aswin1906/github-advisory-2021.csv huggingface dataset:
Cross-site scripting in ICEcoder
Published: 2021-09-09T17:11:11Z
Aliases: CVE-2021-32106

In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
Directory Traversal in isomorphic-git
Published: 2021-09-02T22:00:20Z
Aliases: CVE-2021-30483

isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
Incorrect Authorization in serverless-offline
Published: 2021-09-01T18:32:22Z
Aliases: CVE-2021-38384

Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing `/` character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
Inefficient Regular Expression Complexity in handsontable
Published: 2021-09-30T17:10:46Z
Aliases: CVE-2021-23446

The package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in `Handsontable.helper.isNumeric` function.
Prototype Pollution in cookiex/deep
Published: 2021-09-20T20:12:38Z
Aliases: CVE-2021-23442

The npm @cookiex/deep package before version 0.0.7 has a prototype pollution vulnerability. The global proto object can be polluted using the __proto__ object.
Clearance Gem Open Redirect Vulnerability
Published: 2021-09-13T20:05:09Z
Aliases: CVE-2021-23435

This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of `session[:return_to]`. If the value used for return_to contains multiple leading slashes (`/////example.com`) the user ends up being redirected to the external domain that comes after the slashes (`http://example.com`).
Incorrect Authorization with specially crafted requests
Published: 2021-09-10T17:54:25Z
Aliases: CVE-2021-39206

Envoy, which Pomerium is based on, contains two authorization related vulnerabilities:

- [CVE-2021-32777](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32779): incorrectly transform a URL containing a `#fragment` element, causing a mismatch in path-prefix based authorization decisions.
- [CVE-2021-32779](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32777): incorrectly handle duplicate headers, dropping all but the last.  This may lead to incorrect routing or authorization policy decisions.

### Impact
With specially crafted requests, incorrect authorization or routing decisions may be made by Pomerium.

### Patches

Pomerium v0.14.8 and v0.15.1 contain an upgraded envoy binary with these vulnerabilities patched.

### Workarounds

- This issue can only be triggered when using path prefix based policy.  Removing any such policies should provide mitigation.


### References
[envoy GSA CVE-2021-32777](https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9)
[envoy GSA CVE-2021-32779](https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic.
Published: 2021-09-08T20:14:56Z
Aliases: CVE-2021-38698

HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Uncontrolled Resource Consumption in trim-off-newlines
Published: 2021-09-02T17:15:42Z
Aliases: CVE-2021-23425

All versions of package trim-off-newlines are vulnerable to Regular Expression Denial of Service (ReDoS) via string processing.
XML Injection in Any23
Published: 2021-09-13T20:06:31Z
Aliases: CVE-2021-38555

An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access.
Regular Expression Denial of Service in jsoneditor
Published: 2021-09-29T17:15:55Z
Aliases: CVE-2021-3822

JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor, and a plain text editor. The jsoneditor package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted element as input to the getInnerText function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex.
Exposure of Sensitive Information to an Unauthorized Actor
Published: 2021-09-08T18:00:40Z
Aliases: CVE-2021-32716

Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin.
Improper Access Control in passport-oauth2
Published: 2021-09-29T17:18:32Z
Aliases: CVE-2021-41580

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability.
Member account takeover
Published: 2021-09-23T23:18:42Z

### Impact

An error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the new address via magic link sent to the new email address.

Ghost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 3.18.0 and 4.15.0 with members functionality enabled.

### Patches

Fixed in 4.15.1, all 4.x sites should upgrade as soon as possible.
Fixed in 3.42.6, all 3.x sites should upgrade as soon as possible.

### Workarounds

The patch in 4.15.1 and 3.42.6 adds a new authenticated endpoint for updating member email addresses. Updating Ghost is the quickest complete solution.

As a workaround, if for any reason you cannot update your Ghost instance, you can block the `POST /members/api/send-magic-link/` endpoint, which will also disable member login and signup for your site.

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@ghost.org](mailto:security@ghost.org)
Cross site scripting in datatables.net 
Published: 2021-09-29T17:11:28Z
Aliases: CVE-2021-23445

This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Reliance on Cookies without Validation and Integrity Checking in getgrav/grav
Published: 2021-09-29T17:12:51Z
Aliases: CVE-2021-3818

grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications can lead a vulnerability in one application to cause a compromise in another.
Unsafe defaults in `remark-html`
Published: 2021-09-07T23:10:56Z
Aliases: CVE-2021-39199

### Impact

The documentation of `remark-html` has mentioned that it was safe by default. In practise the default was never safe and had to be opted into. This means arbitrary HTML can be passed through leading to potential XSS attacks.

### Patches

The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default, and the implementation matches the documentation.

### Workarounds

On older affected versions, pass `sanitize: true`, like so:

```diff
-  .use(remarkHtml)
+  .use(remarkHtml, {sanitize: true})
```

### References

n/a

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [`remark-html`](https://github.com/remarkjs/remark-html)
* Email us at [security@unifiedjs.com](mailto:security@unifiedjs.com)
Prototype Pollution in object-path
Published: 2021-09-20T20:46:43Z
Aliases: CVE-2021-3805

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). The `del()` function fails to validate which Object properties it deletes. This allows attackers to modify the prototype of Object, causing the modification of default properties like `toString` on all objects.
XML External Entity Reference in Apache Jena
Published: 2021-09-20T20:22:05Z
Aliases: CVE-2021-39239

A vulnerability in XML processing in Apache Jena, in versions up to 4.1.0, may allow an attacker to execute XML External Entities (XXE), including exposing the contents of local files to a remote server.
Prototype Pollution in object-path
Published: 2021-09-01T18:37:11Z
Aliases: CVE-2021-23434

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition `currentPath === '__proto__'` returns false if `currentPath` is `['__proto__']`. This is because the `===` operator returns always false when the type of the operands is different.
Path traversal in Grafana Loki
Published: 2021-09-02T22:00:40Z
Aliases: CVE-2021-36156

An issue was discovered in Grafana Loki through 2.2.1. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Loki will attempt to parse a rules file at that location and include some of the contents in the error message.
Confused Deputy in Kubernetes
Published: 2021-09-21T18:28:30Z
Aliases: CVE-2021-25740

A security issue was discovered with Kubernetes that could enable users to send network traffic to locations they would otherwise not have access to via a confused deputy attack.
XML External Entity Injection in PyWPS
Published: 2021-09-02T17:11:13Z
Aliases: CVE-2021-39371

An XML external entity (XXE) injection in PyWPS before 4.5.0 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected.
Improper Certificate Handling
Published: 2021-09-02T22:00:01Z
Aliases: CVE-2020-9321

configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate contents from providers before logging.
Cross-site Scripting in Beego
Published: 2021-09-15T20:23:28Z
Aliases: CVE-2021-39391

Cross Site Scripting (XSS) vulnerability exists in the admin panel in Beego v2.0.1 via the URI path in an HTTP request, which is activated by administrators viewing the "Request Statistics" page.
Inadequate Encryption Strength in showdoc
Published: 2021-09-01T18:31:23Z
Aliases: CVE-2021-3680

showdoc makes use of a hardcoded salt in its user password hash function
Prototype Pollution in set-value
Published: 2021-09-13T20:09:36Z
Aliases: CVE-2021-23440

This affects the package `set-value` before 2.0.1, and starting with 3.0.0 but prior to 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Improper Input Validation in Firefly III
Published: 2021-09-08T17:27:07Z
Aliases: CVE-2019-14671

Firefly III 4.7.17.3 is vulnerable to local file enumeration. An attacker can enumerate local files due to the lack of protocol scheme sanitization, such as for file:/// URLs. This is related to fints_url to import/job/configuration, and import/create/fints.
Deserialization of Untrusted Data in codeception/codeception
Published: 2021-09-01T18:36:15Z
Aliases: CVE-2021-23420

This affects the package codeception/codeception from 4.0.0 before 4.1.22 and before 3.1.3. The RunProcess class can be leveraged as a gadget to run arbitrary commands on a system that is deserializing user input without validation.
Path traversal in Grafana Cortex
Published: 2021-09-02T21:59:50Z
Aliases: CVE-2021-36157

An issue was discovered in Grafana Cortex through 1.9.0. The header value X-Scope-OrgID is used to construct file paths for rules files, and if crafted to conduct directory traversal such as ae ../../sensitive/path/in/deployment pathname, then Cortex will attempt to parse a rules file at that location and include some of the contents in the error message. (Other Cortex API requests can also be sent a malicious OrgID header, e.g., tricking the ingester into writing metrics to a different location, but the effect is nuisance rather than information disclosure.)
prismjs Regular Expression Denial of Service vulnerability
Published: 2021-09-20T20:44:48Z
Aliases: CVE-2021-3801

Prism is a syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.
CSV injection in shuup
Published: 2021-09-30T20:50:07Z
Aliases: CVE-2021-25962

“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.
Weak Password Recovery Mechanism for Forgotten Password
Published: 2021-09-02T17:08:33Z
Aliases: CVE-2021-25957

In “Dolibarr” application, v2.8.1 to v13.0.2 are vulnerable to account takeover via password reset functionality. A low privileged attacker can reset the password of any user in the application using the password reset link the user received through email when requested for a forgotten password.
Remote command injection when using sendmail email transport
Published: 2021-09-20T19:52:41Z

### Impact

Sites using the `sendmail` transport as part of their `mail` config are vulnerable to remote command injection due to a [vulnerability](https://github.com/advisories/GHSA-48ww-j4fc-435p) in the `nodemailer` dependency.

Ghost defaults to the `direct` transport so this is only exploitable if the `sendmail` transport is explicitly used.

### Patches

Fixed in 4.15.0, all sites should upgrade as soon as possible.

### Workarounds

* Use an alternative email transport as described in the [docs](https://ghost.org/docs/config/#mail). 

### For more information

If you have any questions or comments about this advisory:

* email us at security@ghost.org
Cross-site Scripting in Apache Zeppelin
Published: 2021-09-07T22:55:56Z
Aliases: CVE-2021-27578

Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts. This issue affects Apache Zeppelin Apache Zeppelin versions prior to 0.9.0.
Confused Deputy in Kubernetes
Published: 2021-09-21T18:28:21Z
Aliases: CVE-2020-8561

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Content object state fetch functions open to SQL injection
Published: 2021-09-07T22:54:23Z

### Impact
This Security Update is about a vulnerability in eZ Publish Legacy. The content object state code could be vulnerable to SQL injection. There is no known exploit, but one might be possible. If you use Legacy in any way, we strongly recommend that you install this update as soon as possible.

### Patches
The fix is distributed via Composer, see "Patched versions".
Excessive CPU usage
Published: 2021-09-10T17:54:13Z
Aliases: CVE-2021-39204

Envoy, which Pomerium is based on, incorrectly handles resetting of HTTP/2 streams with excessive complexity.  This can lead to high CPU utilization when a large number of streams are reset.  

### Impact

This can result in a DoS condition.

### Patches
Pomerium versions 0.14.8 and 0.15.1 contain an upgraded envoy binary with this vulnerability patched.

### Workarounds
N/A

### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-3xh3-33v5-chcc)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32778)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Infinite Loop in rencode
Published: 2021-09-13T20:05:51Z
Aliases: CVE-2021-40839

The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.
Published: 2021-09-01T18:25:44Z
Aliases: CVE-2021-39163

### Impact
Unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where:
- the vulnerable homeserver is in the room; and
- untrusted users are permitted to create groups (communities).

By default, only homeserver administrators can create groups. However, homeserver administrators can already access this information in the database or using the admin API. As a result, only homeservers where the configuration setting `enable_group_creation` has been set to `true` are impacted.

### Patches
Server administrators should upgrade to 1.41.1 or higher.

### Workarounds
Server administrators can set `enable_group_creation` to `false` in their homeserver configuration (this is the default value) to prevent creation of groups by non-administrators.

Administrators that are using a reverse proxy could, with partial loss of group functionality, block the following endpoints:
* `/_matrix/client/r0/groups/{group_id}/rooms`
* `/_matrix/client/unstable/groups/{group_id}/rooms`

### References
n/a

### For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Cross-site Scripting in GilaCMS
Published: 2021-09-30T17:12:56Z
Aliases: CVE-2020-20695

A stored cross-site scripting (XSS) vulnerability in GilaCMS v1.11.4 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG file.
body-parser-xml vulnerable to Prototype Pollution
Published: 2021-09-14T20:25:35Z
Aliases: CVE-2021-3666

body-parser-xml is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution').
Server-Side Request Forgery in UReport
Published: 2021-09-20T20:45:21Z
Aliases: CVE-2020-21122

UReport v2.2.9 contains a Server-Side Request Forgery (SSRF) in the designer page which allows attackers to detect intranet device ports.
Parse Server crashes with query parameter
Published: 2021-09-02T16:51:14Z
Aliases: CVE-2021-39187

### Impact
Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch.

### Patches
Upgrade to Parse Server 4.10.3
Improper Handling of Missing Values in kaml
Published: 2021-09-07T23:08:40Z
Aliases: CVE-2021-39194

### Impact
Attackers that could provide arbitrary YAML input to an application that uses kaml could cause the application to endlessly loop while parsing the input. This could result in resource starvation and denial of service. 

This only affects applications that use polymorphic serialization with the default tagged polymorphism style. Applications using the property polymorphism style are not affected.

YAML input for a polymorphic type that provided a tag but no value for the object would trigger the issue, for example:

```yaml
!<x>
```

The following is a sample application that demonstrates this issue:

```kotlin
import com.charleskorn.kaml.Yaml
import kotlinx.serialization.SerialName
import kotlinx.serialization.Serializable

@Serializable
private sealed class K {
    @Serializable
    @SerialName("x")
    data class X(
        val property: String? = null,
    ) : K()
}

const val s = """
!<x>
"""

fun main() {
    println("Started.")
    val result = Yaml.default.decodeFromString(K.serializer(), s)
    println("Finished, result is $result")
}
```

On vulnerable versions of kaml, the `decodeFromString()` operation hangs and never returns. 


### Patches
Version 0.35.3 or later contain the fix for this issue.
Improper Neutralization of Text-Values in Object Version Preview
Published: 2021-09-01T18:22:09Z
Aliases: CVE-2021-39166

Text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources.
CWE-730 Regex injection with IFTTT Plugin
Published: 2021-09-20T20:57:02Z
Aliases: CVE-2021-39229

### Impact
Anyone _publicly_ hosting the Apprise library and granting them access to the IFTTT notification service.

### Patches
Update to Apprise v0.9.5.1
   ```bash
   # Install Apprise v0.9.5.1 from PyPI
   pip install apprise==0.9.5.1
   ```

The patch to the problem was performed [here](https://github.com/caronc/apprise/pull/436/files).

### Workarounds
Alternatively, if upgrading is not an option, you can safely remove the following file:
- `apprise/plugins/NotifyIFTTT.py` 

The above will eliminate the ability to use IFTTT, but everything else will work smoothly.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Apprise](https://github.com/caronc/apprise/issues)
* Email me at [lead2gold@gmail.com](mailto:lead2gold@gmail.com)

### Additional Credit
Github would not allow me to additionally credit **Rasmus Petersen**, but I would like to put that here at the very least - thank you for finding and reporting this issue along with those already credited

## Additional Notes:
- Github would not allow me to add/tag the 2 CWE's this issue is applicable to (only CWE-400).  The other is: CWE-730 (placed in the title)
tmpl vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion
Published: 2021-09-20T20:27:52Z
Aliases: CVE-2021-3777

nodejs-tmpl is simple string formatting. tmpl is vulnerable to Inefficient Regular Expression Complexity which may lead to resource exhaustion.