aswin1906/github-advisory-2021.csv huggingface dataset:
Missing Release of Memory after Effective Lifetime in detect-character-encoding
Published: 2021-09-01T18:25:16Z
Aliases: CVE-2021-39176

### Impact

In detect-character-encoding v0.3.0 and earlier, allocated memory is not released.

### Patches

The problem has been patched in [detect-character-encoding v0.3.1](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.3.1).

### CVSS score

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)

Base Score: 7.5 (High)
Temporal Score: 7.2 (High)

Since detect-character-encoding is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, using detect-character-encoding in a program accessible over the internet which becomes unavailable when running out of memory. Depending on your specific implementation, the vulnerability’s severity in your program may be different.

### Proof of concept

```js
const express = require("express");
const detectCharacterEncoding = require("detect-character-encoding");

const app = express();

app.get("/", (req, res) => {
  detectCharacterEncoding(Buffer.from("foo"));

  res.end();
});

app.listen(3000);
```

`hey -n 1000000 http://localhost:3000` ([`hey`](https://github.com/rakyll/hey)) causes the Node.js process to consume more and more memory.

### References

- https://github.com/sonicdoe/detect-character-encoding/commit/d44356927b92e3b13e178071bf6d7c671766f588
- https://github.com/sonicdoe/detect-character-encoding/pull/6
semver-regex Regular Expression Denial of Service (ReDOS)
Published: 2021-09-20T20:42:25Z
Aliases: CVE-2021-3795

npm `semver-regex` is vulnerable to Inefficient Regular Expression Complexity
Remote Code Execution in Halibut
Published: 2021-09-23T23:17:07Z
Aliases: CVE-2021-31819

In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
Cross-site scripting in pywb
Published: 2021-09-02T17:16:18Z
Aliases: CVE-2021-39286

Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.
Privilege escalation in Hashicorp Nomad
Published: 2021-09-08T20:14:38Z
Aliases: CVE-2021-37218

HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
User impersonation due to incorrect handling of the login JWT
Published: 2021-09-07T23:04:04Z
Aliases: CVE-2021-39177

### Impact
<!--_What kind of vulnerability is it? Who is impacted?_-->
This allows anyone that can connect to the server to forge a LoginPacket with manipulated JWT token allowing impersonation as any Bedrock user. Unless credentials are saved in your configuration, online mode is not affected as users are still required to log in separately. If your credentials are saved, there is no risk of exposing your email or password.

### Patches
<!--_Has the problem been patched? What versions should users upgrade to?_-->
This was patched as part of https://github.com/GeyserMC/Geyser/commit/b9541505af68ac7b7c093206ac7b1ba88957a5a6 and https://github.com/GeyserMC/Geyser/commit/ab2f5b326fe590e09167e8b45b4b165ac06ecd13. if your Geyser version is `1.4.2-SNAPSHOT` or later, the issue has been addressed on your build.

### Workarounds
<!--_Is there a way for users to fix or remediate the vulnerability without upgrading?_-->
Geyser strongly recommends updating to fix this issue. If this isn't possible:
- Use online mode and don't save credentials in your Geyser configuration
- Use an additional authentication method on the Java server

### References
<!--_Are there any links users can visit to find out more?_-->
This was disclosed to us by a staff member over at Hive; you can read their disclosure here: https://updates.playhive.com/weekend-maintenance-disclosure-2kJMaY

### For more information
If you have any questions or comments about this advisory:
* Come talk to us over on our [Discord](https://discord.gg/geysermc) server in the [#development](https://discord.com/channels/613163671870242838/613170125696270357) channel
Inefficient Regular Expression Complexity in code-server
Published: 2021-09-20T20:18:39Z
Aliases: CVE-2021-3810

code-server is vulnerable to Inefficient Regular Expression Complexity
Remote code execution in Eclipse Theia
Published: 2021-09-02T22:02:36Z
Aliases: CVE-2021-34435

In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside the IDE. But with the way it is made it is possible for a previewed HTML file to trigger an RCE. This exploit only happens if a user previews a malicious file.
Prototype Pollution in immer
Published: 2021-09-07T22:57:14Z
Aliases: CVE-2021-3757

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Cross-Site Request Forgery in firefly-iii
Published: 2021-09-29T17:12:37Z
Aliases: CVE-2021-3819

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF). This has been mitigated in version 5.6.1
Sensitive Data Exposure in miniorange_saml
Published: 2021-09-01T18:36:24Z
Aliases: CVE-2021-36786

The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.
Stored XSS vulnerability on Bounce Management Callback
Published: 2021-09-01T18:40:48Z
Aliases: CVE-2021-27910

### Impact
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" parameters of the POST request of the bounce management callback will be permanently stored and executed once the details page of an affected lead is opened by a Mautic user.

An attacker with access to the bounce management callback function (identified with the Mailjet webhook, but it is assumed this will work uniformly across all kinds of webhooks) can inject arbitrary JavaScript Code into the "error" and "error_related_to" parameters of the POST request (POST /mailer/<product / webhook>/callback). It is noted that there is no authentication needed to access this function.

The JavaScript Code is stored permanently in the web application and executed every time an authenticated user views the details page of a single contact / lead in Mautic. This means, arbitrary code can be executed to, e.g., steal or tamper with information.

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:

* Email us at [security@mautic.org](mailto:security@mautic.org)
Use of Insufficiently Random Values in yiisoft/yii2-dev
Published: 2021-09-01T18:35:34Z
Aliases: CVE-2021-3689

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
Regular Expression Denial of Service in flask-restx
Published: 2021-09-08T15:41:15Z
Aliases: CVE-2021-32838

Flask RESTX contains a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service) in `email_regex`.
Drop of uninitialized memory in stack_dst
Published: 2021-09-01T18:30:55Z
Aliases: CVE-2021-28035

Affected versions of stack_dst used a push_inner function that increased the internal length of the array and then called val.clone(). If the val.clone() call panics, the stack could drop an already dropped element or drop uninitialized memory. This issue was fixed in `2a4d538` by increasing the length of the array after elements are cloned.
Prototype Pollution in Proto
Published: 2021-09-02T22:01:01Z
Aliases: CVE-2021-23426

This affects all versions of package Proto. It is possible to inject pollute the object property of an application using Proto by leveraging the merge function.
Prototype Pollution in immer
Published: 2021-09-02T17:17:37Z
Aliases: CVE-2021-23436

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition `(p === "__proto__" || p === "constructor")` in `applyPatches_` returns false if `p` is `['__proto__']` (or `['constructor']`). The `===` operator (strict equality operator) returns false if the operands have different type.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Santuario
Published: 2021-09-20T23:18:41Z
Aliases: CVE-2021-40690

All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Any storage file can be downloaded from p.sh if full server path is known
Published: 2021-09-14T20:25:13Z

The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.
Prototype Pollution in merge-change
Published: 2021-09-01T18:36:01Z
Aliases: CVE-2021-23421

All current versions of package merge-change are vulnerable to Prototype Pollution via the utils.set function.
Cross Site Scripting (XSS) in Simiki
Published: 2021-09-01T18:37:01Z
Aliases: CVE-2020-19000

Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simiki/blob/master/simiki/generators.py'.
Improperly Implemented path matching for in-toto-golang
Published: 2021-09-22T20:37:09Z
Aliases: CVE-2021-41087

### Impact
Authenticated attackers posing as functionaries (i.e., within a trusted set of users for a layout) are able to create attestations that may bypass DISALLOW rules in the same layout. An attacker with access to trusted private keys, may issue an attestation that contains a disallowed artifact by including path traversal semantics (e.g., foo vs dir/../foo).

### Patches
The problem has been fixed in version 0.3.0.

### Workarounds
Exploiting this vulnerability is dependent on the specific policy applied.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [in-toto-golang](http://github.com/in-toto/in-toto-golang)
* Email us at [in-toto-public](mailto:in-toto-public@googlegroups.com)
* If this is a sensitive security-relevant disclosure, please send a PGP encrypted email to santiagotorres@purdue.edu or jcappos@nyu.edu
Cross-site scripting
Published: 2021-09-08T18:00:00Z
Aliases: CVE-2021-32713

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
Cross-site scripting in LavaLite-CMS
Published: 2021-09-08T17:25:36Z
Aliases: CVE-2020-23700

Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.
Prototype Pollution in mootools
Published: 2021-09-02T17:09:30Z
Aliases: CVE-2021-23432

This affects all versions of package mootools. This is due to the ability to pass untrusted input to Object.merge()
Command Injection in RaspAP 2.6.6
Published: 2021-09-02T17:11:00Z
Aliases: CVE-2021-38556

includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.
SnappyFrameDecoder doesn't restrict chunk length any may buffer skippable chunks in an unnecessary way
Published: 2021-09-09T17:11:31Z
Aliases: CVE-2021-37137

### Impact
The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well.

This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk.

### Impact

All users of SnappyFrameDecoder are affected and so the application may be in risk for a DoS attach due excessive memory usage.

### References
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L79
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L171
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/SnappyFrameDecoder.java#L185
Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev
Published: 2021-09-01T18:35:26Z
Aliases: CVE-2021-3692

yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
Cross-site Scripting in GilaCMS
Published: 2021-09-30T17:13:02Z
Aliases: CVE-2020-20696

A cross-site scripting (XSS) vulnerability in /admin/content/post of GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Tags field.
objection.js Prototype Pollution vulnerability
Published: 2021-09-07T23:09:43Z
Aliases: CVE-2021-3766

objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). This issue is patched in version 2.2.16.
Directory Traversal in startserver
Published: 2021-09-02T17:09:40Z
Aliases: CVE-2021-23430

All versions of package startserver are vulnerable to Directory Traversal due to missing sanitization.
Cross-Site Request Forgery in GilaCMS
Published: 2021-09-30T17:13:11Z
Aliases: CVE-2020-20693

A Cross-Site Request Forgery (CSRF) in GilaCMS v1.11.4 allows authenticated attackers to arbitrarily add administrator accounts.
NLTK Vulnerable to REDoS
Published: 2021-09-29T17:14:53Z
Aliases: CVE-2021-3828

The nltk package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide as an input to the [`_read_comparison_block()`](https://github.com/nltk/nltk/blob/23f4b1c4b4006b0cb3ec278e801029557cec4e82/nltk/corpus/reader/comparative_sents.py#L259) function in the file `nltk/corpus/reader/comparative_sents.py` may cause an application to consume an excessive amount of CPU.
Use after free passing `externref`s to Wasm in Wasmtime
Published: 2021-09-20T19:54:05Z
Aliases: CVE-2021-39216

### Impact

There was a use-after-free bug when passing `externref`s from the host to guest Wasm content.

To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by

* passing multiple `externref`s as arguments from host code to a Wasm function,
* or returning multiple `externref`s to Wasm from a multi-value return function defined in the host.
 
If you do not have host code that matches one of these shapes, then you are not impacted.

If Wasmtime's [`VMExternRefActivationsTable`](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/crates/runtime/src/externref.rs#L493) became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed.

We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare.

### Patches

The bug has been fixed, and users should upgrade to Wasmtime 0.30.0.

Additionally, we have updated [our primary `externref` fuzz target](https://github.com/bytecodealliance/wasmtime/blob/37c094faf53f1b356aab3c79d451395e4f7edb34/fuzz/fuzz_targets/table_ops.rs) such that it better exercises these code paths and we can have greater confidence in their correctness going forward.

### Workarounds

If you cannot upgrade Wasmtime yet, you can avoid the bug by disabling reference types support in Wasmtime by passing `false` to [`wasmtime::Config::wasm_reference_types`](https://docs.rs/wasmtime/0.29.0/wasmtime/struct.Config.html#method.wasm_reference_types).

### References

* [The reference types Wasm proposal, which introduces `externref`](https://github.com/WebAssembly/reference-types/)

### For more information

If you have any questions or comments about this advisory:

* Reach out to us on [the Bytecode Alliance Zulip chat](https://bytecodealliance.zulipchat.com/#narrow/stream/217126-wasmtime)
* Open an issue in [the `bytecodealliance/wasmtime` repository](https://github.com/bytecodealliance/wasmtime/)
Elvish vulnerable to remote code execution via the web UI backend
Published: 2021-09-23T23:17:33Z
Aliases: CVE-2021-41088

### Impact

Elvish's backend for the experimental web UI (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI.

The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost.

### Patches

All Elvish releases since 0.14.0 no longer include the experimental web UI, although it is still possible for the user to build a version from source that includes it.

The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).

### Workarounds

Do not use the experimental web UI.

### For more information

If you have any questions or comments about this advisory, please email xiaqqaix@gmail.com.
Druid ingestion system Authenticated users can read data from other sources than intended 
Published: 2021-09-27T20:13:25Z
Aliases: CVE-2021-36749

In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
Basic auth bypass in esphome
Published: 2021-09-29T17:09:14Z
Aliases: CVE-2021-41104

### Impact

Anyone with web_server enabled and HTTP basic auth configured on 2021.9.1 or older

`web_server` allows OTA update without checking user defined basic auth username & password

### Patches

Patch released in 2021.9.2

### Workarounds

Disable/remove `web_server`
Prototype Pollution in the merge and clone helper methods
Published: 2021-09-20T19:53:15Z
Aliases: CVE-2021-39227

### Impact
Using `merge` and `clone` helper methods in the `src/core/util.ts` module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.

### Patches
 
It has been patched in https://github.com/ecomfe/zrender/pull/826. 
Users should update zrender to `5.2.1`.  and update echarts to `5.2.1` if project is using echarts.
Remote Code Execution in Any23
Published: 2021-09-13T20:06:38Z
Aliases: CVE-2021-40146

A Remote Code Execution (RCE) vulnerability was discovered in the Any23 YAMLExtractor.java file and is known to affect Any23 versions < 2.5. RCE vulnerabilities allow a malicious actor to execute any code of their choice on a remote machine over LAN, WAN, or internet. RCE belongs to the broader class of arbitrary code execution (ACE) vulnerabilities.
Unrestricted File Upload in ShowDoc v2.9.5
Published: 2021-09-09T17:08:46Z
Aliases: CVE-2021-36440

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.
Exposure of sensitive information in Elasticsearch
Published: 2021-09-20T20:29:40Z
Aliases: CVE-2021-22147

A flaw was discovered in Elasticsearch where document and field level security was not applied to searchable snapshots. This could lead to an authenticated user gaining access to information that they are unauthorized to view.
matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
Published: 2021-09-14T20:24:18Z
Aliases: CVE-2021-40823

### Impact

A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.

† Or anyone with access to the account of the original recipient of an encrypted message.

Known clients affected (via their use of vulnerable versions of matrix-js-sdk):

- Element Web (1.8.2 and earlier)
- Element Desktop (1.8.2 and earlier)
- SchildiChat Web (1.7.32-sc1 and earlier)
- SchildiChat Desktop (1.7.32-sc1 and earlier)
- Cinny (1.2.0 and earlier)

### Patch

This was fixed in https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9.

### Workarounds
To prevent a homeserver from being able to steal the room keys, vulnerable clients can be taken offline or signed out. If signing out, care should be taken to either set up Secure Backup or export E2E room keys in order to preserve access to past messages.
Remote Code Execution in Apache Dubbo
Published: 2021-09-10T17:54:37Z
Aliases: CVE-2021-36161

Some component in Dubbo will try to print the formated string of the input arguments, which will possibly cause RCE for a maliciously customized bean with special toString method. In the latest version, we fix the toString call in timeout, cache and some other places. Fixed in Apache Dubbo 2.7.13
Cross-site Scripting in peertube
Published: 2021-09-20T20:42:41Z
Aliases: CVE-2021-3780

peertube is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). It was found that one could upload a SVG image and then send the url of that to other users and when they open the link we can get their complete session keys as the session keys stored in local storage and with Javascript easily can be stolen by attackers.