aswin1906/github-advisory-2021.csv huggingface dataset:
Missing Authorization with Default Settings in Dashboard UI
Published: 2021-11-03T17:30:59Z
Aliases: CVE-2021-41238

Dashboard UI in Hangfire.Core uses authorization filters to protect it from showing sensitive data to unauthorized users. By default when no custom authorization filters specified, `LocalRequestsOnlyAuthorizationFilter` filter is being used to allow only local requests and prohibit all the remote requests to provide sensible, protected by default settings.

However due to the recent changes, in version 1.7.25 no authorization filters are used by default, allowing remote requests to succeed.

### Impact

Missing authorization when default options are used for the Dashboard UI, e.g. when no custom authorization rules are used as recommended in the [Using Dashboard](https://docs.hangfire.io/en/latest/configuration/using-dashboard.html#configuring-authorization) documentation article. 

#### Impacted

If you are using `UseHangfireDashboard` method with default `DashboardOptions.Authorization` property value, then your installation is impacted:

```csharp
app.UseHangfireDashboard(); // Impacted
app.UseHangfireDashboard("/hangfire", new DashboardOptions()); // Impacted
```

#### Not Impacted

If any other authorization filter is specified in the `DashboardOptions.Authorization` property, the you are not impacted:

```csharp
app.UseHangfireDashboard("/hangfire", new DashboardOptions
{
    Authorization = new []{ new SomeAuthorizationFilter(); } // Not impacted
});
```

### Patches

Patch is already available in version [1.7.26](https://github.com/HangfireIO/Hangfire/releases/tag/v1.7.26) and already available on NuGet.org, please see [Hangfire.Core 1.7.26](https://www.nuget.org/packages/Hangfire.Core/1.7.26). Default authorization rules now prohibit remote requests by default again by including the `LocalRequestsOnlyAuthorizationFilter` filter to the default settings. Please upgrade to the newest version in order to mitigate the issue.

### Workarounds

It is possible to fix the issue by using the `LocalRequestsOnlyAuthorizationFilter` explicitly when configuring the Dashboard UI. In this case upgrade is not required.

```csharp
// using Hangfire.Dashboard;

app.UseHangfireDashboard("/hangfire", new DashboardOptions
{
    Authorization = new []{ new LocalRequestsOnlyAuthorizationFilter(); }
});
```

### References

Original GitHub Issue: https://github.com/HangfireIO/Hangfire/issues/1958
Vulnerability in singleCrunch function leads to arbitrary code execution via filePath parameters
Published: 2021-11-01T19:19:29Z
Aliases: CVE-2020-36381

aaptjs is a node wraper for aapt. An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Heap OOB in `FusedBatchNorm` kernels
Published: 2021-11-10T18:46:52Z
Aliases: CVE-2021-41223

### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/fused_batch_norm_op.cc#L1292) of `FusedBatchNorm` kernels is vulnerable to a heap OOB:

```python
import tensorflow as tf
    
tf.raw_ops.FusedBatchNormGrad(
  y_backprop=tf.constant([i for i in range(9)],shape=(1,1,3,3),dtype=tf.float32)
  x=tf.constant([i for i in range(2)],shape=(1,1,1,2),dtype=tf.float32)
  scale=[1,1],
  reserve_space_1=[1,1],
  reserve_space_2=[1,1,1],
  epsilon=1.0,
  data_format='NCHW',
  is_training=True) 
```
  
### Patches
We have patched the issue in GitHub commit [aab9998916c2ffbd8f0592059fad352622f89cda](https://github.com/tensorflow/tensorflow/commit/aab9998916c2ffbd8f0592059fad352622f89cda).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Regular expression denial of service vulnerability (ReDoS) in date
Published: 2021-11-16T00:32:30Z
Aliases: CVE-2021-41817

Date’s parsing methods including Date.parse are using Regexps internally, some of which are vulnerable against regular expression denial of service. Applications and libraries that apply such methods to untrusted input may be affected.

The fix limits the input length up to 128 bytes by default instead of changing the regexps. This is because Date gem uses many Regexps and it is possible that there are still undiscovered vulnerable Regexps. For compatibility, it is allowed to remove the limitation by explicitly passing limit keywords as nil like Date.parse(str, limit: nil), but note that it may take a long time to parse.

Please update the date gem to version 3.2.1, 3.1.2, 3.0.2, and 2.0.1, or later. You can use gem update date to update it. If you are using bundler, please add gem "date", ">= 3.2.1" to your Gemfile. If you import `date` from the standard library rather than as a gem you should update your Ruby install to `3.0.3`, `2.7.5`, `2.6.9` or later.

Users unable to upgrade may consider using `Date.strptime` instead with a predefined date format
```ruby
Date.strptime('2001-02-20', '%Y-%m-%d')
```
Arbitrary file reading vulnerability in Aim
Published: 2021-11-23T22:03:23Z
Aliases: CVE-2021-43775

### Impact
A path traversal attack aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash (../)” sequences and its variations or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system including application source code or configuration and critical system files.

Vulnerable code: https://github.com/aimhubio/aim/blob/0b99c6ca08e0ba7e7011453a2f68033e9b1d1bce/aim/web/api/views.py#L9-L16

### Patches
The vulnerability issue is resolved in Aim v3.1.0.

### References
https://owasp.org/www-community/attacks/Path_Traversal
Cross-site Scripting in kimai2
Published: 2021-11-23T17:59:40Z
Aliases: CVE-2021-3957

Cross site request forgery vulnerability is present in delete functionality of doctor feature. This vulnerability is capable of deleting system logs
FPE in convolutions with zero size filters
Published: 2021-11-10T19:02:17Z
Aliases: CVE-2021-41209

### Impact
The [implementations for convolution operators](https://github.com/tensorflow/tensorflow/blob/8d72537c6abf5a44103b57b9c2e22c14f5f49698/tensorflow/core/kernels/conv_ops.cc) trigger a division by 0 if passed empty filter tensor arguments.

### Patches
We have patched the issue in GitHub commit [f2c3931113eaafe9ef558faaddd48e00a6606235](https://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235).
  
The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Code injection in spring-cloud-netflix-hystrix-dashboard
Published: 2021-11-23T17:53:33Z
Aliases: CVE-2021-22053

Applications using the `spring-cloud-netflix-hystrix-dashboard` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
Prototype Pollution in node-jsonpointer
Published: 2021-11-08T17:44:45Z
Aliases: CVE-2021-23807

This affects the package `jsonpointer` before `5.0.0`. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
XSS via prototype pollution in NodeBB 
Published: 2021-11-30T22:21:01Z
Aliases: CVE-2021-43787

### Impact
A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report.

### Patches
The vulnerability has been patched as of v1.18.5.

### Workarounds
Cherry-pick commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Embedded malware in rc
Published: 2021-11-04T16:24:44Z

The npm package `rc` had versions published with malicious code. Users of affected versions (1.2.9, 1.3.9, and 2.3.9) should downgrade to 1.2.8 as soon as possible and check their systems for suspicious activity.
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Missing validation during checkpoint loading
Published: 2021-11-10T19:12:46Z
Aliases: CVE-2021-41203

### Impact
An attacker can trigger undefined behavior, integer overflows, segfaults and `CHECK`-fail crashes if they can change saved checkpoints from outside of TensorFlow.

This is because the checkpoints loading infrastructure is missing validation for invalid file formats.

### Patches
We have patched the issue in GitHub commits [b619c6f865715ca3b15ef1842b5b95edbaa710ad](https://github.com/tensorflow/tensorflow/commit/b619c6f865715ca3b15ef1842b5b95edbaa710ad), [e8dc63704c88007ee4713076605c90188d66f3d2](https://github.com/tensorflow/tensorflow/commit/e8dc63704c88007ee4713076605c90188d66f3d2), [368af875869a204b4ac552b9ddda59f6a46a56ec](https://github.com/tensorflow/tensorflow/commit/368af875869a204b4ac552b9ddda59f6a46a56ec), and [abcced051cb1bd8fb05046ac3b6023a7ebcc4578](https://github.com/tensorflow/tensorflow/commit/abcced051cb1bd8fb05046ac3b6023a7ebcc4578).

These fixes will be included in TensorFlow 2.7.0. We will also cherrypick these commits on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information 
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.
Template injection in thymeleaf-spring5
Published: 2021-11-10T19:52:33Z
Aliases: CVE-2021-43466

In the thymeleaf-spring5:3.0.12 component, thymeleaf combined with specific scenarios in template injection may lead to remote code execution.
Unrestricted Uploads in Concrete5
Published: 2021-11-03T17:29:29Z
Aliases: CVE-2020-11476

Concrete5 before 8.5.3 allows Unrestricted Upload of File with Dangerous Type such as a .phar file.
Improper Neutralization of Special Elements used in an LDAP Query in stevenweathers/thunderdome-planning-poker
Published: 2021-11-08T18:16:21Z
Aliases: CVE-2021-41232

### Impact
LDAP injection vulnerability, only affects instances with LDAP authentication enabled.

### Patches
Patch for vulnerability released with v1.16.3.

### Workarounds
Disable LDAP feature if in use

### References
[OWASP LDAP Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html
)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Thunderdome Github Repository](https://github.com/StevenWeathers/thunderdome-planning-poker)
* Email us at [steven@weathers.me](mailto:steven@weathers.me)
showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Published: 2021-11-15T23:13:52Z
Aliases: CVE-2021-3683

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Stored XSS in Jupyter nbdime
Published: 2021-11-08T18:09:27Z
Aliases: CVE-2021-41134

### Impact

Improper handling of user controlled input caused a stored cross-site scripting (XSS) vulnerability. All previous versions of nbdime are affected.

### Patches

Security patches will be released for each of the major versions of the nbdime packages since version 1.x of the nbdime python package.

#### Python
- nbdime 1.x: Patched in v. 1.1.1
- nbdime 2.x: Patched in v. 2.1.1
- nbdime 3.x: Patched in v. 3.1.1

#### npm
- nbdime 6.x version: Patched in 6.1.2
- nbdime 5.x version: Patched in 5.0.2
- nbdime-jupyterlab 1.x version: Patched in 1.0.1
- nbdime-jupyterlab 2.x version: Patched in 2.1.1

### For more information
If you have any questions or comments about this advisory email us at [security@ipython.org](mailto:security@ipython.org).
Cross-site Scripting in kimai2
Published: 2021-11-23T18:16:43Z
Aliases: CVE-2021-3963

kimai2 is vulnerable to Cross-Site Request Forgery (CSRF) in deleting invoice templates. This vulnerability is capable of tricking admin user to delete invoice templates.
Cross-Site Request Forgery in PiranhaCMS
Published: 2021-11-17T23:42:40Z
Aliases: CVE-2021-25976

In PiranhaCMS, versions 4.0.0-alpha1 to 9.2.0 are vulnerable to cross-site request forgery (CSRF) when performing various actions supported by the management system, such as deleting a user, deleting a role, editing a post, deleting a media folder etc., when an ID is known.
Server-Side Request Forgery in Concrete CMS
Published: 2021-11-23T18:18:43Z
Aliases: CVE-2021-22970

Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.
Publify `guest` role users can self-register even when the admin does not allow it
Published: 2021-11-03T17:34:22Z
Aliases: CVE-2021-25973

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. `guest` role users can self-register even when the admin does not allow it. This happens due to front-end restriction only.
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application
Published: 2021-11-15T17:54:01Z
Aliases: CVE-2021-41263

### Impact
This vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application.

### Patches
The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.
XML External Entity vulnerability in Easy-XML
Published: 2021-11-01T19:19:54Z
Aliases: CVE-2020-26705

The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as input.
ReDoS in LDAP schema parser
Published: 2021-11-29T17:58:59Z

https://github.com/python-ldap/python-ldap/issues/424

### Impact
The LDAP schema parser of python-ldap 3.3.1 and earlier are vulnerable to a regular expression denial-of-service attack. The issue affects clients that use ``ldap.schema`` package to parse LDAP schema definitions from an untrusted source.

### Patches
The upcoming release of python-ldap 3.4.0 will contain a workaround to prevent ReDoS attacks. The schema parser refuses schema definitions with an excessive amount of backslashes.

### Workarounds
As a workaround, users can check input for excessive amount of backslashes in schemas. More than a dozen backslashes per line are atypical.

### References
[CWE-1333](https://cwe.mitre.org/data/definitions/1333.html)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [python-ldap](https://github.com/python-ldap/python-ldap) tracker
HTML comments vulnerability allowing to execute JavaScript code
Published: 2021-11-17T21:58:25Z
Aliases: CVE-2021-41165

### Affected packages
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.

### Impact
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.17.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank William Bowling ([wbowling](https://github.com/wbowling)) for recognizing and reporting this vulnerability.
Improper Certificate Validation in OPCFoundation.NetStandard.Opc.Ua.Core
Published: 2021-11-19T20:19:53Z
Aliases: CVE-2020-29457

A Privilege Elevation vulnerability in OPC UA .NET Standard Stack 1.4.363.107 allows attackers to establish a connection using invalid certificates.
Cross-site Scripting in bootstrap-table
Published: 2021-11-08T17:54:46Z
Aliases: CVE-2021-23472

This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
Improper privilege management in Keycloak
Published: 2021-11-10T15:30:36Z
Aliases: CVE-2020-14389

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission.
Authentication Bypass by CSRF Weakness
Published: 2021-11-18T20:15:23Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.1 users should update to spree_auth_devise 4.1.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type
Published: 2021-11-15T23:17:37Z
Aliases: CVE-2021-3915

bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type.
Authentication Bypass by CSRF Weakness
Published: 2021-11-18T20:15:09Z

### Impact

CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of `spree_auth_devise` are affected if `protect_from_forgery` method is both:

* Executed whether as:
  * A before_action callback (the default)
  * A prepend_before_action (option prepend: true given) before the :load_object hook in Spree::UserController (most likely order to find).
* Configured to use :null_session or :reset_session strategies (:null_session is the default in case the no strategy is given, but rails --new generated skeleton use :exception).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

Thanks @waiting-for-dev for reporting and providing a patch 👏 

### Patches

Spree 4.3 users should update to spree_auth_devise 4.4.1
Spree 4.2 users should update to spree_auth_devise 4.2.1
 
### Workarounds

If possible, change your strategy to :exception:

```ruby
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end
```

Add the following to`config/application.rb `to at least run the `:exception` strategy on the affected controller:

```ruby
config.after_initialize do
  Spree::UsersController.protect_from_forgery with: :exception
end
```

### References
https://github.com/solidusio/solidus_auth_devise/security/advisories/GHSA-xm34-v85h-9pg2
Cross-site Scripting in github.com/schollz/rwtxt
Published: 2021-11-29T18:00:21Z
Aliases: CVE-2021-20848

Cross-site scripting vulnerability in rwtxt versions prior to v1.8.6 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Overflow/crash in `tf.range`
Published: 2021-11-10T19:13:16Z
Aliases: CVE-2021-41202

### Impact
While calculating the size of the output within the `tf.range` kernel, there is a conditional statement of type `int64 = condition ? int64 : double`. Due to C++ implicit conversion rules, both branches of the condition will be cast to `double` and the result would be truncated before the assignment. This result in overflows:

```python
import tensorflow as tf

tf.sparse.eye(num_rows=9223372036854775807, num_columns=None)
```
  
Similarly, `tf.range` would result in crashes due to overflows if the start or end point are too large.

```python
import tensorflow as tf

tf.range(start=-1e+38, limit=1)
```

### Patches
We have patched the issue in GitHub commits [6d94002a09711d297dbba90390d5482b76113899](https://github.com/tensorflow/tensorflow/commit/6d94002a09711d297dbba90390d5482b76113899) (merging [#51359](https://github.com/tensorflow/tensorflow/pull/51359)) and [1b0e0ec27e7895b9985076eab32445026ae5ca94](https://github.com/tensorflow/tensorflow/commit/1b0e0ec27e7895b9985076eab32445026ae5ca94) (merging [#51711](https://github.com/tensorflow/tensorflow/pull/51711)).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported externally via [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46912), [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46899) and [GitHub issue](https://github.com/tensorflow/tensorflow/issues/46889).