aswin1906/github-advisory-2021.csv huggingface dataset:
StripComments filter contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)
Published: 2021-09-10T17:56:06Z
Aliases: CVE-2021-32839

### Impact
The formatter function that strips comments from a SQL contains a regular expression that is vulnerable to [ReDoS](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS) (Regular Expression Denial of Service). The regular expression may cause exponential backtracking on strings containing many repetitions of '\r\n' in SQL comments.

### Patches
The issues has been fixed in sqlparse 0.4.2.

### Workarounds
Only the formatting feature that removes comments from SQL statements is affected by this regular expression. As a workaround don't use the `sqlformat.format` function with keyword `strip_comments=True` or the `--strip-comments` command line flag when using the `sqlformat` command line tool.

### References
This issue was discovered by GitHub team members @erik-krogh and @yoff. It was found using a [CodeQL](https://codeql.github.com/) query which identifies inefficient regular expressions. You can see the results of the query on python-sqlparse by following [this link](https://lgtm.com/query/2223658096471222354/). 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [sqlparse issue tracker](https://github.com/andialbrecht/sqlparse/issues)
* Email us at [albrecht.andi@gmail.com](mailto:albrecht.andi@gmail.com)
Arbitrary file upload in Fork CMS
Published: 2021-09-08T17:26:26Z
Aliases: CVE-2021-28931

Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.
Directory Traversal in typo3/phar-stream-wrapper
Published: 2021-09-30T17:10:14Z
Aliases: CVE-2019-11831

The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 does not prevent directory traversal, which allows attackers to bypass a deserialization protection mechanism, as demonstrated by a phar:///path/bad.phar/../good.phar URL.
Any storage file can be downloaded from p.sh if full server path is known
Published: 2021-09-14T20:24:44Z

The default configuration for platform.sh (.platform.app.yaml) allows access to uploaded files if you know or can guess their location, regardless of whether roles grant content read access to the content containing those files. If you're using Legacy Bridge, the default configuration also allows access to certain legacy files that should not be readable, including the legacy var directory and extension directories.
Regular Expression Denial of Service in Leo Editor
Published: 2021-09-23T23:14:28Z
Aliases: CVE-2020-23478

Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.
UUPSUpgradeable vulnerability in @openzeppelin/contracts
Published: 2021-09-15T20:23:17Z
Aliases: CVE-2021-41264

### Impact

Upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.

### Patches

A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

### References

[Post-mortem](https://forum.openzeppelin.com/t/uupsupgradeable-vulnerability-post-mortem/15680).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Imporoper path validation in elFinder.NetCore
Published: 2021-09-02T22:05:17Z
Aliases: CVE-2021-23427

This affects all versions of package elFinder.NetCore. The ExtractAsync function within the FileSystem is vulnerable to arbitrary extraction due to insufficient validation.
CSRF token exposure in TYPO3 extension
Published: 2021-09-02T17:16:56Z
Aliases: CVE-2021-36793

When using the CsrfTokenViewHelper the extension discloses the user's session identifier to HTML output without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance Cross Site Scripting  in the frontend output.
User can obtain JWT token even if account is disabled
Published: 2021-09-29T17:09:23Z

Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. (Someone who never had an account cannot exploit this vulnerability.) The fix ensures tokens are generated only for enabled user accounts, and is distributed via Composer as ezsystems/ezplatform-rest v1.3.8
Clipboard-based XSS
Published: 2021-09-22T20:39:26Z
Aliases: CVE-2021-41086

### Impact
XSS against the user.

### Details
jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` causing XSS.

### References
The Curious Case of Copy & Paste – on risks of pasting arbitrary content in browsers: https://research.securitum.com/the-curious-case-of-copy-paste/
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown
Published: 2021-09-07T23:07:56Z

### Impact

A Remote Command Execution vulnerability was found in the rebber module,
which allowed execution of arbitrary commands. The reported problem came
from CodeBlocks, which could be escaped to insert malicious LaTeX.

Anyone using `rebber` without sanitation of code content or a custom
macro is impacted by this vulnerability. Here is an example of a Markdown
content that will exploit the vulnerability:

````markdown
```
\end{CodeBlock}

\immediate\write18{COMMAND > outputrce}
\input{outputrce}

\begin{CodeBlock}{text}
```
````

Will insert into the generated LaTeX the result of executing
`COMMAND` on the system.

### Patches

The vulnerability has been patched in version 5.2.1.
If impacted, you should update to this version as soon as possible.

### Workarounds

It is possible to mitigate the vulnerability without upgrading by using a
custom code macro. Please make sure this custom macro escapes your
closing LaTeX sequence. For the example above, use:

```javascript
const escaped = content.replace(new RegExp('\\\\end\\s*{CodeBlock}', 'g'), '')
```

### For more information

If you have any questions or comments about this advisory, open an issue in [ZMarkdown](https://github.com/zestedesavoir/zmarkdown/issues).
Cross-site Scripting in file-upload-with-preview
Published: 2021-09-07T23:08:54Z
Aliases: CVE-2021-23439

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).
Use of a Broken or Risky Cryptographic Algorithm
Published: 2021-09-01T18:41:06Z
Aliases: CVE-2021-27913

## ✍️ Description
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographically insecure nature of this function to enumerate session tokens for accounts that are not under his/her control

## 🕵️‍♂️ Proof of Concept
Numerous examples and attack implementations can be found in this paper . If you're looking for a practical tool that can crack your mt_rand implementation's seed value, see this project and run the following commands in a console with php5 and OpenWall's tool installed:

`root$ php -r 'mt_srand(13333337); echo mt_rand( ), "\n";'`
After that, copy the output (1863134308) and execute the following commands:

`root$ gcc php_mt_seed.c -o php_mt_seedroot$ ./php_mt_seed 1863134308`
After waiting ~1 minute you should have a few possible seeds corresponding to their PHP versions, next to your installed PHP version you should see something akin to:

seed = 0x00cb7359 = 13333337 (PHP 7.1.0+)
Hey, that's your seed!

## 💥 Impact
An attacker could takeover accounts at random by enumerating and using access tokens.

## 📝 References

- https://openwall.com/php_mt_seedhttps://crypto.di.uoa.gr/CRYPTO.SEC/Randomness_Attacks_files/paper.pdf
- https://github.com/mautic/mautic/blob/5213e320b4ef4d0c51bb84c1d46a1071e8e4f7fc/app/bundles/PointBundle/Controller/TriggerController.php#L187
- https://github.com/mautic/mautic/releases/tag/3.3.4
- https://github.com/mautic/mautic/releases/tag/4.0.0
inflect vulnerable to Inefficient Regular Expression Complexity
Published: 2021-09-29T17:12:19Z
Aliases: CVE-2021-3820

inflect is customizable inflections for nodejs. inflect is vulnerable to Inefficient Regular Expression Complexity
HashiCorp Consul Privilege Escalation Vulnerability
Published: 2021-09-08T20:14:48Z
Aliases: CVE-2021-37219

HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
Code Injection in total.js
Published: 2021-09-01T18:24:05Z
Aliases: CVE-2021-32831

Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.
Cross-site Scripting in the femanager TYPO3 extension
Published: 2021-09-01T18:36:51Z
Aliases: CVE-2021-36787

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.

Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.
Double free in stack_dst
Published: 2021-09-01T18:30:44Z
Aliases: CVE-2021-28034

Affected versions of stack_dst used a push_inner function that increased the internal length of the array and then called val.clone(). If the val.clone() call panics, the stack could drop an already dropped element or drop uninitialized memory. This issue was fixed in `2a4d538` by increasing the length of the array after elements are cloned.
File reference keys leads to incorrect hashes on HMAC algorithms
Published: 2021-09-29T17:09:40Z
Aliases: CVE-2021-41106

### Impact

Users of HMAC-based algorithms (HS256, HS384, and HS512) combined with `Lcobucci\JWT\Signer\Key\LocalFileReference` as key are having their tokens issued/validated using the file path as hashing key - instead of the contents.

The HMAC hashing functions take any string as input and, since users can issue and validate tokens, people are lead to believe that everything works properly.

### Patches

All versions have been patched to always load the file contents, deprecated the `Lcobucci\JWT\Signer\Key\LocalFileReference`, and suggest `Lcobucci\JWT\Signer\Key\InMemory` as the alternative.

### Workarounds

Use `Lcobucci\JWT\Signer\Key\InMemory` instead of `Lcobucci\JWT\Signer\Key\LocalFileReference` to create the instances of your keys:

```diff
-use Lcobucci\JWT\Signer\Key\LocalFileReference;
+use Lcobucci\JWT\Signer\Key\InMemory;

-$key = LocalFileReference::file(__DIR__ . '/public-key.pem');
+$key = InMemory::file(__DIR__ . '/public-key.pem');
```
Deno's static imports inside dynamically imported modules do not adhere to permission checks
Published: 2021-09-23T23:18:03Z
Aliases: CVE-2021-32619

### Impact

Modules that are dynamically imported through `import()` or `new Worker` might have been able to bypass network and file system permission checks when statically importing other modules. In Deno 1.5.x and 1.6.x only programs dynamically importing (especially transitively) untrusted code are affected. In Deno 1.7.x all programs importing (especially transitively) untrusted code are affected.

In effect an attacker in control of a (possibly remote) module in a programs module graph has been able to, **irrespective of permissions**:
1. initiate GET requests to arbitrary URLs on the internet (including LAN) and possibly read (parts of) the contents of these resources.
2. check for existence of arbitrary paths on the file system, and possibly read (parts of) the contents of these files.

In Deno 1.5.x (October 27th, 2020) and Deno 1.6.x (December 8th, 2020) the attacker module had to have been granted permissions to load dynamically through the network / fs read permission. Since Deno 1.7.x (January 19th, 2021) this vulnerability was able to be exploited in a fully sandboxed isolate (without any permissions). This vulnerability was not present in releases prior to 1.5.0.

Arbitrary non-GET requests, control over request headers, or file system writes are not possible through this vulnerability. Users of the `deno_core`, `deno_runtime`, or other `deno_*` crates are not affected. This is a Deno CLI only vulnerability.

We are relatively confident this was not abused in the wild, as by default Deno prints out a green "Download" message when remote imports are downloaded, and this would have caused suspicion if it occurred in the middle of a programs execution. This message can be silenced with the `--quiet` flag.  

### Patches

The vulnerability has been patched in Deno release 1.10.2. You can upgrade to the latest Deno version by running the `deno upgrade` command. The release is available through all official download channels. 

### Workarounds

There is no workaround for this issue.

### For more information

If you have any questions or comments about this advisory:
* Open an issue on [the issue tracker](https://github.com/denoland/deno)
* Discuss on [Discord](https://discord.gg/deno)
Inefficient Regular Expression Complexity in taro
Published: 2021-09-20T20:09:59Z
Aliases: CVE-2021-3804

taro is vulnerable to Inefficient Regular Expression Complexity
Uninitialized memory access in toodee
Published: 2021-09-01T18:30:40Z
Aliases: CVE-2021-28029

An issue was discovered in the toodee crate before 0.3.0 for Rust. The row-insertion feature allows attackers to read the contents of uninitialized memory locations.
Security check skip in Apache Dubbo
Published: 2021-09-10T17:56:23Z
Aliases: CVE-2021-37579

The Dubbo Provider will check the incoming request and the corresponding serialization type of this request meet the configuration set by the server. But there's an exception that the attacker can use to skip the security check (when enabled) and reaching a deserialization operation with native java serialization. Apache Dubbo 2.7.13, 3.0.2 fixed this issue by quickly fail when any unrecognized request was found.
XSS vulnerability on contacts view
Published: 2021-09-01T18:40:40Z
Aliases: CVE-2021-27911

### Impact
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI, API, 3rd party syncing, forms, etc. 

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Bzip2Decoder doesn't allow setting size restrictions for decompressed data
Published: 2021-09-09T17:11:21Z
Aliases: CVE-2021-37136

### Impact
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression).


All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack

### Workarounds
No workarounds other than not using the `Bzip2Decoder`

### References

Relevant code areas:

https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L80
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L294
https://github.com/netty/netty/blob/netty-4.1.67.Final/codec/src/main/java/io/netty/handler/codec/compression/Bzip2Decoder.java#L305
Prototype Pollution in jointjs
Published: 2021-09-22T20:36:34Z
Aliases: CVE-2021-23444

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.
Hessian protocol configuration vulnerability in Apache Dubbo
Published: 2021-09-08T20:14:14Z
Aliases: CVE-2021-36163

In Apache Dubbo, users may choose to use the Hessian protocol. The Hessian protocol is implemented on top of HTTP and passes the body of a POST request directly to a HessianSkeleton: New HessianSkeleton are created without any configuration of the serialization factory and therefore without applying the dubbo properties for applying allowed or blocked type lists. In addition, the generic service is always exposed and therefore attackers do not need to figure out a valid service/method name pair. This is fixed in 2.7.13, 2.6.10.1
Path traversal in elFinder.NetCore
Published: 2021-09-02T22:05:26Z
Aliases: CVE-2021-23428

This affects all versions of package elFinder.NetCore. The Path.Combine(...) method is used to create an absolute file path. Due to missing sanitation of the user input and a missing check of the generated path its possible to escape the Files directory via path traversal
Path Traversal in serve-here.js
Published: 2021-09-22T18:40:57Z
Aliases: CVE-2019-5444

Versions of serve-here.js prior to 1.2.0 are vulnerable to path traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.
Dolibarr vulnerable to Improper Authentication and Improper Access Control
Published: 2021-09-02T17:16:28Z
Aliases: CVE-2021-25956

In `Dolibarr` application, v3.3.beta1_20121221 to v13.0.2 have `Modify` access for admin level users to change other user’s details but fails to validate already existing “Login” name, while renaming the user `Login`. This leads to complete account takeover of the victim user. This happens since the password gets overwritten for the victim user having a similar login name.
Exposure of Sensitive Information in keycloak
Published: 2021-09-20T20:43:24Z
Aliases: CVE-2020-1744

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.
Deserialization of Untrusted Data in ParlAI
Published: 2021-09-13T20:06:14Z
Aliases: CVE-2021-24040

Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. This issue affects ParlAI prior to v1.1.0.
Observable Response Discrepancy in Lost Password Service
Published: 2021-09-20T19:53:55Z
Aliases: CVE-2021-39189

### Impact
It is possible to enumerate usernames via the forgot password functionality

### Patches
Update to version `10.1.3` or apply this patch manually: https://github.com/pimcore/pimcore/pull/10223.patch

### Workarounds
Apply https://github.com/pimcore/pimcore/pull/10223.patch manually.
Deserialization of Untrusted Data in parlai
Published: 2021-09-13T20:05:39Z
Aliases: CVE-2021-39207

### Impact
Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks.

### Patches
The issue can be patched by upgrading to v1.1.0 or later. It can also be patched by replacing YAML deserialization with equivalent safe_load calls.

### References

- https://github.com/facebookresearch/ParlAI/commit/507d066ef432ea27d3e201da08009872a2f37725
- https://github.com/facebookresearch/ParlAI/commit/4374fa2aba383db6526ab36e939eb1cf8ef99879
- https://anon-artist.github.io/blogs/blog3.html
Infinite loop in Tomcat due to parsing error
Published: 2021-09-20T20:45:44Z
Aliases: CVE-2021-41079

Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
Prototype pollution in aurelia-path
Published: 2021-09-27T20:12:16Z
Aliases: CVE-2021-41097

### Impact
The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`

### Patches
The problem should be patched in version `1.1.7`. Any version earlier than this is vulnerable.

### Workarounds
A partial work around is to free the Object prototype:
```ts
Object.freeze(Object.prototype)
```
URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilder
Published: 2021-09-08T21:11:14Z
Aliases: CVE-2021-32805

### Impact
If using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability 

### Patches
Install Flask-AppBuilder 3.2.2 or above

### Workarounds
Filter HTTP traffic containing `?next={next-site}` where the `next-site` domain is different from the application you are protecting
Directory traversal in Eclipse Mojarra
Published: 2021-09-01T18:23:58Z
Aliases: CVE-2020-6950

Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
SQL Injection in topthink/thinkphp
Published: 2021-09-30T17:11:11Z
Aliases: CVE-2020-20120

ThinkPHP v3.2.3 and below contains a SQL injection vulnerability which is triggered when the array is not passed to the "where" and "query" methods.
Incomplete List of Disallowed Inputs in Kubernetes
Published: 2021-09-07T23:09:24Z
Aliases: CVE-2021-25737

A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs.
Improper use of cryptographic key in wal-g
Published: 2021-09-02T17:17:16Z
Aliases: CVE-2021-38599

WAL-G before 1.1, when a non-libsodium build (e.g., one of the official binary releases published as GitHub Releases) is used, silently ignores the libsodium encryption key and uploads cleartext backups. This is arguably a Principle of Least Surprise violation because "the user likely wanted to encrypt all file activity."