The Google Login Plugin (versions 1.0 and 1.1) allows malicious anonymous users to authenticate successfully against Jenkins instances that are supposed to be locked down to a particular Google Apps domain through client-side request modification.
Refe…
[org.apache.druid:druid] Cross site scripting in Apache Druid
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. This makes it possible to execute reflected XSS attacks.
References
https://nvd.nist.gov/vuln/detail/CVE-2021-447…
[org.apache.druid:druid] Clickjacking in Apache Druid
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking. Druid 0.23.0 and later prevent clickjacking using the Content-Security-Policy header.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-28889
ht…
[snipe/snipe-it] Snipe-IT 6.0.2 vulnerable to Cross-site Scripting via arbitrary file upload in Update Branding Settings
An arbitrary file upload vulnerability in the Update Branding Settings component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-32060
https://grimthereaperteam.med…
[snipe/snipe-it] Snipe-IT 6.0.2 vulnerable to Cross-site Scripting
An arbitrary file upload vulnerability in the Select User function under the People Menu component of Snipe-IT v6.0.2 allows attackers to execute arbitrary code via a crafted file.
References
https://nvd.nist.gov/vuln/detail/CVE-2022-32061
https://gri…
[org.eclipse.lyo:lyo-parent] XML External Entity Reference in Eclipse Lyo
In Eclipse Lyo versions 1.0.0 to 4.1.0, a TransformerFactory is initialized with the defaults that do not restrict DTD loading when working with RDF/XML. This allows an attacker to cause an external DTD to be retrieved.
References
https://nvd.nist.gov…
[apache-superset] Apache Superset before 1.5.1 allows authenticated users to access metadata for datasets they have no permission on
Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.
References
https://nvd.nist.gov/vuln/detail/CVE-20…
[github.com/ipfs/go-ipfs] DOS and excessive memory usage when passing untrusted user input to to dag import
Impact
go-ipfs nodes crash when trying to import certain malformed CAR files due to an issue in the go-car dependency. This impacts nodes running ipfs dag import on untrusted user inputs, for example, pinning services with a car ingest endpoint.
This i…
[openssl-src] AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised
implementation will not encrypt the entirety of the data under some
circumstances. This could reveal sixteen bytes of data that was
preexisting in the memory that wasn’t written…
[parse-server] Protected fields exposed via LiveQuery
Impact
Parse Server LiveQuery does not remove protected fields in classes, passing them to the client.
Patches
The LiveQueryController now removes protected fields from the client response.
Workarounds
Use Parse.Cloud.afterLiveQueryEvent to manually re…