Advisories

The serial-number package allows execution of arbritary commands. The cmdPrefix argument in serialNumber function is used by the exec function without any validation.

enpeem allows execution of arbitrary commands. The options.dir argument is provided to the exec function without any sanitization.

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

In Puma (RubyGem), if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. CR, LF or /r, /n) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as …

In Puma (RubyGem), if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. CR, LF or/r, /n) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site …

A lack of input validation in pdf-image npm package version may allow an attacker to run arbitrary code if PDF file path is constructed based on untrusted user input.

valib allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.

Insufficient validation in cross-origin communication (postMessage) in reveal.js allows attackers to perform cross-site scripting attacks.

There is an XSS vulnerability in GwtUpload in the file upload functionality. Someone can upload a file with a malicious filename, which contains JavaScript code, which would result in XSS. Cross-site scripting enables attackers to steal data, change the appearance of a website, and perform other malicious activities like phishing or drive-by hacking.

It is possible to bypass enshrined/svg-sanitize before 0.13.1 using the "xlink:href" attribute due to mishandling of the xlink namespace by the sanitizer.

Apache Struts has a cross-site scripting (XSS) vulnerability.

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

Arbitrary filesystem write vulnerability in Yarn allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.

There is an OS command injection vulnerability in Ruby Rake in Rake::FileList when supplying a filename that begins with the pipe character |.

compile-sass allows execution of arbritary commands. The function setupCleanupOnExit(cssPath) within dist/index.js is executed as part of the rm command without any sanitization.

rpi allows execution of arbitrary commands. The variable pinNumber in function GPIO within src/lib/gpio.js is used as part of the arguments to the exec function without any sanitization.

In BuddyPress, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.

DNN (formerly DotNetNuke) has Insecure Permissions.

In Apache Tomcat, the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner.

In Apache Tomcat M1 to to to the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

In Apache Tomcat, the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner.

Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2.

DNN (formerly DotNetNuke) allows XSS.

DNN (formerly DotNetNuke) allows Path Traversal.

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising.

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. Tomcat is shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was …

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising.

Impact Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed. Patches This has been patched Workarounds Escape the characters <>& before sending plain code blocks to discord-markdown. References https://github.com/brussell98/discord-markdown/issues/13

uap-core is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core

uap-core is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Ansible sets permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the deb http://user:pass@server:port/ format.

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string.

The vault subsystem in Ansible does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.

The safe_eval function in Ansible does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.

The safe_eval function in Ansible does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.

Ansible constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the deb http://user:pass@server:port/ format.

openHAB allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB.

golang.org/x/crypto allows a panic during signature verification in the golang.org/x/crypto/ssh package. A client can attack an SSH server that accepts public keys. Also, a server can attack any SSH client.

archive_read_support_format_rar5.c in libarchive attempts to unpack a RAR5 file with an invalid or corrupted header (such as a header size of zero), leading to a SIGSEGV or possibly unspecified other impact.

Nokogiri is vulnerable to XXE attacks.

SilverStripe allows a Denial of Service on flush and development URL tools.

Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the default node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting strict_hostname_checking = true in …

taffy allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, taffyDB will ignore other query conditions and directly return the …

taffy through 2.6.2 allows attackers to forge adding additional properties into user-input processed by taffy which can allow access to any data items in the DB. taffy sets an internal index for each data item in its DB. However, it is found that the internal index can be forged by adding additional properties into user-input. If index is found in the query, taffyDB will ignore other query conditions and directly …

JYaml allows remote code execution during deserialization of a malicious payload through the load() function.

SilverStripe is vulnerable to CSRF in GraphQL mutations

promise-probe allows remote attackers to perform a command injection attack. The file, outputFile and options functions can be controlled by users without any sanitization.

Zend framework is vulnerable to SQLi when used with the sqlsrv PHP extension.

The codecov-node npm module allows remote attackers to execute arbitrary commands. The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js.

Moodle is vulnerable to information exposure of service tokens for users enrolled in the same course.

Joplin allows Arbitrary File Read via XSS.

SilverStripe allows Reflected XSS on the login form and custom forms. Silverstripe Forms allow malicious HTML or JavaScript to be inserted through non-scalar FormField attributes, which allows performing XSS (Cross-Site Scripting) on some forms built with user input (Request data). This can lead to phishing attempts to obtain a user's credentials or other sensitive user input.

Dolibarr allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.

An unintended require and server-side request forgery vulnerabilities in jsreport allow attackers to execute arbitrary code.

An out-of-bounds read was discovered in PCRE when the pattern \X is JIT compiled and used to match specially crafted subjects in non-UTF mode. Applications that use PCRE to parse untrusted input may be vulnerable to this flaw, which would allow an attacker to crash the application. The flaw occurs in do_extuni_no_utf in pcre2_jit_compile.c.

In aws-lambda versions, the "config.FunctioName" is used to construct the argument used within the "exec" function without any sanitization. It is possible for a user to inject arbitrary commands to the "zipCmd" used within "config.FunctionName".

In "index.js" file line, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Under certain circumstances, it is possible to bypass a specifically configured Mixer policy. Istio-proxy accepts the x-istio-attributes header at ingress that can be used to affect policy decisions when Mixer policy selectively applies to a source equal to ingress. To exploit this vulnerability, someone has to encode a source.uid in this header.

An Unintended Require vulnerability in the script-manager npm package may allow attackers to load and execute arbitrary code.

matestack-ui-core (RubyGem) is vulnerable to XSS/Script injection. This vulnerability is patched

dojox is vulnerable to Cross-site Scripting in all versions before version 1.16.1, 1.15.2, 1.14.5, 1.13.6, 1.12.7 and 1.11.9. This is due to dojox.xmpp.util.xmlEncode only encoding the first occurrence of each character, not all of them.

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.

Jenkins Eagle Tester Plugin stores a password unencrypted in its global configuration file com.bmc.rpd.jenkins.plugin.bmcrpd.configuration.RPDPluginConfiguration.xml on the Jenkins master where it can be viewed by users with access to the master file system.

Jenkins S3 publisher Plugin transmits configured credentials in plain text as part of the global Jenkins configuration form. This can result in exposure of the credential through browser extensions, cross-site scripting vulnerabilities, and similar situations.

Jenkins Dynamic Extended Choice Parameter Plugin stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

Jenkins Debian Package Builder Plugin stores a GPG passphrase unencrypted in its global configuration file on the Jenkins master where it can be viewed by users with access to the master file system.

Jenkins Harvest SCM Plugin stores passwords unencrypted in it's global configuration file hudson.plugins.harvest.HarvestSCM.xml and in job config.xml files on the Jenkins master. These credentials can be viewed by users with Extended Read permission (job config.xml only) or access to the master file system (both).

Jenkins Parasoft Environment Manager Plugin stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

Jenkins Applatix Plugin stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

Jenkins DigitalOcean Plugin stores a token unencrypted in the global config.xml file on the Jenkins master where it can be viewed by users with access to the master file system.

Jenkins BMC Release Package and Deployment Plugin stores credentials unencrypted in it's global configuration file com.bmc.rpd.jenkins.plugin.bmcrpd.configuration.RPDPluginConfiguration.xml on the Jenkins master where they can be viewed by users with access to the master file system.

Jenkins ECX Copy Data Management Plugin stores a password unencrypted in job config.xml files on the Jenkins master where it can be viewed by users with Extended Read permission, or access to the master file system.

Jenkins Harvest SCM Plugin stores passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

libnotify allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify.

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

A missing permission check in Jenkins Pipeline GitHub Notify Step Plugin in form-related methods allowed users with Overall/Read access to enumerate credential ID of the credentials stored in Jenkins.

Jenkins NUnit Plugin does not configure the XML parser to prevent XML external entity (XXE) attacks.

Jenkins FitNesse Plugin does not configure the XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.

Jenkins NUnit Plugin does not configure the XML parser to prevent XML external entity (XXE) attacks. This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins master, server-side request forgery, or denial-of-service attacks.

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset velocity/ directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting params.resource.loader.enabled by defining a response writer with that setting set to true. …

Sandbox protection in Jenkins Script Security Plugin could be circumvented during the script compilation phase by applying AST transforming annotations to imports or by using them inside other annotations.

The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match.

Jenkins RadarGun Plugin does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain bad user input. On serialization or unserialization, this could result in the deletion of files that the current user has access to. This is related to symfony/cache and symfony/phpunit-bridge.

Jenkins Git Parameter Plugin does not escape the parameter name shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.

Jenkins Brakeman Plugin does not escape values received from parsed JSON files when rendering them, resulting in a stored cross-site scripting vulnerability exploitable by users able to control the Brakeman post-build step input data.

Jenkins Subversion Plugin does not escape the error message for the Project Repository Base URL field form validation, resulting in a stored cross-site scripting vulnerability.

Jenkins Git Parameter Plugin does not escape the default value shown on the UI, resulting in a stored cross-site scripting vulnerability exploitable by users with Job/Configure permission.

A cross-site request forgery vulnerability in Jenkins Pipeline GitHub Notify Step Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the credentials stored in Jenkins.

Jenkins Google Kubernetes Engine Plugin does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability.

Ruby PDFKit has a Code Execution Vulnerability

An attacker is able to guess generated digits due to insufficient entropy.

In Apache NiFi, the flow fingerprint factory generated flow fingerprints which included sensitive property descriptor values. In the event a node attempted to join a cluster and the cluster flow was not inheritable, the flow fingerprint of both the cluster and local flow was printed, potentially containing sensitive values in plaintext.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory.

htmlunit contains code execution vulnerabilities. HtmlUnit initializes Rhino engine improperly, hence a malicious JavaScript code can execute arbitrary Java code on the application. Moreover, when embedded in Android application, Android-specific initialization of Rhino engine is not performed correctly, hence a malicious JavaScript code can execute arbitrary Java code on the application.

This advisory has been marked as a False Positive and has been removed.

Persistent XSS in /course/modedit.php of Moodle allows authenticated users (Teacher) to inject JavaScript into the session of another user (e.g., enrolled student or site administrator) via the introeditor[text] parameter.

FasterXML jackson-databind lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

FasterXML jackson-databind lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

SockJS's function htmlfile in lib/transport/htmlfile.js is vulnerable to Reflected XSS via the /htmlfile endpoint through the c callback parameter.

In Keycloak, links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

Links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authenticated malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

An unrestricted file upload vulnerability in the jQuery File Upload Plugin server/php/UploadHandler.php allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension. This file is then accessible via a direct request to the file in files/.

The omniauth-weibo-oauth2 gem for Ruby included a code-execution backdoor inserted by a third party.

A vulnerability exists in nw.js when calling nw methods from normal frames, which has an unspecified impact.

Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle allow remote attackers to upload, copy, and modify files on the filesystem.

bbPress is vulnerable to XSS through the /bb-login.php url via the re parameter.

Waitress version allows a DoS attack when waitress receives a header that contains invalid characters. When a header similar to Bad-header: xxxxxxxxxxxxxxx\x10 is received, it will cause the regular expression engine to catastrophically backtrack causing the process to use % CPU time and blocking any other interactions. This allows an attacker to send a single request with an invalid header and take the service offline.

A denial of service exists in strapi can be abused in the admin console using admin rights can lead to arbitrary restart of the application.

Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.

im-resize allows remote attackers to execute arbitrary commands via the exec argument. The cmd argument used within index.js can be controlled by user without any sanitization.

The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.

Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.

The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.

Flaw in input validation in npm package klona version may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.

network-manager allows remote attackers to execute arbitrary commands via the execSync() argument.

Insufficient validation and sanitization of user input exists in url-parse npm package may allow attacker to bypass security checks.

Prototype pollution vulnerability in dot-prop npm package version allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.

Django allows SQL Injection if untrusted data is used as a delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.

The Kubernetes kubectl cp command in versions allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree.

Auth0 Lock allows XSS when additionalSignUpFields is used with an untrusted placeholder.

HashiCorp Consul allows unbounded resource usage, and is susceptible to unauthenticated denial of service.

MessagePack for C# and Unity has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

MessagePack for C# and Unity before version 1.9.11 and 2.1.90 has a vulnerability where untrusted data can lead to DoS attack due to hash collisions and stack overflow. Review the linked GitHub Security Advisory for more information and remediation steps.

HashiCorp Consul does not enforce ACLs across all API endpoints, resulting in potential unintended information disclosure.

HashiCorp Consul and Consul Enterprise does not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure.

All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.

Opencast enables a remember-me cookie based on a hash created from the username, password, and an additional system key. This means that an attacker getting access to a remember-me token for one server can get access to all servers which allow log-in using the same credentials without ever needing the credentials.

Opencast stores passwords using the outdated and cryptographically insecure MD5 hash algorithm. Password hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide. This is problematic especially for common users like the default admin user. This means that for an attacker it might be feasible to reconstruct a user's password given access to these hashes. Note that …

Opencast before 8.1 stores passwords using the rather outdated and cryptographically insecure MD5 hash algorithm. Furthermore, the hashes are salted using the username instead of a random salt, causing hashes for users with the same username and password to collide which is problematic especially for popular users like the default admin user. This essentially means that for an attacker, it might be feasible to reconstruct a user's password given access …

Opencast before 8.1 and 7.6 allows unauthorized public access to all media and metadata by default via OAI-PMH. OAI-PMH is part of the default workflow and is activated by default, requiring active user intervention of users to protect media. This leads to users unknowingly handing out public access to events without their knowledge. The problem has been addressed in Opencast 7.6 and 8.1 where the OAI-PMH endpoint is configured to …

node-uuid uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.

Opencast allows near-arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast's Id.toString() vs Id.compact() behavior, the latter trying to mitigate some of the file system problems, can cause errors due …

In Opencast before 7.6 and 8.1, users with the role ROLE_COURSE_ADMIN can use the user-utils endpoint to create new users not including the role ROLE_ADMIN. ROLE_COURSE_ADMIN is a non-standard role in Opencast which is referenced neither in the documentation nor in any code (except for tests) but only in the security configuration. From the name – implying an admin for a specific course – users would never expect that this …

A user who owns an ENS domain can set a trapdoor, allowing them to transfer ownership to another user, regain ownership without the new owners consent or awareness. A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry.

Opencast before 8.1 and 7.6 allows almost arbitrary identifiers for media packages and elements to be used. This can be problematic for operation and security since such identifiers are sometimes used for file system operations which may lead to an attacker being able to escape working directories and write files to other locations. In addition, Opencast's Id.toString(…) vs Id.compact(…) behavior, the latter trying to mitigate some of the file system …

In Opencast using a remember-me cookie with an arbitrary username can cause Opencast to assume proper authentication for that user even if the remember-me cookie was incorrect given that the attacked endpoint also allows anonymous access. This way, an attacker can, for example, fake a remember-me token, assume the identity of the global system administrator and request non-public content from the search service without ever providing any proper authentication.

Jenkins improperly reuses encryption key parameters in the Inbound TCP Agent Protocol/3, allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents, which can be used to connect to Jenkins, impersonating those agents.

Jenkins is vulnerable to a UDP amplification reflection denial of service attack on port

Magento is vulnerable to SQL injection. Successful exploitation could lead to sensitive information disclosure.

contao has a sql injection vulnerability

Magento is vulnerable to a path traversal. Successful exploitation could lead to sensitive information disclosure.

Jenkins Fortify Plugin stores proxy server passwords unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

The npm module is vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.

Jenkins does not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.

Jenkins uses a non-constant time comparison function when validating an HMAC.

Jenkins exposes session identifiers on a user detail object in the whoAmI diagnostic page.

Jenkins allows users with Overall/Read access to view a JVM memory usage chart.

HttpObjectDecoder.java in Netty allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an invalid fold.

HttpObjectDecoder.java in Netty allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

This advisory has been marked as a false positive.

This advisory has been marked as a false positive.

REST API endpoints in Jenkins are vulnerable to clickjacking attacks.

Magento has a deserialization vulnerability. Successful exploitation could lead to arbitrary code execution.

Jenkins Code Coverage API Plugin does not escape the filename of the coverage report used in its view, resulting in a stored XSS vulnerability exploitable by users able to change job configurations.

Magento has a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Magento has a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

flaskparser.py in Webargs does not check whether the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made across domains, leading to CSRF.

Magento has a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution.

packet.py uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.

opj_t1_clbl_decode_processor in openjp2/t1.c in OpenJPEG has a heap-based buffer overflow in the qmfbid==1 case, a different issue than CVE-2020-6851.

Authenticated Apache Superset users are able to retrieve other users' information, including hashed passwords, by accessing an unused and undocumented API endpoint on Apache Superset.

An information disclosure vulnerability was found in Apache NiFi. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present.

The optional initial password change and password expiration features are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed.

The (1) create_branch, (2) create_tag, (3) import_project, and (4) fork_project functions in lib/gitlab_projects.rb allows remote authenticated users to include information from local files into the metadata of a Git repository via the web interface.

Feedgen is susceptible to XML Denial of Service attacks. The library allows supplying XML as content for some available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly …

The parse_cmd function in lib/gitlab_shell.rb allows remote authenticated users to gain privileges and clone arbitrary repositories.

In TensorFlow before 1.15.2 and 2.0.1, converting a string to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating …

In TensorFlow before 1.15.2 and 2.0.1, converting a string to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating …

In TensorFlow converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating saved models …

This advisory has been marked as a False Positive and has been removed.

A XSS vulnerability was found in Apache NiFi. Malicious scripts could be injected to the UI through action by an unaware authenticated user in Firefox. Did not appear to occur in other browsers.

ratpack is vulnerable to Cross-site Scripting (XSS). This affects the development mode error handler when an exception message contains untrusted data. Note the production mode error handler is not vulnerable - so for this to be utilized in production it would require users to not disable development mode.

A stored XSS vulnerability is present within the node-red npm package, which is a visual tool for wiring the Internet of Things. This issue will allow the attacker to steal session cookies, deface web applications, etc.

CRLF injection vulnerability allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the header of an email.

Sylius ResourceBundle accepts and uses any serialisation groups to be passed via a HTTP header. This might lead to data exposure by using an unintended serialisation group - for example it could make Shop API use a more permissive group from Admin API.

Netty allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header.

This advisory has been marked as a false positive.

Affected versions of Sylius give attackers the ability to switch channels via the _channel_code GET parameter in production environments. This was meant to be enabled only when kernel.debug is set to true. However, if no sylius_channel.debug is set explicitly in the configuration, the default value which is kernel.debug will be not resolved and cast to boolean, enabling this debug feature even if that parameter is set to false.

Netty allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.

In Ktor before 1.3.0, request smuggling is possible when running behind a proxy that doesn't handle Content-Length and Transfer-Encoding properly or doesn't handle \n as a headers separator.

svg.swf in TYPO3 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.

svg.swf in TYPO3 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.

The htdocs/index.php?mainmenu=home login page in Dolibarr allows an unlimited rate of failed authentication attempts.

htdocs/user/passwordforgotten.php in Dolibarr allows XSS via the Referer HTTP header.

Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to …

sql.rb in Geocoder allows Boolean-based SQL injection when within_bounding_box is used in conjunction with untrusted sw_lat, sw_lng, ne_lat, or ne_lng data.

Codecov npm module allows remote attackers to execute arbitrary commands via the gcov-args argument.

Background Several scripts part of SimpleSAMLphp display a web page with links obtained from the request parameters. This allows us to enhance usability, as the users are presented with links they can follow after completing a certain action, like logging out. Description The following scripts were not checking the URLs obtained via the HTTP request before displaying them as the target of links that the user may click on: www/logout.php …

Angular Expressions has a remote code execution vulnerability if you call expressions.compile(userControlledInput) where userControlledInput is text that comes from user input. If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput). If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

Tornado sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.

Log injection in SimpleSAMLphp before version. The www/erroreport.php script, which receives error reports and sends them via email to the system administrator, did not properly sanitize the report identifier obtained from the request. This allows an attacker, under specific circumstances, to inject new log lines by manually crafting this report ID. When configured to use the file logging handler, SimpleSAMLphp will output all its logs by appending each log line …

In Django User Sessions (django-user-sessions), the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However, if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen.

A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client, .NET CAS Client, and phpCAS that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.

Cross-site scripting in SimpleSAMLphp. The www/erroreport.php script allows error reports to be submitted and sent to the system administrator. Starting with SimpleSAMLphp, a new SimpleSAML\Utils\EMail class was introduced to handle sending emails, implemented as a wrapper of an external dependency. This new wrapper allows us to use Twig templates in order to create the email sent with an error report. Since Twig provides automatic escaping of variables, manual escaping of …

CiphertextHeader.java allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with new byte may depend on untrusted input within the header of encoded data.

Missing password strength checks on some forms in Plone allow users to set weak passwords, leading to easier cracking.

An open redirect on the login form (and possibly other places) in Plone allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.

A vulnerability was found in the Undertow HTTP server when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

SQL Injection in DTML or in connection objects in Plone allows users to perform unwanted SQL queries. (This is a problem in Zope.)

If user-supplied input is passed into append/override_content_security_policy_directives, a newline could be injected leading to limited header injection. Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy header with the remaining value of the original string. It will continue to create new headers for each newline.

The secure_headers gem is vulnerable to a directive injection vulnerability.

plone.restapi in Plone allows users with a certain privilege level to escalate their privileges up to the highest level.

A privilege escalation issue in plone.app.contenttypes in Plone allows users to PUT (overwrite) some content without needing write permission.

An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue will not be fixed.

sanitize-html does not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript.

In PrivateBin, a persistent XSS attack is possible. Under certain conditions, a user provided attachment file name can inject HTML leading to a persistent Cross-site scripting (XSS) vulnerability.

An XSS issue in the title field in Plone allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.

Umbraco CMS allows CSRF to enable/disable or delete user accounts.

BibTeX-ruby allows command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.

Waitress allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress treats the body of the request as a new request in HTTP pipelining.

A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling.

xmlSchemaPreRun in xmlschemas.c in libxml2 allows an xmlSchemaValidateStream memory leak.

xmlStringLenDecodeEntities in parser.c in libxml2 has an infinite loop in a certain end-of-file situation.

xmlStringLenDecodeEntities in parser.c in libxml2 has an infinite loop in a certain end-of-file situation.

xmlStringLenDecodeEntities in parser.c in libxml2 has an infinite loop in a certain end-of-file situation.

The validators package for Python enters an infinite loop when validators.domain is called with a crafted domain string. This is fixed

The papercrop gem for Ruby on Rails does not properly handle crop input.

In SaltStack Salt, the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.

In Spring Framework, an application is vulnerable to a reflected file download (RFD) attack when it sets a Content-Disposition header in the response where the filename attribute is derived from user supplied input.

In Spring Framework, an application is vulnerable to a reflected file download (RFD) attack when it sets a Content-Disposition header in the response where the filename attribute is derived from user supplied input.

In Spring Framework, an application is vulnerable to a reflected file download (RFD) attack when it sets a Content-Disposition header in the response where the filename attribute is derived from user supplied input.

Spring Framework is vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints.

Spring Framework is vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints.

Spring Framework is vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However, a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of …

async.c and dict.c in libhiredis.a in hiredis allow a NULL pointer dereference because malloc return values are unchecked.

Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local keystore (JKS/PKCS12) by specifing the path of the keystore and the alias of the keystore entry. This case is not vulnerable. However it …

Insecure permissions in cwrapper_perl in Centreon Infrastructure Monitoring Software allows local attackers to gain privileges.

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploits a feature which is not typically present in modern browsers, which remove dot segments before sending the request. However, Mobile applications may be …

Jenkins Redgate SQL Change Automation Plugin stored an API key unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system.

A missing permission check in Jenkins Health Advisor by CloudBees Plugin allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient.

A missing permission check in Jenkins Amazon EC2 Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.

Jenkins Sounds Plugin does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins.

Jenkins Robot Framework Plugin does not configure its XML parser to prevent XML external entity (XXE) attacks, allowing users with Job/Configure permissions make Jenkins parse crafted XML documents.

XML external entity (XXE) vulnerability in PyAMF allows remote attackers to cause a denial of service or read arbitrary files via a crafted Action Message Format (AMF) payload.

The create function in app/code/core/Mage/Catalog/Model/Product/Api/V2.php in Magento Community Edition, when used with PHP, allows remote authenticated users to execute arbitrary PHP code via the productData parameter to index.php/api/v2_soap.

The Apache Beam MongoDB connector in versions has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.

python-markdown2 has multiple cross-site scripting (XSS) issues.

phpBB allows a CSRF attack that can approve pending group memberships.

phpBB allows a CSRF attack that can modify a group avatar.

A cross-site request forgery vulnerability in Jenkins Amazon EC2 Plugin allows attackers to connect to an attacker-specified URL within the AWS region using attacker-specified credentials IDs obtained through another method.

A cross-site request forgery vulnerability in Jenkins Sounds Plugin allows attacker to execute arbitrary OS commands as the OS user account running Jenkins.

A cross-site request forgery vulnerability in Jenkins Health Advisor by CloudBees allows attackers to send an email with fixed content to an attacker-specified recipient.

An SQL Injection vulnerability exists in Drupal due to insufficient sanitization of table names or column names.

An SQL Injection vulnerability exists in Drupal due to insufficient sanitization of table names or column names.

A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka 'ASP.NET Core Remote Code Execution Vulnerability'.

When Connect workers in Apache Kafka are configured with one or more config providers, and a connector is created/updated on that Connect cluster to use an externalized secret variable in a substring of a connector configuration property value, then any client can issue a request to the same Connect cluster to obtain the connector's task configuration and the response will contain the plaintext secret rather than the externalized secrets variables.

In PyInstaller before version, only on Windows, a local privilege escalation vulnerability is present in this particular case. A software using PyInstaller in onefile mode can be launched by a privileged user (at least more than the current one) so that TempPath may become a world writable directory. This is the case for example if the software is launched as a service or as a scheduled task using a system …

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service Vulnerability'.

A Cross-Site Scripting vulnerability exists in Drupal with Data due to insufficient sanitization of table descriptions, field names, or labels before display.

A Cross-Site Scripting vulnerability exists in Drupal due to insufficient sanitization of table descriptions, field names, or labels before display.

In Apache Airflow when running with the classic UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected.

OpenJPEG has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions validation.

PySAML2 does not check that the signature in a SAML document is enveloped and thus signature wrapping is effective, i. The signature information and the node/object that is signed can be in different places and thus the signature verification will succeed, but the wrong data will be used. This specifically affects the verification of assertion that have been signed.

grammar-parser.jison in the hot-formula-parser package for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input, it may allow attackers to run arbitrary commands on the server.

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

phpMyAdmin contains a SQL injection in the user accounts page. A malicious user could inject custom SQL in place of their own username when creating queries to this page. An attacker must have a valid MySQL account to access the server.

Apache Olingo provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.

GSocketClient in GNOME GLib may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct …

Ansible mishandles the evaluation of some strings.

We have identified that some gamification module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

We have identified that some autoupgrade module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE.

It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

darylldoyle svg-sanitizer before 0.12.0 mishandles script and data values in attributes, as demonstrated by unexpected whitespace such as in the javascript :alert substring.

Apache Atlas versions 0.8.3 and 1.1.0 were found vulnerable to Stored Cross-Site Scripting in the search functionality

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

Impact We have identified that some ps_facetedsearch module ZIP archives have been built with phpunit dev dependencies. PHPUnit contains a php script that would allow, on a webserver, an attacker to perform a RCE. This vulnerability impacts phpunit before 4.8.28 and 5.x before 5.6.3 as reported in CVE-2017-9841 phpunit >= 5.63 before 7.5.19 and 8.5.1 (this is a newly found vulnerability that is currently being submitted as a CVE after …

In Netwide Assembler (NASM) rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set_text_free when called from expand_one_smacro in asm/preproc.c.

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the …

Multiple cross-site scripting (XSS) vulnerabilities in the Marked module for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

In Netwide Assembler (NASM), stack consumption occurs in expr# functions in asm/eval.c. This potentially affects the relationships among expr0, expr1, expr2, expr3, expr4, expr5, and expr6 (and stdscan in asm/stdscan.c). This is similar to CVE-2019-6290 and CVE-2019-6291.

The OpenID Connect reference implementation for MITREid Connect allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.

libImaging/TiffDecode.c in Pillow has a TIFF decoding integer overflow, related to realloc.

libImaging/PcxDecode.c in Pillow has a PCX P mode buffer overflow.

libImaging/SgiRleDecode.c in Pillow has an SGI buffer overflow.

libImaging/FliDecode.c in Pillow has an FLI buffer overflow.

Pivotal Spring Framework suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required.

Bolt has an XSS via the slug, teaser, or title parameter to editcontent/pages, a related issue to CVE-2017-11128 and CVE-2018-19933.

ctorName allows external user input to overwrite certain internal attributes via a conflicting name.

php-shellcommand has a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.

Open redirect vulnerability in Athenz allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a specially crafted page.

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain …

Versions of handlebars prior to 4.3.0 is vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Improper Neutralization in waitress.

xmlParseBalancedChunkMemoryRecover in parser.c in libxml2 has a memory leak related to newDoc->oldNs.

mongo-express is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment.

When using FORM authentication with Apache Tomcat there is a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

When Apache Tomcat is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.

Waitress implemented an optional part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient may recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and …

Waitress would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would …

Included in Log4j is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

Included in Log4j is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data.

Django allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.)

A Path traversal exists in http_server which allows an attacker to read arbitrary system files.

A path traversal in statics-server exists in all version that allows an attacker to perform a path traversal when a symlink is used within the working directory.

There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker …

A code injection exists in node-df that can allow an attacker to remote code execution by unsanitized input.

A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.

A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.

class.upload.php in verot.net class.upload, omits .pht from the set of dangerous file extensions, a similar issue to CVE-2019-19576.

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.

Contao allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.

A user-supplied regular expression in Jenkins Build Failure Analyzer Plugin was processed in a way that wasn't interruptible, allowing attackers to have Jenkins evaluate a regular expression without the ability to interrupt this process.

Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backend user who has administrator privileges.

It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability.

A missing permission check in Jenkins Team Concert Plugin in form-related methods allows users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.

Jenkins Weibo Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

Jenkins Redgate SQL Change Automation stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

A missing permission check in Jenkins Alauda Kubernetes Suport Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.

A missing permission check in Jenkins Team Concert Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

A missing permission check in Jenkins Alauda DevOps Pipeline Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

Jenkins Rundeck Plugin stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

A missing permission check in Jenkins RapidDeploy Plugin allows attackers with Overall/Read permission to connect to an attacker-specified web server.

Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

Contao has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

A missing permission check in Jenkins Gerrit Trigger Plugin allows attackers with Overall/Read permission to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials, or determine the existence of a file with a given path on the Jenkins master.

A missing permission check in Jenkins Build Failure Analyzer Plugin allows attackers with Overall/Read permission to have Jenkins evaluate a computationally expensive regular expression.

core/plugins/medias in SPIP allows remote authenticated authors to inject content into the database.

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Contao has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Jenkins Spira Importer Plugin disables SSL/TLS certificate validation for the Jenkins master JVM.

It has been discovered that the classes QueryGenerator and QueryView are vulnerable to insecure deserialization. One exploitable scenario requires having the system extension ext:lowlevel (Backend Module DB Check) installed, with a valid backend user who has administrator privileges. The other exploitable scenario requires having the system extension ext:sys_action installed, with a valid backend user who has limited privileges.

Jenkins Mission Control does not escape job display names and build names shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.

Jenkins buildgraph-view Plugin does not escape the description of builds shown in its view, resulting in a stored XSS vulnerability exploitable by users able to change build descriptions.

Jenkins Pipeline Aggregator View Plugin does not escape information shown on its view, resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.

A cross-site request forgery vulnerability in Jenkins Alauda Kubernetes Suport Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing the Kubernetes service account token or credentials stored in Jenkins.

A cross-site request forgery vulnerability in Jenkins Gerrit Trigger Plugin allows attackers to connect to an attacker-specified HTTP URL or SSH server using attacker-specified credentials.

A cross-site request forgery vulnerability in Jenkins RapidDeploy Plugin allows attackers to connect to an attacker-specified web server.

A cross-site request forgery vulnerability in Jenkins Team Concert Plugin allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

A cross-site request forgery vulnerability in Jenkins Alauda DevOps Pipeline allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.

A cross-site request forgery vulnerability in Jenkins Build Failure Analyzer Plugin allows attackers to have Jenkins evaluate a computationally expensive regular expression.

A cross-site request forgery vulnerability in Jenkins Mantis Plugin allows attackers to connect to an attacker-specified web server using attacker-specified credentials.

Jenkins SCTMExecutor Plugin transmits previously configured service credentials in plain text as part of the global configuration, as well as individual jobs' configurations.

In TensorFlow, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out-of-bounds heap memory.

In Apache Incubator Superset, a user could query database metadata information from a database he has no access to, by using a specially crafted complex query.

In Apache Incubator Superset, a user can view database names that he has no access to on a dropdown list in SQLLab

In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.

In TensorFlow before 1.15, a heap buffer overflow in UnsortedSegmentSum can be produced when the Index template argument is int32. In this case data_size and num_segments fields are truncated from int64 to int32 and can produce negative numbers, resulting in accessing out of bounds heap memory. This is unlikely to be exploitable and was detected and fixed internally in TensorFlow 1.15 and 2.0.

In Yarn, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

In RubyGem excon, there was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still …

npm is vulnerable to an Arbitrary File Write.

The lodahs package is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.

SnakeYAML allows entity expansion during a load operation.

In phpfastcache before 5.1.3, there is a possible object injection vulnerability in cookie driver.

An issue was discovered in the BSON ObjectID (aka bson-objectid). ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects _bsontype==ObjectID in the user-input object. As a result, objects in arbitrary forms can bypass formatting if they have a valid bsontype.

safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulnerable to Arbitrary Code Execution via generating a RangeError.

The package omniauth-facebook supports passing an access token directly in the URL. Because of that, an attacker may be able to authenticate as another user by passing a valid access token obtained from Facebook for another app.

Type confusion in xsltNumberFormatGetMultipleLevel in libxslt, which is included in nokogiri, could allow attackers to potentially exploit heap corruption via crafted XML data.

The serialize-to-js NPM package is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in com.linecorp.armeria:armeria.

phpMyAdmin does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php.

Improper validation of URL redirection in the Kubernetes API server allows an attacker-controlled Kubelet to redirect API server requests from streaming endpoints to arbitrary hosts. Impacted API servers will follow the redirect as a GET request with client-certificate credentials for authenticating to the Kubelet.

Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response. This vulnerability has been patched in 0.97.0. Potential impacts of this vulnerability include cross-user defacement, cache poisoning, Cross-site scripting (XSS), and page hijacking.

The Strapi framework is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

A vulnerability was found in keycloak, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.

In affected versions of Sylius, exception messages from internal exceptions (like database exception) are wrapped by \Symfony\Component\Security\Core\Exception\AuthenticationServiceException and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. A validation message with the exception details will be presented to the user when one will try to log into the shop. This has been patched in versions 1.3.14, 1.4.10, 1.5.7, and 1.6.3.

The serialize-javascript npm package is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

GitBook allows XSS via a local .md file.

In GitLab Puma, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

In Puma, a poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack. If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

class.upload.php in verot.net class.upload, omits .phar from the set of dangerous file extensions.

This is a malicious package which tries to steal SSH and GPG keys.

babelcli is a malicious module published with the intent to hijack environment variables.

The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

This is a malicious package which tries to steal SSH and GPG keys.

The XML content type entity deserializer in Apache Olingo is not configured to deny the resolution of external entities. Request with content type application/xml, which trigger the deserialization of entities, can be used to trigger XXE attacks.

The AsyncResponseWrapperImpl class in Apache Olingo, the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.

In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

A vulnerability was found in Keycloak where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

Apache Olingo provides the AbstractService class, which is public API, uses ObjectInputStream and does not check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.

A User Enumeration flaw exists in Harbor. The issue is present in the /users API endpoint. This endpoint is supposed to be restricted to administrators. This restriction is able to be bypassed and information can be obtained about registered users can be obtained via the search functionality.

Chartkick.js, as used in the Chartkick gem for Ruby, allows prototype pollution.

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.

Django allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and …

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.

When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.

When using wagtail-2fa, if someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS. This problem has been patched

typed_ast has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code.

typed_ast has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code.

ansible contains a critical vulnerability.

An error-handling flaw was found in python-ecdsa. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service.

Centreon allows XSS via myAccount alias and name fields.

Dolibarr CRM/ERP allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.

Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leaked as an output when running ansible playbooks.

Python keyring has insecure permissions on new databases allowing world-readable files to be created

In Eclipse Jetty v20190926 v20191022 v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

In Eclipse Jetty the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Characters in the GET url path are not properly escaped and can be reflected in the server response.

A crafted database/table name can be used to trigger a SQL injection attack through the designer feature.

In Pannellum from URLs were not sanitized for data URIs (or vbscript:), allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if pannellum.htm was hosted on a domain that shared cookies with the targeted site's user authentication; an <iframe> could then be embedded on the attacker's …

ansible-playbook -k and ansible cli tools prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.

Versions of vant are vulnerable to Cross-Site Scripting. The text value of the Picker component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser. Upgrade to or later.

A CSRF vulnerability in Pagekit allows an attacker to upload an arbitrary file by removing the CSRF token from a request.

The Ruby net-ldap gem uses a weak salt when generating SSHA passwords.

A path traversal vulnerability in Jenkins Support Core Plugin allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master.

An attacker can include file contents from outside the /adapter/xxx/ directory, where xxx is the name of an existent adapter like admin. It is exploited using the administrative web panel with a request for an adapter file.

Jenkins Anchore Container Image Scanner Plugin stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.

Jenkins QMetry for JIRA stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.

Jenkins Spira Importer Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.

An issue was discovered in Symfony. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.

Serializing certain cache adapter interfaces could result in remote code injection.

The UriSigner is subject to timing attacks.

An issue was discovered in Symfony. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality.

The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality.

Missing permission checks in various API endpoints in Jenkins Google Compute Engine allows attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.

A sandbox bypass vulnerability in Jenkins Script Security Plugin related to the handling of default parameter expressions in closures allows attackers to execute arbitrary code in sandboxed scripts.

A missing permission check in Jenkins Support Core Plugin allows attackers with Overall/Read permission to delete support bundles.

If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime ).

The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code.

If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command.

If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command.

The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code.

Jenkins JIRA does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.

A cross-site request forgery vulnerability in Jenkins Google Compute Engine in ComputeEngineCloud#doProvision could be used to provision new agents.

The UriSigner was subjectto timing attacks.

Jenkins Google Compute Engine Plugin does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.

iobroker.admin allows attacker to include file contents from outside the /log/file1/ directory.

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.

Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.

Eval injection in the Math plugin of Limnoria ( ) and Supybot ( ) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.

Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) allows attackers to execute arbitrary scripts.

Cookie-signature is vulnerable to timing attacks.

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to hours after logging out to make API requests to NiFi.

Information disclosure in simplesamlphp.

When updating a Process Group via the API in NiFi, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.

The XMLFileLookupService in NiFi allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.

RubyGems passenger betas 1 and 2 allows remote attackers to delete arbitrary files during the startup process.

In AngularJS the function merge() could be tricked into adding or modifying properties of Object.prototype using a proto payload.

Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr. then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983`), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr …

pimcore/pimcore is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via id, storeId, pageSize and tables parameters, using a payload for trigger a time based or error based sql injection.

A flaw was found in org.codehaus.jackson:jackson-mapper-asl libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

Apache Shiro when using the default remember me configuration, cookies could be susceptible to a padding attack.

This advisory has been marked as False Positive and has been removed.

KairosDB has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a "sampling":{"value":"<script>' substring.

Pimcore lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.

Pimcore lacks brute force protection for the 2FA token.

Pimcore allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.

A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus.

A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slp-validate@1.0.0 npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus.

bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem for Ruby. It allows directory traversal through .. to access private resources because resource matching does not ensure that pathnames are in a canonical format.

Pomelo allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious attacker can manipulate internal attributes by adding additional attributes to user input.

Insufficient content type validation of proxied resources in go-camo allows a remote attacker to serve arbitrary content from go-camo's origin.

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

A remote attacker able to send XML requests to a REST endpoint could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks.

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.

In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the …

In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the …

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1427, CVE-2019-1428, CVE-2019-1429.

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1429.

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1426, CVE-2019-1428, CVE-2019-1429.

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.

Istio allows Denial of Service because continue_on_listener_filters_timeout is set to True.

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.

In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.

The json-jwt gem before for Ruby lacks an element count during the splitting of a JWE string.

Python Twisted trustRoot is not respected in HTTP client

An information disclosure vulnerability exists when affected Open Enclave SDK versions improperly handle objects in memory, aka 'Open Enclave SDK Information Disclosure Vulnerability'.

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with privileges to generate sitemaps can bypass configuration that restricts directory access. The bypass allows overwrite of a subset of configuration files which can lead to denial of service.

Chartkick.js, as used in the Chartkick gem for Ruby, allows prototype pollution.

It was discovered that the C++ implementation (which underlies the R, Python and Ruby implementations) of Apache Arrow has an uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Apache Arrow left memory Array data uninitialized when reading RLE null data from parquet. Python, Ruby and R implementations. The uninitialized memory could potentially be shared if are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Apache Arrow versions leaves memory Array data uninitialized when reading RLE null data from parquet.

Apache Arrow has an uninitialized memory bug when building arrays with null values in some cases. This can lead to uninitialized memory being unintentionally shared if Arrow Arrays are transmitted over the wire (for instance with Flight) or persisted in the streaming IPC and file formats.

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they …

Default Express middleware security check is ignored in production Impact All Cube.js deployments that use affected versions of @cubejs-backend/api-gateway with default express authentication middleware in production environment are affected. Patches @cubejs-backend/api-gateway@0.11.17 Workarounds Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware For more information If you have any questions or comments about this advisory: Open an issue in https://github.com/cube-js/cube.js/issues Reach out us in community Slack: https://slack.cube.dev/