aswin1906/github-advisory-2021.csv huggingface dataset:
Prototype Pollution in merge-deep2.
Published: 2021-12-16T14:33:09Z
Aliases: CVE-2021-23700

All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
Session fixation in express-openid-connect
Published: 2021-12-09T19:08:58Z
Aliases: CVE-2021-41246

### Overview

Versions `2.3.0` up to and including `2.5.1` do not regenerate the session id and session cookie when user logs in.  This behavior opens up the application to various session fixation vulnerabilities.

### Am I affected?
You are affected by this vulnerability if you are using `express-openid-connect` version `2.3.0` up to and including `2.5.1` and use a custom session store.


### How to fix that?
Upgrade to version `>= 2.5.2`.

### Will this update impact my users?
The fix provided in patch will not affect your users.
Exposure of Resource to Wrong Sphere in org.craftercms:crafter-search
Published: 2021-12-16T15:27:35Z
Aliases: CVE-2021-23264

Installations, where crafter-search is not protected, allow unauthenticated remote attackers to create, view, and delete search indexes.
Uncontrolled Resource Consumption in fun-map
Published: 2021-12-10T20:05:07Z
Aliases: CVE-2020-7644

fun-map through 3.3.1 is vulnerable to Prototype Pollution. The function assocInM could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Denial of Service in TenderMint
Published: 2021-12-20T18:17:33Z
Aliases: CVE-2020-15091

### Description

**Denial of Service**

Tendermint 0.33.0 and above allow block proposers to include signatures for the wrong block. This may happen naturally if you start a network, have it run for some time and restart it without changing the chainID. (It is a [misconfiguration](https://docs.tendermint.com/master/tendermint-core/using-tendermint.html) to reuse chainIDs.) Correct block proposers will accidentally include signatures for the wrong block if they see these signatures, and then commits won't validate, making all proposed blocks invalid. A malicious validator (even with a minimal amount of stake) can use this vulnerability to completely halt the network.

Tendermint 0.33.6 checks all the signatures are for the block with +2/3 majority before creating a commit.

**False Witness**

Tendermint 0.33.1 and above are no longer fully verifying commit signatures during block execution - they stop after +2/3. This means proposers can propose blocks that contain valid +2/3 signatures and then the rest of the signatures can be whatever they want. They can claim that all the other validators signed just by including a CommitSig with arbitrary signature data. While this doesn't seem to impact safety of Tendermint per se, it means that Commits may contain a lot of invalid data **.

_** This was already true of blocks, since they could include invalid txs filled with garbage, but in that case the application knew that they are invalid and could punish the proposer. But since applications didn't--and don't-- verify commit signatures directly (they trust Tendermint to do that), they won't be able to detect it._

This can impact incentivization logic in the application that depends on the LastCommitInfo sent in BeginBlock, which includes which validators signed. For instance, Gaia incentivizes proposers with a bonus for including more than +2/3 of the signatures. But a proposer can now claim that bonus just by including arbitrary data for the final -1/3 of validators without actually waiting for their signatures. There may be other tricks that can be played because of this.

Tendermint 0.33.6 verifies all the signatures during block execution ***.

_*** Please note that the light client does not check nil votes and exits as soon as 2/3+ of the signatures are checked._

### Impact

- All nodes
- The network stops due to having a commit with a wrong signature.

### Patches

- v0.33.6

### Workarounds

No workarounds.

### References

- https://github.com/tendermint/tendermint/issues/4926

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [tendermint/tendermint](https://github.com/tendermint/tendermint)
* Email us at [security@tendermint.com](mailto:security@tendermint.com)

More information can be found [here](https://tendermint.com/security/).
Unsafe Deserialization that can Result in Code Execution
Published: 2021-12-10T17:15:49Z
Aliases: CVE-2020-36282

JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted StreamMessage data.
Open Redirect in oauth2_proxy
Published: 2021-12-20T18:04:40Z
Aliases: CVE-2017-1000070

The Bitly oauth2_proxy in version 2.1 and earlier was affected by an open redirect vulnerability during the start and termination of the 2-legged OAuth flow. This issue was caused by improper input validation and a violation of RFC-6819
Unsafe Deserialization in jackson-databind
Published: 2021-12-09T19:16:59Z
Aliases: CVE-2020-36189

FasterXML jackson-databind 2.x before 2.9.10.8 an 2.6.7.5 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource.
OS Command Injection in adb-driver
Published: 2021-12-09T19:54:29Z
Aliases: CVE-2020-7636

adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.
Incomplete fix for Apache Log4j vulnerability
Published: 2021-12-14T18:01:28Z
Aliases: CVE-2021-45046

# Impact

The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. 

## Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.

# Mitigation

Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class).

Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.
Cross-site Scripting in Apereo CAS
Published: 2021-12-10T20:24:11Z
Aliases: CVE-2021-42567

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.
Information exposure in elgg
Published: 2021-12-16T15:30:48Z
Aliases: CVE-2021-3980

elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor. Forms in the view namespace 'forms/admin' were not protected by an AdminGatekeeper in case of AJAX requests to 'ajax/form/admin/'.
phpservermon is vulnerable to CRLF Injection
Published: 2021-12-16T14:26:00Z
Aliases: CVE-2021-4097

phpservermon is vulnerable to Improper Neutralization of CRLF Sequences.
Uncaught Exception in mercurius
Published: 2021-12-13T21:33:04Z
Aliases: CVE-2021-43801

### Impact

Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler.

### Patches

The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2.

### Workarounds

Use a custom error handler.

### References

See https://github.com/mercurius-js/mercurius/issues/677

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/mercurius-js/mercurius
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Cross-site Scripting in LibreNMS
Published: 2021-12-03T20:48:42Z
Aliases: CVE-2021-44277

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.
Unsafe Deserialization in jackson-databind
Published: 2021-12-09T19:16:26Z
Aliases: CVE-2020-36184

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
Apache JSPWiki Cross-site Scripting due to carefully crafted plugin link invocation
Published: 2021-12-02T17:49:14Z
Aliases: CVE-2021-40369

A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Denounce plugin, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.
Denial of Service in OpenShift Origin
Published: 2021-12-20T16:58:22Z
Aliases: CVE-2015-5250

The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data
Command Injection in compass-compile
Published: 2021-12-09T19:27:46Z
Aliases: CVE-2020-7635

compass-compile through 0.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Cross-Site Scripting Vulnerability in @joeattardi/emoji-button
Published: 2021-12-01T18:29:02Z
Aliases: CVE-2021-43785

### Impact

There are two vectors for XSS attacks with versions of @joeattardi/emoji-button before 4.6.2:

- A URL for a custom emoji
- An i18n string

In both of these cases, a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.

### Patches

This vulnerability is fixed starting in version 4.6.2. This is resolved by properly escaping strings that are inserted into the HTML document.

### Workarounds

There is no workaround other than upgrading to a non-vulnerable version.

### Credit

This issue was discovered by GitHub team member [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh) and was reported by the GitHub Security Lab team.
Potential bypass of an upstream access control based on URL paths in Django
Published: 2021-12-09T19:09:37Z
Aliases: CVE-2021-44420

In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths. This issue has low severity, according to the Django security policy.
Files Accessible to External Parties in Opencast
Published: 2021-12-14T21:44:03Z
Aliases: CVE-2021-43821

Opencast before version 10.6 allows references to local file URLs in ingested media packages, allowing attackers to include local files from Opencast's host machines and making them available via the web interface.

### Impact

Before Opencast 10.6, Opencast would [open and include local files during ingests](https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587). Attackers could exploit this to include most local files the process has read access to, extracting secrets from the host machine.

For example, to expose the `custom.properties` of develop.opencast.org via the asset manager, an attacker could have run:

```
curl -f -i -u admin:opencast \
  https://develop.opencast.org/ingest/addMediaPackage/fast \
  -F 'flavor=presenter/source'\
  -F mediaUri=file:///srv/opencast/opencast-dist-allinone/etc/custom.properties\
  -F title="custom.properties"  
```

An attacker would need to have the privileges required to add new media to exploit this. But these are often widely given.


### Patches

The issue has been fixed in Opencast 10.6 and 11.0.

### Workarounds

You can mitigate this issue by narrowing down the read access Opencast has to files on the file system using UNIX permissions or mandatory access control systems like SELinux. This cannot prevent access to files Opencast needs to read though and we highly recommend updating.

### References

-  [Example of problematic code](https://github.com/opencast/opencast/blob/69952463971cf578363e3b97d8edaf334ff51253/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java#L1587).
- [Patch fixing the issue](https://github.com/opencast/opencast/commit/65c46b9d3e8f045c544881059923134571897764)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)
BookStack is vulnerable to Improper Access Control.
Published: 2021-12-16T19:40:26Z
Aliases: CVE-2021-4119

BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user (if public access enabled) can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user because BookStack also uses the code where(`email`, `like`, `%` . $search . `%`) to search for users based on email.
Improper Input Validation in is-email
Published: 2021-12-10T17:25:21Z
Aliases: CVE-2021-36716

is-email helps validate an email address. A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.
SQL Injection in rosariosis
Published: 2021-12-02T17:48:53Z
Aliases: CVE-2021-44427

An unauthenticated SQL Injection vulnerability in Rosario Student Information System (aka rosariosis) before 8.1.1 allows remote attackers to execute PostgreSQL statements (e.g., SELECT, INSERT, UPDATE, and DELETE) through /Side.php via the syear parameter.
OS Command Injection Vulnerability and Potential Zip Slip Vulnerability in baserCMS
Published: 2021-12-01T18:29:42Z
Aliases: CVE-2021-41243

There is an OS Command Injection Vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

Target
baserCMS 4.5.3 and earlier versions

Vulnerability
OS Command Injection Vulnerability.

Countermeasures
Update to the latest version of baserCMS

Credits
Akagi Yusuke @NTT-ME
Cross-site Scripting in CKAN
Published: 2021-12-03T20:44:48Z
Aliases: CVE-2021-25967

In CKAN, versions 2.9.0 to 2.9.3 are affected by a stored XSS vulnerability via SVG file upload of users’ profile picture. This allows low privileged application users to store malicious scripts in their profile picture. These scripts are executed in a victim’s browser when they open the malicious profile picture
Command injection in git-it-electron
Published: 2021-12-08T00:01:44Z
Aliases: CVE-2021-44685

Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).
ReDOS in IS-SVG
Published: 2021-12-10T19:02:37Z
Aliases: CVE-2021-29059

A vulnerability was discovered in IS-SVG version 4.3.1 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.
Server-Side Request Forgery in snipe/snipe-it
Published: 2021-12-10T20:22:15Z
Aliases: CVE-2021-4075

Admin users on the external network can perform blind POST-based SSRF (issue requests on behalf of the server into the internal network) via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network which can be escalated to higher-impact.
Cross-site Scripting in pimcore
Published: 2021-12-16T14:28:27Z
Aliases: CVE-2021-4084

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
yetiforcecrm is vulnerable to Cross-site Scripting
Published: 2021-12-16T14:12:23Z
Aliases: CVE-2021-4107

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
Published: 2021-12-17T20:41:33Z
Aliases: CVE-2020-35209

An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to join a target cluster via providing configuration information.
Cross-site Request Forgery (CSRF)
Published: 2021-12-20T18:04:46Z
Aliases: CVE-2017-1000069

CSRF in Bitly oauth2_proxy 2.1 during authentication flow
Improper Input Validation in xdLocalStorage
Published: 2021-12-09T19:29:36Z
Aliases: CVE-2015-9544

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStoragePostMessageApi.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
Cross-site Scripting in django-wiki
Published: 2021-12-02T17:49:40Z
Aliases: CVE-2021-25986

In Django-wiki, versions 0.0.20 to 0.7.8 are vulnerable to Stored Cross-Site Scripting (XSS) in Notifications Section. An attacker who has access to edit pages can inject JavaScript payload in the title field. When a victim gets a notification regarding the changes made in the application, the payload in the notification panel renders and loads external JavaScript.
Path traversal in librenms/librenms
Published: 2021-12-10T20:18:30Z
Aliases: CVE-2021-44278

Librenms 21.11.0 is affected by a path manipulation vulnerability in includes/html/pages/device/showconfig.inc.php.
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Published: 2021-12-03T20:38:37Z
Aliases: CVE-2021-3944

bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Header injection in nodemailer
Published: 2021-12-10T18:56:57Z
Aliases: CVE-2021-23400

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
RCE vulnerability affecting v1beta3 templates in @backstage/plugin-scaffolder-backend
Published: 2021-12-01T18:29:12Z

The templating library used by the scaffolder backend assumes that templates are trusted which is an undesired property of the scaffolder-backend. This has now been mitigated by sandboxing the template code execution.

### Impact
A malicious actor with write access to a registered scaffolder template could manipulate the template in a way that allows for remote code execution on the scaffolder-backend instance. This was only exploitable in the template yaml definition itself and not by user input data.

### Patches
This is vulnerability is patched in version `0.15.14` of `@backstage/plugin-scaffolder-backend`.


### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Open Redirect in OAuth2 Proxy
Published: 2021-12-20T17:58:59Z
Aliases: CVE-2020-4037

### Impact
As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access.
This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites.
yetiforcecrm is vulnerable to Cross-site Scripting
Published: 2021-12-16T21:00:45Z
Aliases: CVE-2021-4116

yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node.
Published: 2021-12-17T20:40:38Z
Aliases: CVE-2020-35211

An issue in Atomix v3.1.5 allows unauthorized Atomix nodes to become the lead node in a target cluster via manipulation of the variable terms in RaftContext.
Invalid handling of `X509_verify_cert()` internal errors in libssl
Published: 2021-12-15T00:00:42Z
Aliases: CVE-2021-4044

Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. That function may return a negative return value to indicate an internal error (for example out of memory). Such a negative return value is mishandled by OpenSSL and will cause an IO function (such as SSL_connect() or SSL_do_handshake()) to not indicate success and a subsequent call to SSL_get_error() to return the value SSL_ERROR_WANT_RETRY_VERIFY. This return value is only supposed to be returned by OpenSSL if the application has previously called SSL_CTX_set_cert_verify_callback(). Since most applications do not do this the SSL_ERROR_WANT_RETRY_VERIFY return value from SSL_get_error() will be totally unexpected and applications may not behave correctly as a result. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses. This issue is made more serious in combination with a separate bug in OpenSSL 3.0 that will cause X509_verify_cert() to indicate an internal error when processing a certificate chain. This will occur where a certificate does not include the Subject Alternative Name extension but where a Certificate Authority has enforced name constraints. This issue can occur even with valid chains. By combining the two issues an attacker could induce incorrect, application dependent behaviour. Fixed in OpenSSL 3.0.1 (Affected 3.0.0).
Improper Removal of Sensitive Information Before Storage or Transfer in Apache Jackrabbit Oak
Published: 2021-12-10T17:20:11Z
Aliases: CVE-2020-1940

The optional initial password change and password expiration features present in Apache Jackrabbit Oak 1.2.0 to 1.22.0 are prone to a sensitive information disclosure vulnerability. The code mandates the changed password to be passed as an additional attribute to the credentials object but does not remove it upon processing during the first phase of the authentication. In combination with additional, independent authentication mechanisms, this may lead to the new password being disclosed.
Privilege Elevation in runc
Published: 2021-12-20T18:21:34Z
Aliases: CVE-2016-3697

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.
Cross-site scripting in lazysizes
Published: 2021-12-10T20:06:23Z
Aliases: CVE-2020-7642

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: `data-vimeo`, `data-vimeoparams`, `data-youtube` and `data-ytparams` which can be abused to inject malicious JavaScript.