aswin1906/github-advisory-2021.csv huggingface dataset:
Regular Expression Denial of Service (ReDOS)
Published: 2021-06-22T01:14:09Z
Aliases: CVE-2021-29060

In the npm package `color-string`, there is a  ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for
linearly increasing input lengths for `hwb()` color strings.

Strings reaching more than 5000 characters would see several
milliseconds of processing time; strings reaching more than
50,000 characters began seeing 1500ms (1.5s) of processing time.

The cause was due to a the regular expression that parses
hwb() strings - specifically, the hue value - where
the integer portion of the hue value used a 0-or-more quantifier
shortly thereafter followed by a 1-or-more quantifier.

This caused excessive backtracking and a cartesian scan,
resulting in exponential time complexity given a linear
increase in input length.
Injection in Apache Syncope
Published: 2021-06-16T17:18:49Z
Aliases: CVE-2020-1961

Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.
Uncontrolled Resource Consumption in XNIO
Published: 2021-06-08T22:29:29Z
Aliases: CVE-2020-14340

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings 
Published: 2021-06-23T18:03:18Z
Aliases: CVE-2021-32699

### Impact
All versions of Pterodactyl Wings preior to `1.4.4` are vulnerable to system resource exhaustion due to improper container process limits being defined. A malicious user can consume more resources than intended and cause downstream impacts to other clients on the same hardware, eventually causing the physical server to stop responding.

### Patches
Users should upgrade to `1.4.4`.

### Workarounds
There is no non-code based workaround for impacted versions of the software. Users running customized versions of this software can manually set a PID limit for containers created.

### For more information
If you have any questions or comments about this advisory:
* Contact us on [Discord](https://discord.gg/pterodactyl)
* Email us at `dane ät pterodactyl dot io`
Potential infinite loop in Pillow
Published: 2021-06-08T18:48:53Z
Aliases: CVE-2021-28676

An issue was discovered in Pillow before 8.2.0. For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.
Path traversal
Published: 2021-06-04T19:09:20Z
Aliases: CVE-2021-32662

### Impact

A malicious actor could read sensitive files from the environment where TechDocs documentation is built and published by setting a particular path for `docs_dir` in `mkdocs.yml`. These files would then be available over the TechDocs backend API.

This vulnerability is mitigated by the fact that an attacker would need access to modify the `mkdocs.yml` in the documentation source code, and would also need access to the TechDocs backend API.

### Patches

The vulnerability is patched in the `0.6.3` release of `@backstage/techdocs-common`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Missing Authorization in jenkins xray-connector
Published: 2021-06-16T17:29:26Z
Aliases: CVE-2021-21653

Jenkins Xray - Test Management for Jira Plugin 2.4.0 and earlier does not perform a permission check in an HTTP endpoint, allowing with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
Integer Overflow in go-jose
Published: 2021-06-23T17:14:12Z
Aliases: CVE-2016-9123

go-jose before 1.0.5 suffers from a CBC-HMAC integer overflow on 32-bit architectures. An integer overflow could lead to authentication bypass for CBC-HMAC encrypted ciphertexts on 32-bit architectures.
Cross-site Scripting in ckeditor4
Published: 2021-06-21T17:16:42Z
Aliases: CVE-2021-33829

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because `--!>` is mishandled.
SQL Injection in NukeViet
Published: 2021-06-22T15:24:55Z
Aliases: CVE-2019-7726

modules/banners/funcs/click.php in NukeViet before 4.3.04 has a SQL INSERT statement with raw header data from an HTTP request (e.g., Referer and User-Agent).
Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone
Published: 2021-06-10T17:23:21Z
Aliases: CVE-2020-28924

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limits the entropy of the passwords enormously. These passwords are often used in the crypt backend for encryption of data. It would be possible to make a dictionary of all possible passwords with about 38 million entries per password length. This would make decryption of secret material possible with a plausible amount of effort. NOTE: all passwords generated by affected versions should be changed.
Improper rate limiting in Koel
Published: 2021-06-01T21:38:20Z
Aliases: CVE-2021-33563

Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
Path Traversal in Zope
Published: 2021-06-10T17:22:08Z
Aliases: CVE-2021-32674

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.2.1 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.
Cross-site scripting in Apache HttpClient
Published: 2021-06-03T23:40:23Z
Aliases: CVE-2020-13956

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
keycloak Self Stored Cross-site Scripting vulnerability
Published: 2021-06-08T23:02:43Z
Aliases: CVE-2021-20195

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Path traversal in github.com/ipfs/go-ipfs
Published: 2021-06-23T17:27:44Z
Aliases: CVE-2020-26279

### Impact
It is currently possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when `ipfs get` is done on an affected DAG.

1. The only affected command is `ipfs get`.
2. The gateway is not affected.

### Patches
Traversal fix patched in https://github.com/whyrusleeping/tar-utils/commit/20a61371de5b51380bbdb0c7935b30b0625ac227
`tar-utils` patch applied to go-ipfs via https://github.com/ipfs/go-ipfs/commit/b7ddba7fe47dee5b1760b8ffe897908417e577b2

### Workarounds
Upgrade to go-ipfs 0.8 or later.

### References
Binaries for the patched versions of go-ipfs are available on the IPFS distributions site, https://dist.ipfs.io/go-ipfs

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ipfs](https://github.com/ipfs/go-ipfs)
* Email us at [security@ipfs.io](mailto:security@ipfs.io)
Possible bypass of token claim validation when OAuth2 Introspection caching is enabled
Published: 2021-06-23T18:00:20Z

### Impact

When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid.

### Patches

A patch will be released with `v0.38.12-beta.1`.

### Workarounds

Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist.

### Trace

The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes.

### Post-Mortem

The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process.

To avoid this from happening again we enabled codecov with a strict policy on the Ory Oathkeeper repository: Without an increase in code coverage the PR can not be merged.

To address this issue and any regressions we have added a test suite ensuring that the cache behaviour is correct in the different scenarios:

- Scope strategy is `none`, cache is enabled, and `requested_scope` is not empty -> cache will not be used;
- Scope strategy is `none`, cache is enabled, and `requested_scope` is empty -> cache will be used;
- Scope strategy is not `none`, cache is enabled, and `requested_scope` is not empty -> cache will be used;

as well as validating if `iss`, `aud`, `exp`, `token_use`, and scope are validated.

Additionally, we added [CodeQL scanning](https://github.com/ory/oathkeeper/commit/64ac7562669287d391cd72dfd43c5d71ff9f89a1) to the CI.
Path Traversal in pip
Published: 2021-06-09T17:35:04Z
Aliases: CVE-2019-20916

The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py. A fix was committed 6704f2ace.
Pillow Denial of service
Published: 2021-06-08T18:49:11Z
Aliases: CVE-2021-28675

An issue was discovered in Pillow before 8.2.0. `PSDImagePlugin.PsdImageFile` lacked a sanity check on the number of input layers relative to the size of the data block. This could lead to a DoS on `Image.open` prior to `Image.load`.
Reflected XSS when using flashMessages or languageDictionary
Published: 2021-06-04T19:10:34Z
Aliases: CVE-2021-32641

### Overview

Versions before and including `11.30.0` are vulnerable to reflected XSS.  An attacker can execute arbitrary code when the library's
- `flashMessage` feature is utilized and user input or data from URL parameters is incorporated into the `flashMessage`.
- `languageDictionary` feature is utilized and user input or data from URL parameters is incorporated into the `languageDictionary`.

### Am I affected?
You are affected by this vulnerability if you are using `auth0-lock` version `11.30.0` or lower and all of the following conditions apply:

- You are utilizing `flashMessage` feature.
- User input or data from URL parameters is incorporated into the `flashMessage`.

An example of a vulnerable snippet where query parameters are used to populate the `text` property of a `flashMessage`.
```js
var params = new URLSearchParams(location.search);
var errorMessage = params.get('error__message');
var showParams = {};

if (!!errorMessage === true) {
  showParams.flashMessage = {
    type: 'error',
    text: 'We were unable to log you in. ' + errorMessage,
  };
}

lock.show(showParams);
```

OR

- You are utilizing `languageDictionary` feature.
- User input or data from URL parameters is used in `languageDictionary` properties.

An example of a vulnerable snippet where query parameters are used to populate the `socialLoginInstructions` property of a `languageDictionary`.
```js
var params = new URLSearchParams(location.search);
var instruction = params.get('instruction');

var options = {
  languageDictionary: {
    emailInputPlaceholder: "something@youremail.com",
    title: "title",
    socialLoginInstructions: instruction
  },
};

var lock = new Auth0LockPasswordless(
    CLIENT_ID,
    DOMAIN,
    options
);

lock.show()
```

### How to fix that?
Upgrade to version `11.30.1`.

### Will this update impact my users?
The fix uses [DOMPurify](https://github.com/cure53/DOMPurify) to sanitise the `flashMessage` and `languageDictionary` inputs. If you are including inline JavaScript in these fields, like `script` tags or `onclick` attributes, these will be removed.
Cache Manipulation Attack in Apache Traffic Control
Published: 2021-06-18T22:04:32Z
Aliases: CVE-2020-17522

When ORT (now via atstccfg) generates ip_allow.config files in Apache Traffic Control 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0, those files include permissions that allow bad actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Additionally, these permissions are potentially extended to IP addresses outside the desired range, resulting in them being granted to clients possibly outside the CDN arcitechture.
Path Traversal in Django
Published: 2021-06-04T21:15:56Z
Aliases: CVE-2021-31542

In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.
Prototype pollution in nconf-toml
Published: 2021-06-07T22:12:13Z
Aliases: CVE-2021-25946

Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Helm passes repository credentials to alternate domain
Published: 2021-06-23T18:14:31Z
Aliases: CVE-2021-32690

Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This issue has been resolved in 3.6.1. There is a workaround through which one may check for improperly passed credentials. One may use a username and password for a Helm repository and may audit the Helm repository in order to check for another domain being used that could have received the credentials. In the `index.yaml` file for that repository, one may look for another domain in the `urls` list for the chart versions. If there is another domain found and that chart version was pulled or installed, the credentials would be passed on.
Deserialization of Untrusted Data in Tendenci
Published: 2021-06-18T18:31:05Z
Aliases: CVE-2020-14942

Tendenci 12.0.10 allows unrestricted deserialization in apps\helpdesk\views\staff.py.
Reflected XSS from the callback handler's error query parameter
Published: 2021-06-28T16:46:41Z
Aliases: CVE-2021-32702

### Overview

Versions before and including `1.4.1` are vulnerable to reflected XSS.  An attacker can execute arbitrary code by providing an XSS payload in the `error` query parameter which is then processed by the callback handler as an error message.

### Am I affected?
You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `1.4.1` or lower **unless** you are using custom error handling that does not return the error message in an HTML response.

### How to fix that?
Upgrade to version `1.4.2`.

### Will this update impact my users?
The fix adds basic HTML escaping to the error message and it should not impact your users.

### Credit

https://github.com/inian
https://github.com/git-ishanpatel
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Published: 2021-06-16T17:45:29Z
Aliases: CVE-2021-25122

When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning user A and user B could both see the results of user A's request.
github.com/sassoftware/go-rpmutils Arbitrary File Write via Archive Extraction (Zip Slip)
Published: 2021-06-23T17:13:29Z
Aliases: CVE-2020-7667

The CPIO extraction functionality doesn't sanitize the paths of the archived files for leading and non-leading `..` which leads in file extraction outside of the current directory. Note, the fixing commit was applied to all affected versions which were re-released.
Cross-site scripting in Jenkins Kiuwan Plugin
Published: 2021-06-16T17:10:50Z
Aliases: CVE-2021-21666

Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.

Only older releases of Jenkins are affected by this vulnerability. Jenkins 2.275 and newer, LTS 2.263.2 and newer include a protection preventing this from being exploitable.

Kiuwan Plugin 1.6.1 escapes affected parts of the error message in the form validation endpoint.
Regular Expression Denial of Service (ReDoS) in Prism
Published: 2021-06-28T18:33:18Z
Aliases: CVE-2021-32723

Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS).

### Impact

When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. Do not use the following languages to highlight untrusted text.

- ASCIIDoc
- ERB

Other languages are __not__ affected and can be used to highlight untrusted text.

### Patches
This problem has been fixed in Prism v1.24.

### References

- PrismJS/prism#2774
- PrismJS/prism#2688
Out-of-bounds Read in Pillow
Published: 2021-06-08T18:49:02Z
Aliases: CVE-2021-25287

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.