aswin1906/github-advisory-2021.csv huggingface dataset:
Privilage Escalation in moodle
Published: 2021-03-29T20:42:55Z
Aliases: CVE-2020-25701

If the upload course tool in Moodle was used to delete an enrollment method which did not exist or was not already enabled, the tool would erroneously enable that enrollment method. This could lead to unintended users gaining access to the course. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5, 3.7 to 3.7.8, 3.5 to 3.5.14 and earlier unsupported versions. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, 3.5.15, and 3.10.
Prototype pollution in set-in
Published: 2021-03-19T21:01:46Z
Aliases: CVE-2020-28273

Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.
Cross-Site Scripting in Content Preview
Published: 2021-03-23T01:53:47Z
Aliases: CVE-2021-21340

> ### Meta
> * CVSS: `AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0)
> * CWE-79
> * Status: **DRAFT**

### Problem
It has been discovered that database fields used as _descriptionColumn_ are vulnerable to cross-site scripting when their content gets previewed in the page module. A valid backend user account is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 10.4.14, 11.1.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-007](https://typo3.org/security/advisory/typo3-core-sa-2021-007)
It's possible to execute anything with the rights of the author of a macro which uses the {{wikimacrocontent}} macro
Published: 2021-03-23T22:47:26Z
Aliases: CVE-2021-21379

### Impact

The `{{wikimacrocontent}}` executes the content with the rights of the wiki macro author instead of the caller of that wiki macro. This makes possible to inject scripts through it and they will be executed with the rights of the wiki macro (very often a user which has Programming rights).

Fortunately, no such macro exists by default in XWiki Standard but one could have been created or installed with an extension.

### Patches

It has been patched in versions XWiki 12.6.3, 11.10.11 and 12.8-rc-1.

### Workarounds

There is no easy workaround other than disabling the affected macros.
Inserting content in a safe way or knowing what is the user who called the wiki macro is not easy.

### References

https://jira.xwiki.org/browse/XWIKI-17759

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [our security mailing list](mailto:security@xwiki.org)
Out-of-bounds write
Published: 2021-03-29T20:58:01Z
Aliases: CVE-2019-1196

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1131, CVE-2019-1139, CVE-2019-1140, CVE-2019-1141, CVE-2019-1195, CVE-2019-1197.
Remote Code Execution in Apache Dubbo
Published: 2021-09-08T20:14:24Z
Aliases: CVE-2021-36162

Apache Dubbo supports various rules to support configuration override or traffic routing (called routing in Dubbo). These rules are loaded into the configuration center (eg: Zookeeper, Nacos, ...) and retrieved by the customers when making a request in order to find the right endpoint. When parsing these YAML rules, Dubbo customers will use SnakeYAML library to load the rules which by default will enable calling arbitrary constructors. An attacker with access to the configuration center he will be able to poison the rule so when retrieved by the consumers, it will get RCE on all of them. This was fixed in Dubbo 2.7.13, 3.0.2
Code Injection in pac-resolver
Published: 2021-09-02T17:10:06Z
Aliases: CVE-2021-23406

This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Command Injection in Simiki
Published: 2021-09-01T18:37:24Z
Aliases: CVE-2020-19001

Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'.
Inefficient Regular Expression Complexity in chalk/ansi-regex
Published: 2021-09-20T20:20:09Z
Aliases: CVE-2021-3807

ansi-regex is vulnerable to Inefficient Regular Expression Complexity which could lead to a denial of service when parsing invalid ANSI escape codes.

**Proof of Concept**
```js
import ansiRegex from 'ansi-regex';
for(var i = 1; i <= 50000; i++) {
    var time = Date.now();
    var attack_str = "\u001B["+";".repeat(i*10000);
    ansiRegex().test(attack_str)
    var time_cost = Date.now() - time;
    console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
}
```
The ReDOS is mainly due to the sub-patterns `[[\\]()#;?]*` and `(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*`
Cross-site Scripting in the yoast_seo TYPO3 extension
Published: 2021-09-01T18:36:44Z
Aliases: CVE-2021-36788

The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
Improper authorisation of members discloses room membership to non-members
Published: 2021-09-01T18:25:27Z
Aliases: CVE-2021-39164

### Impact
Unauthorised users can access the membership (list of members, with their display names) of a room if they know the ID of the room. The vulnerability is limited to rooms with `shared` history visibility. Furthermore, the unauthorised user must be using an account on a vulnerable homeserver that is in the room.

### Patches
Server administrators should upgrade to 1.41.1 or later.

### Workarounds
Administrators of servers that use a reverse proxy could, with potentially unacceptable loss of functionality, block the following endpoints:
* `/_matrix/client/r0/rooms/{room_id}/members` with `at` query parameter
* `/_matrix/client/unstable/rooms/{room_id}/members` with `at` query parameter

### References
n/a

### For more information
If you have any questions or comments about this advisory, e-mail us at security@matrix.org.
Uncontrolled Resource Consumption in ansi-html
Published: 2021-09-02T17:15:24Z
Aliases: CVE-2021-23424

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
Uncontrolled Resource Consumption in pillow
Published: 2021-09-07T23:08:10Z
Aliases: CVE-2021-23437

The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Improper Authentication
Published: 2021-09-02T22:00:09Z
Aliases: CVE-2019-20894

Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a situation where ERR_BAD_SSL_CLIENT_AUTH_CERT should have occurred.
Bash command injection in Apache Zeppelin
Published: 2021-09-07T22:56:43Z
Aliases: CVE-2019-10095

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
Exposure of Resource to Wrong Sphere in LibreNMS
Published: 2021-09-08T17:27:16Z
Aliases: CVE-2020-15877

An issue was discovered in LibreNMS before 1.65.1. It has insufficient access control for normal users because of "'guard' => 'admin'" instead of "'middleware' => ['can:admin']" in routes/web.php.
Uncontrolled Resource Consumption in transpile
Published: 2021-09-02T17:10:42Z
Aliases: CVE-2021-23429

All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.
Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass
Published: 2021-09-20T20:18:11Z
Aliases: CVE-2021-41303

Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
XSS vulnerability on password reset page
Published: 2021-09-01T18:40:56Z
Aliases: CVE-2021-27909

### Impact
For Mautic versions prior to 3.3.4, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized. 

### Patches

Upgrade to 3.3.4 or 4.0.0

### Workarounds

No

### References

https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Transaction validity oversight in pallet-ethereum
Published: 2021-09-01T18:22:48Z
Aliases: CVE-2021-39193

### Impact

A bug in `pallet-ethereum` can cause invalid transactions to be included in the Ethereum block state in `pallet-ethereum` due to not validating the input data size. Any invalid transactions included this way have no possibility to alter the internal Ethereum or Substrate state. The transaction will appear to have be included, but is of no effect as it is rejected by the EVM engine. The impact is further limited by Substrate extrinsic size constraints.

### Patches

Patches are applied in PR #465.

### Workarounds

None.

### References

Patch PR: https://github.com/paritytech/frontier/pull/465

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the [Frontier repo](https://github.com/paritytech/frontier)
Cross-site Scripting in Gitea
Published: 2021-09-27T20:17:39Z
Aliases: CVE-2021-28378

Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.
raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions.
Published: 2021-09-02T17:10:52Z
Aliases: CVE-2021-38557

raspap-webgui in RaspAP 2.6.6 allows attackers to execute commands as root because of the insecure sudoers permissions. The www-data account can execute /etc/raspap/hostapd/enablelog.sh as root with no password; however, the www-data account can also overwrite /etc/raspap/hostapd/enablelog.sh with any executable content.
Path traversal in atlasboard
Published: 2021-09-02T17:17:25Z
Aliases: CVE-2021-39109

The renderWidgetResource resource in Atlasian Atlasboard before version 1.1.9 allows remote attackers to read arbitrary files via a path traversal vulnerability.
Improper Restriction of XML External Entity Reference (XXE) in Nokogiri on JRuby
Published: 2021-09-27T20:12:47Z
Aliases: CVE-2021-41098

### Severity

The Nokogiri maintainers have evaluated this as [**High Severity** 7.5 (CVSS3.0)](https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C/MAV:N/MAC:L) for JRuby users. (This security advisory does not apply to CRuby users.)


### Impact

In Nokogiri v1.12.4 and earlier, **on JRuby only**, the SAX parser resolves external entities by default.

Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected:

- Nokogiri::XML::SAX::Parser
- Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser
- Nokogiri::XML::SAX::PushParser
- Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser


### Mitigation

JRuby users should upgrade to Nokogiri v1.12.5 or later. There are no workarounds available for v1.12.4 or earlier.

CRuby users are not affected.
Insertion of Sensitive Information into Externally-Accessible File or Directory and Exposure of Sensitive Information to an Unauthorized Actor in hbs
Published: 2021-09-02T17:16:46Z
Aliases: CVE-2021-32822

The npm hbs package is an Express view engine wrapper for Handlebars. Depending on usage, users of hbs may be vulnerable to a file disclosure vulnerability. There is currently no patch for this vulnerability. hbs mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options a file disclosure vulnerability may be triggered in downstream applications. For an example PoC see the referenced GHSL-2021-020.
OS Command Injection in ssh2
Published: 2021-09-21T16:50:46Z
Aliases: CVE-2020-26301

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
Inefficient Regular Expression Complexity in nth-check
Published: 2021-09-20T20:47:31Z
Aliases: CVE-2021-3803

There is a Regular Expression Denial of Service (ReDoS) vulnerability in nth-check that causes a denial of service when parsing crafted invalid CSS nth-checks.

The ReDoS vulnerabilities of the regex are mainly due to the sub-pattern `\s*(?:([+-]?)\s*(\d+))?` with quantified overlapping adjacency and can be exploited with the following code.

**Proof of Concept**
```js
// PoC.js
var nthCheck = require("nth-check")
for(var i = 1; i <= 50000; i++) {
    var time = Date.now();
    var attack_str = '2n' + ' '.repeat(i*10000)+"!";
    try {
        nthCheck.parse(attack_str) 
    }
    catch(err) {
        var time_cost = Date.now() - time;
        console.log("attack_str.length: " + attack_str.length + ": " + time_cost+" ms")
    }
}
```

**The Output**
```
attack_str.length: 10003: 174 ms
attack_str.length: 20003: 1427 ms
attack_str.length: 30003: 2602 ms
attack_str.length: 40003: 4378 ms
attack_str.length: 50003: 7473 ms
```
OctoRPKI lacks contextual out-of-bounds check when validating RPKI ROA maxLength values
Published: 2021-09-07T23:02:18Z
Aliases: CVE-2021-3761

Any CA issuer in the RPKI can trick OctoRPKI prior to https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422 into emitting an invalid VRP "MaxLength" value, causing RTR sessions to terminate. 

### Impact

An attacker can use this to disable RPKI Origin Validation in a victim network (for example AS 13335 - Cloudflare) prior to launching a BGP hijack which during normal operations would be rejected as "RPKI invalid". Additionally, in certain deployments RTR session flapping in and of itself also could cause BGP routing churn, causing availability issues.

### Patches
https://github.com/cloudflare/cfrpki/commit/a8db4e009ef217484598ba1fd1c595b54e0f6422

https://github.com/cloudflare/cfrpki/releases/tag/v1.3.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@cloudflare.com](security@cloudflare.com)
SQL Injection in Subrion CMS 
Published: 2021-09-08T17:27:45Z
Aliases: CVE-2020-18155

SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.
Lacking Protection against HTTP Request Smuggling in mitmproxy
Published: 2021-09-20T19:53:30Z
Aliases: CVE-2021-39214

### Impact

In mitmproxy 7.0.2 and below, a malicious client or server is able to perform [HTTP request smuggling](https://en.wikipedia.org/wiki/HTTP_request_smuggling) attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

Unless you use mitmproxy to protect an HTTP/1 service, no action is required.


### Patches

The vulnerability has been fixed in mitmproxy 7.0.3 and above.


### Acknowledgements

We thank João Sobral (@chinchila) for responsibly disclosing this vulnerability to the mitmproxy team.


### Timeline

- **2021-09-08**: Received initial report for mitmproxy <= 6.0.2.
- **2021-09-08**: Requested clarification if 7.x is affected.
- **2021-09-10**: Received additional details, 7.x situation still unclear.
- **2021-09-13**: Internally determined that 7.x is also affected.
- **2021-09-13**: Shared initial fix with researcher.
- **2021-09-14**: Received confirmation that fix is working, but H2.TE/H2.CL should also be looked at.
- **2021-09-14**: Shared revised fix that includes additional H2.TE mitigations.
- **2021-09-14**: Received confirmation that revised fix is working.
- **2021-09-16**: Completed internal patch review.
- **2021-09-16**: Published patch release and advisory.
Tarslip in go-unarr
Published: 2021-09-01T18:32:02Z
Aliases: CVE-2021-38197

unarr.go in go-unarr (aka Go bindings for unarr) 0.1.1 allows Directory Traversal via ../ in a pathname within a TAR archive.
Denial of Service in node-static
Published: 2021-09-22T18:22:02Z

All versions of node-static are vulnerable to a Denial of Service. The package fails to catch an exception when user input includes null bytes. This allows attackers to access `http://host/%00` and crash the server.
Cross-site Scripting in yourls
Published: 2021-09-20T20:42:52Z
Aliases: CVE-2021-3785

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in edit dialog.
Improper Input Validation and Command Injection in Ansible
Published: 2021-09-23T23:16:38Z
Aliases: CVE-2021-3583

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Exposure of Sensitive Information to an Unauthorized Actor
Published: 2021-09-08T17:59:46Z
Aliases: CVE-2021-32712

Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
Cross-site Scripting in OpenCRX
Published: 2021-09-30T20:50:21Z
Aliases: CVE-2021-25959

In OpenCRX, versions v4.0.0 through v5.1.0 are vulnerable to reflected Cross-site Scripting (XSS), due to unsanitized parameters in the password reset functionality. This allows execution of external javascript files on any user of the openCRX instance.
Cross-site Scripting in yourls
Published: 2021-09-20T20:43:15Z
Aliases: CVE-2021-3783

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in arbitrary path handling.
Incorrect handling of H2 GOAWAY + SETTINGS frames
Published: 2021-09-10T17:54:01Z
Aliases: CVE-2021-39162

Envoy, which Pomerium is based on, can abnormally terminate if an H/2 GOAWAY and SETTINGS frame are received in the same IO event.  

### Impact
This can lead to a DoS in the presence of untrusted *upstream* servers.

### Patches
0.15.1 contains an upgraded envoy binary with this vulnerability patched.

### Workarounds
If only trusted upstreams are configured, there is not substantial risk of this condition being triggered.

### References
[envoy GSA](https://github.com/envoyproxy/envoy/security/advisories/GHSA-j374-mjrw-vvp8)
[envoy CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32780)
[envoy announcement](https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJ)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pomerium/pomerium](https://github.com/pomerium/pomerium/issues)
* Email us at [security@pomerium.com](mailto:security@pomerium.com)
Command injection in @diez/generation
Published: 2021-09-02T17:08:20Z
Aliases: CVE-2021-32830

The `@diez/generation` npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. All versions of this package are vulnerable as of the writing of this CVE.
Cross-site Scripting in Mattermost
Published: 2021-09-23T23:11:06Z
Aliases: CVE-2021-37860

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.
Path traversal in ServiceCenter
Published: 2021-09-01T18:35:52Z
Aliases: CVE-2021-21501

Improper configuration will cause ServiceComb ServiceCenter Directory Traversal problem in ServcieCenter 1.x.x versions and fixed in 2.0.0.
Partial path traversal in sharpcompress
Published: 2021-09-20T19:53:42Z
Aliases: CVE-2021-39208

SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to prevent extraction outside the destination directory the destinationFileName path is verified to begin with fullDestinationDirectoryPath. However it is not enforced that fullDestinationDirectoryPath ends with slash:

```csharp
public static void WriteEntryToDirectory(IEntry entry,
                                         string destinationDirectory,
                                         ExtractionOptions? options,
                                         Action<string, ExtractionOptions?> write)
{
    string destinationFileName;
    string file = Path.GetFileName(entry.Key);
    string fullDestinationDirectoryPath = Path.GetFullPath(destinationDirectory);
...
        throw new ExtractionException("Entry is trying to write a file outside of the destination directory.");
}
```

If the destinationDirectory is not slash terminated like /home/user/dir it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. /home/user/dir.sh.

#### Impact
Because of the file name and destination directory constraints the arbitrary file creation impact is limited and depends on the use case.
Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server
Published: 2021-09-01T18:26:48Z
Aliases: CVE-2021-39133

### Impact

A user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions.

### Patches
Available in Rundeck 3.4.3 and 3.3.14


### Workarounds

Please visit [https://rundeck.com/security](https://rundeck.com/security) for information about specific workarounds.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@rundeck.com](mailto:security@rundeck.com)

To report security issues to Rundeck please use the form at [https://rundeck.com/security](https://rundeck.com/security)
Use of Cryptographically Weak Pseudo-Random Number Generator in showdoc
Published: 2021-09-02T17:07:48Z
Aliases: CVE-2021-3678

showdoc is vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Cross-Site Request Forgery in sqlite-web
Published: 2021-09-09T17:10:35Z
Aliases: CVE-2021-23404

This affects all versions of package sqlite-web. The SQL dashboard area allows sensitive actions to be performed without validating that the request originated from the application. This could enable an attacker to trick a user into performing these actions unknowingly through a Cross Site Request Forgery (CSRF) attack.