aswin1906/github-advisory-2021.csv huggingface dataset:
XSS vulnerability in company name field in Mautic
Published: 2021-01-19T21:16:26Z
Aliases: CVE-2018-11200

### Impact
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.

### Patches
Update to 2.14.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
XML External Entity attack in log4net
Published: 2021-01-29T19:47:23Z
Aliases: CVE-2018-1285

Apache log4net before 2.0.10 does not disable XML external entities when parsing log4net configuration files. This could allow for XXE-based attacks in applications that accept arbitrary configuration files from users.
Injection/XSS in Redcarpet
Published: 2021-01-11T19:06:10Z
Aliases: CVE-2020-26298

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the `:escape_html` option was being used.  This is fixed in version 3.5.1 by the referenced commit.
Command injection in buns
Published: 2021-01-13T18:22:13Z
Aliases: CVE-2020-7794

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
Denial of Service in Apache POI
Published: 2021-01-14T19:18:22Z
Aliases: CVE-2017-12626

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks:
  - Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294)
  - Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295)
XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic
Published: 2021-01-19T20:43:56Z
Aliases: CVE-2020-35124

### Impact
This is a cross-site scripting vulnerability which affects every version of Mautic and could allow an attacker unauthorised administrator level access to Mautic.

This vulnerability was reported by Naveen Sunkavally at Horizon3.ai.

### Patches
Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Post in https://forum.mautic.org/c/support
* Email us at security@mautic.org
CSV Injection vulnerability with exported contact lists in Mautic
Published: 2021-01-19T21:16:29Z
Aliases: CVE-2018-8092

### Impact
Mautic versions before 2.13.0 had a vulnerability that allowed a CSV injection with exported contact lists - https://www.owasp.org/index.php/CSV_Injection.

### Patches
Update to 2.13.0 or later.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
XSS in Mautic
Published: 2021-01-29T20:51:20Z
Aliases: CVE-2021-3142

### Impact
This is a cross-site scripting vulnerability relating to creating/editing a company which requires the user to be logged in as an administrator to be executed.

This vulnerability was reported by Dardan Prebreza at Bishop Fox.

### Patches
Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

### Workarounds
None

### References
https://www.mautic.org/blog/community/security-release-all-versions-mautic-prior-2-16-5-and-3-2-4

### For more information
If you have any questions or comments about this advisory:
* Post in https://forum.mautic.org/c/support
* Email us at security@mautic.org
Directory Traversal in spring-boot-actuator-logview
Published: 2021-01-05T17:29:40Z
Aliases: CVE-2021-21234

### Impact
The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile&base=../` could access a file outside the logging base directory).

### Patches
The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release.

### Workarounds
There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [github repo](https://github.com/lukashinsch/spring-boot-actuator-logview)
Regular Expression Denial of Service in CairoSVG
Published: 2021-01-06T16:57:50Z
Aliases: CVE-2021-21236

# Doyensec Vulnerability Advisory 

* Regular Expression Denial of Service (REDoS) in cairosvg
* Affected Product: CairoSVG v2.0.0+
* Vendor: https://github.com/Kozea
* Severity: Medium
* Vulnerability Class: Denial of Service
* Author(s): Ben Caller ([Doyensec](https://doyensec.com))

## Summary

When processing SVG files, the python package CairoSVG uses two regular expressions which are vulnerable to Regular Expression Denial of Service (REDoS).
If an attacker provides a malicious SVG, it can make cairosvg get stuck processing the file for a very long time.

## Technical description

The vulnerable regular expressions are

https://github.com/Kozea/CairoSVG/blob/9c4a982b9a021280ad90e89707eacc1d114e4ac4/cairosvg/colors.py#L190-L191

The section between 'rgb(' and the final ')' contains multiple overlapping groups.

Since all three infinitely repeating groups accept spaces, a long string of spaces causes catastrophic backtracking when it is not followed by a closing parenthesis.

The complexity is cubic, so doubling the length of the malicious string of spaces makes processing take 8 times as long.

## Reproduction steps

Create a malicious SVG of the form:

    <svg width="1" height="1"><rect fill="rgb(                     ;"/></svg>

with the following code:

    '<svg width="1" height="1"><rect fill="rgb(' + (' ' * 3456) + ';"/></svg>'

Note that there is no closing parenthesis before the semi-colon.

Run cairosvg e.g.:

    cairosvg cairo-redos.svg -o x.png

and notice that it hangs at 100% CPU. Increasing the number of spaces increases the processing time with cubic complexity.

## Remediation

Fix the regexes to avoid overlapping parts. Perhaps remove the [ \n\r\t]* groups from the regex, and use .strip() on the returned capture group.

## Disclosure timeline

- 2020-12-30: Vulnerability disclosed via email to CourtBouillon
CKEditor 5 Markdown plugin Regular expression Denial of Service
Published: 2021-01-29T21:51:22Z
Aliases: CVE-2021-21254

### Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version <= 24.0.0. 

### Patches
The problem has been recognized and patched. The fix will be available in version 25.0.0.

### Workarounds
The user can work around the issue by:
- Upgrading CKEditor 5 to version 25.0.0.
- Disabling the Markdown plugin.

### More information
If you have any questions or comments about this advisory:
* Email us at [security@cksource.com](mailto:security@cksource.com)

### Acknowledgements
The CKEditor 5 team would like to thank Erik Krogh Kristensen from the GitHub team for recognizing this vulnerability and 
Alvaro Muñoz from GitHub for reporting it.
XSS in hello.js
Published: 2021-01-13T19:07:01Z
Aliases: CVE-2020-7741

This affects the package hello.js before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect, such as `javascript:alert(1)`.
Steam Socialite Provider v1 does not correctly validate openid server
Published: 2021-01-29T20:51:30Z

### Impact
The outdated version 1 of the Steam Socialite Provider doesn't check properly if the login comes from `steamcommunity.com`, allowing a malicious actor to substitute their own openID server.

### Patches
This vulnerability only affects the outdated v1.x versions of the package. These are no longer maintained, users should upgrade to v3 or v4, which use a hardcoded endpoint to verify the login.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [SocialiteProviders/Providers](https://github.com/SocialiteProviders/Providers)
* Email us at [socialite@atymic.dev](mailto:socialite@atymic.dev)
Cross Site Scripting (XSS) in XWiki
Published: 2021-01-29T18:13:03Z
Aliases: CVE-2021-3137

XWiki 12.10.2 allows XSS via an SVG document to the upload feature of the comment section.
Command injection in ts-process-promises
Published: 2021-01-13T18:22:28Z
Aliases: CVE-2020-7784

This affects all versions of package ts-process-promises. The injection point is located in line 45 in main entry of package in lib/process-promises.js.
Deserialization of untrusted data in jackson-databind
Published: 2021-01-20T21:20:15Z
Aliases: CVE-2021-20190

A flaw was found in jackson-databind before 2.9.10.7 and 2.6.7.5. FasterXML mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Regular Expression Denial of Service in jquery-validation
Published: 2021-01-13T18:21:54Z
Aliases: CVE-2021-21252

The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.

The project contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service)

This issue was discovered and reported by GitHub team member @erik-krogh (Erik Krogh Kristensen).
CSRF can expose users authentication token
Published: 2021-01-11T20:38:28Z
Aliases: CVE-2021-21241

### Issue
The  /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token.

### Patches
Version 3.4.5 and soon to be released 4.0.0 are patched.

### Workarounds
If you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to "0" (seconds) which should make the token unusable.

### References
None
Malicious npm package: discord-fix
Published: 2021-01-29T18:12:07Z

The npm `discord-fix` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Improper Verification of Cryptographic Signature in PySAML2
Published: 2021-01-21T14:12:18Z
Aliases: CVE-2021-21239

### Impact

All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 <= 6.4.1` does not ensure that a signed SAML document is correctly signed. The default `CryptoBackendXmlSec1` backend is using the `xmlsec1` binary to verify the signature of signed SAML documents, but by default, `xmlsec1` accepts any type of key found within the given document. `xmlsec1` needs to be configured explicitly to only use only _x509 certificates_ for the verification process of the SAML document signature.

### Patches

Users should upgrade to pysaml2 `v6.5.0`.

### Workarounds

No workaround provided at this point.

### References

This issue has been reported in the past at the xmlsec1 mailing list:
https://www.aleksey.com/pipermail/xmlsec/2013/009717.html

### Credits

- Brian Wolff

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [pysaml2](https://github.com/IdentityPython/pysaml2)
* Email us at [the incident-response address](mailto:incident-response@idpy.org)
rails_admin ruby gem XSS vulnerability
Published: 2021-01-14T19:17:16Z
Aliases: CVE-2020-36190

RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.
Axios vulnerable to Server-Side Request Forgery
Published: 2021-01-04T20:59:40Z
Aliases: CVE-2020-28168

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
CORS misconfiguration in socket.io
Published: 2021-01-20T21:22:37Z
Aliases: CVE-2020-28481

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
IPC messages delivered to the wrong frame in Electron
Published: 2021-01-28T19:11:34Z
Aliases: CVE-2020-26272

### Impact
IPC messages sent from the main process to a subframe in the renderer process, through `webContents.sendToFrame`, `event.reply` or when using the `remote` module, can in some cases be delivered to the wrong frame.

If your app does ANY of the following, then it is impacted by this issue:
- Uses `remote`
- Calls `webContents.sendToFrame`
- Calls `event.reply` in an IPC message handler

### Patches
This has been fixed in the following versions:

- 9.4.0
- 10.2.0
- 11.1.0
- 12.0.0-beta.9

### Workarounds
There are no workarounds for this issue.

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
XSS in HtmlSanitizer
Published: 2021-01-04T18:22:11Z
Aliases: CVE-2020-26293

### Impact

If you have explicitly allowed the `<style>` tag, an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not explicitly allowed the `<style>` tag.

### Patches

The problem has been fixed in version 5.0.372.

### Workarounds

Remove the `<style>` tag from the set of allowed tags.

### For more information

If you have any questions or comments about this advisory open an issue in https://github.com/mganss/HtmlSanitizer

### Credits

This issue was discovered by Michal Bentkowski of Securitum.
Cross-site scripting vulnerability in TinyMCE
Published: 2021-01-06T19:27:54Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are using TinyMCE 5.5.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.6.0 by improved URL sanitization logic.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Manually sanitize `iframe`, `object` and `embed` URL attributes using a [TinyMCE node filter](https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.domparser/#addnodefilter).
- Disable `iframe`, `object`, and `embed` elements in your content using the [invalid_elements](https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements) setting.

#### Example: Sanitizing using a node filter
```js
editor.parser.addNodeFilter('iframe,object,embed', function(nodes) {
  nodes.forEach(function(node) {
    if (node.attributes) {
      node.attributes.forEach(function(attr) {
        var name = attr.name;
        var value = attr.value;
        // Sanitize the attribute value here or remove it entirely
        var sanitizedValue = ...;
        node.attr(name, santizedValue);
      });
    }
  });
});
```

#### Example: Using invalid_elements
```js
invalid_elements: 'iframe,object,embed'
```

### Acknowledgements
Tiny Technologies would like to thank Aaron Bishop at SecurityMetrics for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Mautic Sessions could be hijacked due to tracking contacts by an auto-incremented ID
Published: 2021-01-19T21:16:21Z
Aliases: CVE-2018-10189

### Impact
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a third party can manipulate the cookie value with +1 to systematically assume being tracked as each contact in Mautic. It is then possible to retrieve information about the contact through forms that have progressive profiling enabled.

### Patches
Update to 2.13.0 or later

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Malicious npm package: an0n-chat-lib
Published: 2021-01-29T18:12:19Z

The npm `an0n-chat-lib` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Cross-site Request Forgery in fastify-csrf
Published: 2021-01-20T21:30:34Z
Aliases: CVE-2020-28482

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection.
1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: `cookieOpts: { path: '/', sameSite: true }`
2. The CSRF token was available in the GET query parameter
lxml vulnerable to Cross-site Scripting
Published: 2021-01-07T21:54:01Z
Aliases: CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.
Blind SQL injection in PrestaShop productcomments module
Published: 2021-01-20T21:33:53Z
Aliases: CVE-2020-26248

### Impact
An attacker can use a Blind SQL injection to retrieve data or stop the MySQL service.

### Patches
The problem is fixed in 4.2.1
Path Traversal in the Java Kubernetes Client
Published: 2021-01-29T18:12:54Z
Aliases: CVE-2020-8570

Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executing the client code.
OS Command Injection in async-git
Published: 2021-01-29T18:14:00Z
Aliases: CVE-2021-3190

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted user input before passing it to one of the vulnerable functions as a workaround or update async-git to version 1.13.1.
Prototype pollution in JointJS
Published: 2021-01-20T21:21:16Z
Aliases: CVE-2020-28480

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.
Signature validation bypass in ServiceStack
Published: 2021-01-13T19:13:11Z
Aliases: CVE-2020-28042

ServiceStack before 5.9.2 mishandles JWT signature verification unless an application has a custom ValidateToken function that establishes a valid minimum length for a signature.
Mautic users able to download any files from server using filemanager
Published: 2021-01-19T20:50:38Z
Aliases: CVE-2017-1000490

### Impact
Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user has access to.

### Patches
Update to 2.12.0 or later.

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
SAML XML Signature wrapping in PySAML2
Published: 2021-01-21T14:12:16Z
Aliases: CVE-2021-21238

### Impact

All users of pysaml2 that use the default `CryptoBackendXmlSec1` backend and need to verify signed SAML documents are impacted. `pysaml2 <= 6.4.1` does not validate the SAML document against an XML schema. This allows invalid XML documents to trick the verification process, by presenting elements with a valid signature inside elements whose content has been malformed. The verification is offloaded to `xmlsec1` and `xmlsec1` will not validate every signature in the given document, but only the first it finds in the given scope.

### Patches

Users should upgrade to pysaml2 `v6.5.0`.

### Workarounds

No workaround provided at this point.

### References

No references provided at this point.

### Credits

- Victor Schönfelder Garcia (isits AG International School of IT Security)
- Juraj Somorovsky (Paderborn University)
- Vladislav Mladenov (Ruhr University Bochum)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [pysaml2](https://github.com/IdentityPython/pysaml2)
* Email us at [the incident-response address](mailto:incident-response@idpy.org)
Query Binding Exploitation
Published: 2021-01-19T19:36:51Z
Aliases: CVE-2021-21263

### Description

Laravel versions <6.20.12, <7.30.3 & <8.22.1 contain a query binding exploitation.

If a request is crafted where a field that is normally a non-array value is an array, and that input is not validated or cast to its expected type before being passed to the query builder, an unexpected number of query bindings can be added to the query. In some situations, this will simply lead to no results being returned by the query builder; however, it is possible certain queries could be affected in a way that causes the query to return unexpected results.

This vulnerability was discovered by Tim Groenevelt (tim.g@foodbyus.com).

### References

- https://github.com/laravel/framework/pull/35865
Path traversal in Node-RED-Dashboard
Published: 2021-01-29T18:13:52Z
Aliases: CVE-2021-3223

In Node-RED-Dashboard before 2.26.2 there is a path traversal vulnerability. It allows ui_base/js/..%2f directory traversal to read files.