aswin1906/github-advisory-2021.csv huggingface dataset:
Potential Host Header Poisoning on misconfigured servers
Published: 2021-03-10T21:07:25Z
Aliases: CVE-2021-21265

### Impact
When running on servers that are configured to accept a wildcard as a hostname (i.e. the server routes any request, regardless of the HOST header to an October CMS instance) the potential exists for Host Header Poisoning attacks to succeed. See the following resources for more information on Host Header Poisoning:
- https://portswigger.net/web-security/host-header
- https://dzone.com/articles/what-is-a-host-header-attack

### Patches

A feature has been added in v1.1.2 to allow a set of trusted hosts to be specified in the application.

### Workarounds

- Apply https://github.com/octobercms/library/commit/f86fcbcd066d6f8b939e8fe897409d152b11c3c6 & https://github.com/octobercms/october/commit/f638d3f78cfe91d7f6658820f9d5e424306a3db0 to your installation manually if unable to upgrade to v1.1.2.

- Check that the configuration setting `cms.linkPolicy` is set to `force`.

### Alternative Workaround

Check to make sure that your web server does not accept any hostname when serving your web application.

1. Add an entry called `testing.tld` to your computer's host file and direct it to your server's IP address
2. Open the address `testing.tld` in your web browser
3. Make sure an October CMS website is not available at this address

If an October CMS website is returned, configure your webserver to only allow known hostnames. If you require assistance with this, please contact your server administrator.

### References

Reported by [Abdullah Hussam](https://github.com/ahussam)

### For More Information

If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
<img width="1108" alt="Screen Shot 2021-01-15 at 4 12 57 PM" src="https://user-images.githubusercontent.com/7253840/104783859-92fb3600-574c-11eb-9e21-c0dc05d230a9.png">
Command injection in fs-path
Published: 2021-03-25T21:06:41Z
Aliases: CVE-2020-8298

fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy`, `copySync`, `remove`, and `removeSync` methods.
Out-of-bounds write
Published: 2021-03-29T20:59:09Z
Aliases: CVE-2019-1062

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1092, CVE-2019-1103, CVE-2019-1106, CVE-2019-1107.
Improper Authentication
Published: 2021-03-08T15:49:53Z
Aliases: CVE-2021-1725

### Impact
A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot.

### Patches
The problem has been patched in all affected versions. Please see the list of patched versions for the most appropriate one for your individual case.

### Workarounds
Users who do not wish or are not able to upgrade can add an authentication configuration containing ClaimsValidator, which throws an exception if the Claims are Skill Claims.

For detailed instructions, see the link in the References section.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Microsoft Bot Builder SDK](https://github.com/microsoft/botbuilder-dotnet)
* Email us at [bf-reports@microsoft.com](mailto:bf-reports@microsoft.com)
Out-of-bounds write
Published: 2021-03-29T21:00:11Z
Aliases: CVE-2019-0922

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0916, CVE-2019-0917, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
Uncontrolled Resource Consumption in Apache Thrift
Published: 2021-03-12T21:33:55Z
Aliases: CVE-2020-13949

In Apache Thrift 0.9.3 to 0.13.0, malicious RPC clients could send short messages which would result in a large memory allocation, potentially leading to denial of service.
Cross site-scripting (XSS) moodle
Published: 2021-03-29T20:43:15Z
Aliases: CVE-2020-25628

The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1, 3.8 to 3.8.4, 3.7 to 3.7.7, 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2, 3.8.5, 3.7.8 and 3.5.14.
Vulnerability allowing for reading internal HTTP resources
Published: 2021-03-12T23:04:46Z

### Impact

The vulnerability allows for reading and outputting files served by other services on the internal network in which the export server is hosted. If the export server is exposed to the internet, this potentially allows a malicious user to gain read access to internal web-resources.

The impact is limited to internal services that serve content via. HTTP(S), and requires the attacker to know internal hostnames/IP addresses.

The previous versions have been marked as deprecated on NPM.

### Patches

Version 2.1.0 released alongside this security advisory addresses the issue. **Please note that this release is not backwards compatible out of the box. See the [changelog](https://github.com/highcharts/node-export-server/blob/master/CHANGELOG.md) for details.**

Additionally, it's also recommended to upgrade to the latest version of Highcharts to get the added input sanitation implemented in version 9.0 and later. 

### Workarounds

There are no known workarounds to the issue - an upgrade to version 2.1.0 is required.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the export server issue tracker](https://github.com/highcharts/node-export-server/issues)
* Email us at [security@highsoft.com](mailto:security@highsoft.com)
Denial of service attack via .well-known lookups
Published: 2021-03-01T19:34:54Z
Aliases: CVE-2021-21274

### Impact
A malicious homeserver could redirect requests to their .well-known file to a large file. This can lead to a denial of service attack where homeservers will consume significantly more resources when requesting the .well-known file of a malicious homeserver.

This affects any server which accepts federation requests from untrusted servers.

### Patches
Issue is resolved by #8950. A bug not affecting the security aspects of this was fixed in #9108.

### Workarounds
The `federation_domain_whitelist` setting can be used to restrict the homeservers communicated with over federation.
Out of bounds read in Pillow
Published: 2021-03-29T16:35:27Z
Aliases: CVE-2021-25293

An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
Out of bounds read in Pillow
Published: 2021-03-29T16:35:57Z
Aliases: CVE-2021-25291

An issue was discovered in Pillow before 8.2.0. In `TiffDecode.c`, there is an out-of-bounds read in `TiffreadRGBATile` via invalid tile boundaries.
Prototype Pollution in y18n
Published: 2021-03-29T16:05:12Z
Aliases: CVE-2020-7774

### Overview

The npm package `y18n` before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution. 

### POC

```js
const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true
```

### Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.
XStream is vulnerable to an Arbitrary Code Execution attack
Published: 2021-03-22T23:29:37Z
Aliases: CVE-2021-21351

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21351](https://x-stream.github.io/CVE-2021-21351.html).

### Credits
wh1t3p1g G5-RD6@IIE found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Insufficiently Protected Credentials in Elasticsearch
Published: 2021-03-18T19:27:27Z
Aliases: CVE-2021-22132

Elasticsearch versions 7.7.0 to 7.10.1 contain an information disclosure flaw in the async search API. Users who execute an async search will improperly store the HTTP headers. An Elasticsearch user with the ability to read the .tasks index could obtain sensitive request headers of other users in the cluster. This issue is fixed in Elasticsearch 7.10.2
Cross-Site Scripting in Content Preview (CType menu)
Published: 2021-03-23T01:54:17Z
Aliases: CVE-2021-21370

> ### Meta
> * CVSS: `AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.1)
> * CWE-79
> * Status: **DRAFT**

### Problem
It has been discovered that content elements of type _menu_ are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to TYPO3 contributor Oliver Bartsch who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-008](https://typo3.org/security/advisory/typo3-core-sa-2021-008)
Out-of-bounds write
Published: 2021-03-29T21:00:00Z
Aliases: CVE-2019-0911

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0884, CVE-2019-0918.
/user/sessions endpoint allows detecting valid accounts
Published: 2021-03-11T17:42:08Z

This Security Advisory is about a vulnerability in eZ Platform v1.13, v2.5, and v3.2, and in Ibexa DXP and Ibexa Open Source v3.3. The /user/sessions endpoint can let an attacker detect if a given username or email refers to a valid account. This can be detected through differences in the response data or response time of certain requests. The fix ensures neither attack is possible. The fix is distributed via Composer.

If you come across a security issue in our products, here is how you can report it to us: https://doc.ibexa.co/en/latest/guide/reporting_issues/#toc
Out-of-bounds write
Published: 2021-03-29T20:57:42Z
Aliases: CVE-2019-0991

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1003, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
Privilege Context Switching Error in Elasticsearch
Published: 2021-03-18T19:27:13Z
Aliases: CVE-2020-7020

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents the attacker should not be able to view. This could result in an attacker gaining additional insight into potentially sensitive indices.
Moodle allowed some users without permission to view other users' full names
Published: 2021-03-29T20:43:23Z
Aliases: CVE-2021-20281

It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
Out-of-bounds write
Published: 2021-03-29T20:59:06Z
Aliases: CVE-2019-1003

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989, CVE-2019-0991, CVE-2019-0992, CVE-2019-0993, CVE-2019-1002, CVE-2019-1024, CVE-2019-1051, CVE-2019-1052.
Out-of-bounds write
Published: 2021-03-29T21:00:09Z
Aliases: CVE-2019-0916

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912, CVE-2019-0913, CVE-2019-0914, CVE-2019-0915, CVE-2019-0917, CVE-2019-0922, CVE-2019-0923, CVE-2019-0924, CVE-2019-0925, CVE-2019-0927, CVE-2019-0933, CVE-2019-0937.
OMERO.web exposes some unnecessary session information in the page
Published: 2021-03-23T15:26:34Z
Aliases: CVE-2021-21376

### Background
OMERO.web loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. Some additional information being loaded is not used by the webclient and is being removed in this release.

### Impact
OMERO.web before 5.9.0

### Patches
5.9.0

### Workarounds
No workaround

### References

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [omero-web](https://github.com/ome/omero-web)
* Email us at [security](mailto:security@openmicroscopy.org.uk)
XStream is vulnerable to an Arbitrary Code Execution attack
Published: 2021-03-22T23:28:23Z
Aliases: CVE-2021-21344

### Impact
The vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21344](https://x-stream.github.io/CVE-2021-21344.html).

### Credits
钟潦贵 (Liaogui Zhong) found and reported the issue to XStream and provided the required information to reproduce it.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Command injection in wc-cmd
Published: 2021-03-19T21:10:30Z
Aliases: CVE-2020-28431

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS)
Published: 2021-03-18T19:39:31Z
Aliases: CVE-2021-23346

This affects the package html-parse-stringify before 2.0.1; all versions of package html-parse-stringify2. Sending certain input could cause one of the regular expressions that is used for parsing to backtrack, freezing the process.
Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup
Published: 2021-03-09T00:38:31Z
Aliases: CVE-2021-21360

### Impact
_What kind of vulnerability is it? Who is impacted?_

Information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Visit the ZMI Security tab at `portal_setup/manage_access` and click on the link _Access contents information_. On the next page, uncheck the box _Also use roles acquired from folders containing this objects_ at the bottom and check the boxes for _Manager_ and _Owner_. Then click on _Save Changes_. Return to the ZMI Security tab at `portal_setup/manage_access` and scroll down to the link _View_. Click on _View_, uncheck the box _Also use roles acquired from folders containing this objects_ at the bottom and check the boxes for _Manager_ and _Owner_. Then click on _Save Changes_. 

### References
_Are there any links users can visit to find out more?_

- [GHSA-jff3-mwp3-f8cw](https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw)
- [Products.GenericSetup on PyPI](https://pypi.org/project/Products.GenericSetup/)
- [Definition of information disclosure at MITRE](https://cwe.mitre.org/data/definitions/200.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [Products.GenericSetup issue tracker](https://github.com/zopefoundation/Products.GenericSetup/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Out of bounds write in Pillow
Published: 2021-03-29T16:35:16Z
Aliases: CVE-2021-25289

An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.
Double Free in Adplug
Published: 2021-03-29T20:48:45Z
Aliases: CVE-2019-15151

AdPlug 2.3.1 has a double free in the `Cu6mPlayer` class in `u6m.h`.
Pillow Out-of-bounds Read
Published: 2021-03-18T19:55:34Z
Aliases: CVE-2020-35655

In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.
Improper Input Validation in PyYAML
Published: 2021-03-25T21:26:26Z
Aliases: CVE-2020-14343

A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747.
Cross-site scripting (XSS) and Server side request forgery (SSRF) in moodle
Published: 2021-03-29T20:42:15Z
Aliases: CVE-2021-20280

Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
XSS in CreateQueuedJobTask
Published: 2021-03-24T17:42:02Z
Aliases: CVE-2021-27938

A vulnerability has been identified in the Silverstripe CMS 3 and 4 version of the symbiote/silverstripe-queuedjobs module. A Cross Site Scripting vulnerability allows an attacker to inject an arbitrary payload in the CreateQueuedJobTask dev task via a specially crafted URL.
A Server-Side Forgery Request can be activated unmarshalling with XStream to access data streams from an arbitrary URL referencing a resource in an intranet or the local host
Published: 2021-03-22T23:29:19Z
Aliases: CVE-2021-21349

### Impact
The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types.

### Patches
If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.16.

### Workarounds
See [workarounds](https://x-stream.github.io/security.html#workaround) for the different versions covering all CVEs.

### References
See full information about the nature of the vulnerability and the steps to reproduce it in XStream's documentation for [CVE-2021-21349](https://x-stream.github.io/CVE-2021-21349.html).

### Credits
The vulnerability was discovered and reported by threedr3am.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [XStream](https://github.com/x-stream/xstream/issues)
* Contact us at [XStream Google Group](https://groups.google.com/group/xstream-user)
Cross-site scripting (XSS) vulnerability in the password reset endpoint
Published: 2021-03-26T19:52:54Z
Aliases: CVE-2021-21332

### Impact
The password reset endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

### Patches
This is fixed in #9200.

### Workarounds
Depending on the needs and configuration of the homeserver a few options are available:

1. Password resets can be disabled by delegating email to a third-party service (via the `account_threepid_delegates.email` setting) or disabling email (by not configuring the `email` setting).

2. If the homeserver is not configured to use passwords (via the `password_config.enabled` setting) then the affected endpoint can be blocked at a reverse proxy:

    * `/_synapse/client/password_reset/email/submit_token`

3. The `password_reset_confirmation.html` template can be overridden with a custom template that manually escapes the variables using [JInja2's `escape` filter](https://jinja.palletsprojects.com/en/2.11.x/templates/#escape). See the `email.template_dir` setting.
Pillow Uncontrolled Resource Consumption
Published: 2021-03-18T19:55:21Z
Aliases: CVE-2021-27922

Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
Published: 2021-03-19T19:42:11Z
Aliases: CVE-2021-28363

### Impact

Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`.
Only the default SSLContext is impacted.

### Patches

[urllib3 >=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.

### Workarounds

Upgrading is recommended as this is a minor release and not likely to break current usage.

Configuring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext`

### For more information
If you have any questions or comments about this advisory:
* Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)
printf vulnerable to Regular Expression Denial of Service (ReDoS)
Published: 2021-03-19T21:22:10Z
Aliases: CVE-2021-23354

The package printf before 0.6.1 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex string 
```regex
/\%(?:\(([\w_.]+)\)|([1-9]\d*)\$)?([0 +\-\]*)(\*|\d+)?(\.)?(\*|\d+)?[hlL]?([\%bscdeEfFgGioOuxX])/g
```
 in `lib/printf.js`. The vulnerable regular expression has cubic worst-case time complexity.