GHSA-3HX4-285W-V6MM Jenkins Project Inheritance Plugin vulnerable to cross site scripting

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to control the reason a queue item is blocked...

GHSA-Q754-VWC4-P6QJ Authenticated Stored Cross-site Scripting in Shopware

Impact Authenticated Stored XSS in Administration Patches We recommend updating to version 5.7.12. You can get the update to 5.7.12 regularly via the Auto-Updater or directly via the download overview. https://www.shopware.com/de/changelog-sw5/5-7-12 For older versions you can use the Security...

GHSA-PM37-5J5M-6CVW Cross-site Scripting in NukeViet CMS

There is a Cross Site Scripting Stored XSS vulnerability in NukeViet CMS before 4.5.02...

GHSA-6978-4W92-428P Backdoor in api-res-py

api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package...

GHSA-V8X6-59G4-5G3W Denial of service binding form from JSON in Play Framework

Impact A denial-of-service vulnerability has been discovered in Play's forms library, in both the Scala and Java APIs. This can occur when using either the FormbindFromRequest method on a JSON request body or the Formbind method directly on a JSON value. If the JSON data being bound to the form...

GHSA-9QRP-H7FW-42HG Path Traversal in XWiki Platform

Impact One can ask for any file located in the classloader using the template API and a path with ".." in it. For example template name="../xwiki.hbm.xml"/ To our knownledge none of the available files of the classloader in XWiki Standard contain any strong confidential data, hence the low...

GHSA-VXR9-P2XW-M8CF Dolibarr remote PHP code execution

The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shellexec are blocked but backticks are not blocked...

GHSA-5GQ7-826W-8282 Unrestricted File Upload vulnerability in Firefly III

firefly-iii is vulnerable to Unrestricted Upload of File with Dangerous Type...

GHSA-C8MX-43CQ-993W EC-CUBE Cross-site scripting vulnerability

Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific input field of the EC web site which is created using EC-CUBE. As a result, it may lead to an arbitrary script execution on the administrator's web browser...

GHSA-JWH2-FFG4-48XC Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client

A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client copy command to extract files outside the working path. The highest threat from this vulnerability is to integrity and...

GHSA-H437-QJJ9-VMQ4 Magento XPath Injection

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful...

GHSA-4RGH-JX4F-QFCQ http before 0.13.3 vulnerable to header injection

An issue was discovered in the http package before 0.13.3 for Dart. If the attacker controls the HTTP method and the app is using Request directly, it's possible to achieve CRLF injection in an HTTP request via HTTP header injection. This issue has been addressed in commit abb2bb182 by validating...

GHSA-CH37-CH8W-CFRQ Bookstack Cross-site Scripting vulnerability

In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of javascript: URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a pag...

GHSA-G2X4-256V-5PVX Codiad Cross-site Scripting Vulnerability

A Cross Site Scripting XSS vulnerability was found in Codiad v1.7.8 and later. The vulnerability occurs because of improper sanitization of the folder's name $path variable in components/filemanager/class.filemanager.php. NOTE: the vendor states "Codiad is no longer under active maintenance by co...

GHSA-CV78-V957-JX34 Exposure of Sensitive Information in Gradle publish plugin

All versions of com.gradle.plugin-publish before 0.11.0 are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while running Gradle with the --info log level flag, the Gradle Logger logs an AWS pre-signed URL. If this build log is public...

GHSA-774Q-WFCP-VC2Q Moodle Email media URL tokens were not checking for user status

A vulnerability was found in Moodle 3.6 before 3.6.7 and 3.7 before 3.7.3, where tokens used to fetch inline atachments in email notifications were not disabled when a user's account was no longer active. Note: to access files, a user would need to know the file path, and their token...

GHSA-C3CG-MV5W-CVW8 XXE vulnerability in FitNesse Plugin

FitNesse Plugin 1.30 and earlier does not configure the XML parser to prevent XML external entity XXE attacks. This allows a user able to control the input files for its post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the Jenkins...

GHSA-VVG2-HG3C-MQJ3 Client secret transmitted in plain text by Azure AD Plugin

Azure AD Plugin stores a client secret in its global configuration. While the credential is stored encrypted on disk, it is transmitted in plain text as part of the configuration form by Azure AD Plugin 1.1.2 and earlier. This can result in exposure of the credential through browser extensions,...

GHSA-82J9-WFCF-9V2H Plone Open Redirect Vulnerability

An open redirect on the login form and possibly other places in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site...

GHSA-98M4-M2C3-QXGQ Jenkins JIRA Plugin allows users to select and use credentials with System scope

Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct folder scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope. Jira Plugin 3.0.11 defines the appropriate folder context for credential lookup. As a side effect, existing...

GHSA-2GC6-2H2G-PH48 Rambox RCE Vulnerability

There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron,...

GHSA-QCFR-65HF-F98X Jenkins TestLink Plugin stores credentials in plain text

Jenkins TestLink Plugin stores credentials unencrypted in its global configuration file hudson.plugins.testlink.TestLinkBuilder.xml on the Jenkins controller. These credentials can be viewed by users with access to the Jenkins controller file system. As of publication of this advisory, there is n...

GHSA-862J-CV9P-6HPF Jenkins Codefresh Integration Plugin Improper Certificate Validation vulnerability

Codefresh Integration Plugin unconditionally disables SSL/TLS certificate validation for the entire Jenkins controller JVM. As of publication of this advisory, there is no fix...

GHSA-VWQ9-CMQR-3C8C Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin

Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked i.e. replaced with asterisks in that log to prevent accidental disclosure. Between Configuration as Code Plugin 0.8-alpha and 1.0, log messages contained values if the...

GHSA-V3C9-W6G2-HJG3 Cross-Site Request Forgery in XXL-Job

A Cross-Site Request Forgery CSRF in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add...

GHSA-J6M4-FRXH-P4X8 Zope Object Database Denial of Service vulnerability

Race condition in ZEO/StorageServer.py in Zope Object Database ZODB before 3.10.0a2 allows remote attackers to cause a denial of service daemon outage by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an...

GHSA-Q326-JHW3-699G Improper Neutralization of Input During Web Page Generation in IPython

Cross-site scripting XSS vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path...

GHSA-CR9C-RHQ6-VH53 Withdrawn: Code execution via SVG file upload in tiddlywiki

Withdrawn Advisory This advisory has been withdrawn because it has been found to not be valid. Please see the issue here for more information. Original Description An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via...

GHSA-726G-CGCQ-4XW8 Dolibarr Cross-Site Scripting (XSS) vulnerability

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting XSS vulnerabilities in versions before 5.0.4: index.php leftmenu parameter, core/ajax/box.php PATHINFO, product/stats/card.php type parameter, holiday/list.php monthcreate, monthstart, and monthend parameters, and don/card.ph...

GHSA-P76J-5V6V-6C22 Apache NiFi JMS Deserialization issue

Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client library to 5.15.3 was applied on the Apache NiFi 1.6.0 release...

GHSA-7577-F8FP-5977 Stored Cross-Site Scripting Vulnerability in Jenkins Shelve Project Plugin

A cross-site scripting vulnerability exists in Jenkins Shelve Project Plugin 1.5 and earlier in ShelveProjectAction/index.jelly, ShelvedProjectsAction/index.jelly that allows attackers with Job/Configure permission to define JavaScript that would be executed in another user's browser when that...

GHSA-85HW-W436-C725 XML External Entity Reference in Apache Cayenne

This affects Apache Cayenne 4.1.M1, 3.2.M1, 4.0.M2 to 4.0.M5, 4.0.B1, 4.0.B2, 4.0.RC1, 3.1, 3.1.1, 3.1.2. CayenneModeler is a desktop GUI tool shipped with Apache Cayenne and intended for editing Cayenne ORM models stored as XML files. If an attacker tricks a user of CayenneModeler into opening a...

GHSA-WHF8-3H58-2W9F Jenkins Warnings Next Generation Plugin cross-site request forgery vulnerability

Jenkins Warnings Next Generation Plugin has a form validation HTTP endpoint used to validate a Groovy script through compilation, which was not subject to sandbox protection. The endpoint checked for the Overall/RunScripts permission, but did not require POST requests, so it was vulnerable to...

GHSA-5R8Q-9FWV-2GPR Jenkins Slack Notification Plugin CSRF vulnerability and missing permission checks

A cross-site request forgery vulnerability in Jenkins Slack Notification Plugin 2.19 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

GHSA-7H99-VJMF-5PG8 Jenkins VMware vRealize Automation Plugin Missing Encryption of Sensitive Data

Jenkins VMware vRealize Automation Plugin stores credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

GHSA-25GW-4PCC-45CF Deserialization of Untrusted Data in Apache Batik

In Apache Batik 1.x before 1.10, when deserializing subclass of AbstractDocument, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization...

GHSA-W559-623P-VFG8 MyBatis PageHelper vulnerable to time-blind SQL injection via orderBy parameter

MyBatis PageHelper versions 3.5.x through 5.3.x were discovered to contain a time-blind SQL injection vulnerability via the orderBy parameter...

GHSA-5JQ3-8437-X35P Multiple cross-site scripting (XSS) vulnerabilities in Roundup

Multiple cross-site scripting XSS vulnerabilities in Roundup before 1.4.20 allow remote attackers to inject arbitrary web script or HTML via the 1 @okmessage or 2 @errormessage parameter to issue...

GHSA-72CX-5FF9-4HHC Cross-site scripting in markdown2 for python

python-markdown2 before 1.0.1.14 has multiple cross-site scripting XSS issues...

GHSA-HHR9-7XVH-8XGC Server side request forgery in LiveHelperChat

SSRF filter bypass port 80, 433 in LiveHelperChat prior to v3.67. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191...

GHSA-2V6V-Q994-XVXX Privilege escalation in beego

beego is an open-source, high-performance web framework for the Go programming language. An issue was discovered in file profile.go in function GetCPUProfile in beego through 2.0.2, allows attackers to launch symlink attacks locally...

GHSA-QG5X-66HP-CW5P Uncontrolled Resource Consumption in Apache DolphinScheduler

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service ReDoS attacks. Apache DolphinScheduler users should upgrade to version 2.0.5 or higher...

GHSA-MF22-92PM-M8P8 Cross site scripting in @awsui/components-react

Impact Components could potentially allow cross-site scripting XSS in certain circumstances. These components could render content without adequate neutralization. Patches Fixed in 3.0.367...

GHSA-44CG-QCPR-FWJH Cross site scripting in francoisjacquet/rosariosis

A Cross Site Scripting XSS vulnerabilty exits in RosarioSIS before 7.6.1 via the xssclean function in classes/Security.php, which allows remote malicious users to inject arbitrary JaveScript of HTML.An example of affected components are all Markdown input fields...

GHSA-HJ8G-CW8X-2C6M Cross-site Scripting in Microweber

Microweber prior to version 1.3 is vulnerable to reflected cross-site scripting...

GHSA-X92V-XV3X-9V29 CSRF vulnerability in Jenkins Chef Sinatra Plugin allow XXE

Jenkins Chef Sinatra Plugin 1.20 and earlier does not perform a permission check in a method implementing form validation. This allows attackers with Overall/Read permission to have Jenkins send an HTTP request to an attacker-controlled URL and have it parse the response as XML. As the plugin doe...

GHSA-JP32-VMM6-3VF5 Directory Traversal in Kubernetes

Directory traversal vulnerability in Kubernetes, as used in Red Hat OpenShift Enterprise 3.0, allows attackers to write to arbitrary files via a crafted object type name, which is not properly handled before passing it to etcd...

GHSA-QGRQ-CX4C-2RMM Incorrect Authorization in WildFly Elytron

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secur...

GHSA-F2JW-PR2C-9X96 Code injection in @rkesters/gnuplot

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The gnuplot package prior to version 0.1.0 for Node.js allows code execution via shell metacharacters in Gnuplot commands...

GHSA-PX4W-RCV2-6X8X Arbitrary code execution in Apache ServiceComb java-chassis

When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5...