aswin1906/github-advisory-2021.csv huggingface dataset:
Command injection in launchpad
Published: 2021-04-13T15:20:20Z
Aliases: CVE-2021-23330

All versions of package launchpad are vulnerable to Command Injection via stop.
"Deserialization errors in MyBatis"
Published: 2021-04-22T16:14:38Z
Aliases: CVE-2020-26945

MyBatis before 3.5.6 mishandles deserialization of object streams leading to potential cache poisoning.
Authenticated path traversal in Umbraco CMS
Published: 2021-04-13T15:51:33Z
Aliases: CVE-2020-5811

An authenticated path traversal vulnerability exists during package installation in Umbraco CMS <= 8.9.1 or current, which could result in arbitrary files being written outside of the site home and expected paths when installing an Umbraco package.
CSRF Vuln can expose user's QRcode
Published: 2021-04-08T16:46:00Z

### Impact
When a user is setting up two-factor authentication using an authenticator app, a QRcode is generated and made available via a GET request to /tf-qrcode. Since GETs do not have any CSRF protection, it is possible a malicious 3rd party could access the QRcode and therefore gain access to two-factor authentication codes. Note that the /tf-qrcode endpoint is ONLY accessible while the user is initially setting up their device. Once setup is complete, there is no vulnerability.

### Patches
This is fixed in the upcoming 4.0.0 release.

### Workarounds
You can provide your own URL for fetching the QRcode by defining SECURITY_TWO_FACTOR_QRCODE_URL and providing your own implementation (that presumably required a POST with CSRF protection). This would require changing the two-factor setup template as well.

### References
None.

### For more information
If you have any questions or comments about this advisory:
* Read this pull request: #423
Exposure of Resource to Wrong Sphere in valib
Published: 2021-04-13T15:21:59Z
Aliases: CVE-2019-10805

valib through 2.0.0 allows Internal Property Tampering. A maliciously crafted JavaScript object can bypass several inspection functions provided by valib. Valib uses a built-in function (hasOwnProperty) from the unsafe user-input to examine an object. It is possible for a crafted payload to overwrite this function to manipulate the inspection results to bypass security checks.
Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible
Published: 2021-04-20T16:44:49Z
Aliases: CVE-2019-14905

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
OS Command Injection in serial-number
Published: 2021-04-13T15:22:19Z
Aliases: CVE-2019-10804

serial-number through 1.3.0 allows execution of arbritary commands. The &quot;cmdPrefix&quot; argument in serialNumber function is used by the &quot;exec&quot; function without any validation.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in @nextcloud/dialogs
Published: 2021-04-16T19:52:58Z
Aliases: CVE-2021-29438

### Impact

The Nextcloud dialogs library before 3.1.2 did insufficiently escape text input passed to a toast. If your application displays toasts with user-supplied input, this could lead to a XSS vulnerability.

_Note_: Nextcloud Server employs a strict Content Security Policy that mitigates the risk of these XSS vulnerabilities.

### Patches

The vulnerability has been patched in version 3.1.2. If you need to display HTML in the toast, explicitly pass the `options.isHTML` config flag.

### Workarounds

Make sure no user-supplied input flows into toasts.
Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
Published: 2021-04-07T21:47:31Z
Aliases: CVE-2020-1740

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Forced Browsing in Twisted
Published: 2021-04-30T17:32:28Z
Aliases: CVE-2016-1000111

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the `HTTP_PROXY` environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an `httpoxy` issue.
Improper Certificate Validation in blackduck
Published: 2021-04-20T16:29:41Z
Aliases: CVE-2020-27589

Synopsys hub-rest-api-python (aka blackduck on PyPI) version 0.0.25 - 0.0.52 does not validate SSL certificates in certain cases.
DOM XSS in Theme Preview
Published: 2021-04-29T21:53:18Z
Aliases: CVE-2021-29484

### Impact
An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. 

Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. 

Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site - see patches & workarounds below.

### Patches
Fixed in 4.3.3, all 4.x sites should upgrade as soon as possible.
As the endpoint is unused, the patch simply removes it. 

### Workarounds
- Log out of Ghost Admin
- Suspend any users who cannot log out
- Block access to `/ghost/preview`

Example of how to block access in nginx:

```
location ~ /ghost/preview {
    rewrite ^(\/(.*\/)?ghost\/)(.*)$ $1 redirect;
}
```

This redirects the endpoint to `/ghost/`, which mimics the behaviour after the patch is applied.

### References

- [Forum Post](https://forum.ghost.org/t/critical-security-update-available-for-ghost-4-x/22290)

### For more information
If you have any questions or comments about this advisory:
* email us at security@ghost.org


---
Credits: Paul Gerste, SonarSource (https://www.sonarsource.com/)
Cross-site Scripting (XSS) in moodle
Published: 2021-03-29T20:43:08Z
Aliases: CVE-2020-25702

In Moodle, it was possible to include JavaScript when re-naming content bank items. Versions affected: 3.9 to 3.9.2. This is fixed in moodle 3.9.3 and 3.10.
OMERO webclient does not validate URL redirects on login or switching group.
Published: 2021-03-23T15:26:49Z
Aliases: CVE-2021-21377

### Background
OMERO.web supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the ``omero.web.redirect_allowed_hosts`` setting.

### Impact
OMERO.web before 5.9.0

### Patches
5.9.0

### Workarounds
No workaround

### References

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [omero-web](https://github.com/ome/omero-web)
* Email us at [security](mailto:security@openmicroscopy.org.uk)
Open Redirection in Login Handling
Published: 2021-03-23T01:53:35Z
Aliases: CVE-2021-21338


### Problem
It has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing attacks. No authentication is required in order to exploit this vulnerability.

### Solution
Update to TYPO3 versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Alexander Kellner who reported this issue and to TYPO3 security team member Torben Hansen who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-001](https://typo3.org/security/advisory/typo3-core-sa-2021-001)
DOS vulnerability for Quoted Quality CSV headers
Published: 2021-03-10T03:46:47Z
Aliases: CVE-2020-27223

### Impact
When Jetty handles a request containing request headers with a large number of “quality” (i.e. q) parameters (such as what are seen on the `Accept`, `Accept-Encoding`, and `Accept-Language` request headers), the server may enter a denial of service (DoS) state due to high CPU usage while sorting the list of values based on their quality values.  A single request can easily consume minutes of CPU time before it is even dispatched to the application.

The only features within Jetty that can trigger this behavior are:

- Default Error Handling - the `Accept` request header with the `QuotedQualityCSV` is used to determine what kind of content to send back to the client (html, text, json, xml, etc)
- `StatisticsServlet` - uses the `Accept` request header with the `QuotedQualityCSV` to determine what kind of content to send back to the client (xml, json, text, html, etc)
- `HttpServletRequest.getLocale()` - uses the `Accept-Language` request header with the `QuotedQualityCSV` to determine which “preferred” language is returned on this call.
- `HttpservletRequest.getLocales()` - is similar to the above, but returns an ordered list of locales based on the quality values on the `Accept-Language` request header.
- `DefaultServlet` - uses the `Accept-Encoding` request header with the `QuotedQualityCSV` to determine which kind of pre-compressed content should be sent back for static content (content that is not matched against a url-pattern in your web app)

### Versions
`QuotedQualityCSV` was introduced to Jetty 9.3.9.v20160517 and the bug that introduced the vulnerability was in 9.4.6.v20170531. 

Currently, known vulnerable versions include:

- 9.4.6.v20170531 thru to 9.4.36.v20210114
- 10.0.0
- 11.0.0

### Workarounds

Quality ordered values are used infrequently by jetty so they can be avoided by:

 * Do not use the default error page/handler.
 * Do not deploy the `StatisticsServlet` exposed to the network
 * Do not call `getLocale` API
 * Do not enable precompressed static content in the `DefaultServlet` 

### Patches

All patches are available for download from the Eclipse Jetty website at [https://www.eclipse.org/jetty/download.php](https://www.eclipse.org/jetty/download.php)
- 9.4.37.v20210219 and greater
- 10.0.1 and greater 
- 11.0.1 and greater
Out-of-bounds write
Published: 2021-03-29T21:00:06Z
Aliases: CVE-2019-0917

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Unrestricted File Upload in Form Framework
Published: 2021-03-23T01:53:52Z
Aliases: CVE-2021-21355


### Problem
Due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_.

TYPO3 Extbase extensions, which implement a file upload and do not implement a custom _TypeConverter_ to transform uploaded files into _FileReference_ domain model objects are affected by the vulnerability as well, since the _UploadedFileReferenceConverter_ of _ext:form_ handles the file upload and will accept files of any mime-type which are persisted to the default location.

In any way, uploaded files are placed in the default location _/fileadmin/user_upload/_, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information.

No authentication is required to exploit this vulnerability.

### Solution
Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

Type converter _UploadedFileReferenceConverter_ is not registered globally anymore and just handles uploaded files within the scope of the Form Framework. Guessable storage location has changed from _/fileadmin/user_upload/form\_\<random-hash\>/_ to _/fileadmin/form_uploads/<random-40-bit>_. Allowed mime-types must match expected file extensions (e.g. _application/pdf_ must be _.pdf_, and cannot be _.html_).

Extbase extensions, who rely on the global availability of the _UploadedFileReferenceConverter_ must now implement a custom _TypeConverter_ to handle file uploads or explicitly implement the ext:form _UploadedFileReferenceConverter_ with appropriate setting for accepted mime-types.

### Credits
Thanks to Sebastian Michaelsen, Marc Lindemann, Oliver Eglseder, Markus Volkmer, Jakob Kunzmann, Johannes Regner, Richie Lee who reported this issue, and to TYPO3 core & security team members Oliver Hader & Benni Mack, as well as TYPO3 contributor Ralf Zimmermann who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-002](https://typo3.org/security/advisory/typo3-core-sa-2021-002)
Out-of-bounds write
Published: 2021-03-29T20:56:08Z
Aliases: CVE-2019-1217

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1237, CVE-2019-1298, CVE-2019-1300.
Activerecord-session_store Vulnerable to Timing Attack
Published: 2021-03-09T00:45:31Z
Aliases: CVE-2019-25025

The `activerecord-session_store` (aka Active Record Session Store) component through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time. This is a related issue to CVE-2019-16782. 

## Recommendation

This has been fixed in version 2.0.0.  All users are advised to update to this version or later.
Out-of-bounds write
Published: 2021-03-29T20:56:01Z
Aliases: CVE-2019-1298

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1138, CVE-2019-1217, CVE-2019-1237, CVE-2019-1300.
Rating Script Service expose XWiki to SQL injection
Published: 2021-03-23T22:48:01Z
Aliases: CVE-2021-21380

### Impact
This issue impacts only XWiki with the Ratings API installed.
The Rating Script Service expose an API to perform SQL requests without escaping the from and where search arguments. 
This might lead to an SQL script injection quite easily for any user having Script rights on XWiki.

### Patches
The problem has been patched in XWiki 12.9RC1.

### Workarounds
The only workaround besides upgrading XWiki would be to uninstall the Ratings API in XWiki from the Extension Manager.

### References
https://jira.xwiki.org/browse/XWIKI-17662

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](http://jira.xwiki.org)
* Email us at our [security mailing list](mailto:security@xwiki.org)
Null characters not escaped
Published: 2021-03-18T23:47:56Z
Aliases: CVE-2021-21384

### Impact

Anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a [null character](https://en.wikipedia.org/wiki/Null_character) into the payload. For example (on Windows):

```javascript
const cp = require("child_process");
const shescape = require("shescape");

const nullChar = String.fromCharCode(0);
const payload = "foo\" && ls -al ${nullChar} && echo \"bar";
console.log(cp.execSync(`echo ${shescape.quote(payload)}`));
// foototal 3
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 18:44 .
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 00:09 ..
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 18:42 folder                                                                 
// -rw-r--r-- 1 owner XXXXXX      0 Mar 13 18:42 file
```

### Patches

The problem has been patched in [v1.1.3](https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3) which you can upgrade to now. No further changes are required.

### Workarounds

Alternatively, null characters can be stripped out manually using e.g. `arg.replace(/\u{0}/gu, "")`
Possible request smuggling in HTTP/2 due missing validation of content-length
Published: 2021-03-30T15:10:38Z
Aliases: CVE-2021-21409

### Impact
The content-length header is not correctly validated if the request only use a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1

This is a followup of https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj which did miss to fix this one case. 

### Patches
This was fixed as part of 4.1.61.Final

### Workarounds
Validation can be done by the user before proxy the request by validating the header.
HTML injection in email and account expiry notifications
Published: 2021-03-26T19:53:04Z
Aliases: CVE-2021-21333

### Impact
The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow an attacker to insert forged content into the email.

The account expiry feature is not enabled by default and the HTML injection is not controllable by an attacker.

### Patches
This issue is fixed in #9200.

### Workarounds
For the missed messages notifications:

The `notif.html`, `notif_mail.html`, and `room.html` templates can be overridden with custom templates that manually escapes the variables using [JInja2's `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setting.

For the account expiry notifications:

1. Account expiry can be disabled via the `account_validity.enabled` setting.

2. The `notice_expiry.html` template can be overridden with a custom template that manually escapes the variables using [JInja2's `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setting.
Exposure of Sensitive Information to an Unauthorized Actor
Published: 2021-03-18T19:23:57Z
Aliases: CVE-2021-22134

A document disclosure flaw was found in Elasticsearch versions after 7.6.0 and before 7.11.0 when Document or Field Level Security is used. Get requests do not properly apply security permissions when executing a query against a recently updated document. This affects documents that have been updated and not yet refreshed in the index. This could result in the search disclosing the existence of documents and fields the attacker should not be able to view.
Out-of-bounds write
Published: 2021-03-29T20:57:56Z
Aliases: CVE-2019-1141

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1140, CVE-2019-1195, CVE-2019-1196, CVE-2019-1197.
Regular Expression Denial of Service (ReDoS)
Published: 2021-03-19T21:24:36Z
Aliases: CVE-2021-27290

npm `ssri` 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Command injection in node-ps
Published: 2021-03-19T21:21:06Z
Aliases: CVE-2020-7785

This affects all versions of package node-ps. The injection point is located in line 72 in lib/index.js.
XStream can cause a Denial of Service.
Published: 2021-03-22T23:27:51Z
Aliases: CVE-2021-21341

### Impact
The vulnerability may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of service only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21341](https://x-stream.github.io/CVE-2021-21341.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Out-of-bounds Write in Pillow
Published: 2021-03-29T16:35:36Z
Aliases: CVE-2021-25290

An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.
Possible request smuggling in HTTP/2 due missing validation
Published: 2021-03-09T18:49:49Z
Aliases: CVE-2021-21295

### Impact
If a Content-Length header is present in the original HTTP/2 request, the field is not validated by `Http2MultiplexHandler` as it is propagated up.  This is fine as long as the request is not proxied through as HTTP/1.1.
If the request comes in as an HTTP/2 stream, gets converted into the HTTP/1.1 domain objects (`HttpRequest`, `HttpContent`, etc.) via `Http2StreamFrameToHttpObjectCodec `and then sent up to the child channel's pipeline and proxied through a remote peer as HTTP/1.1 this may result in request smuggling.  

In a proxy case, users  may assume the content-length is validated somehow, which is not the case.  If the request is forwarded to a backend channel that is a HTTP/1.1 connection, the Content-Length now has meaning and needs to be checked.

An attacker can smuggle requests inside the body as it gets downgraded from HTTP/2 to HTTP/1.1.   A sample attack request looks like:

```
POST / HTTP/2
:authority:: externaldomain.com
Content-Length: 4

asdfGET /evilRedirect HTTP/1.1
Host: internaldomain.com
```

Users are only affected if all of this is `true`:
 * `HTTP2MultiplexCodec` or `Http2FrameCodec` is used
 * `Http2StreamFrameToHttpObjectCodec` is used to convert to HTTP/1.1 objects
 * These  HTTP/1.1 objects are forwarded to another remote peer.
 

### Patches
This has been patched in 4.1.60.Final

### Workarounds
The user can do the validation by themselves by implementing a custom `ChannelInboundHandler` that is put in the `ChannelPipeline` behind `Http2StreamFrameToHttpObjectCodec`.

### References
Related change to workaround the problem: https://github.com/Netflix/zuul/pull/980
Out-of-bounds write
Published: 2021-03-29T21:00:03Z
Aliases: CVE-2019-0915

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0916, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.