aswin1906/github-advisory-2021.csv huggingface dataset:
Regex denial of service vulnerability in codesample plugin
Published: 2021-01-06T19:25:46Z

### Impact
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the `codesample` plugin using TinyMCE 5.5.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Disable the `codesample` plugin
- Disable ruby code samples using the [codesample_languages](https://www.tiny.cloud/docs/plugins/opensource/codesample/#exampleusingcodesample_languages) setting
- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the [codesample_global_prismjs](https://www.tiny.cloud/docs/plugins/opensource/codesample/#codesample_global_prismjs) setting

### Acknowledgements
Tiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](http://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Prototype Pollution in immer
Published: 2021-01-20T21:27:56Z
Aliases: CVE-2020-28477

## Overview

Affected versions of immer are vulnerable to Prototype Pollution.

## Proof of exploit

```js
const {applyPatches, enablePatches} = require("immer");
enablePatches();
let obj = {};
console.log("Before : " + obj.polluted);
applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]);
// applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]);
console.log("After : " + obj.polluted);
```

## Remediation

Version 8.0.1 contains a [fix](https://github.com/immerjs/immer/commit/da2bd4fa0edc9335543089fe7d290d6a346c40c5) for this vulnerability, updating is recommended.
Users can edit the tags of any discussion
Published: 2021-01-29T18:13:32Z

This advisory concerns a vulnerability which was patched and publicly released on October 5, 2020.

### Impact
This vulnerability allowed any registered user to edit the tags of any discussion for which they have READ access using the REST API.

Users were able to remove any existing tag, and add any tag in which they are allowed to create discussions. The chosen tags still had to match the configured Tags minimums and maximums.

By moving the discussion to new tags, users were able to go around permissions applied to restricted tags. Depending on the setup, this can include publicly exposing content that was only visible to certain groups, or gain the ability to interact with content where such interaction was limited.

The full impact varies depending on the configuration of permissions and restricted tags, and which community extensions are being used. All tag-scoped permissions offered by extensions are impacted by this ability to go around them.

Forums that don't use restricted tags and don't use any extension that relies on tags for access control should not see any security impact. An update is still required to stop users from being able to change any discussion's tags.

Forums that don't use the Tags extension are unaffected.

### Patches
The fix will be available in version v0.1.0-beta.14 with Flarum beta 14. The fix has already been back-ported to Flarum beta 13 as version v0.1.0-beta.13.2 of the Tags extension.

### Workarounds
Version v0.1.0-beta.13.2 of the Tags extension allows existing Flarum beta 13 forums to fix the issue without the need to update to beta 14.

Forums that have not yet updated to Flarum beta 13 are encouraged to update as soon as possible.

### References

- [Release announcement](https://discuss.flarum.org/d/25059-security-update-to-flarum-tags-010-beta132)
- [GitHub issue](https://github.com/flarum/core/issues/2355)

### For more information
If you have any questions or comments about this advisory, please start a new discussion on our [support forum](https://discuss.flarum.org/t/support).

If you discover a security vulnerability within Flarum, please send an e-mail to [security@flarum.org](mailto:security@flarum.org). All security vulnerabilities will be promptly addressed. More details can be found in our [security policy](https://github.com/flarum/core/security/policy).
django-celery-results Stores Sensitive Information In Cleartext
Published: 2021-06-04T21:46:52Z
Aliases: CVE-2020-17495

django-celery-results prior to 2.4.0 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

In version 2.4.0 this is no longer the default behaviour but can be re-enabled with the `result_extended` flag in which case care should be taken to ensure any sensitive variables are scrubbed - see [here](https://github.com/celery/django-celery-results/issues/154#issuecomment-734706270) for an example.
Unsynchronized Access to Shared Data in a Multithreaded Context in RESTEasy
Published: 2021-06-08T22:29:46Z
Aliases: CVE-2020-25724

A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to privileged information. The highest threat from this vulnerability is to confidentiality and integrity. Versions before resteasy 2.0.0.Alpha3 are affected.
Temporary urls leaked via logging
Published: 2021-06-08T19:23:22Z
Aliases: CVE-2017-8761

In OpenStack Swift prior to 2.15.2, the proxy-server logs full tempurl paths, potentially leaking reusable tempurl signatures to anyone with read access to these logs. All Swift deployments using the tempurl middleware are affected.
CRLF injection in urllib3
Published: 2021-06-18T18:46:43Z
Aliases: CVE-2020-26137

urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of `putrequest()`. NOTE: this is similar to CVE-2020-26116.
Improper Authentication in Atlassian Connect Spring Boot
Published: 2021-06-16T17:23:12Z
Aliases: CVE-2021-26077

Broken Authentication in Atlassian Connect Spring Boot (ACSB) in version 1.1.0 before 2.1.3 and from version 2.1.4 before 2.1.5: Atlassian Connect Spring Boot is a Java Spring Boot package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Spring Boot app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Spring Boot versions 1.1.0 before 2.1.3 and versions 2.1.4 before 2.1.5 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
Command injection in LocalStack
Published: 2021-06-18T18:38:00Z
Aliases: CVE-2021-32090

The dashboard component of StackLift LocalStack allows attackers to inject arbitrary shell commands via the functionName parameter.
elFinder unsafe upload filtering leading to remote code execution
Published: 2021-06-15T15:51:02Z
Aliases: CVE-2021-23394

### Impact

Before elFinder 2.1.58, the upload filter did not disallow the upload of `.phar` files. As several Linux distributions are now shipping Apache configured in a way it will process these files as PHP scripts, attackers could gain arbitrary code execution on the server hosting the PHP connector (even in minimal configuration).

### Patches

The issue has been addressed with https://github.com/Studio-42/elFinder/commit/75ea92decc16a5daf7f618f85dc621d1b534b5e1, associating `.phar` files to the right MIME type. Unless explicitly allowed in the configuration, such files cannot be uploaded anymore. This patch is part of the last release of elFinder, 2.1.58.

### Workarounds

If you can't update to 2.1.58, make sure your connector is not exposed without authentication.

### Important tips

Server-side scripts can often be created as text files. Currently, elFinder has an appropriate MIME type set for file extensions that are generally runnable on a web server.

However, the server has various settings. In some cases, the executable file may be judged as "text/plain". Therefore, elFinder installers should understand the extensions that can be executed on the web server where elFinder is installed, and check if there are any missing items in the elFinder settings.

The elFinder PHP connector has an option "additionalMimeMap" that specifies the MIME type for each extension. See [#3295(comment)](https://github.com/Studio-42/elFinder/issues/3295#issuecomment-853042139) for more information.

### References

- https://snyk.io/vuln/composer:studio-42%2Felfinder
- https://github.com/Studio-42/elFinder/issues/3295
- Further technical details will be disclosed on https://blog.sonarsource.com/tag/security after some time.

### For more information

If you have any questions or comments about this advisory, you can contact:
- The original reporters, by sending an email to  support [at] snyk.io or vulnerability.research [at] sonarsource.com;
- The maintainers, by opening an issue on this repository.
Prototype pollution in safe-flat
Published: 2021-06-21T17:18:29Z
Aliases: CVE-2021-25927

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Improper Input Validation in Hibernate Validator
Published: 2021-06-04T21:36:34Z
Aliases: CVE-2020-10693

A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages.
Cross-site Scripting in wagtail
Published: 2021-06-17T20:10:42Z
Aliases: CVE-2021-32681

### Impact
When the `{% include_block %}` template tag is used to output the value of a plain-text StreamField block (`CharBlock`, `TextBlock` or a similar user-defined block derived from `FieldBlock`), and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This could allow users to insert arbitrary HTML or scripting. This vulnerability is only exploitable by users with the ability to author StreamField content (i.e. users with 'editor' access to the Wagtail admin).

### Patches
Patched versions have been released as Wagtail 2.11.8 (for the LTS 2.11 branch), Wagtail 2.12.5, and Wagtail 2.13.2 (for the current 2.13 branch).

Site implementors who wish to retain the existing behaviour of allowing editors to insert HTML content in these blocks (and are willing to accept the risk of untrusted editors inserting arbitrary code) may disable the escaping by surrounding the relevant `{% include_block %}` tag in `{% autoescape off %}...{% endautoescape %}`.

### Workarounds
Site implementors who are unable to upgrade to a current supported version should audit their use of `{% include_block %}` to ensure it is not used to output `CharBlock` / `TextBlock` values with no associated template. Note that this only applies where `{% include_block %}` is used directly on that block (uses of `include_block` on a block _containing_ a CharBlock / TextBlock, such as a StructBlock, are unaffected). In these cases, the tag can be replaced with Django's `{{ ... }}` syntax - e.g. `{% include_block my_title_block %}` becomes `{{ my_title_block }}`.

### Acknowledgements
Many thanks to Karen Tracey for reporting this issue.

### For more information
If you have any questions or comments about this advisory:

* Visit Wagtail's [support channels](https://docs.wagtail.io/en/stable/support.html)
* Email us at security@wagtail.io (if you wish to send encrypted email, the public key ID is `0x6ba1e1a86e0f8ce8`)
Passing in a non-string 'html' argument can lead to unsanitized output
Published: 2021-06-18T19:31:35Z
Aliases: CVE-2021-32696

A type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function.

### Impact

XSS

### Patches

`3.2.0`

### Workarounds

Ensure that the `html` parameter is a string before calling the function.
Script injection
Published: 2021-06-04T19:09:26Z
Aliases: CVE-2021-32661

### Impact

A malicious internal actor can potentially upload documentation content with malicious scripts by embedding the script within an `object` element. This may give access to sensitive data when other users visit that same documentation page.

The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store.

### Patches

The vulnerability is patched in the `0.9.5` release of `@backstage/plugin-techdocs`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Reflected cross-site scripting in development mode handler in Vaadin
Published: 2021-06-28T16:52:45Z

URL encoding error in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows local user to execute arbitrary JavaScript code by opening crafted URL in browser.

- https://vaadin.com/security/cve-2021-33604
Reflected cross-site scripting issue in Datasette
Published: 2021-06-10T17:22:59Z
Aliases: CVE-2021-32670

Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.
glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex
Published: 2021-06-07T21:56:34Z
Aliases: CVE-2020-28469

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Infinite Loop in Apache PDFBox
Published: 2021-06-15T15:54:29Z
Aliases: CVE-2021-31812

In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability
Published: 2021-06-10T15:43:22Z
Aliases: CVE-2021-28169

Requests to the `ConcatServlet` and `WelcomeFilter` are able to access protected resources within the `WEB-INF` directory. For example a request to the `ConcatServlet` with a URI of `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

This occurs because both `ConcatServlet` and `WelcomeFilter` decode the supplied path to verify it is not within the `WEB-INF` or `META-INF` directories. It then uses this decoded path to call `RequestDispatcher` which will also do decoding of the path. This double decoding allows paths with a doubly encoded `WEB-INF` to bypass this security check.

### Impact
This affects all versions of `ConcatServlet` and `WelcomeFilter` in versions before 9.4.41, 10.0.3 and 11.0.3.

### Workarounds

If you cannot update to the latest version of Jetty, you can instead deploy your own version of the [`ConcatServlet`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/ConcatServlet.java) and/or the [`WelcomeFilter`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java) by using the code from the latest version of Jetty.
Excessive Iteration Denial of Service in Apache PDFBox
Published: 2021-06-16T17:56:46Z
Aliases: CVE-2021-27807

A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
non-admin users can create integration role with administrator role
Published: 2021-06-28T18:21:01Z

### Impact
non-admin users can create integration role with administrator role

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3 corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Observable Timing Discrepancy in aaugustin websockets library
Published: 2021-06-11T17:43:14Z
Aliases: CVE-2021-33880

The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enabled with basic_auth_protocol_factory(credentials=...). An attacker may be able to guess a password via a timing attack.
Cross-site scripting in Contentful
Published: 2021-06-18T18:32:20Z
Aliases: CVE-2020-13258

Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.
Cross-Site Scripting
Published: 2021-06-15T15:59:27Z
Aliases: CVE-2021-20293

A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
XSS vulnerability with translator
Published: 2021-06-07T21:48:17Z
Aliases: CVE-2021-32671

Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 (our last beta before v1.0.0) and was not noticed or documented.

This allowed for any user to type malicious HTML markup within certain user input fields and have this execute on client browsers. The example which led to the discovery of this vulnerability was in the forum search box. Entering faux-malicious HTML markup, such as <script>alert('test')</script> resulted in an alert box appearing on the forum. This attack could also be modified to perform AJAX requests on behalf of a user, possibly deleting discussions, modifying their settings or profile, or even modifying settings on the Admin panel if the attack was targetted towards a privileged user.

### Impact

All Flarum communities that run flarum v1.0.0 or v1.0.1 are impacted.

### Patches

The vulnerability has been fixed and published as flarum/core v1.0.2. All communities running Flarum v1.0 have to upgrade as soon as possible to v1.0.2 using:

```
composer update --prefer-dist --no-dev -a -W
```

You can then confirm you run the latest version using:

```
composer show flarum/core
```

### Workarounds

__None.__

### For more information

For any questions or comments on this vulnerability please visit https://discuss.flarum.org/d/27558.

For support questions create a discussion at https://discuss.flarum.org/t/support.

A reminder that if you ever become aware of a security issue in Flarum, please report it to us privately by emailing security@flarum.org, and we will address it promptly.
Cross-site scripting in Plone
Published: 2021-06-08T23:19:28Z
Aliases: CVE-2021-33513

Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.
Denial of service in geth
Published: 2021-06-29T21:13:20Z
Aliases: CVE-2020-26242

### Impact
Denial-of-service (crash) during block processing

### Details

Affected versions suffer from a vulnerability which can be exploited through the `MULMOD` operation, by specifying a modulo of `0`: `mulmod(a,b,0)`, causing a `panic` in the underlying library. 
The crash was in the `uint256` library, where a buffer [underflowed](https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L442).

	if `d == 0`, `dLen` remains `0`

and https://github.com/holiman/uint256/blob/4ce82e695c10ddad57215bdbeafb68b8c5df2c30/uint256.go#L451 will try to access index `[-1]`.

The `uint256` library was first merged in this [commit](https://github.com/ethereum/go-ethereum/commit/cf6674539c589f80031f3371a71c6a80addbe454), on 2020-06-08. 
Exploiting this vulnerabilty would cause all vulnerable nodes to drop off the network. 

The issue was brought to our attention through a [bug report](https://github.com/ethereum/go-ethereum/issues/21367), showing a `panic` occurring on sync from genesis on the Ropsten network.
 
It was estimated that the least obvious way to fix this would be to merge the fix into `uint256`, make a new release of that library and then update the geth-dependency.

- https://github.com/holiman/uint256/releases/tag/v1.1.1 was made the same day, 
- PR to address the issue: https://github.com/holiman/uint256/pull/80 
- PR to update geth deps: https://github.com/ethereum/go-ethereum/pull/21368 


### Patches
Upgrade to v1.9.18 or higher

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Croos-site scripting in Croogo
Published: 2021-06-22T15:23:21Z
Aliases: CVE-2019-20789

Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.
Improper Privilege Management in HashiCorp Nomad
Published: 2021-06-24T20:28:28Z
Aliases: CVE-2021-3283

HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3.
Path traversal in impacket
Published: 2021-06-18T18:43:14Z
Aliases: CVE-2021-31800

Multiple path traversal vulnerabilities exist in smbserver.py in Impacket before 0.9.23. An attacker that connects to a running smbserver instance can list and write to arbitrary files via ../ directory traversal. This could potentially be abused to achieve arbitrary code execution by replacing /etc/shadow or an SSH authorized key.
Code injection in Apache Druid
Published: 2021-06-16T17:40:47Z
Aliases: CVE-2021-25646

Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.