aswin1906/github-advisory-2021.csv huggingface dataset:
No CSRF protection on the password change form
Published: 2021-07-02T19:19:13Z
Aliases: CVE-2021-32730

### Impact
It's possible for forge an URL that, when accessed by an admin, will reset the password of any user in XWiki.

### Patches
The problem has been patched in XWiki 12.10.5, 13.2RC1.

### Workarounds
It's possible to apply the patch manually by modifying the `register_macros.vm` template like in https://github.com/xwiki/xwiki-platform/commit/0a36dbcc5421d450366580217a47cc44d32f7257.

### References
https://jira.xwiki.org/browse/XWIKI-18315

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security ML](mailto:security@xwiki.org)
Regular expression denial of service in react-native
Published: 2021-07-20T17:33:28Z
Aliases: CVE-2020-1920

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
Out-of-bounds Write in ChakraCore
Published: 2021-07-28T18:58:14Z
Aliases: CVE-2020-0831

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Incorrect Authorization in TeamPass
Published: 2021-07-26T21:20:38Z
Aliases: CVE-2020-12477

The REST API functions in TeamPass 2.1.27.36 allow any user with a valid API token to bypass IP address whitelist restrictions via an X-Forwarded-For client HTTP header to the getIp function.
Utils.readChallengeTx does not verify the server account signature
Published: 2021-07-02T19:20:33Z
Aliases: CVE-2021-32738

The `Utils.readChallengeTx` function used in [SEP-10 Stellar Web Authentication](https://github.com/stellar/stellar-protocol/blob/master/ecosystem/sep-0010.md) states in its function documentation that it reads and validates the challenge transaction including verifying that the `serverAccountID` has signed the transaction. The function does not verify that the server has signed the transaction and has been fixed so that it does in v8.2.3.

Applications that also used `Utils.verifyChallengeTxThreshold` or `Utils.verifyChallengeTxSigners` to verify the signatures including the server signature on the challenge transaction are unaffected as those functions verify the server signed the transaction.

Applications calling `Utils.readChallengeTx` should update to v8.2.3 to ensure that the challenge transaction is completely valid and signed by the server creating the challenge transaction.
Cross-site Scripting in Froala WYSIWYG Editor
Published: 2021-07-19T21:21:33Z
Aliases: CVE-2021-28114

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.
Files or Directories Accessible to External Parties in ether/logs
Published: 2021-07-12T16:53:00Z
Aliases: CVE-2021-32752

### Impact
A vulnerability was found that allowed authenticated admin users to access any file on the server.

### Patches
The vulnerability has been fixed in 3.0.4.

### Workarounds
We recommend disabling the plugin if untrustworthy sources have admin access.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [ether/logs](https://github.com/ethercreative/logs/issues)
Privilege escalation: all users can access Admin-level API keys
Published: 2021-07-22T19:43:16Z
Aliases: CVE-2021-39192

### Impact
An error in the implementation of the limits service in 4.0.0 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability.

Ghost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.9.4. Immediate action should be taken to secure your site - see patches & workarounds below.

It is highly recommended to regenerate all API keys after patching or applying the workaround below.

### Patches
Fixed in 4.10.0, all 4.x sites should upgrade as soon as possible.

### Workarounds
- Disable all non-Administrator accounts to prevent API access.

### For more information
If you have any questions or comments about this advisory:
* email us at security@ghost.org

---
Credits: Aden Yap Chuen Zhen, BAE Systems Applied Intelligence (Malaysia)
Deserialization of Untrusted Data in msgpack
Published: 2021-07-26T21:24:09Z
Aliases: CVE-2021-23410

# Withdrawn

This advisory was withdrawn by its CNA (Snyk).

## Original advisory

All versions of package `msgpack` are vulnerable to Deserialization of Untrusted Data via the unpack function. This does not affect the similarly named package `@msgpack/msgpack`.
API information disclosure flaw in Elasticsearch
Published: 2021-07-02T18:33:02Z
Aliases: CVE-2021-22135

Elasticsearch versions before 7.11.2 and 6.8.15 contain a document disclosure flaw was found in the Elasticsearch suggester and profile API when Document and Field Level Security are enabled. The suggester and profile API are normally disabled for an index when document level security is enabled on the index. Certain queries are able to enable the profiler and suggester which could lead to disclosing the existence of documents and fields the attacker should not be able to view.
URIjs Vulnerable to Hostname spoofing via backslashes in URL 
Published: 2021-07-19T21:22:36Z
Aliases: CVE-2021-3647

### Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (`\`) and slash (`/`) characters as part of the scheme delimiter, e.g. `scheme:/\/\/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https:/\/\/\expected-example.com/path`
Escaped string: `https:/\\/\\/\\expected-example.com/path` (JavaScript strings must escape backslash)

Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).

### Patches
Version 1.19.7 is patched against all known payload variants.

### References
https://github.com/medialize/URI.js/releases/tag/v1.19.7 (fix for this particular bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for related bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass)
[PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)

### For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js

### Reporter credit
[ready-research](https://github.com/ready-research) via https://huntr.dev/
Out-of-bounds Write in ChakraCore
Published: 2021-07-28T18:58:22Z
Aliases: CVE-2020-0828

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Cross site scripting in the system log
Published: 2021-07-01T17:00:04Z
Aliases: CVE-2021-35210

### Impact

It is possible to inject code into the `tl_log` table that will be executed in the browser when the system log is called in the back end.

### Patches

Update to Contao 4.9.16 or 4.11.5.

### Workarounds

Disable the system log module in the back end for all users (especially admin users).

### References

https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:57:19Z
Aliases: CVE-2020-0848

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833.
Improper Resource Shutdown or Release in HashiCorp Vault
Published: 2021-07-28T17:57:46Z
Aliases: CVE-2020-7220

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.
Cross-site scripting in anchorme
Published: 2021-07-26T21:23:58Z
Aliases: CVE-2021-23411

All versions of package anchorme are vulnerable to Cross-site Scripting (XSS) via the main functionality.
Unencrypted storage of client side sessions
Published: 2021-07-01T17:02:13Z
Aliases: CVE-2021-29481

### Impact

The default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies.

Note: the documentation does point this out and encourage users to add an encryption key, but it is not mandatory.

For this to be a vulnerability, some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example, the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies.

The proposed change is to change the default behaviour to use a randomly generated encryption key. This would mean that sessions do not survive app restarts, but this is already the behaviour given the random signing key.

### Patches

As of version 1.9.0, a securely randomly generated signing key is used.

### Workarounds

Supply an encryption key, as per the documentation recommendation.

### References

- https://github.com/ratpack/ratpack/pull/1590
Craft CMS Remote Code Injection
Published: 2021-07-02T18:36:41Z
Aliases: CVE-2021-27903

An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did not restrict administrative changes (if an attacker were somehow able to hijack an administrator's session).
Cached redirect poisoning via X-Forwarded-Host header
Published: 2021-07-01T17:02:38Z
Aliases: CVE-2021-29479

A user supplied `X-Forwarded-Host` header can be used to perform cache poisoning of a cache fronting a Ratpack server if the cache key does not include the `X-Forwarded-Host` header as a cache key.

Users are only vulnerable if they do not configure a custom `PublicAddress` instance. A custom `PublicAddress` can be specified by using [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-). For versions prior to 1.9.0, by default, Ratpack utilizes an inferring version of `PublicAddress` which is vulnerable.

### Impact

This can be used to perform redirect cache poisoning where an attacker can force a cached redirect to redirect to their site instead of the intended redirect location.

### Patches

As of Ratpack 1.9.0, two changes have been made that mitigate this vulnerability:

1. The default PublicAddress implementation no longer infers the address from the request context, instead relying on the configured bind host/port
2. Relative redirects issued by the application are no longer absolutized; they are passed through as-is

### Workarounds

In production, ensure that [ServerConfigBuilder::publicAddress](https://ratpack.io/manual/current/api/ratpack/server/ServerConfigBuilder.html#publicAddress-java.net.URI-) correctly configures the server.

### References
 - https://portswigger.net/web-security/web-cache-poisoning
Craft CMS Cross-site Scripting Vulnerability
Published: 2021-07-02T18:36:31Z
Aliases: CVE-2021-27902

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
Code injection in Narou
Published: 2021-07-02T18:36:01Z
Aliases: CVE-2021-35514

Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.
Archive package allows chmod of file outside of unpack target directory
Published: 2021-07-26T21:17:45Z
Aliases: CVE-2021-32760

## Impact

A bug was found in containerd where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host’s filesystem.  Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky.  This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.

## Patches

This bug has been fixed in containerd 1.5.4 and 1.4.8.  Users should update to these versions as soon as they are released.  Running containers do not need to be restarted.

## Workarounds

Ensure you only pull images from trusted sources.

Linux security modules (LSMs) like SELinux and AppArmor can limit the files potentially affected by this bug through policies and profiles that prevent containerd from interacting with unexpected files.

## For more information

If you have any questions or comments about this advisory:

* [Open an issue](https://github.com/containerd/containerd/issues/new/choose)
* Email us at security@containerd.io if you think you’ve found a security bug.
The reset password form reveal users email address
Published: 2021-07-02T19:19:04Z
Aliases: CVE-2021-32731

### Impact
The reset password form reveals the email address of users just by giving their username.

### Patches
The problem has been patched on XWiki 13.2RC1.

### Workarounds
It's possible to manually modify the `resetpasswordinline.vm` to perform the changes made in https://github.com/xwiki/xwiki-platform/commit/0cf716250b3645a5974c80d8336dcdf885749dff#diff-14a3132e3986b1f5606dd13d9d8a8bb8634bec9932123c5e49e9604cfd850fc2

### References
https://jira.xwiki.org/browse/XWIKI-18400

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xiwki.org)
* Email us at [Security ML](mailto:security@xwiki.org)
Missing Authorization in TYPO3 extension
Published: 2021-07-26T21:34:52Z
Aliases: CVE-2020-12698

The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
Hashicorp Consul Missing SSL Certificate Validation
Published: 2021-07-19T21:21:03Z
Aliases: CVE-2021-32574

HashiCorp Consul before 1.10.1 (and Consul Enterprise) has Missing SSL Certificate Validation. xds does not ensure that the Subject Alternative Name of an upstream is validated.
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:57:39Z
Aliases: CVE-2020-0829

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:57:11Z
Aliases: CVE-2020-0823

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
Incorrect Regular Expression in RestSharp
Published: 2021-07-14T19:10:01Z
Aliases: CVE-2021-27293

RestSharp < 106.11.8-alpha.0.13 uses a regular expression which is vulnerable to Regular Expression Denial of Service (ReDoS) when converting strings into DateTimes. If a server responds with a malicious string, the client using RestSharp will be stuck processing it for an exceedingly long time. Thus the remote server can trigger Denial of Service.
github.com/pires/go-proxyproto vulnerable to DoS via Connection descriptor exhaustion
Published: 2021-07-26T21:23:49Z
Aliases: CVE-2021-23409

The package `github.com/pires/go-proxyproto` before 0.6.1 is vulnerable to Denial of Service (DoS) via creating connections without the proxy protocol header. While this issue was patched in 0.6.0, the fix introduced additional issues which were subsequently patched in 0.6.1.
Open Redirect in github.com/AndrewBurian/powermux
Published: 2021-07-01T17:00:32Z
Aliases: CVE-2021-32721

### Impact
Attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link.

### Patches
The issue is resolved in v1.1.1

### Workarounds
There are no existing workarounds.
You may detect attempts to craft urls that exploit this feature by looking for request paths containing pairs of forward slashes in sequence combined with a trailing slash e.g. `https://example.com//foo/`
XML2Dict XML Entity Expansion Vulnerability
Published: 2021-07-02T18:37:31Z
Aliases: CVE-2021-25951

XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service. The parse function does not properly restrict recursive entity references.
Cross-site scripting vulnerability in TinyMCE plugins
Published: 2021-11-02T15:42:52Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the URL processing logic of the `image` and `link` plugins. The vulnerability allowed arbitrary JavaScript execution when updating an image or link using a specially crafted URL. This issue only impacted users while editing and the dangerous URLs were stripped in any content extracted from the editor. This impacts all users who are using TinyMCE 5.9.2 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.10.0 by improved sanitization logic when updating URLs in the relevant plugins.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.10.0 or higher
- Disable the `image` and `link` plugins

### Acknowledgements
Tiny Technologies would like to thank Yakir6 for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes510/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
Improper Verification of Cryptographic Signature in starkbank-ecdsa
Published: 2021-11-10T20:41:39Z
Aliases: CVE-2021-43572

The `verify` function in the Stark Bank Python ECDSA library (starkbank-ecdsa) 2.0.0 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Use after free / memory leak in `CollectiveReduceV2`
Published: 2021-11-10T18:51:21Z
Aliases: CVE-2021-41220

### Impact
The [async implementation](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/collective_ops.cc#L604-L615) of `CollectiveReduceV2` suffers from a memory leak and a use after free:

```python
import tensorflow as tf
  
tf.raw_ops.CollectiveReduceV2(
  input=[],
  group_size=[-10, -10, -10],
  group_key=[-10, -10],
  instance_key=[-10],
  ordering_token=[],
  merge_op='Mul',
  final_op='Div')
``` 

This occurs due to the asynchronous computation and the fact that objects that have been `std::move()`d from are still accessed:

```cc
auto done_with_cleanup = [col_params, done = std::move(done)]() {
  done();
  col_params->Unref();
};
OP_REQUIRES_OK_ASYNC(c,
                     FillCollectiveParams(col_params, REDUCTION_COLLECTIVE,
                                          /*group_size*/ c->input(1),
                                          /*group_key*/ c->input(2),
                                          /*instance_key*/ c->input(3)),
                     done);
```

Here, `done` is already moved from by the time `OP_REQUIRES_OK_ASYNC` macro needs to invoke it in case of errors. In this case, we get an undefined behavior, which can manifest via crashes, `std::bad_alloc` throws or just memory leaks.

### Patches
We have patched the issue in GitHub commit [ca38dab9d3ee66c5de06f11af9a4b1200da5ef75](https://github.com/tensorflow/tensorflow/commit/ca38dab9d3ee66c5de06f11af9a4b1200da5ef75).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, as this version is the only one that is also affected.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server
Published: 2021-11-10T18:20:11Z
Aliases: CVE-2021-22565

### Impact
Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID.

### Patches
v1.1.2+

### Workarounds
There are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can only be expired by providing their 64-bit UUID, and verification codes are already valid for a very short period of time (thus the UUID rotates frequently).

### For more information
Contact exposure-notifications-feedback@google.com
json-schema is vulnerable to Prototype Pollution
Published: 2021-11-19T20:16:17Z
Aliases: CVE-2021-3918

json-schema before version 0.4.0 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Prototype Pollution in json-pointer
Published: 2021-11-08T17:40:49Z
Aliases: CVE-2021-23820

This affects versions of package `json-pointer` up to and including `0.6.1`. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.