GHSA-VC7G-4269-F7HW Missing permission check in Blue Ocean Plugin

Updated 2020-09-16 This entry previously misidentified the problematic behavior. The HTTP request itself is legitimate, but only authorized users should be able to perform it. Original Description Blue Ocean Plugin 1.23.2 and earlier does not perform permission checks in several HTTP endpoints...

GHSA-CFVW-84VQ-43MX Stored XSS vulnerability in Jenkins Deployer Framework Plugin

Deployer Framework Plugin is a framework plugin allowing other plugins to provide a way to deploy artifacts. Deployer Framework Plugin 1.2 and earlier does not escape the URL displayed in the build home page. This results in a stored cross-site scripting XSS vulnerability exploitable by users abl...

GHSA-45H4-6GCJ-6HWV Magento Stored cross-site scripting

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a stored cross-site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure...

GHSA-8V7V-6MMM-XJXM Dolibarr SQL injection vulnerability in accountancy/customer/card.php

A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.4 and below allows remote authenticated users to execute arbitrary SQL commands via the id parameter...

GHSA-X68X-WVM2-HQC8 Stored XSS vulnerability in Jenkins Compact Columns Plugin

Compact Columns Plugin 1.11 and earlier displays the unprocessed job description in tooltips. This results in a stored cross-site scripting vulnerability that can be exploited by users with Job/Configure permission. Compact Columns Plugin 1.12 applies the configured markup formatter to the job...

GHSA-Q397-W28F-JX97 Stored XSS vulnerability in Jenkins ECharts API Plugin

ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart. This results in a stored cross-site scripting XSS vulnerability that can be exploited by users with Run/Update permission. ECharts API Plugin 4.7.0-4 escapes the display name...

GHSA-5CG5-7VW6-JW4R Ignite Realtime Openfire allows Cross-site Scripting

Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter. This issue was fixed in version 4.4.2...

GHSA-JMP9-F42Q-4G85 Passwords stored in plain text by Harvest SCM Plugin

Harvest SCM Plugin 0.5.1 and earlier stores SCM passwords unencrypted in its global configuration file hudson.plugins.harvest.HarvestSCM.xml and in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission job config.xml only or access ...

GHSA-X9P7-VGP2-9PQ2 Magento security bypass vulnerability

Magento versions 2.3.3 and earlier, 2.2.10 and earlier, 1.14.4.3 and earlier, and 1.9.4.3 and earlier have a security bypass vulnerability. Successful exploitation could lead to arbitrary code execution...

GHSA-4J4G-FP93-QVRW Jenkins buildgraph-view Plugin vulnerable to stored Cross-site Scripting

Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view, resulting in a stored cross-site scripting vulnerability exploitable by users able to change build descriptions...

GHSA-46RR-87H4-F5Q6 SSL/TLS certificate validation globally and unconditionally disabled by Jenkins WebSphere Deployer Plugin

Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows users with Overall/Read access to disable SSL/TLS certificate and hostname validation for the entire Jenkins master JVM...

GHSA-GJJM-4X3G-3H33 Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary Javascript code into the dynamic block when invoking page builder on a product...

GHSA-J63V-WCF9-C9HM Magento 2 Community Edition RCE Vulnerability

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these...

GHSA-346G-JRX9-JGF4 Jenkins 360 FireLine Plugin vulnerable to XML External Entity Reference

An XML external entities XXE vulnerability in Jenkins 360 FireLine Plugin allows attackers with Overall/Read access to have Jenkins resolve external entities, resulting in the extraction of secrets from the Jenkins agent, server-side request forgery, or denial-of-service attacks. Note: Jenkins ha...

GHSA-362P-56C9-Q273 Jenkins iceScrum Plugin stores credentials in Cleartext

Jenkins iceScrum Plugin 1.1.4 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

GHSA-PQX8-Q35P-PGCV TeamPass Stored Cross-site Scripting

TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder...

GHSA-JRMF-XHR6-3428 Jenkins SourceGear Vault plugin transmits credentials in plain text

Jenkins SourceGear Vault Plugin transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. As of the publication of the advisory, there are no patches and the plugin is unmaintained...

GHSA-GPMW-H4WQ-4RCH Missing permission check in Jenkins Project Inheritance Plugin

A missing permission check in Jenkins Project Inheritance Plugin 19.08.01 and earlier allowed attackers with Overall/Read permission to trigger project generation from templates...

GHSA-5J25-5HJR-W7M2 Magento 2 Community Edition Information Leak

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP reques...

GHSA-V5M6-2M78-4VR2 Magento 2 Community Edition XSS Vulnerability

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manage orders can inject malicious javascript...

GHSA-5GHG-233H-7J79 PyDio Stored XSS Vulnerability

A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be use...

GHSA-QG47-5PX9-32G7 Ansible Remote Code Execution

The safeeval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions...

GHSA-JHM7-38XJ-PVM8 Cobbler is vulnerable to code injection

templateapi.py in Cobbler before 2.0.7, as used in Red Hat Network Satellite Server and other products, does not disable the ability of the Cheetah template engine to execute Python statements contained in templates, which allows remote authenticated administrators to execute arbitrary code via a...

GHSA-7M7G-JQ4M-98W5 Apache Solr for TYPO3 (solr) extension is vulnerable to Insecure Unserialize

Unspecified vulnerability in the Apache Solr for TYPO3 solr extension before 2.8.3 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."...

GHSA-MM32-JW73-9227 Plone is vulnerable to File System Path Exposure

The WYSIWYG component wysiwyg.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message...

GHSA-QPHH-5FV5-2MJJ Plone is vulnerable to information exposure via the object manager implementation

The object manager implementation objectmanager.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request...

GHSA-M2RR-H6G4-9CM9 Path Traversal in Apache Atlas

Apache Atlas versions 0.6.0 incubating, 0.7.0 incubating, and 0.7.1 incubating allow access to the webapp directory contents by pointing to URIs like /js and /img...

GHSA-8PPF-X4GR-2X7G SQL injection in calibreweb

Calibre-Web before 0.6.18 allows user table SQL Injection...

GHSA-3VV3-585Q-WV6X Apache Guacamole Race Condition vulnerability

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end o...

GHSA-W4X6-J349-9R57 Apache NiFi host header poisoning issue

A malicious host header in an incoming HTTP request could cause NiFi to load resources from an external server. The fix to sanitize host headers and compare to a controlled whitelist was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate...

GHSA-86VQ-8QHC-5RQW Apache Struts vulnerable to possible DoS attack when using URLValidator

If an application allows enter an URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL...

GHSA-4284-JFHC-F854 Phusion Passenger incorrect permission assignment

An issue was discovered in switchGroup in agent/ExecHelper/ExecHelperMain.cpp in Phusion Passenger before 5.3.2. The set of groups gidset is not set correctly, leaving it up to randomness i.e., uninitialized memory which supplementary groups are actually being set while lowering privileges...

GHSA-VG8G-JPM9-JH8R Unsafe pyyaml load usage in PyAnyAPI

An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before 0.6.1. A YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safeload should have been used. An attacker can...

GHSA-QC3M-6XMQ-7HRJ CSRF vulnerability in Jenkins Netsparker Enterprise Scan Plugin

A cross-site request forgery vulnerability in Jenkins Netsparker Cloud Scan Plugin 1.1.5 and older in the NCScanBuilder.DescriptorImpldoValidateAPI form validation method allowed attackers to initiate a connection to an attacker-specified server...

GHSA-XWF4-88XR-HX2J Cross site scripting in Apache Sling

In the XSS Protection API module before 1.0.12 in Apache Sling, the encoding done by the XSSAPI.encodeForJSString method is not restrictive enough and for some input patterns allows script tags to pass through unencoded, leading to potential XSS vulnerabilities...

GHSA-C252-XC8V-MQMM MAGMI plugin for Magento Server Directory Traversal

Directory traversal vulnerability in web/ajaxpluginconf.php in the MAGMI aka Magento Mass Importer plugin for Magento Server allows remote attackers to read arbitrary files via a .. dot dot in the file parameter...

GHSA-4R78-HX75-JJJ2 golang.org/x/net/html has Improper Restriction of Operations within the Bounds of a Memory Buffer

The html package aka x/net/html through 2018-09-25 in Go mishandles , leading to a panic: runtime error index out of range in nodeStack.pop in node.go, called from parser.clearActiveFormattingElements, during an html.Parse call...

GHSA-WRWF-PMMJ-W989 Observable Discrepancy in BouncyCastle

BouncyCastle TLS prior to version 1.0.3, when configured to use the JCE Java Cryptography Extension for cryptographic functions, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable...

GHSA-7M2W-9GW7-C3XP open-uri-cached Gem for Ruby Unsafe Temporary File Creation Enables Code Execution

The open-uri-cached rubygem allows local users to execute arbitrary Ruby code by creating a directory under /tmp containing "openuri-" followed by a crafted UID, and putting Ruby code in said directory once a metafile is created...

GHSA-5HGM-QM5M-5VMW Jakarta Tomcat cross-site scripting (XSS) vulnerability

Multiple cross-site scripting XSS vulnerabilities in the 1 examples and 2 ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML...

GHSA-V98R-GJGC-M9PF Stored Cross-site Scripting vulnerability in Jenkins Promoted Builds Plugin

Jenkins promoted builds Plugin 873.v6149dbd64130 and earlier, except 3.10.1, does not escape the name and description of Promoted Build parameters on views displaying parameters, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

GHSA-36P3-WJMG-H94X Remote Code Execution in Spring Framework

Spring Framework prior to versions 5.2.20 and 5.3.18 contains a remote code execution vulnerability known as Spring4Shell. Impact A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution RCE via data binding. The specific exploit requires the...

GHSA-54FX-GM74-Q676 Permissions bypass in SmallRye

A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vulnerability is a threat to data...

GHSA-Q2QR-3C2P-9235 Denial of Service (DoS) in HashiCorp Consul

HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7.4. Specific Go Packages Affected github.com/hashicorp/consul/agent/consul/discoverychain...

GHSA-M4H3-7MC2-V295 An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations.

An issue in Atomix v3.1.5 allows a malicious Atomix node to remove states of ONOS storage via abuse of primitive operations...

GHSA-8892-84WF-CG8F SyncChannel<T> can move 'T: !Send' to other threads

Affected versions of this crate unconditionally implement Send/Sync for SyncChannel. SyncChannel doesn't provide access to &T but merely serves as a channel that consumes and returns owned T. Users can create UB in safe Rust by sending T: !Send to other threads with SyncChannel::send/recv APIs...

GHSA-P9GF-GMFV-398M Double free in slice-deque

An issue was discovered in the slice-deque crate through 2021-02-19 for Rust. A double drop can occur in SliceDeque::drainfilter upon a panic in a predicate function...

GHSA-RM7F-MPCJ-W4F6 Command injection in Apache Unomi

Apache Unomi prior to version 1.5.5 allows CRLF log injection because of the lack of escaping in the log statements...

GHSA-C9M9-48PW-6MPV apiconnect-cli-plugins vulnerable to OS Command Injection

apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the pluginUri argument. PoC js var root = require"apiconnect-cli-plugins"; var payload = "& touch Song &"; root.pluginLoader.installPluginpayload, ""; The injection point is...

GHSA-44CW-P2HM-GPF6 Disabled Hostname Verification in Opencast

Opencast before version 8.9 and 7.9 disables HTTPS hostname verification of its HTTP client used for a large portion of Opencast's HTTP requests. Hostname verification is an important part when using HTTPS to ensure that the presented certificate is valid for the host. Disabling it can allow for...