UBUNTU-CVE-2022-32531

The Apache Bookkeeper Java Client before 4.14.6 and also 4.15.0 does not close the connection to the bookkeeper server when TLS hostname verification fails. This leaves the bookkeeper client vulnerable to a man in the middle attack. The problem affects BookKeeper client prior to versions 4.14.6 a...

GHSA-4GJR-VGFX-9QVW AList vulnerable to Improper Preservation of Permissions

Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder even a password protected one. Version 3.5.1 contains a patch...

GHSA-H972-V458-M892 Craft CMS discloses password hashes

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. T...

GHSA-G9CP-9FW3-56CF Cross-site Scripting in Backdrop CMS

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via 'Comment.'s...

GHSA-PP74-G2Q5-J4JF Silverstipe CMS Stored XSS in custom meta tags

A malicious content author could create a custom meta tag and execute an arbitrary JavaScript payload. This would require convincing a legitimate user to access a page and enter a custom keyboard shortcut. This requires CMS access to exploit...

GHSA-44XV-V98G-V79F URL XSS vulnerability due to outdated jquery in CMS

Silverstripe silverstripe/framework through 4.11 allows XSS issue 2 of 3...

GHSA-VQP6-RC3H-83CP Tailscale Windows daemon is vulnerable to RCE via CSRF

A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon tailscaled, which can then be used to remotely execute code. Affected platforms: Windows Patched Tailscale client versions: v1.32.3 or later, v1.33.257 or later unstable What...

GHSA-HC4J-7MQG-CXJJ PHPServerMon PRNG has Insufficient Entropy

A vulnerability, which was classified as problematic, was found in phpservermon. Affected is the function setUserLoggedIn of the file src/psm/Service/User.php. The manipulation leads to use of predictable algorithm in random number generator. The exploit has been disclosed to the public and may b...

GHSA-JRVR-GMQV-HGRH Subrion CMS is vulnerable to Cross-Site Scripting (XSS)

A cross-site scripting XSS vulnerability in the CMS Field Add page of Intelliants Subrion CMS in version 4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field...

GHSA-2C6M-6GQH-6QG3 Docker Command Escaping in the GitHub Actions Runner

Impact The actions runner invokes the docker cli directly in order to run job containers, service containers, or container actions. A bug in the logic for how the environment is encoded into these docker commands was discovered that allows an input to escape the environment variable and modify th...

GHSA-J5V3-363P-G843 OpenCRX vulnerable to password enumeration via error messages in password reset

OpenCRX before v5.2.2 was discovered to be vulnerable to password enumeration due to the difference in error messages received during a password reset which could enable an attacker to determine if a username, email or ID is valid...

GHSA-X5GV-5RQV-654M Jenkins Compuware Topaz for Total Test Plugin allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins

Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

GHSA-J2MJ-G8JP-GJFM Jenkins NS-ND Integration Performance Publisher Plugin vulnerable to Missing Authorization

A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials. Version 4.8.0.130 requires POST requests and...

DLA-3099-1 qemu - security update

Bulletin has no description...

GHSA-QH87-2QVH-5JF8 RabbitMQ password stored in plain text by Jenkins CollabNet Plugins Plugin

Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system...

GHSA-4RX6-G5VG-5F3J Juniper is vulnerable to @DOS GraphQL Nested Fragments overflow

GraphQL behaviour Nested fragment in GraphQL might be quite hard to handle depending on the implementation language. Some language support natively a max recursion depth. However, on most compiled languages, you should add a threshold of recursion. graphql Infinite loop example query ...a fragmen...

GHSA-C28R-HW5M-5GV3 Partial Path Traversal in com.amazonaws:aws-java-sdk-s3

Overview A partial-path traversal issue exists within the downloadDirectory method in the AWS S3 TransferManager component of the AWS SDK for Java v1. Applications using the SDK control the destinationDirectory argument, but S3 object keys are determined by the application that uploaded the...

GHSA-748R-5R8Q-273M Apache Superset allows authenticated users to access metadata they have no permission to

Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics...

GHSA-7R65-PJGV-H2H9 Jenkins OpsGenie Plugin vulnerable to Cleartext Transmission of Sensitive Information

Jenkins OpsGenie Plugin 1.9 and earlier stores API keys unencrypted in its global configuration file com.opsgenie.integration.jenkins.OpsGenieNotifier.xml and in job config.xml files on the Jenkins controller as part of its configuration. Additionally, they are transmitted in plain text as part o...

GHSA-5WW9-9QP2-X524 Improper handling of double quotes in file name in Diffy in Windows environment

The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string...

GHSA-CGW6-F3MJ-H742 RustEmbed generated `get` method allows for directory traversal when reading files from disk

When running in debug mode and the debug-embed off by default feature is not enabled, the generated get method does not check that the input path is a child of the folder given. This allows attackers to read arbitrary files in the file system if they have control over the filename given. The...

GHSA-J8C7-3JPQ-8985 Cross-site Scripting in FacturaScripts

Cross-site Scripting XSS - Reflected in GitHub repository neorazorx/facturascripts. A patch is available on the master branch of the repository in commit 7b4ddb92...

CVE-2022-27776

A insufficiently protected credentials vulnerability in fixed in curl 7.83.0 might leak authentication or cookie header data on HTTP redirects to the same host but another port number...

GHSA-5824-6JFV-XR3R Arbitrary file read in ginadmin

In ginadmin through 05-10-2022, the incoming path value is not filtered, resulting in arbitrary file reading. A patch is available on the master branch of the repository...

GHSA-66X3-6CW3-V5GJ Improper Validation of Integrity Check Value in go-tuf

Impact go-tuf does not correctly implement the client workflow for updating the metadata files for roles other than the root role. Specifically, checks for rollback attacks are not implemented correctly meaning an attacker can cause clients to install software that is older than the software whic...

GHSA-JF7X-57G8-9HM5 Jeecg-Boot CMS arbitrary file upload vulnerability

An arbitrary file upload vulnerability in /jeecg-boot/sys/common/upload of jeecg-boot CMS 2.3 allows attackers to execute arbitrary code...

GHSA-4W4J-9533-82QG Moodle Cross-site Scripting (XSS)

A vulnerability was found in Moodle 3.9 to 3.9.1, 3.8 to 3.8.4 and 3.7 to 3.7.7 where it was possible to include JavaScript in a book's chapter title, which was not escaped on the "Add new chapter" page. This is fixed in 3.9.2, 3.8.5 and 3.7.8...

GHSA-9F37-GGXM-H6WX CSRF vulnerability in Jenkins Shelve Project Plugin

Jenkins Shelve Project Plugin 3.0 and earlier does not require POST requests for HTTP endpoints, resulting in cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow attackers to shelve, unshelve, or delete a project. Jenkins Shelve Project Plugin 3.1 requires POST requests f...

GHSA-VP5F-8JGW-J53C XXE vulnerability in Jenkins Subversion Plugin

Jenkins Subversion Plugin 2.13.1 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control an agent process to have Jenkins parse a crafted changelog file that uses external entities for extraction of secrets from the Jenkins...

GHSA-PF27-929J-9PMM Out-of-bounds Read and Out-of-bounds Write in Facebook Hermes

An out-of-bounds read/write vulnerability when executing lazily compiled inner generator functions in Facebook Hermes prior to commit 091835377369c8fd5917d9b87acffa721ad2a168 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the...

GHSA-CCWP-633J-G29V Passwords stored in plain text by Jenkins ReadyAPI Functional Testing Plugin

ReadyAPI Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files as part of its configuration. These project passwords can be viewed by attackers with Extended Read permission or access to the Jenkins controller file system. ReadyAPI Functional Testi...

GHSA-GM5X-HPMW-XPXG Silverstripe CMS information disclosure

In SilverStripe through 4.5.0, a specific URL path configured by default through the silverstripe/framework module can be used to disclose the fact that a domain is hosting a Silverstripe application. There is no disclosure of the specific version. The functionality on this URL path is limited to...

GHSA-98P6-6428-77V7 Jenkins NeoLoad Plugin stores credentials in cleartext

Jenkins NeoLoad Plugin prior to version 2.2.6 stores credentials unencrypted in its global configuration file and in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

GHSA-M26F-W3H5-62FJ Sandbox bypass vulnerability in Jenkins Script Security Plugin

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions in increment and decrement expressions allowed attackers to execute arbitrary code in sandboxed scripts...

GHSA-Q5RG-WG7H-73M5 LibreNMS Information Disclosure

An issue was discovered in LibreNMS through 1.47. The scripts that handle graphing options html/includes/graphs/common.inc.php and html/includes/graphs/graphs.inc.php do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with...

GHSA-XJ63-95XC-JC4V Jenkins eggplant-plugin Plugin stores credentials in plain text

Jenkins eggPlant Plugin 2.2 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system...

GHSA-QH9X-MC42-VG4G django-anymail Includes Sensitive Information in Log Files

Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOKAUTHORIZATION setting value that can result in An attacker with access to error logs could fabricate email tracking events. This attack appear to be exploitable via If you have exposed your...

GHSA-3XJQ-8J89-XRW9 Jenkins Badge Plugin cross-site scripting vulnerability

A persisted cross-site scripting vulnerability exists in Jenkins Badge Plugin 1.4 and earlier in BadgeSummaryAction.java, HtmlBadgeAction.java that allows attackers able to control build badge content to define JavaScript that would be executed in another user's browser when that other user...

GHSA-8Q95-JJ7P-X93X Openstack Neutron vulnerable to eavesdropping on private traffic

Live-migrated instances are briefly able to inspect traffic for other instances on the same hypervisor. This brief window could be extended indefinitely if the instance's port is set administratively down prior to live-migration and kept down after the migration is complete. This is possible due ...

GHSA-27V2-398X-F74X MAGMI cross-site scripting (XSS)

Multiple cross-site scripting XSS vulnerabilities in the MAGMI aka Magento Mass Importer plugin for Magento Server allow remote attackers to inject arbitrary web script or HTML via the 1 profile parameter to web/magmi.php or 2 QUERYSTRING to web/magmiimportrun.php...

GHSA-85V8-VX4W-Q684 Keycloak Improper Bruteforce Detection

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures...

GHSA-X634-34M9-96MP OpensStack Neutron Denial of Service Vulnerability

When using the Linux bridge ml2 driver, non-privileged tenants are able to create and attach ports without specifying an IP address, bypassing IP address validation. A potential denial of service could occur if an IP address, conflicting with existing guests or routers, is then assigned from...

GHSA-36HP-4X3G-PHRG Apache Tomcat's CookieExample Vulnerable to XSS

Multiple cross-site scripting XSS vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Value field, related to error messages...

GHSA-XW7V-QRHC-JJG2 Access Control vulnerability in Dolibarr

An Access Control vulnerability exists in Dolibarr ERP/CRM 13.0.2, fixed version is 14.0.1, in the forgot-password function becuase the application allows email addresses as usernames, which can cause a Denial of Service...

DEBIAN-CVE-2021-4070

Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0...

GHSA-5X92-P4P5-33C4 Path Traversal in HashiCorp Nomad

HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature github.com/hashicorp/nomad/drivers/docker may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8...

DSA-5073-1 expat - security update

Bulletin has no description...

GHSA-7X2H-3V2V-24P9 Cross-Site Request Forgery in microweber

microweber version 1.2.10 and prior is vulnerable to cross-site request forgery...

GHSA-X3G3-JH26-76CF Cross-site Scripting in livehelperchat

LiveHelperChat is vulnerable to Stored XSS at the Name field in the Admin themes of System configuration...

GHSA-77HH-P7R6-66PV Arbitrary File Upload in Mingsoft MCMS

MCMS v5.2.4 was discovered to have an arbitrary file upload vulnerability in the New Template module, which allows attackers to execute arbitrary code via a crafted ZIP file...