory: GHSA-wj78-8xrx-phr7
Aliases: CVE-2022-27207
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Jenkins global-build-stats Plugin 1.5 and earlier does not escape multiple fields in the chart configuration on the 'Global Build Stats' page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Overall/Administer permission.
Arbitrary file read vulnerability in Jenkins Continuous Integration with Toad Edge Plugin
Advisory: GHSA-8p4x-fq8v-xhv4
Aliases: CVE-2022-28146
Published: 2022-03-30T00:00:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller by specifying an input folder on the Jenkins controller as a parameter to its build steps.
Information Exposure in Apache Tapestry
Advisory: GHSA-ghm8-mmx7-xvg2
Aliases: CVE-2021-30638
Published: 2022-03-18T17:53:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Information Exposure vulnerability in context asset handling of Apache Tapestry allows an attacker to download files inside WEB-INF if using a specially-constructed URL. This was caused by an incomplete fix for CVE-2020-13953. This issue affects Apache Tapestry Apache Tapestry 5.4.0 version to Apache Tapestry 5.6.3; Apache Tapestry 5.7.0 version and Apache Tapestry 5.7.1.
Path traversal allows leaking out-of-bound files from Argo CD repo-server
Advisory: GHSA-h6h5-6fmq-rh28
Aliases: CVE-2022-24731
Published: 2022-03-24T00:12:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

### Impact

All unpatched versions of Argo CD starting with v1.5.0 are vulnerable to a path traversal vulnerability allowing a malicious user with read/write access to leak sensitive files from Argo CD's repo-server.

A malicious Argo CD user who has been granted [`create` or `update` access to Applications](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions) can leak the contents of any text file on the repo-server. By crafting a malicious Helm chart and using it in an Application, the attacker can retrieve the sensitive file's contents either as part of the generated manifests or in an error message. The attacker would have to know or guess the location of the target file.

Sensitive files which could be leaked include files from other Application's source repositories (potentially decrypted files, if you are using a decryption plugin) or any secrets which have been mounted as files on the repo-server.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.3.0
* v2.2.6
* v2.1.11

### Workarounds

The only certain way to avoid the vulnerability is to upgrade. 

To mitigate the problem, you can 
* avoid storing secrets in git
* avoid mounting secrets as files on the repo-server
* avoid decrypting secrets into files on the repo-server
* carefully [limit who can `create` or `update` Applications](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#rbac-resources-and-actions)

### References

* [Security documentation for the repo-server component](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/#git-helm-repositories)
* [Argo CD RBAC configuration documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/rbac/#)

### For more information

Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)
Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd
Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()
Advisory: GHSA-phrq-v4q2-hmq6
Aliases: CVE-2020-13756
Published: 2022-03-26T00:15:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
Removal of functional code in faker.js
Advisory: GHSA-5w9c-rv96-fr7g
Published: 2022-03-22T19:28:24Z

Faker.js helps users create large amounts of data for testing and development. The maintainer deliberately removed the functional code from this package. This appears to be a purposeful and successful attempt to make the package unusable. This is related to the colors.js [CVE-2021-23567](https://github.com/advisories/GHSA-gh88-3pxp-6fm8). 

The functional code for this package was forked and can be found [here](https://github.com/faker-js/faker).
Arbitrary file read vulnerability in Jenkins kubernetes-cd Plugin
Advisory: GHSA-fpxq-w7p9-r924
Aliases: CVE-2022-27208
Published: 2022-03-16T00:00:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Kubernetes Continuous Deploy Plugin 2.3.1 and earlier allows users with Credentials/Create permission to read arbitrary files on the Jenkins controller.
Cross-site Scripting in sanitize-url
Advisory: GHSA-hqq7-2q2v-82xq
Aliases: CVE-2021-23648
Published: 2022-03-17T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

The package `@braintree/sanitize-url` before 6.0.0 is vulnerable to Cross-site Scripting (XSS) due to improper sanitization in the `sanitizeUrl` function.
Nicotine+ DoS on Null Character in Download Request
Advisory: GHSA-p4v2-r99v-wjc2
Aliases: CVE-2021-45848
Published: 2022-03-16T00:00:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Denial of service (DoS) vulnerability in Nicotine+ starting with version 3.0.3 and prior to version 3.2.1 allows a user with a modified Soulseek client to crash Nicotine+ by sending a file download request with a file path containing a null character.
Cross-site Scripting in Pimcore
Advisory: GHSA-22hc-47cc-7x6f
Aliases: CVE-2022-0894
Published: 2022-03-16T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore prior to 10.4.0 is vulnerable to stored cross-site scripting.
Improper Input Validation in guzzlehttp/psr7
Advisory: GHSA-q7rv-6hp3-vh96
Aliases: CVE-2022-24775
Published: 2022-03-25T19:26:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Impact

Improper header parsing. An attacker could sneak in a carriage return character (`\r`) and pass untrusted values in both the header names and values.

### Patches

The issue is patched in 1.8.4 and 2.1.1.

### Workarounds

There are no known workarounds.

### References

* https://www.rfc-editor.org/rfc/rfc7230#section-3.2.4
Insertion of Sensitive Information into Log File in Jupyter notebook
Advisory: GHSA-p737-p57g-4cpr
Aliases: CVE-2022-24757
Published: 2022-03-25T19:20:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact
_What kind of vulnerability is it?_

Anytime a 5xx error is triggered, the auth cookie and other header values are recorded in Jupyter Server logs by default. Considering these logs do not require root access, an attacker can monitor these logs, steal sensitive auth/cookie information, and gain access to the Jupyter server.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Upgrade to Jupyter Server version 1.15.4

### For more information

If you have any questions or comments about this advisory, or vulnerabilities to report, please email our security list [security@ipython.org](mailto:security@ipython.org).

Credit: @3coins for reporting. Thank you!
Deserialization of Untrusted Data in SinGooCMS.Utility
Advisory: GHSA-29rv-fqx2-4c9f
Aliases: CVE-2022-0749
Published: 2022-03-18T00:01:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.
Integer Overflow or Wraparound in Microweber
Advisory: GHSA-3qr6-qrqm-8v86
Aliases: CVE-2022-1036
Published: 2022-03-23T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

In Microweber prior to 1.2.12, a user can create an account with a password thousands of characters in length, leading to memory corruption/integer overflow. Version 1.2.2 sets maximum password length at 500 characters.
Duplicate Advisory: Improper Authorization in Gogs
Advisory: GHSA-65f3-3278-7m65
Published: 2022-03-12T00:00:34Z
Withdrawn: 2023-06-30T22:10:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-gw5h-h6hj-f56g. This link is maintained to preserve external references.

## Original Description
### Impact

Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.

### Patches

Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login. 

### References

https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.
Improper Neutralization of Special Elements Used in a Template Engine in microweber
Advisory: GHSA-q9qc-pp5x-mc8c
Aliases: CVE-2022-0896
Published: 2022-03-10T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
Stored Cross-site Scripting in grav
Advisory: GHSA-r6hh-5g3q-wwgc
Aliases: CVE-2022-0970
Published: 2022-03-16T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Grav prior to 1.7.31 is vulnerable to stored cross-site scripting.
Improper Certificate Validation in kubeclient
Advisory: GHSA-69p3-xp37-f692
Aliases: CVE-2022-0759
Published: 2022-03-26T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
Infinite loop in Pillow
Advisory: GHSA-4fx9-vc88-q2xc
Published: 2022-03-11T23:39:27Z

JpegImagePlugin may append an EOF marker to the end of a truncated file, so that the last segment of the data will still be processed by the decoder.

If the EOF marker is not detected as such however, this could lead to an infinite loop where JpegImagePlugin keeps trying to end the file.
Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging
Advisory: GHSA-f8xq-q7px-wg8c
Aliases: CVE-2022-24770
Published: 2022-03-18T23:11:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

### Impact
The `gradio` library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these commands, which could lead to arbitrary commands running on the user's computer.

### Patches
The problem has been patched as of `2.8.11`, which escapes the data saved to the csv with single quotes.

### Workarounds
If you are using an older version of `gradio`, don't open csv files generated by `gradio` with Excel or similar spreadsheet programs.
Cross-site Scripting in Jenkins SiteMonitor Plugin
Advisory: GHSA-mh27-rxmr-8q4c
Aliases: CVE-2022-28153
Published: 2022-03-30T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Jenkins SiteMonitor Plugin 0.6 and earlier does not escape URLs of sites to monitor in tooltips, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
SQL Injection in tribalsystems/zenario 
Advisory: GHSA-w4f3-7f7c-x652
Aliases: CVE-2021-26830
Published: 2022-03-18T17:49:01Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

SQL Injection in Tribalsystems Zenario CMS 8.8.52729 and prior allows remote attackers to access the database or delete the plugin. This is accomplished via the `ID` input field of ajax.php in the `Pugin library - delete` module.
Spring Cloud Gateway vulnerable to Code Injection when Gateway Actuator endpoint enabled, exposed, unsecured
Advisory: GHSA-3gx9-37ww-9qw6
Aliases: CVE-2022-22947
Published: 2022-03-04T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In Spring Cloud Gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker could make a maliciously crafted request resulting in arbitrary remote execution on the remote host.
OS Command injection in npm-lockfile
Advisory: GHSA-cr6m-62pq-hmqh
Aliases: CVE-2022-0841
Published: 2022-03-04T00:00:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5.
Cross site scripting in getgrav/grav
Advisory: GHSA-2p89-ppc2-mrq4
Aliases: CVE-2022-0743
Published: 2022-03-02T00:00:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

User input is not properly sanitized leading to cross site scrpting (xss) in grav.
Incorrect Authorization in @uppy/companion
Advisory: GHSA-q24h-5rq3-63j9
Aliases: CVE-2022-0528
Published: 2022-03-04T00:00:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

@uppy/companion prior to version 3.3.1 is vulnerable to incorrect authorization. A user with URL upload access could enumerate internal companion server networks, send local webservers files to the destination server, and finally download them If each of these files had a guessable and regular name.
Server-Side Request Forgery in Apache Dubbo
Advisory: GHSA-gw4j-4229-q4px
Aliases: CVE-2021-25640
Published: 2022-03-18T17:56:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

In Apache Dubbo prior to 2.6.9 and 2.7.10, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
HTML injection possibility in voucher code form in Shopware
Advisory: GHSA-952p-fqcp-g8pc
Aliases: CVE-2022-24746
Published: 2022-03-10T17:49:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

### Impact
HTML injection possibility in voucher code form

## Patches
Patched in 6.4.8.1, maintainers recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Possible privilege escalation via bash completion script
Advisory: GHSA-w4f8-fxq2-j35v
Published: 2022-03-01T21:04:57Z

The bash completion script for `fscrypt` through v0.3.2 allows injection of commands via crafted mountpoint paths, allowing privilege escalation under a specific set of circumstances. A local user who has control over mountpoint paths could potentially escalate their privileges if they create a malicious mountpoint path and if the system administrator happens to be using the `fscrypt` bash completion script to complete mountpoint paths. We recommend upgrading to v0.3.3 or above.

For more details, see [CVE-2022-25328](https://www.cve.org/CVERecord?id=CVE-2022-25328).
Agent-to-controller security bypass in Jenkins Semantic Versioning Plugin
Advisory: GHSA-x3m3-g8w6-mf28
Aliases: CVE-2022-27201
Published: 2022-03-16T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Jenkins Semantic Versioning Plugin defines a controller/agent message that processes a given file as XML and returns version information. The XML parser is not configured to prevent XML external entity (XXE) attacks, which is only a problem if XML documents are parsed on the Jenkins controller.

Jenkins Semantic Versioning Plugin 1.13 and earlier does not restrict execution of a controller/agent message to agents, and implements no limitations about the file path that can be parsed, allowing attackers able to control agent processes to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins controller or server-side request forgery.

This vulnerability is only exploitable in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. See the [LTS upgrade guide](https://www.jenkins.io/doc/upgrade-guide/2.303/#upgrading-to-jenkins-lts-2-303-3).
CSRF vulnerability and missing permission checks in Extended Choice Parameter Plugin allow SSRF
Advisory: GHSA-x95c-qrqr-2v27
Aliases: CVE-2022-27205
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier does not perform a permission check on form validation methods. This allows attackers with Overall/Read permission to connect to an attacker-specified URL.

Additionally, these form validation methods do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
CSRF vulnerability in Jenkins RocketChat Notifier Plugin
Advisory: GHSA-x25h-f84x-wh4m
Aliases: CVE-2022-28138
Published: 2022-03-30T00:00:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins RocketChat Notifier Plugin 1.4.10 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credential.
XML External Entity Reference in Hazelcast
Advisory: GHSA-99wh-973f-779p
Aliases: CVE-2022-0265
Published: 2022-03-04T00:00:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The AbstractXmlConfigRootTagRecognizer() function makes use of SAXParser generated from a SAXParserFactory with no FEATURE_SECURE_PROCESSING set, allowing for XXE attacks.
Arbitrary JSON and property file read vulnerability in Jenkins Extended Choice Parameter Plugin
Advisory: GHSA-ch63-6cmg-gwg2
Aliases: CVE-2022-27203
Published: 2022-03-16T00:00:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Jenkins Extended Choice Parameter Plugin 346.vd87693c5a_86c and earlier allows attackers with Item/Configure permission to read values from arbitrary JSON and Java properties files on the Jenkins controller.
Prototype Pollution in libnested
Advisory: GHSA-x5m8-2r8v-8f97
Aliases: CVE-2022-25352
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The package libnested before 1.5.2 are vulnerable to Prototype Pollution via the set function in index.js. **Note:** This vulnerability derives from an incomplete fix for [CVE-2020-28283](https://security.snyk.io/vuln/SNYK-JS-LIBNESTED-1054930)
Denial of Service in Go-Ethereum
Advisory: GHSA-pvx3-gm3c-gmpr
Aliases: CVE-2022-23327
Published: 2022-03-05T00:00:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

A design flaw in Go-Ethereum 1.10.12 and older versions allows an attacker node to send 5120 future transactions with a high gas price in one message, which can purge all of pending transactions in a victim node's memory pool, causing a denial of service (DoS).
Remote shell execution vulnerability in image_processing
Advisory: GHSA-cxf7-qrc5-9446
Aliases: CVE-2022-24720
Published: 2022-03-01T22:22:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact

When using the `#apply` method from image_processing to apply a series of operations that are coming from unsanitized user input, this allows the attacker to execute shell commands:

```rb
ImageProcessing::Vips.apply({ system: "echo EXECUTED" })
#>> EXECUTED
```

This method is called internally by Active Storage variants, so Active Storage is vulnerable as well.

### Patches

The vulnerability has been fixed in version 1.12.2 of image_processing.

### Workarounds

If you're processing based on user input, it's highly recommended that you always sanitize the user input, by allowing only a constrained set of operations. For example:

```rb
operations = params[:operations]
  .map { |operation| [operation[:name], *operation[:value]] }
  .select { |name, *| name.to_s.include? %w[resize_to_limit strip ...] } # sanitization

ImageProcessing::Vips.apply(operations)
```
Improper Restriction of XML External Entity Reference in soa-model
Advisory: GHSA-pv39-qp28-4mgh
Aliases: CVE-2021-43090
Published: 2022-03-26T00:00:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Soa-model is a toolkit and Java API for WSDL, WADL and XML Schema. An XML External Entity (XXE) vulnerability exists in versions of soa-model prior to 1.6.4 in the WSDLParser function. This issue has been fixed in version 1.6.4.
Incorrect Authorization and Exposure of Sensitive Information to an Unauthorized Actor in scrapy
Advisory: GHSA-cjvr-mfj7-j4j8
Aliases: CVE-2022-0577
Published: 2022-03-01T22:12:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact

If you manually define cookies on a [`Request`](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request) object, and that `Request` object gets a redirect response, the new `Request` object scheduled to follow the redirect keeps those user-defined cookies, regardless of the target domain.

### Patches

Upgrade to Scrapy 2.6.0, which resets cookies when creating `Request` objects to follow redirects¹, and drops the ``Cookie`` header if manually-defined if the redirect target URL domain name does not match the source URL domain name².

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.6.0 is not an option, you may upgrade to Scrapy 1.8.2 instead.

¹ At that point the original, user-set cookies have been processed by the cookie middleware into the global or request-specific cookiejar, with their domain restricted to the domain of the original URL, so when the cookie middleware processes the new (redirect) request it will incorporate those cookies into the new request as long as the domain of the new request matches the domain of the original request.

² This prevents cookie leaks to unintended domains even if the cookies middleware is not used.

### Workarounds

If you cannot upgrade, set your cookies using a list of dictionaries instead of a single dictionary, as described in the [`Request` documentation](https://docs.scrapy.org/en/latest/topics/request-response.html#scrapy.http.Request), and set the right domain for each cookie.

Alternatively, you can [disable cookies altogether](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#std-setting-COOKIES_ENABLED), or [limit target domains](https://docs.scrapy.org/en/latest/topics/spiders.html#scrapy.spiders.Spider.allowed_domains) to domains that you trust with all your user-set cookies.

### References
* Originally reported at [huntr.dev](https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585/)

### For more information

If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy/scrapy/issues)
* [Email us](mailto:opensource@zyte.com)
Unrestricted Upload of File with Dangerous Type in ShowDoc
Advisory: GHSA-xp82-jmw8-mjxp
Aliases: CVE-2022-1034
Published: 2022-03-23T00:00:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

There is a Unrestricted Upload of File vulnerability in ShowDoc prior to version 2.10.4.
XSS in doc_link
Advisory: GHSA-2v82-5746-vwqc
Aliases: CVE-2021-29625
Published: 2022-03-18T17:49:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

### Impact
Users of MySQL, MariaDB, PgSQL and SQLite are affected. XSS is in most cases prevented by strict CSP in all modern browsers. The only exception is when Adminer is using a `pdo_` extension to communicate with the database (it is used if the native extensions are not enabled). In browsers without CSP, Adminer versions 4.6.1 to 4.8.0 are affected.

### Patches
Patched by 4043092, included in version [4.8.1](https://github.com/vrana/adminer/releases/tag/v4.8.1).

### Workarounds
Do both:
* Use browser supporting strict CSP.
* Enable the native PHP extensions (e.g. `mysqli`) or disable displaying PHP errors (`display_errors`).

### References
https://sourceforge.net/p/adminer/bugs-and-features/797/

### For more information
If you have any questions or comments about this advisory:
* Comment at 4043092.
Data Loss/Denial of Service in SWHKD
Advisory: GHSA-8m49-2xj8-67v9
Aliases: CVE-2022-27816
Published: 2022-03-31T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SWHKD 1.1.5 unsafely uses the /tmp/swhks.pid pathname. There can be data loss or a denial of service. A patch is available on the `1.1.0` branch of the repository.
Leaking of user information on Cross-Domain communication in sysend
Advisory: GHSA-4vvg-x86p-mvqc
Aliases: CVE-2022-24762
Published: 2022-03-14T22:43:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

### Impact
Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted.
This is not a big impact because it happens only on the same browser.

### Patches
It has been patched in version 1.10.0

### Workarounds
The only workaround is to not send sensitive information with sysend messages.
Puma vulnerable to HTTP Request Smuggling
Advisory: GHSA-h99w-9q5r-gjq9
Aliases: CVE-2022-24790
Published: 2022-03-30T21:48:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

When using Puma behind a proxy that does not properly validate that the incoming HTTP request matches the RFC7230 standard, Puma and the frontend proxy may disagree on where a request starts and ends. This would allow requests to be smuggled via the front-end proxy to Puma.

The following vulnerabilities are addressed by this advisory:
- Lenient parsing of `Transfer-Encoding` headers, when unsupported encodings should be rejected and the final encoding must be `chunked`.
- Lenient parsing of malformed `Content-Length` headers and chunk sizes, when only digits and hex digits should be allowed.
- Lenient parsing of duplicate `Content-Length` headers, when they should be rejected.
- Lenient parsing of the ending of chunked segments, when they should end with `\r\n`.

The vulnerability has been fixed in 5.6.4 and 4.3.12. When deploying a proxy in front of Puma, turning on any and all functionality to make sure that the request matches the RFC7230 standard. 

These proxy servers are known to have "good" behavior re: this standard and upgrading Puma may not be necessary. Users are encouraged to validate for themselves.

- Nginx (latest)
- Apache (latest)
- Haproxy 2.5+
- Caddy (latest)
- Traefik (latest)
Cross-site Scripting in ShowDoc
Advisory: GHSA-g585-j55v-38h7
Aliases: CVE-2022-0966
Published: 2022-03-16T00:00:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Cross-site Scripting in Alist
Advisory: GHSA-jpj5-hg26-6jgc
Aliases: CVE-2022-26533
Published: 2022-03-13T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Alist versions 2.0.10 through 2.1.0 were discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist. This issue was fixed in version 2.1.1.
Renderers can obtain access to random bluetooth device without permission in Electron
Advisory: GHSA-3p22-ghq8-v749
Aliases: CVE-2022-21718
Published: 2022-03-22T18:49:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N

### Impact
This vulnerability allows renderers to obtain access to a random bluetooth device via the [web bluetooth API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Bluetooth_API) if the app has not configured a custom `select-bluetooth-device` event handler.  The device that is accessed is random and the attacker would have no way of selecting a specific device.

All current stable versions of Electron are affected.

### Patches
This has been patched and the following Electron versions contain the fix:
* `17.0.0-alpha.6`
* `16.0.6`
* `15.3.5`
* `14.2.4`
* `13.6.6`

### Workarounds
Adding this code to your app can workaround the issue.

```js
app.on('web-contents-created', (event, webContents) => {
  webContents.on('select-bluetooth-device', (event, devices, callback) => {
    // Prevent default behavior
    event.preventDefault();
    // Cancel the request
    callback('');
  });
});
```

For more information
If you have any questions or comments about this advisory, email us at security@electronjs.org.
Server side request forgery in C1 CMS
Advisory: GHSA-8pp6-8x4q-c5mx
Aliases: CVE-2022-24789
Published: 2022-03-30T00:00:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

C1 CMS is an open-source, .NET based Content Management System (CMS). Versions prior to 6.12 allow an authenticated user to exploit Server Side Request Forgery (SSRF) by causing the server to make arbitrary GET requests to other servers in the local network or on localhost. The attacker may also truncate arbitrary files to zero size (effectively delete them) leading to denial of service (DoS) or altering application logic. The authenticated user may unknowingly perform the actions by visiting a specially crafted site. Patched in C1 CMS v6.12, no known workarounds exist.
HTTP caching is marking private HTTP headers as public in Shopware
Advisory: GHSA-6wrh-279j-6hvw
Aliases: CVE-2022-24747
Published: 2022-03-10T17:55:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

### Impact
HTTP caching is marking private HTTP headers as public

## Patches
Fixed in  recommend updating to the current version 6.4.8.2. You can get the update to 6.4.8.2 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

## Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
Parsedown Class-Name Injection
Advisory: GHSA-62m3-fc7f-jpp8
Aliases: CVE-2019-10905
Published: 2022-03-26T00:09:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script (already running on the affected page) executes the contents of any element with a specific class. This occurs because spaces are permitted in code block infostrings, which interferes with the intended behavior of a single class name beginning with the language- substring.
Cross-site Scripting (XSS) vulnerability in Jenkins Continuous Integration with Toad Edge Plugin
Advisory: GHSA-7jh8-ghwc-82cw
Aliases: CVE-2022-28145
Published: 2022-03-30T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Jenkins Continuous Integration with Toad Edge Plugin 2.3 and earlier does not apply Content-Security-Policy headers to report files it serves, resulting in a stored cross-site scripting (XSS) exploitable by attackers with Item/Configure permission or otherwise able to control report contents.
Passwords stored in plain text by Jenkins Vmware vRealize CodeStream Plugin
Advisory: GHSA-9wvr-x83m-84v4
Aliases: CVE-2022-27217
Published: 2022-03-16T00:00:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
Exposure of Private Personal Information to an Unauthorized Actor in alextselegidis/easyappointments
Advisory: GHSA-r6cm-wg48-rh2r
Aliases: CVE-2022-0482
Published: 2022-03-10T00:00:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

The software is a booking management system that has a public form to place bookings, and a private area for the calendar and management of services, users, settings, etc. There is a backend API that allows data manipulation, including listing the appointments for a specific time range. This happens on this endpoint: /index.php/backend_api/ajax_get_calendar_events Unfortunately, there is no authentication / permissions-check on that endpoint, the only required parameters in a POST request are "startDate", "endDate" and "csrfToken". Because the csrfToken can be obtained by any unauthenticated user just visiting the public form (and is valid for the backend as well), any attacker can query the backend API and obtain all sorts of private information about the appointment, in JSON format.
SQL injection in net.mingsoft:ms-mcms
Advisory: GHSA-968c-mm28-jfw4
Aliases: CVE-2022-23899
Published: 2022-03-04T00:00:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.
Execution with Unnecessary Privileges in arc-electron
Advisory: GHSA-v3wr-67px-44xg
Published: 2022-03-03T19:11:14Z

### Impact

When the end-user click on the response header that contains a link the target will be opened in ARC new window. This window will have the default preload script loaded which allows the scripts embedded in the link target to execute any logic that ARC has access to from the renderer process, which includes file system access, data store access (which may contain sensitive information), and some additional processes that only ARC should have access to.

### Patches

This is patched in version 17.0.9.

### Workarounds

Do not click onto any link in the response headers view.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [advanced-rest-client/arc-electron](https://github.com/advanced-rest-client/arc-electron)
* Email us at [Salesforce Security](mailto:security@salesforce.com)
containerd CRI plugin: Insecure handling of image volumes
Advisory: GHSA-crp2-qrr5-8pq7
Aliases: CVE-2022-23648
Published: 2022-03-02T21:33:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

### Impact

A bug was found in containerd where containers launched through containerd’s CRI implementation with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host.  This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information.  Kubernetes and crictl can both be configured to use containerd’s CRI implementation.

### Patches

This bug has been fixed in containerd 1.6.1, 1.5.10 and 1.4.13.  Users should update to these versions to resolve the issue.

### Workarounds

Ensure that only trusted images are used.

### Credits

The containerd project would like to thank Felix Wilhelm of Google Project Zero for responsibly disclosing this issue in accordance with the [containerd security policy](https://github.com/containerd/project/blob/main/SECURITY.md).

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Code injection in npm git
Advisory: GHSA-9gqr-xp86-f87h
Aliases: CVE-2021-23632
Published: 2022-03-18T00:01:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method, which allows execution of OS commands rather than just git commands. At this time, there is no known workaround. There has been no patch released.
Unhandled case in node-lmdb
Advisory: GHSA-32j9-6qqm-mq9g
Aliases: CVE-2022-21164
Published: 2022-03-17T00:00:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package node-lmdb before 0.9.7 is vulnerable to Denial of Service (DoS) when defining a non-invokable `ToString` value, which will cause a crash during type check.
pgAdmin 4 Path Traversal vulnerability
Advisory: GHSA-cr8c-972v-rmp3
Aliases: CVE-2022-0959
Published: 2022-03-17T00:00:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

When run in server mode, pgAdmin 4 allows users to store files on the server under individual storage directories. Files such as SQL scripts may be uploaded through the user interface. The URI to which upload requests are made fails to validate the upload path to prevent path traversal techniques being used to store files outside of the storage directory. A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.
Rust's regex crate vulnerable to regular expression denial of service
Advisory: GHSA-m5pq-gvj9-9vr8
Aliases: CVE-2022-24713
Published: 2022-03-08T20:00:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

> This is a cross-post of [the official security advisory][advisory]. The official advisory contains a signed version with our PGP key, as well.

[advisory]: https://groups.google.com/g/rustlang-security-announcements/c/NcNNL1Jq7Yw

The Rust Security Response WG was notified that the `regex` crate did not properly limit the complexity of the regular expressions (regex) it parses. An attacker could use this security issue to perform a denial of service, by sending a specially crafted regex to a service accepting untrusted regexes. No known vulnerability is present when parsing untrusted input with trusted regexes.

This issue has been assigned CVE-2022-24713. The severity of this vulnerability is "high" when the `regex` crate is used to parse untrusted regexes. Other uses of the `regex` crate are not affected by this vulnerability.

## Overview

The `regex` crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. Those (tunable) mitigations already provide sane defaults to prevent attacks. This guarantee is documented and it's considered part of the crate's API.

Unfortunately a bug was discovered in the mitigations designed to prevent untrusted regexes to take an arbitrary amount of time during parsing, and it's possible to craft regexes that bypass such mitigations. This makes it possible to perform denial of service attacks by sending specially crafted regexes to services accepting user-controlled, untrusted regexes.

## Affected versions

All versions of the `regex` crate before or equal to 1.5.4 are affected by this issue. The fix is include starting from  `regex` 1.5.5.

## Mitigations

We recommend everyone accepting user-controlled regexes to upgrade immediately to the latest version of the `regex` crate.

Unfortunately there is no fixed set of problematic regexes, as there are practically infinite regexes that could be crafted to exploit this vulnerability. Because of this, we do not recommend denying known problematic regexes.

## Acknowledgements

We want to thank Addison Crump for responsibly disclosing this to us according to the [Rust security policy](https://www.rust-lang.org/policies/security), and for helping review the fix.

We also want to thank Andrew Gallant for developing the fix, and Pietro Albini for coordinating the disclosure and writing this advisory.