aswin1906/github-advisory-2021.csv huggingface dataset:
Path Traversal in node-red-contrib-huemagic
Published: 2021-04-13T15:30:00Z
Aliases: CVE-2021-25864

node-red-contrib-huemagic 3.0.0 is affected by `hue/assets/..%2F` Directory Traversal.in the `res.sendFile` API, used in file hue-magic.js, to fetch an arbitrary file.
Cross-site Scripting in vis-timeline
Published: 2021-04-13T15:19:50Z
Aliases: CVE-2020-28487

This affects the package vis-timeline before 7.4.4.
 An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.
SQL Server LIMIT / OFFSET SQL Injection in laravel/framework and illuminate/database
Published: 2021-04-29T21:52:53Z

### Impact

Those using SQL Server with Laravel and allowing user input to be passed directly to the `limit` and `offset` functions are vulnerable to SQL injection. Other database drivers such as MySQL and Postgres are not affected by this vulnerability.

### Patches

This problem has been patched on Laravel versions 6.20.26, 7.30.5, and 8.40.0.

### Workarounds

You may workaround this vulnerability by ensuring that only integers are passed to the `limit` and `offset` functions, as well as the `skip` and `take` functions.
Uncontrolled Resource Consumption in rdf-graph-array
Published: 2021-04-13T15:23:21Z
Aliases: CVE-2019-10798

rdf-graph-array through 0.3.0-rc6 manipulation of JavaScript objects resutling in Prototype Pollution. The rdf.Graph.prototype.add method could be tricked into adding or modifying properties of Object.prototype.
Improper Verification of Cryptographic Signature in ansible
Published: 2021-04-20T16:44:07Z
Aliases: CVE-2020-14365

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when `disable_gpg_check` is set to `False`, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
Directory exposure in jetty
Published: 2021-04-06T17:32:00Z
Aliases: CVE-2021-28163

### Impact
If the `${jetty.base}` directory or the `${jetty.base}/webapps` directory is a symlink (soft link in Linux), the contents of the `${jetty.base}/webapps` directory may be deployed as a static web application, exposing the content of the directory for download. 

For example, the problem manifests in the following `${jetty.base}`:
```$ tree demo-base/
demo-base/
├── etc
├── lib
├── resources
├── start.d
├── deploy
│   └── async-rest.war
└── webapps -> deploy

``` 

### Workarounds
Do not use a symlink
Cross-site Scripting in GwtUpload
Published: 2021-04-22T16:15:33Z
Aliases: CVE-2020-9447

The file-upload feature in GwtUpload 1.0.3 allows XSS via a crafted filename.
Server session is not invalidated when logout() helper method of Authentication module is used in Vaadin 18-19
Published: 2021-04-22T16:11:26Z

`Authentication.logout()` helper in `com.vaadin:flow-client` versions 5.0.0 prior to 6.0.0 (Vaadin 18), and 6.0.0 through 6.0.4 (Vaadin 19.0.0 through 19.0.3) uses incorrect HTTP method, which, in combination with Spring Security CSRF protection, allows local attackers to access Fusion endpoints after the user attempted to log out.

- https://vaadin.com/security/cve-2021-31408
py vulnerable to Regular Expression Denial of Service
Published: 2021-04-20T16:39:57Z
Aliases: CVE-2020-29651

A denial of service via regular expression in the py.path.svnwc component of py (aka python-py) through 1.9.0 could be used by attackers to cause a compute-time denial of service attack by supplying malicious input to the blame functionality.
XML Injection in petl
Published: 2021-04-20T16:32:08Z
Aliases: CVE-2020-29128

petl before 1.68, in some configurations, allows resolution of entities in an XML document.
Improper Certificate Validation in phpseclib
Published: 2021-04-07T20:56:55Z
Aliases: CVE-2021-30130

phpseclib before 2.0.31 and 3.x before 3.0.7 mishandles RSA PKCS#1 v1.5 signature verification.
Prototype Pollution in multi-ini
Published: 2021-04-13T15:23:59Z
Aliases: CVE-2020-28448

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.
Denial of service (via resource exhaustion) due to improper input validation on third-party identifier endpoints
Published: 2021-04-13T15:12:51Z
Aliases: CVE-2021-21394

### Impact
Missing input validation of some parameters on the endpoints used to confirm third-party identifiers could cause excessive use of disk space and memory leading to resource exhaustion.

### Patches
The issue is fixed by #9321.

### Workarounds
Depending on the needs and configuration of the homeserver a few options are available:

1. Using email as third-party identifiers be disabled by not configuring the `email` setting.
2. Using phone numbers as third-party identifiers can be disabled by ensuring that `account_threepid_delegates.msisdn` is not configured.
3. Additionally, the affected endpoint patterns can be blocked at a reverse proxy:

    * `^/_matrix/client/(r0|unstable)/register/email`
    * `^/_matrix/client/(r0|unstable)/register/msisdn`
    * `^/_matrix/client/(r0|unstable)/account/password`
    * `^/_matrix/client/(r0|unstable)/account/3pid`
Improper Certificate Validation in oauth ruby gem
Published: 2021-04-22T16:22:15Z
Aliases: CVE-2016-11086

lib/oauth/consumer.rb in the oauth-ruby gem through 0.5.4 for Ruby does not verify server X.509 certificates if a certificate bundle cannot be found, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information.
Uncontrolled Resource Consumption in pillow
Published: 2021-04-23T16:54:36Z

### Impact
_Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large._

### Patches
_An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._

### Workarounds
_An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image._

### References
https://nvd.nist.gov/vuln/detail/CVE-2021-27921

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [example link to repo](http://example.com)
* Email us at [example email address](mailto:example@example.com)
Cross-Site Scripting in Bootstrap Package
Published: 2021-04-29T21:51:21Z
Aliases: CVE-2021-21365

### Problem
It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability.

The following templates are affected by the vulnerability:

* `Resources/Private/Partials/ContentElements/Carousel/Item/CallToAction.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/Header.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/Text.html`
* `Resources/Private/Partials/ContentElements/Carousel/Item/TextAndImage.html`
* `Resources/Private/Partials/ContentElements/Header/SubHeader.html`

Users of the extension, who have overwritten  the affected templates with custom code must manually apply the security fix as shown in [this Git commit](https://github.com/benjaminkott/bootstrap_package/commit/de3a568fc311d6712d9339643e51e8627c80530b).

### Solution
Update to version 7.1.2, 8.0.8, 9.0.4, 9.1.3, 10.0.10 or 11.0.3 of the Bootstrap Package that fix the problem described.

Updated version are available from the TYPO3 extension manager, Packagist and at https://extensions.typo3.org/extension/download/bootstrap_package/.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.
Cross-Site Request Forgery in Webargs
Published: 2021-04-07T21:06:30Z
Aliases: CVE-2020-7965

flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If the request body is valid JSON, it will accept it even if the content type is application/x-www-form-urlencoded. This allows for JSON POST requests to be made across domains, leading to CSRF.
Denial of service (via resource exhaustion) due to improper input validation on groups/communities endpoints
Published: 2021-04-13T15:12:40Z
Aliases: CVE-2021-21393

### Impact
Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields.

### Patches
This issue is fixed by #9321 and #9393.

### Workarounds
The groups feature can be disabled (by setting `enable_group_creation` to `False`) to mitigate this issue. Note that it is disabled by default.

### Other information
Note that the groups feature is not part of the [Matrix specification](https://matrix.org/docs/spec/) and the chosen maximum lengths are arbitrary. Not all clients might abide by them.
Remote Code Execution and download tracking in Mintegral SDK
Published: 2021-04-22T16:15:15Z
Aliases: CVE-2020-7744

"This affects all versions of package com.mintegral.msdk:alphab. The Android SDK distributed by the company contains malicious functionality in this module that tracks: 1. Downloads from Google urls either within Google apps or via browser including file downloads, e-mail attachments and Google Docs links. 2. All apk downloads, either organic or not. Mintegral listens to download events in Android's download manager and detects if the downloaded file's url contains: a. google.com or comes from a Google app (the com.android.vending package) b. Ends with .apk for apk downloads In both cases, the module sends the captured data back to Mintegral's servers. Note that the malicious functionality keeps running even if the app is currently not in focus (running in the background)."
Improper Access Control in Apache Airflow
Published: 2021-04-07T21:05:57Z
Aliases: CVE-2021-26559

Improper Access Control on Configurations Endpoint for the Stable API of Apache Airflow allows users with Viewer or User role to get Airflow Configurations including sensitive information even when `[webserver] expose_config` is set to `False` in `airflow.cfg`. This allowed a privilege escalation attack. This issue affects Apache Airflow 2.0.0.
Potential sensitive data exposure in applications using Vaadin 15
Published: 2021-04-19T14:52:14Z
Aliases: CVE-2020-36319

Insecure configuration of default `ObjectMapper` in `com.vaadin:flow-server` versions 3.0.0 through 3.0.5 (Vaadin 15.0.0 through 15.0.4) may expose sensitive data if the application also uses e.g. `@RestController`

- https://vaadin.com/security/cve-2020-36319
Authorization Before Parsing and Canonicalization in jetty
Published: 2021-04-06T17:31:01Z
Aliases: CVE-2021-28164

Release 9.4.37 introduced a more precise implementation of [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.3) with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours.   The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain `%2e` or `%2e%2e` segments to access protected resources within the `WEB-INF` directory.  For example a request to `/context/%2e/WEB-INF/web.xml` can retrieve the `web.xml` file.  This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS can be enabled by updating `start.d/http.ini` to include: jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS.
HTTP Request Smuggling in Undertow
Published: 2021-04-30T17:28:33Z
Aliases: CVE-2020-10719

A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.
Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Published: 2021-04-19T14:51:25Z
Aliases: CVE-2021-31404

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 through 13), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.

- https://vaadin.com/security/cve-2021-31404
Node-Redis potential exponential regex in monitor mode
Published: 2021-04-27T15:56:03Z
Aliases: CVE-2021-29469

### Impact
When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.

### Patches
The problem was fixed in commit [`2d11b6d`](https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e) and was released in version `3.1.1`.

### References
#1569 (GHSL-2021-026)
Path Traversal and Improper Input Validation in Apache Commons IO
Published: 2021-04-26T16:04:00Z
Aliases: CVE-2021-29425

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
Insecure Deserialization of untrusted data in rmccue/requests
Published: 2021-04-29T21:52:30Z
Aliases: CVE-2021-29476

### Impact
Unserialization of untrusted data.

### Patches
The issue has been patched and users of `Requests` 1.6.0, 1.6.1 and 1.7.0 should update to version 1.8.0.

### References
Publications about the vulnerability:
* https://dannewitz.ninja/posts/php-unserialize-object-injection-yet-another-stars-rating-wordpress
* https://github.com/ambionics/phpggc/issues/52
* https://blog.detectify.com/2019/07/23/improving-wordpress-plugin-security/
* https://i.blackhat.com/us-18/Thu-August-9/us-18-Thomas-Its-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-Know-It.pdf
* https://cdn2.hubspot.net/hubfs/3853213/us-18-Thomas-It%27s-A-PHP-Unserialization-Vulnerability-Jim-But-Not-As-We-....pdf
* https://2018.zeronights.ru/wp-content/uploads/materials/9%20ZN2018%20WV%20-%20PHP%20unserialize.pdf
* https://medium.com/@knownsec404team/extend-the-attack-surface-of-php-deserialization-vulnerability-via-phar-d6455c6a1066#3c0f

Originally fixed in WordPress 5.5.2:
* https://github.com/WordPress/wordpress-develop/commit/add6bedf3a53b647d0ebda2970057912d3cd79d3
* https://wordpress.org/news/2020/10/wordpress-5-5-2-security-and-maintenance-release/

Related Security Advisories:
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=2020-28032
* https://nvd.nist.gov/vuln/detail/CVE-2020-28032

Notification to the Requests repo including a fix in:
* https://github.com/rmccue/Requests/pull/421 and
* https://github.com/rmccue/Requests/pull/422

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Request](https://github.com/WordPress/Requests/)
Improper parsing of octal bytes in netmask
Published: 2021-04-14T15:03:16Z
Aliases: CVE-2021-28918

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

:exclamation: NOTE: The fix for this issue was incomplete. A subsequent fix was made in version `2.0.1` which was assigned [CVE-2021-29418 / GHSA-pch5-whg9-qr2r](https://github.com/advisories/GHSA-pch5-whg9-qr2r). For complete protection from this vulnerability an upgrade to version 2.0.1 or later is recommended.
OS Command Injection in lsof
Published: 2021-04-13T15:17:53Z
Aliases: CVE-2019-10783

All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.
Cross-site scripting in SocksJS-node
Published: 2021-04-13T15:25:33Z
Aliases: CVE-2020-8823

htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.
Open redirect via transitional IPv6 addresses on dual-stack networks
Published: 2021-04-13T15:13:08Z
Aliases: CVE-2021-21392

### Impact
Requests to user provided domains were not restricted to external IP addresses when transitional IPv6 addresses were used. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks.

### Patches
This issue is fixed by #9240.

### Workarounds
Outbound requests to the following address ranges can be blocked by a firewall, if unused for internal communication between systems:

* `::ffff/80`
* `::0000/80` (note that this IP range is considered deprecated by the IETF)
* `2002::/16` (note that this IP range is considered deprecated by the IETF)

### References
* [RFC3056](https://tools.ietf.org/html/rfc3056)
* [RFC4291](https://tools.ietf.org/html/rfc4291)
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Published: 2021-04-19T14:52:29Z
Aliases: CVE-2019-25027

Missing output sanitization in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

- https://vaadin.com/security/cve-2019-25027
Allocation of Resources Without Limits or Throttling in Undertow
Published: 2021-04-30T17:28:42Z
Aliases: CVE-2020-10705

A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.
Path Traversal in Ansible
Published: 2021-04-07T20:35:24Z
Aliases: CVE-2020-1735

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Command injection vulnerability in @prisma/sdk in getPackedPackage function
Published: 2021-04-06T17:25:12Z
Aliases: CVE-2021-21414

### Impact

As of today, we are not aware of any Prisma users or external consumers of the `@prisma/sdk` package who are affected by this security vulnerability.

This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

It only affects the `getPackedPackage` function and this function is not advertised and only used for tests & building our CLI, no malicious code was found after checking our codebase.

### Patches

Fixed in 
- @prisma/sdk@2.20.0 (latest channel)
- @prisma/sdk@2.20.0-dev.29 (dev channel)

Pull Request closing this vulnerability [https://github.com/prisma/prisma/pull/6245](https://github.com/prisma/prisma/pull/6245)

### Acknowledgements

This issue was discovered and reported by GitHub Engineer [@erik-krogh (Erik Krogh Kristensen)](https://github.com/erik-krogh).

### For more information

If you have any questions or comments about this advisory:

- Create a discussion in [the Prisma repository](https://github.com/prisma/prisma/discussions)
- Email us at security@prisma.io
Sydent vulnerable to denial of service attack via memory exhaustion
Published: 2021-04-19T14:54:04Z
Aliases: CVE-2021-29430

### Impact

Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to disk space exhaustion and denial of service.

Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service.

This affects any server which accepts registration requests from untrusted clients.

### Patches

Patched by 89071a1, 0523511, f56eee3.

### Workarounds

Request sizes can be limited in an HTTP reverse-proxy.

There are no known workarounds for the problem with overlarge responses.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
Directory traversal in development mode handler in Vaadin 14 and 15-17
Published: 2021-04-19T14:48:15Z

Improper URL validation in development mode handler in `com.vaadin:flow-server` versions 2.0.0 through 2.4.1 (Vaadin 14.0.0 through 14.4.2), and 3.0 prior to 5.0 (Vaadin 15 prior to 18) allows attacker to request arbitrary files stored outside of intended frontend resources folder.

- https://vaadin.com/security/cve-2020-36321
Externally Controlled Reference to a Resource in Another Sphere and Confused Deputy in Spring Cloud Netflix
Published: 2021-04-30T17:29:42Z
Aliases: CVE-2020-5412

Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
Reflected cross-site scripting in default RouteNotFoundError view in Vaadin 10 and 11-13
Published: 2021-04-19T14:48:51Z

Missing output sanitization in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.10 (Vaadin 10.0.0 through 10.0.13), and 1.1.0 through 1.4.2 (Vaadin 11.0.0 through 13.0.5) allows attacker to execute malicious JavaScript via crafted URL.

- https://vaadin.com/security/cve-2019-25027
Code injection in port-killer
Published: 2021-04-13T15:20:49Z
Aliases: CVE-2021-23359

This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
Out-of-bounds Write in Chakra
Published: 2021-04-13T15:54:40Z
Aliases: CVE-2020-17131

Chakra Scripting Engine Memory Corruption Vulnerability
Unauthorized client-side property update in UIDL request handler in Vaadin 10 and 11
Published: 2021-04-19T14:49:13Z

Missing check in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.5 (Vaadin 10.0.0 through 10.0.7, and 11.0.0 through 11.0.2) allows attacker to update element property values via crafted synchronization message.

- https://vaadin.com/security/cve-2018-25007