aswin1906/github-advisory-2021.csv huggingface dataset:
Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware
Published: 2021-12-09T19:57:29Z
Aliases: CVE-2020-7616

express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.
Cross-Site Request Forgery in kimai2
Published: 2021-12-10T20:34:01Z
Aliases: CVE-2021-4033

CSRF in saving invoices / modifying status of invoices (pending and cancel only)
Inability to de-op players if listed in ops.txt with non-lowercase letters
Published: 2021-12-16T18:53:57Z

### Impact
Originally reported in iTXTech/Genisys#1188

```txt
PotterHarry98
potterharry98
```

`deop PotterHarry98`

will remove `potterharry98` from the ops.txt but not `PotterHarry98`.

Operator permissions are checked using `Config->exists()` with `lowercase=true`, which will result in a match:
https://github.com/pmmp/PocketMine-MP/blob/22bb1ce8e03dba57173debf0415390511d68e045/src/utils/Config.php#L449

This means that it's possible to make yourself impossible to de-op (using commands) by adding your name to ops.txt with uppercase letters.

### Patches
4d37b79ff7f9d9452e988387f97919a9a1c4954e

### Workarounds
This can be easily addressed by removing the offending lines from ops.txt manually.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pmmp/PocketMine-MP](https://github.com/pmmp/PocketMine-MP)
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Uncontrolled Resource Consumption in strapi
Published: 2021-12-10T17:22:01Z
Aliases: CVE-2020-8123

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
kimai2 is vulnerable to Improper Access Control
Published: 2021-12-03T20:42:59Z
Aliases: CVE-2021-3992

kimai2 is vulnerable to Improper Access Control
Critical vulnerability in log4j may affect generated PEAR projects
Published: 2021-12-16T21:01:51Z

### Impact
UIMA PEAR projects that have been generated with the `de.averbis.textanalysis:pear-archetype ` version `2.0.0` have a maven dependency with scope `test` to` log4j 2.8.2` and might be affected by CVE-2021-44228.

### Patches
- The issue has been resolved in `de.averbis.textanalysis:pear-archetype ` version `2.0.1`. Please make sure to use `de.averbis.textanalysis:pear-archetype ` version >= `2.0.1` for generating new PEAR projects.

- Existing maven PEAR projects can be patched by manually upgrading to `log4j` >= `2.16.0` in `pom.xml`.


### References
https://www.lunasec.io/docs/blog/log4j-zero-day/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/averbis/pear-archetype/issues
Authentication Bypass in dex
Published: 2021-12-20T17:52:12Z
Aliases: CVE-2020-27847

A vulnerability exists in the SAML connector of the github.com/dexidp/dex library used to process SAML Signature Validation. This flaw allows an attacker to bypass SAML authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects dex versions before 2.27.0.
Prototype Pollution in putil-merge
Published: 2021-12-10T17:24:16Z
Aliases: CVE-2021-25953

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
Cross-site Scripting in python-cjson
Published: 2021-12-06T18:17:45Z
Aliases: CVE-2009-4924

Python-cjson 1.0.5 does not properly handle a ['/'] argument to cjson.encode, which makes it easier for remote attackers to conduct certain cross-site scripting (XSS) attacks involving Firefox and the end tag of a SCRIPT element.
OS Command Injection in heroku-addonpool
Published: 2021-12-09T19:52:03Z
Aliases: CVE-2020-7634

heroku-addonpool through 0.1.15 is vulnerable to Command Injection. The second parameter of the exported function `HerokuAddonPool(id, app, opt)` can be controlled by users without any sanitization.

**PoC**
```js
var Root = require("heroku-addonpool");
var root = Root("sss", "& touch JHU", {});
root.setup();
```
DoS Vulnerability from Upstream Actix Web Issues
Published: 2021-12-15T22:51:07Z

### Impact
This vulnerability affects all users of the `perseus deploy` functionality who have not exported their sites to static files. If you are using the inbuilt Perseus server in production, there is a memory leak in Actix Web stemming from [this upstream issue](https://github.com/actix/actix-web/issues/1780) which can allow even a single user to cause the process to exhaust its memory on low-memory servers by continuously reloading the page. Note that this issue does not affect all Actix Web applications, but rather results from certain usage patterns which appear to be present in Perseus' server mechanics.

### Patches
This vulnerability is addressed in all versions after Perseus `v0.3.0-beta.21`, which temporarily discontinues the use of `perseus-actix-web` (until the upstream bug is fixed) and switches to `perseus-warp` instead, which utilizes [Warp](https://github.com/seanmonstar/warp).

Additionally, as of Perseus `v0.3.0-beta.22`, the Actix Web integration has been upgraded to use the latest unstable beta version of Actix Web, which appears to partially resolve this issue (the severity of the memory leak is reduced). However, due to the instability of this version, the default integration will remain Warp for now, and a warning will appear if you attempt to use the Actix Web integration.

<details>
<summary>Using the Actix Web integration</summary>

If the instability of the latest beta version of Actix Web is not a concern for you, you can use this integration by adding `-i actix-web` to `perseus serve` and the like. This will print a warning about instability, and will then operate with the beta version. Please report any failures in functionality that are not security-related to the Perseus team by [opening an issue on the repository](https://github.com/arctic-hen7/perseus/issues/new/choose).

Note however that switching to the Warp integration requires no code changes whatsoever unless you've ejected, so there are very few disadvantages to this change.

</details>

### Workarounds
Due to significant infrastructural changes within other Perseus packages that were needed to support Warp, this integration is not backward-compatible with any previous version of Perseus, meaning there are no easily feasible workarounds. If you're only in development though, this vulnerability is irrelevant until you push to production.

### CVE Status

Due to GitHub's requirements, a CVE can't be issued for this security advisory because the issue is technically one with Actix Web (though it's only in combination with certain mechanics in the Perseus server that this problem arises).

### References
See [this upstream issue](https://github.com/actix/actix-web/issues/1780) in Actix Web.

### For more information
If you have any questions or comments about this advisory:
* Open an issue on this repository
* Email me at [arctic_hen7@pm.me](mailto:arctic_hen7@pm.me)
firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF)
Published: 2021-12-06T17:19:18Z
Aliases: CVE-2021-4015

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Cross-site scripting in react-bootstrap-table
Published: 2021-12-10T18:58:49Z
Aliases: CVE-2021-23398

All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
Remote Code Execution in AjaxNetProfessional
Published: 2021-12-16T15:27:55Z
Aliases: CVE-2021-23758

All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes, which can be abused to gain remote code execution.
OS Command Injection in Strapi
Published: 2021-12-10T17:22:12Z
Aliases: CVE-2019-19609

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Improperly Controlled Modification of Dynamically-Determined Object Attributes in Apache Struts
Published: 2021-12-02T14:50:51Z
Aliases: CVE-2019-0230

Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.
GitLab auth uses full name instead of username as user ID, allowing impersonation
Published: 2021-12-20T17:56:03Z
Aliases: CVE-2020-5415

### Impact

Installations which use the GitLab auth connector are vulnerable to identity spoofing by way of configuring a GitLab account with the same full name as another GitLab user who is granted access to a Concourse team by having their full name listed under `users` in the team configuration or given to the `--gitlab-user` flag.

See the [GitLab auth docs](https://concourse-ci.org/gitlab-auth.html) for details.

Concourse installations which do not configure the GitLab auth connector are not affected.

### Patches

Concourse [v6.3.1](https://github.com/concourse/concourse/releases/tag/v6.3.1) and [v6.4.1](https://github.com/concourse/concourse/releases/tag/v6.4.1) were both released with a fix on August 4th, 2020.

Both versions change the GitLab connector to use the username, rather than the full name. This was always the intent, and the previous behavior was originally reported as a bug (concourse/dex#7) prior to being reported as a security issue.

Any Concourse teams which configure GitLab users will have to switch each user from their full name to their username upon upgrading to these versions.

### Workarounds

GitLab groups do not have this vulnerability, so GitLab users may be moved into groups which are then configured in the Concourse team.

### References

* concourse/dex#12: PR with the fix

### For more information

If you have any questions or comments about this advisory, you may reach us privately at [concourseteam+security@gmail.com](mailto:concourseteam+security@gmail.com).
Cross Site Request Forgery in mailman
Published: 2021-12-16T15:27:06Z
Aliases: CVE-2021-44227

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
vault-cli contains possible RCE when reading user-defined data
Published: 2021-12-16T21:02:12Z
Aliases: CVE-2021-43837

### Impact
_What kind of vulnerability is it? Who is impacted?_

vault-cli features the ability for rendering templated values (as explained in the [documentation](https://github.com/peopledoc/vault-cli/blob/2.2.1/docs/howto/templated_secrets.rst)). When a secret starts with the prefix `!template!`, vault-cli interprets the rest of the contents of the secret as a Jinja2 template.
Jinja2 is a powerful templating engine and it's not designed to safely render arbitrary templates. An attacker controlling a jinja2 template rendered on a machine can trigger arbitrary code, making this a Remote Code Execution (RCE) risk.
If the content of the vault can be completely trusted, then this is not a problem. Otherwise, if your threat model includes cases where an attacker can manipulate a secret value read from the vault using vault-cli, then this vulnerability may impact you.

This does not impact `vault` itself, except for the fact that the attacker, having an RCE on the machine that executes `vault-cli`, may abuse the token that `vault-cli` uses, to read, write or delete other data from the vault.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

In 3.0.0, the code related to interpreting vault templated secrets has been removed entirely.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Using the environment variable `VAULT_CLI_RENDER=false` or the flag `--no-render` (placed between `vault-cli` and the subcommand, e.g. `vault-cli --no-render get-all`) or adding `render: false` to the vault-cli configuration yaml file disables rendering and removes the vulnerability.
Using the python library, you can use: `vault_cli.get_client(render=False)` when creating your client to get a client that will not render templated secrets and thus operates securely.

### References
_Are there any links users can visit to find out more?_

Here's an article explaining how jinja2 templates might be exploited to have side effects: https://podalirius.net/en/publications/grehack-2021-optimizing-ssti-payloads-for-jinja2/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the vault-cli repo](https://github.com/peopledoc/vault-cli/issues/new)
showdoc is vulnerable to URL Redirection to Untrusted Site
Published: 2021-12-03T20:41:35Z
Aliases: CVE-2021-3989

showdoc is vulnerable to URL Redirection to Untrusted Site.
The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect
Published: 2021-12-20T18:02:38Z
Aliases: CVE-2020-5233

### Impact
An open redirect vulnerability has been found in `oauth2_proxy`. Anyone who uses `oauth2_proxy` may potentially be impacted. 

For a context [detectify] have an in depth blog post about the potential impact of an open redirect. Particularly see the OAuth section.

**tl;dr**: People's authentication tokens could be silently harvested by an attacker. e.g:
`facebook.com/oauth.php?clientid=123&state=abc&redirect_url=https://yourdomain.com/red.php?url%3dhttps://attacker.com/`

### Patches

@sauyon found the issue, and has submitted a patch. 

```
diff --git a/oauthproxy.go b/oauthproxy.go
index 72ab580..f420df6 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -517,7 +517,7 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error)
 // IsValidRedirect checks whether the redirect URL is whitelisted
 func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
 	switch {
-	case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//"):
+	case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !strings.HasPrefix(redirect, "/\\"):
 		return true
 	case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):
 		redirectURL, err := url.Parse(redirect)
```

This patch will be applied to the next release, which is scheduled for when this is publicly disclosed.

### Workarounds

At this stage there is no work around.
Code Injection in md-to-pdf.
Published: 2021-12-16T14:34:40Z
Aliases: CVE-2021-23639

The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content, without disabling the JS engine.
Cross-site Scripting in kimai2
Published: 2021-12-03T20:43:06Z
Aliases: CVE-2021-3983

kimai2 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Malicious Atomix node queries expose sensitive information
Published: 2021-12-17T20:41:45Z
Aliases: CVE-2020-35215

An issue in Atomix v3.1.5 allows attackers to access sensitive information when a malicious Atomix node queries distributed variable primitives which contain the entire primitive lists that ONOS nodes use to share important states.
Deserialization of Untrusted Data in topthink/framework
Published: 2021-12-10T20:23:19Z
Aliases: CVE-2021-36564

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.
Improper Authentication in HashiCorp Nomad
Published: 2021-12-10T20:17:55Z
Aliases: CVE-2021-43415

HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 1.2.0, with the QEMU task driver enabled, allowed authenticated users with job submission capabilities to bypass the configured allowed image paths. Fixed in 1.0.14, 1.1.8, and 1.2.1.
Code Injection in jackson-databind
Published: 2021-12-09T19:14:51Z
Aliases: CVE-2020-24616

This project contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPDataSource (aka Anteros-DBCP).
Improper Privilege Management in devise_masquerade
Published: 2021-12-08T19:55:30Z
Aliases: CVE-2021-28680

The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side `secret_key_base` value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When `devise_masquerade` is used, however, an attacker can decide which user the "back" action will go back to without knowing that user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.
OS Command Injection in fsa
Published: 2021-12-09T19:56:44Z
Aliases: CVE-2020-7615

fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.
showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published: 2021-12-03T20:38:50Z
Aliases: CVE-2021-3990

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG).
XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
Published: 2021-12-01T18:28:29Z

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
Code Injection in node-rules
Published: 2021-12-10T20:05:37Z
Aliases: CVE-2020-7609

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend
Published: 2021-12-01T18:29:21Z
Aliases: CVE-2021-43776

### Impact
This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities.

### Patches
This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.

### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Remote code injection in Log4j (through pax-logging-log4j2)
Published: 2021-12-10T20:15:37Z

### Impact
Remote Code Execution.

### Patches
Users of pax-logging 1.11.9 should update to 1.11.10.
Users of pax-logging 2.0.10 should update to 2.0.11.

### Workarounds
Set system property `-Dlog4j2.formatMsgNoLookups=true`

### References
https://github.com/advisories/GHSA-jfh8-c2jp-5v3q
SQL injection in prestashop/prestashop
Published: 2021-12-07T21:23:17Z
Aliases: CVE-2021-43789

### Impact
Blind SQLi using Search filters with `orderBy` and `sortOrder` parameters

### Patches
The problem is fixed in 1.7.8.2
Potential Zip Slip Vulnerability in baserCMS
Published: 2021-12-01T18:29:32Z
Aliases: CVE-2021-41279

There is a OS Command Injection Vulnerability on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

Target
baserCMS 4.5.3 and earlier versions

Vulnerability
OS Command Injection Vulnerability.

Countermeasures
Update to the latest version of baserCMS

Credits
Daniele Scanu @SoterItSecurity
elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Published: 2021-12-03T20:43:25Z
Aliases: CVE-2021-3964

elgg is vulnerable to Authorization Bypass Through User-Controlled Key
Prototype pollution in paypal-adaptive
Published: 2021-12-10T20:05:57Z
Aliases: CVE-2020-7643

paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.
Unsafe HTTP Redirect in Puppet Agent and Puppet Server
Published: 2021-12-02T17:52:45Z
Aliases: CVE-2021-27023

A flaw was discovered in Puppet Agent and Puppet Server that may result in a leak of HTTP credentials when following HTTP redirects to a different host. This is similar to CVE-2018-1000007
Buffer overrun in CGI.escape_html
Published: 2021-12-14T21:36:20Z
Aliases: CVE-2021-41816

A buffer overrun vulnerability was discovered in CGI.escape_html. This can lead to a buffer overflow when a user passes a very large string (> 700 MB) to CGI.escape_html on a platform where long type takes 4 bytes, typically, Windows.
Cross-site Scripting in LibreNMS
Published: 2021-12-03T20:49:16Z
Aliases: CVE-2021-44279

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/forms/poller-groups.inc.php.
Open Redirect in Flask-Security-Too
Published: 2021-12-14T18:14:04Z

# Withdrawn

Duplicate of GHSA-6qmf-fj6m-686c

# Original description

Flask-Security-Too allows redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL.

This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com
will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want.

This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False`.