aswin1906/github-advisory-2021.csv huggingface dataset:
Deserialization of Untrusted Data in org.apache.ddlutils:ddlutils
Published: 2021-10-04T20:12:30Z
Aliases: CVE-2021-41616

Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY, LONGVARBINARY, or BLOB between databases using the ddlutils features. The BinaryObjectsHelper class was insecure and used ObjectInputStream.readObject without validating that the input data was safe to deserialize. Please note that DdlUtils is no longer being actively developed. To address the insecurity of the BinaryObjectHelper class, the following changes to DdlUtils have been made: (1) BinaryObjectsHelper.java has been deleted from the DdlUtils source repository and the DdlUtils feature of propagating data of SQL binary types is therefore no longer present in DdlUtils; (2) The ddlutils-1.0 release has been removed from the Apache Release Distribution Infrastructure; (3) The DdlUtils web site has been updated to indicate that DdlUtils is now available only as source code, not as a packaged release.
Out-of-bounds Read in OpenCV
Published: 2021-10-12T22:22:05Z
Aliases: CVE-2019-16249

OpenCV 4.1.1 has an out-of-bounds read in hal_baseline::v_load in core/hal/intrin_sse.hpp when called from computeSSDMeanNorm in modules/video/src/dis_flow.cpp.
Improper escaping of command arguments on Windows leading to command injection
Published: 2021-10-05T20:23:18Z
Aliases: CVE-2021-41116

### Impact
Windows users running Composer to install untrusted dependencies are affected and should definitely upgrade for safety. Other OSs and WSL are not affected. 

### Patches
1.10.23 and 2.1.9 fix the issue

### Workarounds
None
Improper Access Control in jupyterhub-firstuseauthenticator
Published: 2021-10-28T23:13:57Z
Aliases: CVE-2021-41194

### Impact

When JupyterHub is used with FirstUseAuthenticator, the vulnerability allows unauthorized access to any user's account if `create_users=True` and the username is known or guessed.

### Patches

Upgrade to jupyterhub-firstuseauthenticator to 1.0, or apply patch https://github.com/jupyterhub/firstuseauthenticator/pull/38.patch

### Workarounds

If you cannot upgrade, there is no complete workaround, but it can be mitigated.

If you cannot upgrade yet, you can disable user creation with `c.FirstUseAuthenticator.create_users = False`, which will only allow login with fully normalized usernames for already existing users prior to jupyterhub-firstuserauthenticator 1.0. If any users have never logged in with their normalized username (i.e. lowercase), they will still be vulnerable until you can patch or upgrade.
github.com/tidwall/gjson Vulnerable to REDoS attack
Published: 2021-10-25T19:43:15Z
Aliases: CVE-2021-42836

GJSON is a Go package that provides a fast and simple way to get values from a json document. GJSON before 1.9.3 allows a ReDoS (regular expression denial of service) attack.
Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Published: 2021-10-05T17:53:11Z
Aliases: CVE-2021-40324

Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.
Cross Site Scripting in Microweber
Published: 2021-10-25T19:43:39Z
Aliases: CVE-2021-33988

Cross Site Scripting (XSS). vulnerability exists in Microweber CMS 1.2.7 via the Login form, which could let a malicious user execute Javascript by Inserting code in the request form.
Integer Overflow or Wraparound in OpenCV
Published: 2021-10-12T22:02:35Z
Aliases: CVE-2017-12863

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMDecoder::readData has an integer overflow when calculate src_pitch. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
Out-of-bounds Read in OpenCV
Published: 2021-10-12T22:07:14Z
Aliases: CVE-2019-14491

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read in the function cv::predictOrdered<cv::HaarEvaluator> in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
Risk of code injection
Published: 2021-10-12T16:03:43Z
Aliases: CVE-2021-21278

### Impact
Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues

### Patches
Temporarily removed the problematic route and added a `no-new-func` rule to eslint
Self-built users should upgrade to 7f1c430 and later as soon as possible

### Credits
Tencent Woodpecker Security Team

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/DIYgod/RSSHub/issues](https://github.com/DIYgod/RSSHub/issues)
* Email us at [i@diygod.me](mailto:i@diygod.me)
modern-async's `forEachSeries` and `forEachLimit` functions do not limit the number of requests
Published: 2021-10-21T17:49:30Z
Aliases: CVE-2021-41167

### Impact

This is a bug affecting two of the functions in this library: `forEachSeries` and `forEachLimit`. They should limit the concurrency of some actions but, in practice, they don't. Any code calling these functions will be written thinking they would limit the concurrency but they won't. This could lead to potential security issues in other projects.

### Patches

The problem has been patched in 1.0.4.

### Workarounds

There is no workaround aside from upgrading to 1.0.4.
Weak Password Recovery Mechanism for Forgotten Password in Strapi
Published: 2021-10-06T17:48:16Z
Aliases: CVE-2021-28128

In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.
Async-h1 request smuggling possible with long unread bodies
Published: 2021-10-12T16:00:37Z
Aliases: CVE-2020-26281

### Impact
This vulnerability affects any webserver that uses async-h1 behind a reverse proxy, including all such Tide applications.

If the server does not read the body of a request which is longer than some buffer length, async-h1 will attempt to read a subsequent request from the body content starting at that offset into the body.

One way to exploit this vulnerability would be for an adversary to craft a request such that the body contains a request that would not be noticed by a reverse proxy, allowing it to forge forwarded/x-forwarded headers. If an application trusted the authenticity of these headers, it could be misled by the smuggled request.

Another potential concern with this vulnerability is that if a reverse proxy is sending multiple http clients' requests along the same keep-alive connection, it would be possible for the smuggled request to specify a long content and capture another user's request in its body. This content could be captured in a post request to an endpoint that allows the content to be subsequently retrieved by the adversary.


### Patches
This has been addressed in async-h1 2.3.0 and previous versions have been yanked.

### Workarounds
none

### References
https://github.com/http-rs/async-h1/releases/tag/v2.3.0

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [async-h1](https://github.com/http-rs/async-h1)
* Contact a core team member on [zulip](https://http-rs.zulip-chat.com) or [discord](https://discord.gg/x2gKzst)
Prototype pollution vulnerability in 'predefine'
Published: 2021-10-12T16:27:18Z
Aliases: CVE-2020-28280

Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Expression injection in AviatorScript
Published: 2021-10-04T20:14:31Z
Aliases: CVE-2021-41862

AviatorScript through 5.2.7 allows code execution via an expression that is encoded with Byte Code Engineering Library (BCEL).
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:01:44Z
Aliases: CVE-2017-12603

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an invalid write in the cv::RLByteStream::getBytes function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 2-opencv-heapoverflow-fseek test case.
Open Redirect in Apache Superset
Published: 2021-10-06T17:47:53Z
Aliases: CVE-2021-28125

Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
Open Redirect in firefly-iii
Published: 2021-10-21T17:48:41Z
Aliases: CVE-2021-3851

firefly-iii is vulnerable to URL Redirection to Untrusted Site
Prototype pollution vulnerability in 'patchmerge'
Published: 2021-10-13T15:33:20Z
Aliases: CVE-2021-25916

Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:01:55Z
Aliases: CVE-2017-12604

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillUniColor function in utils.cpp when reading an image file by using cv::imread.
Memory corruption when returning a literal struct with a private call inside of it
Published: 2021-10-12T15:59:29Z
Aliases: CVE-2021-41121

### Impact

When performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack.

### Patches
0.3.0 / #2447

*
Arbitrary command execution on Windows via qutebrowserurl: URL handler
Published: 2021-10-22T16:20:10Z
Aliases: CVE-2021-41146

### Impact
Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers it as a handler for certain URL schemes. With some applications such as Outlook Desktop, opening a specially crafted URL can lead to argument injection, allowing execution of qutebrowser commands, which in turn allows arbitrary code execution via commands such as `:spawn` or `:debug-pyeval`.

Only Windows installs where qutebrowser is registered as URL handler are affected. It does *not* have to be set as default browser for the exploit to work.

### Patches
The issue has been fixed in [qutebrowser v2.4.0](https://github.com/qutebrowser/qutebrowser/releases/tag/v2.4.0) in commit 8f46ba3f6dc7b18375f7aa63c48a1fe461190430.

The fix also adds additional hardening for potential similar issues on Linux (by adding the new `--untrusted-args` flag to the `.desktop` file), though no such vulnerabilities are known.

Backported patches for older versions are available, but no further releases are planned:

- v1.7.x: d1ceaab
- v1.8.x: ca7155d
- v1.9.x: 157d871
- v1.10.x: 94a6125
- v1.11.x: 10acfbb
- v1.12.x: 363a18f
- v1.13.x: 410f262
- v1.14.x: e4f4d93
- v2.0.x: 15a1654
- v2.1.x: 509ddf2
- v2.2.x: 03dcba5
- v2.3.x: 00a694c

(commits are referring to qutebrowser/qutebrowser on GitHub)

### Workarounds
Remove qutebrowser from the default browser settings entirely, so that it does not handle any kind of URLs. Make sure to remove *all* handlers, including an (accidental) `qutebrowserURL` handler, e.g. using [NirSoft URLProtocolView](https://www.nirsoft.net/utils/url_protocol_view.html).

### Timeline
2021-10-15: Issue reported via security@qutebrowser.org by Ping Fan (Zetta) Ke of [Valkyrie-X Security Research Group (VXRL)](https://www.vxrl.hk/)
2021-10-15: Issue confirmed by @The-Compiler (lead developer), author of installer (@bitraid) contacted for help/review
2021-10-15: CVE assigned by GitHub
2021-10-15 to 2021-10-17: Fix developed
2021-10-17: Additional core developer (@toofar) contacted for help/review
2021-10-21: v2.4.0 released containing the fix
2021-10-21: Advisory and fix published

### References
See the [commit message](https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430) for additional information and references to various similar issues in other projects.

### Acknowledgements
Thanks to Ping Fan (Zetta) Ke of [Valkyrie-X Security Research Group](https://www.vxrl.hk/) (VXRL/@vxresearch) for finding and responsibly disclosing this issue.

### Contact
If you have any questions or comments about this advisory, please email [security@qutebrowser.org](mailto:security@qutebrowser.org).
Denial of Service in OpenCV
Published: 2021-10-12T22:01:34Z
Aliases: CVE-2017-12602

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a denial of service (memory consumption) issue, as demonstrated by the 10-opencv-dos-memory-exhaust test case.
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:00:41Z
Aliases: CVE-2017-12597

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to opencv-python and opencv-contrib-python through 3.3.0.9) has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread.
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:02:12Z
Aliases: CVE-2017-12606

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the function FillColorRow4 in utils.cpp when reading an image file by using cv::imread.
Out-of-bounds Read and Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:09:31Z
Aliases: CVE-2019-14492

An issue was discovered in OpenCV before 3.4.7 and 4.x before 4.1.1 (OpenCV-Python before 3.4.7.28 and 4.x before 4.1.1.26). There is an out of bounds read/write in the function HaarEvaluator::OptFeature::calc in modules/objdetect/src/cascadedetect.hpp, which leads to denial of service.
CSV injection in Craft CMS
Published: 2021-10-04T20:12:45Z

# Withdrawn 

Duplicate of GHSA-h7vq-5qgw-jwwq
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Published: 2021-10-13T18:56:12Z

Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided.
Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV 
Published: 2021-10-12T22:01:23Z
Aliases: CVE-2017-12601

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmt_bmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy test case.
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:23:13Z
Aliases: CVE-2019-5063

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV 4.1.0 (corresponds with OpenCV-Python 4.1.0.25). A specially crafted XML file can cause a buffer overflow, resulting in multiple heap corruptions and potential code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
Origin Validation Error in Magento 2
Published: 2021-10-12T16:30:58Z
Aliases: CVE-2020-8818

An issue was discovered in the CardGate Payments plugin through 2.0.30 for Magento 2. Lack of origin authentication in the IPN callback processing function in Controller/Payment/Callback.php allows an attacker to remotely replace critical plugin settings (merchant ID, secret key, etc.) and therefore bypass the payment process (e.g., spoof an order status by manually sending an IPN callback request with a valid signature but without real payment) and/or receive all of the subsequent payments.
Email relay in Apache Traffic Control
Published: 2021-10-13T18:55:04Z
Aliases: CVE-2021-42009

An authenticated Apache Traffic Control Traffic Ops user with Portal-level privileges can send a request with a specially-crafted email subject to the /deliveryservices/request Traffic Ops endpoint to send an email, from the Traffic Ops server, with an arbitrary body to an arbitrary email address. Apache Traffic Control 5.1.x users should upgrade to 5.1.3 or 6.0.0. 4.1.x users should upgrade to 5.1.3.
Improper Certificate Validation in Heartland & Global Payments PHP SDK
Published: 2021-10-12T16:31:12Z
Aliases: CVE-2019-20455

Gateways/Gateway.php in Heartland & Global Payments PHP SDK before 2.0.0 does not enforce SSL certificate validations.
Incorrect Privilege Assignment in HashiCorp Vault
Published: 2021-10-12T18:41:16Z
Aliases: CVE-2021-42135

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.
Cross-site Scripting in django-unicorn
Published: 2021-10-12T17:51:04Z
Aliases: CVE-2021-42134

The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in sulu/sulu
Published: 2021-10-22T16:20:53Z
Aliases: CVE-2021-41169

### Impact

_What kind of vulnerability is it? Who is impacted?_

It is an issue when input HTML into the Tag name. The HTML is execute when the tag name is listed in the auto complete form.
Only admin users are affected and only admin users can create tags.

### Patches

_Has the problem been patched? What versions should users upgrade to?_

The problem is patched with Version 1.6.42.

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Create a custom request listener to avoid that this kind of tags are created.

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [sulu/sulu repository](https://github.com/sulu/sulu/issues)
* Email us at [security@sulu.io](mailto:security@sulu.io)
URL Redirection to Untrusted Site ('Open Redirect') in fastify-static
Published: 2021-10-05T20:24:49Z
Aliases: CVE-2021-22963

### Impact

A redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//google.com/%2e%2e`.

The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

### Patches
The issue has been patched in `fastify-static@4.2.4`

### Workarounds
If updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.

### References

+ Bug founder: drstrnegth
+ [hackerone Report](https://hackerone.com/reports/1354255)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-static](https://github.com/fastify/fastify-static)
* Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)
Authenticated Stored XSS in shopware/shopware
Published: 2021-10-27T18:53:18Z
Aliases: CVE-2021-41188

### Impact
Authenticated Stored XSS in Administration

### Patches
Use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### Workarounds
If you cannot use the security plugin, add the following config to your `.htaccess` file

```
<IfModule mod_headers.c>
    <FilesMatch "\.(?i:svg)$">
        Header set Content-Security-Policy "script-src 'none'"
    </FilesMatch>
</IfModule>
```

If you are using nginx as server config, you can add the following to your configuration:
```
server {
    # ...

    location ~* ^.+\.svg$ {
        add_header Content-Security-Policy "script-src 'none'";
    }
}
```

### References
https://docs.shopware.com/en/shopware-5-en/sicherheitsupdates/security-update-10-2021
Command injection leading to Remote Code Execution in Apache Storm
Published: 2021-10-27T18:51:22Z
Aliases: CVE-2021-38294

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
Puma with proxy which forwards LF characters as line endings could allow HTTP request smuggling
Published: 2021-10-12T17:53:00Z
Aliases: CVE-2021-41136

### Impact

Prior to `puma` version 5.5.0, using `puma` with a proxy which forwards LF characters as line endings could allow HTTP request smuggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client.

This behavior (forwarding LF characters as line endings) is very uncommon amongst proxy servers, so we have graded the impact here as "low". Puma is only aware of a single proxy server which has this behavior.

If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client.

### Patches

This vulnerability was patched in Puma 5.5.1 and 4.3.9.

### Workarounds

This vulnerability only affects Puma installations without any proxy in front.

Use a proxy which does not forward LF characters as line endings.

Proxies which do not forward LF characters as line endings:

* Nginx
* Apache (>2.4.25)
* Haproxy
* Caddy
* Traefik

### Possible Breakage

If you are [dealing with legacy clients that want to send `LF` as a line ending](https://stackoverflow.com/questions/43574428/have-apache-accept-lf-vs-crlf-in-request-headers) in an HTTP header, this will cause those clients to receive a `400` error.

### References

* [HTTP Request Smuggling](https://portswigger.net/web-security/request-smuggling)

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [Puma](https://github.com/puma/puma)
* See our [security policy](https://github.com/puma/puma/security/policy)
Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
Published: 2021-10-12T22:03:09Z
Aliases: CVE-2017-17760

OpenCV 3.3.1 (corresponding with opencv-python and opencv-contrib-python 3.3.1.11) has a Buffer Overflow in the cv::PxMDecoder::readData function in grfmt_pxm.cpp, because an incorrect size value is used.