aswin1906/github-advisory-2021.csv huggingface dataset:
HTTP Method Spoofing
Published: 2021-12-14T21:43:00Z
Aliases: CVE-2021-43807

Opencast versions prior to 9.10 allow HTTP method spoofing, allowing to change the assumed HTTP method via URL parameter. This allows  attackers to turn HTTP GET requests into PUT requests or an HTTP form to send DELETE requests. This bypasses restrictions otherwise put on these types of requests and aids in cross-site request forgery (CSRF) attacks, which would otherwise not be possible.

### Impact

The vulnerability allows attackers to craft links or forms which may change the server state. For example, the following GET request would create a new user:

```sh
% curl -i -u admin:opencast \
  'https://legacy.opencast.org/admin-ng/users/test.json?_method=PUT&username=test&password=attack'
HTTP/2 200
…
```

If an admin is logged in to legacy.opencast.org and accidentally clicks this link, a user will silently be created.


### Patches

This issue is fixed in Opencast 9.10 and 10.0.

### Workarounds

You can mitigate the problem by setting the `SameSite=Strict` attribute for your cookies. If this is a viable option for you depends on your integrations. We strongly recommend updating in any case.

### References

- [Fix for 10.0](https://github.com/opencast/opencast/commit/59cb6731067283e54f15462be38b6117d8b9ea8b#diff-9c5fb3d1b7e3b0f54bc5c4182965c4fe1f9023d449017cece3005d3f90e8e4d8)
- [Fix for 9.10](https://github.com/opencast/opencast/commit/8f8271e1085f6f8e306c689d6a56b0bb8d076444)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)
Integer Overflow in png-img
Published: 2021-12-10T17:23:30Z
Aliases: CVE-2020-28248

An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.
Authorization bypass in Openshift
Published: 2021-12-20T16:58:14Z
Aliases: CVE-2016-1906

Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
Code injection in plupload
Published: 2021-12-16T15:32:31Z
Aliases: CVE-2021-23562

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.
HTTP Request Smuggling in github.com/hyperledger/fabric
Published: 2021-12-03T20:52:02Z
Aliases: CVE-2021-43669

A vulnerability has been detected in HyperLedger Fabric v1.4.0, v2.0.0, v2.0.1, v2.3.0. It can easily break down as many orderers as the attacker wants. This bug can be leveraged by constructing a message whose header is invalid to the interface Order. This bug has been admitted and fixed by the developers of Fabric.
Excessive Platform Resource Consumption within a Loop in Kubernetes
Published: 2021-12-20T16:55:06Z
Aliases: CVE-2019-11254

The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.
OS Command injection in docker-cli-js
Published: 2021-12-02T17:51:22Z
Aliases: CVE-2021-23732

# Withdrawn

After reviewing this CVE, and [this response from the maintainer](https://github.com/Quobject/docker-cli-js/issues/22#issuecomment-967760940), we have withdrawn this advisory.

# Original CVE description

This affects all versions of package docker-cli-js. If the command parameter of the Docker.command method can at least be partially controlled by a user, they will be in a position to execute any arbitrary OS commands on the host system.
Deserialization of Untrusted Data in topthink/framework
Published: 2021-12-07T00:00:27Z
Aliases: CVE-2021-36567

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache.
YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number
Published: 2021-12-16T21:01:15Z
Aliases: CVE-2021-4111

YetiForceCRM is vulnerable to Business Logic Errors because product amount can be a negative number.
Serialization gadgets exploit in jackson-databind
Published: 2021-12-09T19:15:00Z
Aliases: CVE-2020-35490

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource.
Information Exposure in RunC
Published: 2021-12-20T18:21:43Z
Aliases: CVE-2016-9962

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container.  This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.
Incorrect Permission Assignment for Critical Resource in Singularity
Published: 2021-12-20T18:25:33Z
Aliases: CVE-2019-11328

An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a malicious user with local/network access to the host system (e.g. ssh) could exploit this vulnerability due to insecure permissions allowing a user to edit files within `/run/singularity/instances/sing/<user>/<instance>`. The manipulation of those files can change the behavior of the starter-suid program when instances are joined resulting in potential privilege escalation on the host.
Path Traversal in @backstage/plugin-scaffolder-backend
Published: 2021-12-01T18:28:51Z
Aliases: CVE-2021-43783

### Impact
A malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance.

This vulnerability can in some situation also be exploited through user input when executing a template, meaning you do not need write access to the templates. This method will not allow the attacker to control the contents of the injected file however, unless the template is also crafted in a specific way that gives control of the file contents.

### Patches
This vulnerability is fixed in version `0.15.14` of the `@backstage/plugin-scaffolder-backend`.

### Workarounds
This attack is mitigated by restricting access and requiring reviews when registering or modifying scaffolder templates.

### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Laravel Framework XSS in Blade templating engine
Published: 2021-12-08T19:57:36Z
Aliases: CVE-2021-43808

A security researcher has disclosed a possible XSS vulnerability in the Blade templating engine.

Given the following two Blade templates:

resources/views/parent.blade.php:

```html
@section('content')
<input value="{{ $value }}">
@show
```

resources/views/child.blade.php:

```html
@extends('parent')

@section('content')
<input value="{{ $value }}">
@endsection
```

And a route like the following:

```php
Route::get('/example', function() {
    $value = '//localhost/###parent-placeholder-040f06fd774092478d450774f5ba30c5da78acc8## onclick=location.assign(this.value);//';

    return view('child', ['value' => $value]);
});
```

The broken HTML element may be clicked and the user is taken to another location in their browser due to XSS. This is due to the user being able to guess the parent placeholder SHA-1 hash by trying common names of sections. If the parent template contains an exploitable HTML structure an XSS vulnerability can be exposed.

This vulnerability has been patched by determining the parent placeholder at runtime and using a random hash that is unique to each request.
Open Redirect in showdoc
Published: 2021-12-16T15:31:58Z
Aliases: CVE-2021-4000

showdoc is vulnerable to URL Redirection to Untrusted Site
Prototype polluation in just-safe-set
Published: 2021-12-10T18:50:40Z
Aliases: CVE-2021-25952

Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Command injection in itext7-core
Published: 2021-12-16T00:02:15Z
Aliases: CVE-2021-43113

iTextPDF in iText before 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.
Silent Configuration Failure in Puppet Agent
Published: 2021-12-02T17:54:25Z
Aliases: CVE-2021-27025

A flaw was discovered in Puppet Agent where the agent may silently ignore Augeas settings or may be vulnerable to a Denial of Service condition prior to the first 'pluginsync'.
Cross-site Scripting in pekeupload
Published: 2021-12-02T17:52:26Z
Aliases: CVE-2021-23673

This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.
bookstack is vulnerable to Improper Access Control
Published: 2021-12-01T18:26:48Z
Aliases: CVE-2021-4026

bookstack is vulnerable to Improper Access Control.
PHP file inclusion in the Sulu admin panel
Published: 2021-12-15T22:54:20Z
Aliases: CVE-2021-43836

### Impact
_What kind of vulnerability is it? Who is impacted?_

An attacker can read arbitrary local files via a PHP file include. In a default configuration this also leads to remote code execution.

* Compromised components: Arbitrary file read on the server, (Potential) Remote code execution
* Exploitation pre-requisite: User account on the backend

### Patches

_Has the problem been patched? What versions should users upgrade to?_

The problem is patched with the Versions 1.6.44, 2.2.18, 2.3.8, 2.4.0

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Overwrite the service `sulu_route.generator.expression_token_provider` and wrap the translator before passing it to the expression language. 

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Denial of Service (DoS) in Jackson Dataformat CBOR
Published: 2021-12-09T19:17:21Z
Aliases: CVE-2020-28491

This affects the package com.fasterxml.jackson.dataformat:jackson-dataformat-cbor from 2.8.0-rc1 and before 2.11.4, from 2.12.0-rc1 and before 2.12.1. Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception.
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Published: 2021-12-03T20:42:35Z
Aliases: CVE-2021-3993

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
Published: 2021-12-17T20:40:50Z
Aliases: CVE-2020-35213

An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false link event messages sent to a master ONOS node.
actionpack Open Redirect in Host Authorization Middleware
Published: 2021-12-14T21:19:08Z
Aliases: CVE-2021-44528

Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:

```
config.hosts <<  '.EXAMPLE.com'
```

When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.

Releases
--------
The fixed releases are available at the normal locations.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 6-0-host-authorzation-open-redirect.patch - Patch for 6.0 series
* 6-1-host-authorzation-open-redirect.patch - Patch for 6.1 series
* 7-0-host-authorzation-open-redirect.patch - Patch for 7.0 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
Published: 2021-12-01T18:28:38Z

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
Remote Code Execution in npm-groovy-lint
Published: 2021-12-20T16:59:31Z

Versions of npm-groovy-lint prior to 9.1.0 bundle vulnerable versions of the Log4j library which are subject to remote code execution via jndi rendering. As a result npm-groovy-lint prior to 9.1.0 is also vulnerable.
Prototype pollution in gsap
Published: 2021-01-20T21:21:50Z
Aliases: CVE-2020-28478

There is a prototype pollution vulnerability in gsap which affects all versions before 3.6.0.
XSS in Flarum Sticky extension
Published: 2021-01-29T18:13:41Z
Aliases: CVE-2021-21283

### Impact
A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit.

Any HTML would be injected through Mithril's `m.trust()` helper. This resulted in an HTML injection where `<script>` tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed.

Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned.

On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited.

Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history, you cannot be certain if a malicious edit was reverted.

### Patches
The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension.

### Workarounds
Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.

### References

- [Release announcement](https://discuss.flarum.org/d/26042-security-update-to-flarum-sticky-010-beta151)
- [Pull Request](https://github.com/flarum/sticky/pull/24)

### For more information
If you have any questions or comments about this advisory, please start a new discussion on our [support forum](https://discuss.flarum.org/t/support).

If you discover a security vulnerability within Flarum, please send an e-mail to [security@flarum.org](mailto:security@flarum.org). All security vulnerabilities will be promptly addressed. More details can be found in our [security policy](https://github.com/flarum/core/security/policy).
Processing untrusted theming resources might execute arbitrary code (ACE)
Published: 2021-01-29T20:51:37Z
Aliases: CVE-2021-21316

### Impact
When processing theming resources (i.e. `*.less` files) with less-openui5 that originate from an untrusted source, those resources might contain JavaScript code which will be executed in the context of the build process.

While this is a [feature](http://lesscss.org/usage/#less-options-enable-inline-javascript-deprecated-) of the [Less.js library](https://github.com/less/less.js), it is an unexpected behavior in the context of OpenUI5 and SAPUI5 development.

Especially in the context of [UI5 Tooling](https://github.com/SAP/ui5-tooling), which relies on less-openui5, this poses a security threat:

An attacker might create a [library](https://sap.github.io/ui5-tooling/pages/Builder/#library) or [theme-library](https://sap.github.io/ui5-tooling/pages/Builder/#theme-library) containing a custom control or theme, hiding malicious JavaScript code in one of the `.less` files.

This is an example of inline JavaScript in a Less file:
```less
.rule {
	@var: `(function(){console.log('Hello from JavaScript'); process.exit(1);})()`;
	color: @var;
}
```

Starting with Less.js version 3.0.0, the Inline JavaScript feature is disabled by default. less-openui5 however currently uses [a fork](https://github.com/SAP/less-openui5/tree/master/lib/thirdparty/less) of Less.js v1.6.3.

Note that disabling the Inline JavaScript feature in Less.js versions 1.x, still evaluates code has additional double codes around it:
```less
.rule {
	@var: "`(function(){console.log('Hello from JavaScript'); process.exit(1);})()`";
	color: @var;
}
```

### Patches
We decided to remove the inline JavaScript evaluation feature completely from the code of our Less.js fork.

This fix is available in less-openui5 version [v0.10.0](https://github.com/SAP/less-openui5/releases/tag/v0.10.0)

### Workarounds
Only process trusted theming resources.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/SAP/less-openui5
* Email us at secure@sap.com
Path Traversal in Apache Flink
Published: 2021-01-06T20:01:34Z
Aliases: CVE-2020-17519

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
Command Injection in @graphql-tools/git-loader
Published: 2021-01-29T18:13:14Z
Aliases: CVE-2021-23326

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
XSS vulnerability in theme config file in Mautic
Published: 2021-01-19T21:16:17Z
Aliases: CVE-2018-8071

### Impact
Mautic before v2.13.0 has stored XSS via a theme config file.

### Patches
Update to 2.13.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Kirby .dev domains and some reverse proxy setups were treated as local
Published: 2021-01-14T19:15:19Z
Aliases: CVE-2020-26253

### Impact

#### About our registration block

In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we implemented years ago in Kirby 2. It helps to avoid that you forget registering your first admin account on a public server. 

In this case – without our security block – someone else might theoretically be able to find your site, find out it's running on Kirby, find the Panel and then register the account first. It's an unlikely situation, but it's still a certain risk.

To be able to register the first Panel account on a public server, you have to enforce the installer via a config setting. This helps to push all users to the best practice of registering your first Panel account on your local machine and upload it together with the rest of the site. 

#### The issue

As noted by [Jukka Rautanen](https://github.com/jukra), this installation block implementation in Kirby versions before 3.3.6 still assumed that .dev domains are local domains, which is no longer true. In the meantime, those domains became publicly available. This means that our installation block is no longer working as expected if you use a .dev domain for your Kirby site.

In fixing this issue, we've also found out that the local installation check may also fail if your site is behind a reverse proxy. 

#### Am I affected?

You are only affected if:

1. you use a .dev domain or your site is behind a reverse proxy &
2. you have not yet registered your first Panel account on the public server & 
3. someone finds your site and tries to login at `yourdomain.dev/panel` before you register your first account.

You are not affected if you have already created one or multiple Panel accounts (no matter if on a .dev domain or behind a reverse proxy).

### Patches

The problem has been patched in [Kirby 2.5.14](https://github.com/getkirby-v2/panel/releases/tag/2.5.14) and [Kirby 3.3.6](https://github.com/getkirby/kirby/releases/tag/3.3.6). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.

**Note:** Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

### Workarounds

Kirby 2 sites on older releases can also be patched by applying the [changes from this commit](https://github.com/getkirby-v2/panel/commit/7f9ac1876bacb89fd8f142f5e561a02ebb725baa).
Inline JS XSS vulnerability in Mautic
Published: 2021-01-19T21:16:24Z
Aliases: CVE-2017-1000488

### Impact

Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.

### Patches
Upgrade to 2.12.0 or later.

### Workarounds
None

### References
https://github.com/mautic/mautic/releases/tag/2.12.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Disabled users able to log in with third party SSO plugin
Published: 2021-01-19T21:16:19Z
Aliases: CVE-2017-1000489

### Impact
Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address

### Patches
Upgrade to 2.12.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
XSS vulnerability in Author URL of themes in Mautic
Published: 2021-01-19T21:16:14Z
Aliases: CVE-2018-11198

### Impact
An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes.

### Patches
Update to 2.14 or later

### Workarounds
None

### References
https://github.com/mautic/mautic/releases/tag/2.14.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Malicious npm package: sonatype
Published: 2021-01-29T18:11:20Z

The npm `sonatype` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.