aswin1906/github-advisory-2021.csv huggingface dataset:
Composer's missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial
Published: 2021-04-29T21:52:04Z
Aliases: CVE-2021-29472

URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow commands to be executed in the HgDriver if hg/Mercurial is installed on the system.

### Impact
- The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from, e.g. Composer plugins.
- The main impact is to services passing user input to Composer, including Packagist.org and Private Packagist. This allowed users to trigger remote command injection. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs, to the best of our knowledge, was not abused by anyone.
- Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately

### Patches
1.10.22 and 2.0.13 include patches for this issue.
JavaScript execution via malicious molfiles (XSS)
Published: 2021-04-16T19:52:49Z

### Impact
The viewer plugin implementation of `<mol:molecule>` renders molfile data directly inside a `<script>` tag without any escaping. Arbitrary JavaScript code can thus be executed in the client browser via crafted molfiles.

### Patches
Patched in v0.3.0: Molfile data is now rendered as value of a hidden `<input>` tag and escaped via JSF's mechanisms.

### Workarounds
No workaround available.
Cross-site Scripting (XSS) in Eclipse Theia
Published: 2021-04-13T15:18:09Z
Aliases: CVE-2020-27224

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.
OS Command Injection and Improper Input Validation in ansible
Published: 2021-04-20T16:44:22Z
Aliases: CVE-2019-14904

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
Code Injection in script-manager
Published: 2021-04-13T15:24:38Z
Aliases: CVE-2020-8129

An unintended require vulnerability in script-manager npm package version 0.8.6 and earlier may allow attackers to execute arbitrary code.
Malicious users could abuse Sydent to control the content of invitation emails
Published: 2021-04-19T14:54:24Z
Aliases: CVE-2021-29432

### Impact

A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example.

### Patches

Fixed in 4469d1d, 6b405a8, 65a6e91.

Note that these patches include changes to the *default* email templates. If these templates have been locally modified, they must also be updated.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
Potential API key leak
Published: 2021-04-13T15:12:06Z

If a user is actively blackholing the location or weather APIs, or those APIs become otherwise unavailable, it is possible for the API keys to get leaked to the active IRC channel.

This is patched in v1.2.4
Timing attacks in python-rsa
Published: 2021-04-30T17:35:15Z
Aliases: CVE-2020-25658

It was found that python-rsa is vulnerable to Bleichenbacher timing attacks. An attacker can use this flaw via the RSA decryption API to decrypt parts of the cipher text encrypted with RSA
OS Command Injection in giting
Published: 2021-04-13T15:22:09Z
Aliases: CVE-2019-10802

giting version prior to 0.0.8 allows execution of arbritary commands. The first argument `repo` of function `pull()` is executed by the package without any validation.
Regular expression denial of service (ReDoS) in EmailValidator class in Vaadin 7
Published: 2021-04-19T14:49:32Z
Aliases: CVE-2020-36320

Unsafe validation RegEx in `EmailValidator` class in `com.vaadin:vaadin-server` versions 7.0.0 through 7.7.21 (Vaadin 7.0.0 through 7.7.21) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

- https://vaadin.com/security/cve-2020-36320
Improper Restriction of XML External Entity Reference in pikepdf
Published: 2021-04-20T16:30:03Z
Aliases: CVE-2021-29421

models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.
Server classes and resources exposure in OSGi applications using Vaadin 12-14 and 19
Published: 2021-04-19T14:46:49Z

Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

- https://vaadin.com/security/cve-2021-31407
Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and 	Exposure of Sensitive Information to an Unauthorized Actor in Ansible
Published: 2021-04-07T20:33:26Z
Aliases: CVE-2020-1753

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
Code Injection in oauth2-server
Published: 2021-04-22T15:53:45Z
Aliases: CVE-2017-18924

"oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.'"
Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Published: 2021-04-22T16:11:17Z
Aliases: CVE-2021-31408

`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

- https://vaadin.com/security/cve-2021-31408
Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Published: 2021-04-19T14:47:18Z

Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.

- https://vaadin.com/security/cve-2021-31406
Plaintext password leak in Apache Superset
Published: 2021-04-30T17:34:03Z
Aliases: CVE-2020-13952

In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection information including the plaintext password for the current connection. It would also be possible to run arbitrary methods on the database connection object for the Presto or Hive connection, allowing the user to bypass security controls internal to Superset. This vulnerability is present in every Apache Superset version < 0.37.2.
Directory traversal in development mode handler in Vaadin 14 and 15-17
Published: 2021-04-19T14:51:58Z
Aliases: CVE-2020-36321

Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

- https://vaadin.com/security/cve-2020-36321
Command Injection in killport
Published: 2021-04-13T15:16:20Z
Aliases: CVE-2021-23360

This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
Arbitrary code execution in clickhouse-driver
Published: 2021-04-07T20:50:57Z
Aliases: CVE-2020-26759

clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.
Prototype Pollution in iniparserjs
Published: 2021-04-13T15:20:09Z
Aliases: CVE-2021-23328

This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Authentication bypass in Apache Airflow
Published: 2021-04-30T17:34:13Z
Aliases: CVE-2020-13927

"The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the default has been changed to deny all requests by default and is documented at https://airflow.apache.org/docs/1.10.11/security.html#api-authentication. Note this change fixes it for new installs but existing users need to change their config to default `[api]auth_backend = airflow.api.auth.backend.deny_all` as mentioned in the Updating Guide: https://github.com/apache/airflow/blob/1.10.11/UPDATING.md#experimental-api-will-deny-all-request-by-default"
Uncontrolled Resource Consumption in urllib3
Published: 2021-04-30T17:31:43Z
Aliases: CVE-2020-7212

The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).
Apache Airflow Cross-site scripting due to incomplete fix for CVE-2020-13944
Published: 2021-04-20T16:40:14Z
Aliases: CVE-2020-17515

The `origin` parameter passed to some of the endpoints like `/trigger` was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.14. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.
Open Redirect in werkzeug
Published: 2021-04-20T16:30:26Z
Aliases: CVE-2020-28724

Open redirect vulnerability in werkzeug before 0.11.6 via a double slash in the URL.
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Published: 2021-04-19T14:53:09Z
Aliases: CVE-2018-25007

Missing check in UIDL request handler in com.vaadin:flow-server versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

- https://vaadin.com/security/cve-2018-25007
Improper Control of Dynamically-Managed Code Resources in config-shield
Published: 2021-04-13T15:30:09Z
Aliases: CVE-2021-26276

scripts/cli.js in the GoDaddy node-config-shield (aka Config Shield) package before 0.2.2 for Node.js calls eval when processing a set command. **NOTE:** the vendor reportedly states that this is not a vulnerability. The set command was not intended for use with untrusted data.
OS Command Injection in compile-sass
Published: 2021-04-13T15:23:13Z
Aliases: CVE-2019-10799

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function &quot;setupCleanupOnExit(cssPath)&quot; within &quot;dist/index.js&quot; is executed as part of the &quot;rm&quot; command without any sanitization.
Command Injection in macfromip
Published: 2021-04-12T19:01:20Z
Aliases: CVE-2020-7786

All versions of npm package macfromip are affected by a command injection vulnerability. The injection point is located in line 66 in macfromip.js.
Injection in bodymen
Published: 2021-04-13T15:24:21Z
Aliases: CVE-2019-10792

bodymen before 1.1.1 is vulnerable to Prototype Pollution. The handler function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
OS Command Injection in im-resize
Published: 2021-04-13T15:17:06Z
Aliases: CVE-2019-10787

im-resize through 2.3.2 allows remote attackers to execute arbitrary commands via the "exec" argument. The cmd argument used within index.js, can be controlled by user without any sanitization.
Directory Traversal in Archive_Tar
Published: 2021-04-22T16:20:36Z
Aliases: CVE-2020-36193

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

### :exclamation: Note: 
There was an [initial fix](https://github.com/pear/Archive_Tar/commit/cde460582ff389404b5b3ccb59374e9b389de916) for this vulnerability made in version `1.4.12`. That fix introduced a bug which was [fixed in 1.4.13](https://github.com/pear/Archive_Tar/pull/36). Therefore we have set the first-patched-version to `1.4.13` which the earliest working version that avoids this vulnerability.
Infinite Loop in Pygments
Published: 2021-04-20T16:35:47Z
Aliases: CVE-2021-20270

An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Multiple vulnerabilities through filename manipulation in Archive_Tar
Published: 2021-04-22T16:20:59Z
Aliases: CVE-2020-28949

Archive_Tar through 1.4.10 has `://` filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as `file://` to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33
SQL Injection via in django-debug-toolbar
Published: 2021-04-16T19:53:28Z
Aliases: CVE-2021-30459

### Impact
With Django Debug Toolbar attackers are able to execute SQL by changing the `raw_sql` input of the SQL explain, analyze or select forms and submitting the form.

**NOTE:** This is a high severity issue for anyone using the toolbar in a **production environment**.

Generally the Django Debug Toolbar team only maintains the latest version of django-debug-toolbar, but an exception was made because of the high severity of this issue.

### Patches
Please upgrade to one of the following versions, depending on the major version you're using:

- Version 1.x: [django-debug-toolbar 1.11.1](https://pypi.org/project/django-debug-toolbar/1.11.1/)
- Version 2.x: [django-debug-toolbar 2.2.1](https://pypi.org/project/django-debug-toolbar/2.2.1/)
- Version 3.x: [django-debug-toolbar 3.2.1](https://pypi.org/project/django-debug-toolbar/3.2.1/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [django-debug-toolbar repo](https://github.com/jazzband/django-debug-toolbar/issues/new)  (Please NO SENSITIVE INFORMATION, send an email instead!)
* Email us at [security@jazzband.co](mailto:security@jazzband.co)
VVE-2021-0001: Memory corruption using function calls within arrays
Published: 2021-04-19T15:12:05Z

### Impact
When performing a function call inside an array, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack.

### Patches
This issue was partially fixed in [VVE-2020-0004](https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf), however the fix did not update similar code for arrays, which had a similar issue. The issue is fully fixed in https://github.com/vyperlang/vyper/pull/2345
Sydent DoS (via resource exhaustion) due to improper input validation
Published: 2021-04-16T19:53:37Z
Aliases: CVE-2021-29433

### Impact

Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.

### Patches

Fixed by 3175fd3.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
ApiKey secret could be revelated on network issue
Published: 2021-04-06T17:29:52Z
Aliases: CVE-2021-21421

### Impact
_What kind of vulnerability is it? Who is impacted?_
Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too

### Patches
_Has the problem been patched? What versions should users upgrade to?_

creharmony/node-etsy-client#18 fixes this issue. This is fixed in [node-etsy-client v0.3.0](https://github.com/creharmony/node-etsy-client/tree/v0.3.0) and later.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not report or log etsy client error if you are using version <= v0.2.0

Update your version of node-etsy-client

### References
_Are there any links users can visit to find out more?_

- https://github.com/creharmony/node-etsy-client/issues/17 : On connect error secret appears in error #17

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/creharmony/node-etsy-client/issues](https://github.com/creharmony/node-etsy-client/issues/)
Mautic vulnerable to secret data exfiltration via symfony parameters
Published: 2021-04-06T17:20:58Z
Aliases: CVE-2021-27908

### Impact
Symfony parameters (which is what Mautic transforms configuration parameters into) can be used within other Symfony parameters by design. However, this also means that an admin who is normally not privy to certain parameters, such as database credentials, could expose them by leveraging any of the free text fields in Mautic’s configuration that are used in publicly facing parts of the application.

For example,

1. Go to Configuration page -> Landing Page Settings -> Analytics script and enter this: <`script> console.log("db password is: %mautic.db_password%"); </script>`
2. Visit any landing page and open the JS dev console. You will see the following message with real instance db password: `db password is: <real password>`

Risk rating: ModerateCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

### Patches
Upgrade to 3.3.2

### Workarounds
No

### References
No

### For more information
If you have any questions or comments about this advisory:

* Email us at [security@mautic.org](mailto:security@mautic.org)
Improper Input Validation in sopel-plugins.channelmgnt
Published: 2021-04-09T15:42:40Z
Aliases: CVE-2021-21431

### Impact
On some IRC servers, restrictions around the removal of the bot using the kick/kickban command could be bypassed when kicking multiple users at once.
We also believe it may have been possible to remove users from other channels but due to the wonder that is IRC and following RfCs, We have no POC for that.

Freenode is not affected.

### Patches
Upgrade to 2.0.1 or higher

### Workarounds
Do not use this plugin on networks where TARGMAX > 1.

### For more information
If you have any questions or comments about this advisory:
* Open an issue on [phab](https://phab.mirahezebots.org/maniphest/task/edit/form/1/).
* Email us at [staff(at)mirahezebots(dot)org](mailto:staff@mirahezebots.org)
Exposure of class information in RESTEasy
Published: 2021-04-07T21:51:33Z
Aliases: CVE-2021-20289

A flaw was found in RESTEasy in all current versions of RESTEasy up to 4.6.0.Final. The endpoint class and method names are returned as part of the exception response when RESTEasy cannot convert one of the request URI path or query values to the matching JAX-RS resource method's parameter value. The highest threat from this vulnerability is to data confidentiality.
RSA signature validation vulnerability on maleable encoded message in jsrsasign
Published: 2021-04-16T19:52:35Z
Aliases: CVE-2021-30246

### Impact
Vulnerable jsrsasign will accept RSA signature with improper PKCS#1.5 padding.
Decoded RSA signature value consists following form:
`01(ff...(8 or more ffs)...ff)00[ASN.1 OF DigestInfo]`
Its byte length must be the same as RSA key length, however such checking was not sufficient.

To make crafted message for practical attack is very hard.

### Patches
Users validating RSA signature should upgrade to 10.2.0 or later.

### Workarounds
There is no workaround. Not to use RSA signature validation in jsrsasign.

### ACKNOWLEDGEMENT
Thanks to Daniel Yahyazadeh @yahyazadeh for reporting and analyzing this vulnerability.
Command Injection in nuance-gulp-build-common
Published: 2021-04-13T15:19:23Z
Aliases: CVE-2020-28430

All versions of package nuance-gulp-build-common are vulnerable to Command Injection via the index.js file.

**PoC:** 
```js
var a = require("nuance-gulp-build-common")
a.run("touch JHU")
```
Cross-Site Request Forgery in Vert.x-Web framework
Published: 2021-04-22T16:16:18Z
Aliases: CVE-2020-35217

Vert.x-Web framework v4.0 milestone 1-4 does not perform a correct CSRF verification. Instead of comparing the CSRF token in the request with the CSRF token in the cookie, it compares the CSRF token in the cookie against a CSRF token that is stored in the session. An attacker does not even need to provide a CSRF token in the request because the framework does not consider it. The cookies are automatically sent by the browser and the verification will always succeed, leading to a successful CSRF attack.
Observable Differences in Behavior to Error Inputs in Bouncy Castle
Published: 2021-04-22T16:16:49Z
Aliases: CVE-2020-26939

In Legion of the Bouncy Castle BC before 1.55 and BC-FJA before 1.0.2, attackers can obtain sensitive information about a private exponent because of Observable Differences in Behavior to Error Inputs. This occurs in org.bouncycastle.crypto.encodings.OAEPEncoding. Sending invalid ciphertext that decrypts to a short payload in the OAEP Decoder could result in the throwing of an early exception, potentially leaking some information about the private exponent of the RSA private key performing the encryption.
HTTP Request Smuggling in Undertow
Published: 2021-04-30T17:28:52Z
Aliases: CVE-2020-10687

A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.
Exposure of Sensitive Information to an Unauthorized Actor in Ansible
Published: 2021-04-07T20:30:44Z
Aliases: CVE-2020-1739

A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.