aswin1906/github-advisory-2021.csv huggingface dataset:
PHP Code Injection by malicious function name in smarty
Published: 2021-02-26T19:53:24Z
Aliases: CVE-2021-26120

Template authors could inject php code by choosing a malicous {function} name. Sites that cannot fully trust template authors should update as soon as possible. Please upgrade to 3.1.39 or higher.
Command injection in total.js
Published: 2021-02-05T20:43:27Z
Aliases: CVE-2020-28494

There is a command injection vulnerability that affects the package total.js before version 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Open redirects on some federation and push requests
Published: 2021-02-26T17:28:34Z
Aliases: CVE-2021-21273

### Impact
Requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible.

For the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.

### Patches
Issue is resolved by #8821. Further improvements to protect homeservers by default were made in #8870 and #8954.

### Workarounds
Requests to internal IP addresses could be blocked at the system or network level.
SSRF in adminer
Published: 2021-02-11T20:42:59Z
Aliases: CVE-2021-21311

### Impact
Users of Adminer versions bundling all drivers (e.g. `adminer.php`) are affected.

### Patches
Patched by ccd2374b, included in version [4.7.9](https://github.com/vrana/adminer/releases/tag/v4.7.9).

### Workarounds
* Use a single driver version (e.g. `adminer-mysql.php`).
* Protect access to Adminer also by other means, e.g. by HTTP password, IP address limiting or by OTP [plugin](https://www.adminer.org/plugins/).

### References
https://github.com/vrana/adminer/files/5957311/Adminer.SSRF.pdf

### For more information
If you have any questions or comments about this advisory:
* Comment at ccd2374b.
Reflected Cross-site Scripting in ACS Commons
Published: 2021-02-02T15:46:52Z
Aliases: CVE-2021-21028

### Impact

ACS Commons version 4.9.2 (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in version-compare and page-compare due to invalid JCR characters that are not handled correctly.

An attacker could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. Exploitation of this issue requires user interaction in order to be successful.

### Patches

This issue has been resolved in v4.10.0

### Workarounds

No workaround exist.

### References

N/A

### For more information

If you have any questions or comments about this advisory open an issue in acs-aem-commons.

### Credit

This issue was discovered and reported by Christopher Whipp (Christopher.Whipp@servicesaustralia.gov.au).
Denial of Service
Published: 2021-02-25T17:15:39Z


**Withdrawn:** Duplicate of GHSA-j95h-wmx9-4279.

Affected versions of the package are vulnerable to a Denial of Service attack sending an OPTIONS request for an undefined route.
XML external entity (XXE) vulnerability
Published: 2021-02-24T19:40:41Z

An XML eXternal Entity (XXE) Injection was discovered in pmml-model before version 1.4.3. A remote attacker can exploit this vulnerability by sending a request to submit malicious External Entity references within the embedded XML metadata to the target system.
Regular Expression Denial of Service (REDoS) in Marked
Published: 2021-02-08T21:17:58Z
Aliases: CVE-2021-21306

### Impact
_What kind of vulnerability is it? Who is impacted?_

[Regular expression Denial of Service](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)

A Denial of Service attack can affect anyone who runs user generated code through `marked`.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

patched in v2.0.0

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

None.

### References
_Are there any links users can visit to find out more?_

https://github.com/markedjs/marked/issues/1927
https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [marked](https://github.com/markedjs/marked/issues)
Cross-site scripting in Bleach
Published: 2021-02-02T17:58:40Z
Aliases: CVE-2021-23980

### Impact                                                                                                                                                                                                                                                    

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with all of:

* `svg` or `math` in the allowed tags
* `p` or `br` in allowed tags
* `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` in allowed tags
* the keyword argument `strip_comments=False`

Note: none of the above tags are in the default allowed tags and `strip_comments` defaults to `True`.

### Patches

Users are encouraged to upgrade to bleach v3.3.0 or greater.

Note: bleach v3.3.0 introduces a breaking change to escape HTML comments by default.

### Workarounds

* modify `bleach.clean` calls to at least one of:
  * not allow the `style`, `title`, `noscript`, `script`, `textarea`, `noframes`, `iframe`, or `xmp` tag
  * not allow `svg` or `math` tags
  * not allow `p` or `br` tags
  * set `strip_comments=True`

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1689399
* https://advisory.checkmarx.net/advisory/CX-2021-4303
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23980
* https://cure53.de/fp170.pdf

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx
* Additional eject tags not mentioned in the original advisory and the CSP mitigation line being truncated in the revised advisory reported by [Michał Bentkowski](https://twitter.com/SecurityMB) at Securitum

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)
Path traversal in Node-Red
Published: 2021-02-26T16:31:23Z
Aliases: CVE-2021-21298

### Impact

This vulnerability allows arbitrary path traversal via the Projects API.

If the Projects feature is enabled, a user with `projects.read` permission is able to access any file via the Projects API.

### Patches

The issue has been patched in Node-RED 1.2.8

### Workarounds

The vulnerability applies only to the Projects feature which is not enabled by default in Node-RED.

The primary workaround is not give untrusted users read access to the Node-RED editor.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@nodered.org](mailto:team@nodered.org)

### Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
Prototype pollution in dotty
Published: 2021-02-05T20:43:08Z
Aliases: CVE-2021-25912

Prototype pollution vulnerability in 'dotty' before version 0.1.1 allows attackers to cause a denial of service and may lead to remote code execution.
Code Injection vulnerability in CarrierWave::RMagick
Published: 2021-02-08T19:16:39Z
Aliases: CVE-2021-21305

### Impact
[CarrierWave::RMagick](https://github.com/carrierwaveuploader/carrierwave/blob/master/lib/carrierwave/processing/rmagick.rb) has a Code Injection vulnerability. Its `#manipulate!` method inappropriately evals the content of mutation option(`:read`/`:write`), allowing attackers to craft a string that can be executed as a Ruby code.
If an application developer supplies untrusted inputs to the option, it will lead to remote code execution(RCE).

(But supplying untrusted input to the option itself is dangerous even in absence of this vulnerability, since is prone to DoS vulnerability - attackers can try to consume massive amounts of memory by resizing to a very large dimension)

### Proof of Concept
```ruby
class MyUploader < CarrierWave::Uploader::Base
  include CarrierWave::RMagick
end

MyUploader.new.manipulate!({ read: { density: "1 }; p 'Hacked'; {" }}) # => shows "Hacked"
```

### Patches
Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).

### Workarounds
Stop supplying untrusted input to `#manipulate!`'s mutation option.

### References
[Code Injection Software Attack](https://owasp.org/www-community/attacks/Code_Injection)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [CarrierWave repo](https://github.com/carrierwaveuploader/carrierwave)
* Email me at [mit.shibuya@gmail.com](mailto:mit.shibuya@gmail.com)
HTML tag injection
Published: 2021-02-23T21:37:48Z

Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page.
Unencrypted passwords
Published: 2021-02-24T19:33:17Z

A vulnerability found in Apache NIFI before v0.4.0-RC2. Passwords of InvokeHTTP weren?t encrypted.
Cross-Site Scripting in marked
Published: 2021-02-25T02:01:15Z

Versions 0.3.7 and earlier of marked unescape only lowercase while owsers support both lowercase and uppercase x in hexadecimal form of HTML character entity
Server-side request forgery in CarrierWave
Published: 2021-02-08T19:16:26Z
Aliases: CVE-2021-21288

### Impact
[CarrierWave download feature](https://github.com/carrierwaveuploader/carrierwave#uploading-files-from-a-remote-location) has an SSRF vulnerability, allowing attacks to provide DNS entries or IP addresses that are intended for internal use and gather information about the Intranet infrastructure of the platform.

### Patches
Upgrade to [2.1.1](https://rubygems.org/gems/carrierwave/versions/2.1.1) or [1.3.2](https://rubygems.org/gems/carrierwave/versions/1.3.2).

### Workarounds
Using proper network segmentation and applying the principle of least privilege to outbound connections from application servers can reduce the severity of SSRF vulnerabilities. Ideally the vulnerable gem should run on an isolated server without access to any internal network resources or cloud metadata access.

### References
[Server-Side Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [CarrierWave repo](https://github.com/carrierwaveuploader/carrierwave)
* Email me at [mit.shibuya@gmail.com](mailto:mit.shibuya@gmail.com)
Remote Code Execution in SCIMono
Published: 2021-02-10T02:31:53Z
Aliases: CVE-2021-21479

### Impact
It is possible for attacker to inject and execute java expression and compromising the availability and integrity of the system.

### Patches
The issue was fixed on  [0.0.19 version](https://mvnrepository.com/artifact/com.sap.scimono/scimono-server/0.0.19)
Command Injection Vulnerability
Published: 2021-02-16T16:51:04Z
Aliases: CVE-2021-21315

### Impact
command injection vulnerability

### Patches
Problem was fixed with a parameter check. Please upgrade to version >= 5.3.1

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Angular Expressions - Remote Code Execution
Published: 2021-02-01T15:01:26Z
Aliases: CVE-2021-21277

### Impact

The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call `expressions.compile(userControlledInput)` where `userControlledInput` is text that comes from user input.

This time, the security of the package could be bypassed by using a more complex payload, using a `.constructor.constructor` technique.

* If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).
* If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

### Patches

Users should upgrade to version 1.1.2 of angular-expressions

### Workarounds

A temporary workaround might be either to : 

* disable user-controlled input that will be fed into angular-expressions in your application

OR

* allow only following characters in the userControlledInput : 

```js
if (/^[|a-zA-Z.0-9 :"'+-?]+$/.test(userControlledInput)) {
      var result = expressions.compile(userControlledInput);
}
else {
     result = undefined;
}
```

### References

[Removal of angular-expression sandbox](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [angular-expressions](https://github.com/peerigon/angular-expressions/issues)
* [Email us](mailto:contact@javascript-ninja.fr)

### Credits 

The issue was reported by Maxime Nadeau from GoSecure, Inc.
Cross-Site Scripting
Published: 2021-02-24T19:46:00Z

Django-Rest-Framework, before 3.9.1, has a XSS vulnerability caused by disabled autoescaping in the default DRF Browsable API view templates.
Prototype Pollution in Dynamoose
Published: 2021-02-08T17:44:01Z
Aliases: CVE-2021-21304

### Impact

In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method [`lib/utils/object/set.ts`](https://github.com/dynamoose/dynamoose/blob/master/lib/utils/object/set.ts). This method is used throughout the codebase for various operations throughout Dynamoose.

We have not seen any evidence of this vulnerability being exploited.

We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.

### Patches

v2.7.0 includes a patch for this vulnerability.

### Workarounds

We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.

### References

- Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e

### For more information

If you have any questions or comments about this advisory:

* [Contact me](https://charlie.fish/contact)
* [Read our Security Policy](https://github.com/dynamoose/dynamoose/blob/master/SECURITY.md)

### Credit

- GitHub CodeQL Code Scanning
Prototype Pollution in Node-Red
Published: 2021-02-26T16:31:05Z
Aliases: CVE-2021-21297

### Impact

Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime.

### Patches

The vulnerability is patched in the 1.2.8 release.

### Workarounds

A workaround is to ensure only authorised users are able to access the editor url.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@nodered.org](mailto:team@nodered.org)

### Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
Cross-Site Request Forgery (CSRF)
Published: 2021-02-24T19:17:37Z

# Withdrawn

Affected versions of the package are vulnerable to Cross-Site Request Forgery (CSRF) attacks.
Path traversal in bolt/core
Published: 2021-02-18T20:51:56Z
Aliases: CVE-2021-27367

Controller/Backend/FileEditController.php and Controller/Backend/FilemanagerController.php in Bolt before 4.1.13 allow Directory Traversal.
`aiohttp` Open Redirect vulnerability (`normalize_path_middleware` middleware)
Published: 2021-02-26T02:11:57Z
Aliases: CVE-2021-21330

### Impact
_What kind of vulnerability is it? Who is impacted?_

Open redirect vulnerability — a maliciously crafted link to an aiohttp-based web-server could redirect the browser to a different website.

It is caused by a bug in the `aiohttp.web_middlewares.normalize_path_middleware` middleware.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

This security problem has been fixed in v3.7.4. Upgrade your dependency as follows:
[`pip install aiohttp >= 3.7.4`]

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

If upgrading is not an option for you, a workaround can be to avoid using `aiohttp.web_middlewares.normalize_path_middleware` in your applications.

### References
_Are there any links users can visit to find out more?_

* [aiohttp @ PyPI]
* [GHSA-v6wp-4m6f-gcjg]
* [OWASP page on open redirects]

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the [aiohttp repo](https://github.com/aio-libs/aiohttp/issues/new/choose)
* Email us at wk+aio-libs-security@sydorenko.org.ua and/or andrew.svetlov+aio-libs-security@gmail.com

Credit: [Jelmer Vernooĳ] and [Beast Glatisant].

[aiohttp @ PyPI]: https://pypi.org/p/aiohttp
[`pip install aiohttp >= 3.7.4`]: https://pypi.org/project/aiohttp/3.7.4/
[GHSA-v6wp-4m6f-gcjg]: https://github.com/aio-libs/aiohttp/security/advisories/GHSA-v6wp-4m6f-gcjg
[OWASP page on open redirects]:
https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html

[Jelmer Vernooĳ]: https://jelmer.uk
[Beast Glatisant]: https://github.com/g147
NanoHTTPD Cross-site Scripting vulnerability
Published: 2021-02-25T16:32:34Z
Aliases: CVE-2020-13697

An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS, because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.
XSS in apexcharts
Published: 2021-02-11T20:47:34Z
Aliases: CVE-2021-23327

The package apexcharts before 3.24.0 are vulnerable to Cross-site Scripting (XSS) via lack of sanitization of graph legend fields.
Path traversal in pimcore/pimcore
Published: 2021-02-25T16:32:46Z
Aliases: CVE-2021-23340

This affects the package pimcore/pimcore before 6.8.8. A Local FIle Inclusion vulnerability exists in the downloadCsvAction function of the CustomReportController class (bundles/AdminBundle/Controller/Reports/CustomReportController.php). An authenticated user can reach this function with a GET request at the following endpoint: /admin/reports/custom-report/download-csv?exportFile=&91;filename]. Since exportFile variable is not sanitized, an attacker can exploit a local file inclusion vulnerability.
Unbounded connection acceptance in http4s-blaze-server
Published: 2021-02-02T21:42:56Z
Aliases: CVE-2021-21294

### Impact

blaze-core, a library underlying http4s-blaze-server, accepts connections unboundedly on its selector pool. This has the net effect of amplifying degradation in services that are unable to handle their current request load, since incoming connections are still accepted and added to an unbounded queue. Each connection allocates a socket handle, which drains a scarce OS resource. This can also confound higher level circuit breakers which work based on detecting failed connections.

http4s provides a general `MaxActiveRequests` middleware mechanism for limiting open connections, but it is enforced inside the Blaze accept loop, after the connection is accepted and the socket opened. Thus, the limit only prevents the number of connections which can be simultaneously processed, not the number of connections which can be held open.

### Patches

In 0.21.18, 0.22.0-M3, and 1.0.0-M16, a new`maxConnections` property, with a default value of 1024, has been added to the `BlazeServerBuilder`.  Setting the value to a negative number restores unbounded behavior, but is strongly disrecommended.  

The NIO2 backend does not respect `maxConnections`.  Its use is now deprecated in http4s-0.21, and the option is removed altogether starting in http4s-0.22.

The connections are bounded in 0.21.17, 0.22.0-M2, and 1.0.0-M14, but the `maxConnections` parameter was passed incorrectly, making it impossible to change the Blaze default of 512. 

### Workarounds
* An Nginx side-car acting as a reverse proxy for the local http4s-blaze-server instance would be able to apply a connection limiting semantic before the sockets reach blaze-core. Nginx’s connection bounding is both asynchronous and properly respects backpressure.
* http4s-ember-server is an alternative to http4s-blaze-server, but does not yet have HTTP/2 or web socket support.  Its performance in terms of RPS is appreciably behind Blaze’s, and as the newest backend, has substantially less industrial uptake.
* http4s-jetty is an alternative to http4s-blaze-server, but does not yet have web socket support.  Its performance in terms of requests per second is somewhat behind Blaze’s, and despite Jetty's industrial adoption, the http4s integration has substantially less industrial uptake.
* http4s-tomcat is an alternative to http4s-blaze-server, but does not yet have HTTP/2 web socket support.  Its performance in terms of requests per second is somewhat behind Blaze’s, and despite Jetty's industrial adoption, the http4s integration has substantially less industrial uptake.

### References

See [the Blaze GHSA](https://github.com/http4s/blaze/security/advisories/GHSA-xmw9-q7x9-j5qc) for more on the underlying issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [http4s/http4s](http://github.com/http4s/http4s)
* Contact us according to the [http4s security policy](https://github.com/http4s/http4s/security/policy)
Code injection in Apache Ant
Published: 2021-02-03T19:16:35Z
Aliases: CVE-2020-11979

As mitigation for CVE-2020-1945 Apache Ant 1.10.8 changed the permissions of temporary files it created so that only the current user was allowed to access them. Unfortunately the fixcrlf task deleted the temporary file and created a new one without said protection, effectively nullifying the effort. This would still allow an attacker to inject modified source files into the build process.
Elliptic Curve Key Disclosure
Published: 2021-02-24T19:38:21Z

Affected versions of the package are vulnerable to Elliptic Curve Key Disclosure.