aswin1906/github-advisory-2021.csv huggingface dataset:
Exposure of Sensitive Information to an Unauthorized Actor in Apache Wicket
Published: 2021-05-07T15:54:15Z
Aliases: CVE-2020-11976

By crafting a special URL it is possible to make Wicket deliver unprocessed HTML templates. This would allow an attacker to see possibly sensitive information inside a HTML template that is usually removed during rendering. Affected are Apache Wicket versions 7.16.0, 8.8.0 and 9.0.0-M5
Prototype Pollution in madlib-object-utils
Published: 2021-05-06T17:28:57Z
Aliases: CVE-2020-7701

madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
CKEditor 4.0 vulnerability in the HTML Data Processor
Published: 2021-05-07T16:32:17Z
Aliases: CVE-2020-9281

A cross-site scripting (XSS) vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment (with the cke_protected syntax).
Prototype Pollution in mathjs
Published: 2021-05-10T18:39:04Z
Aliases: CVE-2020-7743

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.
Improper Input Validation in Apache Camel
Published: 2021-05-21T19:20:30Z
Aliases: CVE-2020-11971

Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel users should upgrade to 3.2.0.
Kubernetes Privilege Escalation
Published: 2021-05-12T18:16:32Z
Aliases: CVE-2017-1000056

Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object.
github.com/ulikunitz/xz fixes readUvarint denial of service
Published: 2021-05-25T18:39:37Z
Aliases: CVE-2021-29482

### Impact

xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format may not terminate a loop provide malicous input.

### Patches

The problem has been fixed in release v0.5.8.

### Workarounds

Limit the size of the compressed file input to a reasonable size for your use case.

### References

The standard library had recently the same issue and got the [CVE-2020-16845](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16845) allocated.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [xz](https://github.com/ulikunitz/xz/issues).
Cross-site scripting in bootstrap-select
Published: 2021-05-07T16:47:54Z
Aliases: CVE-2019-20921

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
Dependency Confusion in Bundler
Published: 2021-05-24T18:12:33Z
Aliases: CVE-2020-36327

Bundler 1.16.0 through 2.2.9 and 2.2.11 through 2.2.17 sometimes chooses a dependency source based on the highest gem version number, which means that a rogue gem found at a public source may be chosen, even if the intended choice was a private gem that is a dependency of another private gem that is explicitly depended on by the application.
Improper Certificate Validation in EM-HTTP-Request
Published: 2021-05-24T18:13:13Z
Aliases: CVE-2020-13482

EM-HTTP-Request 1.1.5 uses the library eventmachine in an insecure way that allows an attacker to perform a man-in-the-middle attack against users of the library. The hostname in a TLS server certificate is not verified.
Division by 0 in `DenseCountSparseOutput`
Published: 2021-05-21T14:23:55Z
Aliases: CVE-2021-29554

### Impact
An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.DenseCountSparseOutput`:

```python
import tensorflow as tf

values = tf.constant([], shape=[0, 0], dtype=tf.int64)
weights = tf.constant([])

tf.raw_ops.DenseCountSparseOutput(
  values=values, weights=weights,
  minlength=-1, maxlength=58, binary_output=True)
```
  
This is because the [implementation](https://github.com/tensorflow/tensorflow/blob/efff014f3b2d8ef6141da30c806faf141297eca1/tensorflow/core/kernels/count_ops.cc#L123-L127) computes a divisor value from user data but does not check that the result is 0 before doing the division:

```cc
int num_batch_elements = 1;
for (int i = 0; i < num_batch_dimensions; ++i) {
  num_batch_elements *= data.shape().dim_size(i);
}
int num_value_elements = data.shape().num_elements() / num_batch_elements;
```

Since `data` is given by the `values` argument, `num_batch_elements` is 0.

### Patches
We have patched the issue in GitHub commit [da5ff2daf618591f64b2b62d9d9803951b945e9f](https://github.com/tensorflow/tensorflow/commit/da5ff2daf618591f64b2b62d9d9803951b945e9f).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, and TensorFlow 2.3.3, as these are also affected.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Lack of validation in `SparseDenseCwiseMul`
Published: 2021-05-21T14:25:16Z
Aliases: CVE-2021-29567

### Impact
Due to lack of validation in `tf.raw_ops.SparseDenseCwiseMul`, an attacker can trigger denial of service via `CHECK`-fails or accesses to outside the bounds of heap allocated data:

```python
import tensorflow as tf

indices = tf.constant([], shape=[10, 0], dtype=tf.int64)
values = tf.constant([], shape=[0], dtype=tf.int64)
shape = tf.constant([0, 0], shape=[2], dtype=tf.int64)
dense = tf.constant([], shape=[0], dtype=tf.int64)
  
tf.raw_ops.SparseDenseCwiseMul(
    sp_indices=indices, sp_values=values, sp_shape=shape, dense=dense)
```

Since the [implementation](https://github.com/tensorflow/tensorflow/blob/38178a2f7a681a7835bb0912702a134bfe3b4d84/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L68-L80) only validates the rank of the input arguments but no [constraints between dimensions](https://www.tensorflow.org/api_docs/python/tf/raw_ops/SparseDenseCwiseMul), an attacker can abuse them to trigger internal `CHECK` assertions (and cause program termination, denial of service) or to write to memory outside of bounds of heap allocated tensor buffers.

### Patches
We have patched the issue in GitHub commit [7ae2af34087fb4b5c8915279efd03da3b81028bc](https://github.com/tensorflow/tensorflow/commit/7ae2af34087fb4b5c8915279efd03da3b81028bc).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Yakun Zhang and Ying Wang of Baidu X-Team.
Overflow/denial of service in `tf.raw_ops.ReverseSequence`
Published: 2021-05-21T14:26:13Z
Aliases: CVE-2021-29575

### Impact
The implementation of `tf.raw_ops.ReverseSequence` allows for stack overflow and/or `CHECK`-fail based denial of service.

```python
import tensorflow as tf

input = tf.zeros([1, 1, 1], dtype=tf.int32)
seq_lengths = tf.constant([0], shape=[1], dtype=tf.int32)

tf.raw_ops.ReverseSequence(
    input=input, seq_lengths=seq_lengths, seq_dim=-2, batch_dim=0)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/5b3b071975e01f0d250c928b2a8f901cd53b90a7/tensorflow/core/kernels/reverse_sequence_op.cc#L114-L118) fails to validate that `seq_dim` and `batch_dim` arguments are valid.
  
Negative values for `seq_dim` can result in stack overflow or `CHECK`-failure, depending on the version of Eigen code used to implement the operation. Similar behavior can be exhibited by invalid values of `batch_dim`.
  
### Patches
We have patched the issue in GitHub commit [ecf768cbe50cedc0a45ce1ee223146a3d3d26d23](https://github.com/tensorflow/tensorflow/commit/ecf768cbe50cedc0a45ce1ee223146a3d3d26d23).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution 
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
OS Command Injection in pomelo-monitor
Published: 2021-05-10T18:37:16Z
Aliases: CVE-2020-7620

pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.
Information Exposure in jaeger
Published: 2021-05-18T18:35:02Z
Aliases: CVE-2020-10750

Sensitive information written to a log file vulnerability was found in jaegertracing/jaeger before version 1.18.1 when the Kafka data store is used. This flaw allows an attacker with access to the container's log file to discover the Kafka credentials.
Segfault in `tf.raw_ops.SparseCountSparseOutput`
Published: 2021-05-21T14:29:02Z
Aliases: CVE-2021-29619

### Impact
Passing invalid arguments (e.g., discovered via fuzzing) to `tf.raw_ops.SparseCountSparseOutput` results in segfault.

### Patches
We have patched the issue in GitHub commit [82e6203221865de4008445b13c69b6826d2b28d9](https://github.com/tensorflow/tensorflow/commit/82e6203221865de4008445b13c69b6826d2b28d9).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Command injection in bestzip
Published: 2021-05-06T18:27:36Z
Aliases: CVE-2020-7730

The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.
Regular Expression Denial of Service (ReDoS) in jsx-slack
Published: 2021-12-17T19:59:02Z
Aliases: CVE-2021-43838

jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service (ReDoS) attack. 

### Impact

If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

```javascript
/** @jsxImportSource jsx-slack */
import { Section } from 'jsx-slack'

console.log(
  <Section>
    <blockquote>
      {[...Array(40)].map((_, i) => (
        <p>{i + 1}</p>
      ))}
    </blockquote>
  </Section>
)
```

### Patches

_See also: https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6_

jsx-slack v4.5.2 has updated regular expressions to prevent catastrophic backtracking.

jsx-slack v4.5.1 also had patched a workaround. It has no problems to contents with ASCII characters, but _still vulnerable to contents with multibyte characters_. (https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d)

### References

- https://nvd.nist.gov/vuln/detail/CVE-2021-43838
- https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d

### Credits

Thanks to @hieki for finding out this vulnerability.
HTTP request smuggling in netty
Published: 2021-12-09T19:09:17Z
Aliases: CVE-2021-43797

### Impact

Netty currently just skips control chars when these are present at the beginning / end of the header name. We should better fail fast as these are not allowed by the spec and could lead to HTTP request smuggling.

Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore and so not do the validation itself.
Prototype Pollution in @fabiocaccamo/utils.js
Published: 2021-12-10T20:31:32Z
Aliases: CVE-2021-3815

utils.js is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Prototype Pollution in field
Published: 2021-12-10T17:22:58Z
Aliases: CVE-2020-28269

Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
snipe-it is vulnerable to Improper Access Control
Published: 2021-12-16T14:32:39Z
Aliases: CVE-2021-4089

snipe-it prior to version 5.3.4 is vulnerable to Improper Access Control. Regular users with `DENY` set to all models permissions can still view model information via the /models/{id}/clone endpoint due to no authorize('view') permission being set.
Deserialization of Untrusted Data in logback
Published: 2021-12-17T20:00:50Z
Aliases: CVE-2021-42550

In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Open redirect vulnerability in Sourcegraph
Published: 2021-12-20T18:12:47Z
Aliases: CVE-2020-12283

### Impact

An open redirect vulnerability that allows users to be targeted for phishing attacks has been found in Sourcegraph instances configured with OAuth, OpenID, or SAML authentication enabled. Users targeted by these phishing attacks could have their authentication tokens silently harvested by an attacker.

### Resolution

Sourcegraph v3.14.4 and v3.15.1 have been released which resolve the vulnerability. ([associated change](https://github.com/sourcegraph/sourcegraph/pull/10167))

### Workarounds

Disabling OAuth, OpenID and/or SAML sign-in options until upgraded to the patched versions will secure Sourcegraph / workaround the issue.

### Timeline

- Apr 23, 8 AM PST: GitHub Security Lab reported the issue to Sourcegraph.
- Apr 23, 11 PM PST: A Sourcegraph engineer proposed a resolution for the vulnerability. https://github.com/sourcegraph/sourcegraph/pull/10167
- Apr 24, 3 AM PST: The proposed resolution was reviewed, approved, and merged.
- Apr 28, 2 PM PST: Patch releases for 3.14.4 and 3.15.1 were published.
- Apr 29, 10 PM PST: Mitre publicly disclosed [CVE-2020-12283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12283).
- Apr 30, 11 AM PST: Sourcegraph issued a GitHub security advisory and notified all affected users.

### References

- [Mitre: CVE-2020-12283](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12283)
- [GitHub Security Lab: GHSL-2020-085](https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraph)
- [detectify's blog post on open redirect vulnerabilities
](https://blog.detectify.com/2019/05/16/the-real-impact-of-an-open-redirect/)

### For more information

If you have any questions or comments about this advisory, please contact us at [support@sourcegraph.com](mailto:support@sourcegraph.com) and include `CVE-2020-12283` in the title.
Privilege escalation in the Sulu Admin panel
Published: 2021-12-15T22:55:16Z
Aliases: CVE-2021-43835

### Impact

Impacted are only users which already have access to the admin UI. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction.

### Patches

The versions have been patched in 2.2.18, 2.3.8 and 2.4.0.

### Workarounds

Patching the ProfileController of affected sulu versions yourself by overwriting it.

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [sulu/sulu repo](https://github.com/sulu/sulu/issues)
* Email us at [security@sulu.io](mailto:security@sulu.io)
Vulnerable dependency in XTDB connector
Published: 2021-12-16T18:53:32Z

### Impact

The impacted portion of the XTDB connector is its connectivity to S3 as a backing store: this is the only portion of the connector that uses this vulnerable `httpclient` dependency. Per the description, the vulnerability regards URIs that may be misinterpreted, which given the area of impact within the connector we understand to be any URI used to configure connectivity to S3. Note therefore that if you do not use or configure S3 as a backing store in your use of the connector, you should not be exposed to any vulnerability from this component.

### Patches

The problem has been addressed in version 4.5.13 of the httpclient library, which is included as a replacement dependency version for the build of the XTDB connector from release 3.5 onwards. Therefore, using release 3.5 (or newer) of the connector will include the fixes to address this CVE.

### Workarounds

We have not investigated specific workarounds, but per the description of the issue it seems likely that ensuring the proper URIs are used for any S3 connectivity used by the connector (and ensuring there are appropriate controls around modifying such URIs in the connector's configuration) would be the first point of investigation.

### References

https://nvd.nist.gov/vuln/detail/CVE-2020-13956
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Published: 2021-12-03T20:38:57Z
Aliases: CVE-2021-4017

showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Apache Log4j Remote Code Execution
Published: 2021-12-14T21:07:14Z

### Impact

Opencast uses an Apache Log4j2 version which, combined with older JDK versions, can be used for remote code execution attacks which have been found to be actively exploited.

Apache Log4j2 <=2.14.1 JNDI features is not sufficiently protected. An attacker who can control log messages or log message parameters can execute arbitrary code when message lookup substitution is enabled.

### Who is affected

- Opencast before 9.10 or 10.6 are affected
    - Log4j version: all 2.x versions before 2.15.0 are affected

### Patches

The issue has been fixed in Opencast 9.10 and 10.6.

### Workarounds

The vulnerability can be mitigated by setting system property `log4j2.formatMsgNoLookups` to `true`.

### References

- [Opencast pull request mitigating the vulnerability](https://github.com/opencast/opencast/pull/3253)
- [CVE-2021-44228 Detail](https://nvd.nist.gov/vuln/detail/CVE-2021-44228)
- [Analysis and Remediation Guidance to the Log4j Zero-Day RCE (CVE-2021-44228) Vulnerability](https://www.veracode.com/blog/security-news/urgent-analysis-and-remediation-guidance-log4j-zero-day-rce-cve-2021-44228)
- [VE-2021-44228 – Log4j 2 Vulnerability Analysis](https://www.randori.com/blog/cve-2021-44228/)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/opencast/opencast/issues)
* Email us at [security@opencast.org](mailto:security@opencast.org)


### Note about dependencies

This issue affects many Java applications. Please also verify these are not vulnerable.
Open redirect in @auth0/nextjs-auth0
Published: 2021-12-16T18:52:21Z
Aliases: CVE-2021-43812

### Overview

Versions `<=1.6.1` do not filter out certain `returnTo` parameter values from the login url, which expose the application to an open redirect vulnerability.

### Am I affected?
You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `<=1.6.1`.

### How to fix that?
Upgrade to version `>=1.6.2`

### Will this update impact my users?
The fix provided in the patch will not affect your users.
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data
Published: 2021-12-14T19:49:31Z
Aliases: CVE-2021-4104

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
Improper Input Validation in xdLocalStorage
Published: 2021-12-09T19:30:29Z
Aliases: CVE-2015-9545

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
Published: 2021-12-17T20:40:58Z
Aliases: CVE-2020-35216

An issue in Atomix v3.1.5 allows attackers to cause a denial of service (DoS) via false member down event messages.
django-helpdesk is vulnerable to Cross-site Scripting
Published: 2021-12-03T20:42:26Z
Aliases: CVE-2021-3994

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Improper Restriction of XML External Entity Reference in com.h2database:h2.
Published: 2021-12-16T14:29:57Z
Aliases: CVE-2021-23463

H2 is an embeddable RDBMS written in Java. The package com.h2database:h2 from 1.4.198 and before 2.0.202 are vulnerable to XML External Entity (XXE) Injection via the org.h2.jdbc.JdbcSQLXML class object, when it receives parsed string data from org.h2.jdbc.JdbcResultSet.getSQLXML() method. If it executes the getSource() method when the parameter is DOMSource.class it will trigger the vulnerability.
Serialization gadgets exploit in jackson-databind
Published: 2021-12-09T19:15:11Z
Aliases: CVE-2020-35491

FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource.