aswin1906/github-advisory-2021.csv huggingface dataset:
pterodactyl/panel CSRF allowing an external page to trigger a user logout event
Published: 2021-10-25T19:42:46Z
Aliases: CVE-2021-41176

### Impact
A malicious user can trigger a user logout if a signed in user visits a malicious website that makes a request to the Panel's sign-out endpoint. This requires a targeted attack against a specific Panel instance, and serves only to sign a user out. **No user details are leaked, nor is any user data affected, this is simply an annoyance at worst.**

### Patches
None.

### Workarounds
None.

### For more information
If you have any questions or comments about this advisory please contact `Tactical Fish#8008` on Discord, or email `dane@pterodactyl.io`.
Cross-site Scripting in Sidekiq
Published: 2021-10-06T17:47:17Z
Aliases: CVE-2021-30151

Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.
Regular expression Denial of Service (ReDoS) in EmailValidator class in V7 compatibility module in Vaadin 8
Published: 2021-10-13T18:55:52Z

Unsafe validation RegEx in `EmailValidator` component in `com.vaadin:vaadin-compatibility-server` versions 8.0.0 through 8.12.4 (Vaadin versions 8.0.0 through 8.12.4) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.
Policies not properly enforced in OWASP Java HTML Sanitizer
Published: 2021-10-19T20:15:50Z
Aliases: CVE-2021-42575

The OWASP Java HTML Sanitizer before 20211018.1 does not properly enforce policies associated with the `SELECT`, `STYLE`, and `OPTION` elements.
Cross-site Scripting in teddy
Published: 2021-10-12T16:22:04Z
Aliases: CVE-2021-23447

Teddy is a readable and easy to learn templating language. This affects the package teddy before 0.5.9. A type confusion vulnerability can be used to bypass input sanitization when the model content is an array (instead of a string).
NULL Pointer Dereference in OpenCV.
Published: 2021-10-12T22:21:43Z
Aliases: CVE-2019-14493

An issue was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.1.26). There is a NULL pointer dereference in the function cv::XMLParser::parse at modules/core/src/persistence.cpp.
Server-Side Request Forgery vulnerability in concrete5
Published: 2021-10-12T18:41:59Z
Aliases: CVE-2021-22958

A Server-Side Request Forgery vulnerability was found in concrete5 < 8.5.5 that allowed a decimal notation encoded IP address to bypass the limitations in place for localhost allowing interaction with local services. Impact can vary depending on services exposed.
Nameko Arbitrary code execution due to YAML deserialization
Published: 2021-10-19T15:28:57Z
Aliases: CVE-2021-41078

### Impact

Nameko can be tricked to perform arbitrary code execution when deserialising a YAML config file. Example:

``` yaml
# malicious.yaml
!!python/object/new:type
args: ['z', !!python/tuple [], {'extend': !!python/name:exec }]
listitems: "__import__('os').system('cat /etc/passwd')"
```

``` shell
$ nameko run --config malicious.yaml test
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
... 
```

### Patches

The problem was fixed in https://github.com/nameko/nameko/pull/722 and released in version 2.14.0, and in rc10 of the v3 pre-release.

Versions prior to 2.14.0, and v3.0.0rc0 through v3.0.0rc9 are still vulnerable.

### Workarounds

The vulnerability is exploited by config files with malicious content. It can be avoided by only using config files that you trust.
DOS and Open Redirect with user input
Published: 2021-10-12T16:04:17Z
Aliases: CVE-2021-22964

### Impact

A redirect vulnerability in the `fastify-static` module allows remote attackers to redirect Mozilla Firefox users to arbitrary websites via a double slash `//` followed by a domain: `http://localhost:3000//a//youtube.com/%2e%2e%2f%2e%2e`.

A DOS vulnerability is possible if the URL contains invalid characters `curl --path-as-is "http://localhost:3000//^/.."`

The issue shows up on all the `fastify-static` applications that set `redirect: true` option. By default, it is `false`.

### Patches
The issue has been patched in `fastify-static@4.4.1`

### Workarounds
If updating is not an option, you can sanitize the input URLs using the [`rewriteUrl`](https://www.fastify.io/docs/latest/Server/#rewriteurl) server option.

### References

+ Bug founder: drstrnegth
+ [hackerone Report](https://hackerone.com/reports/1361804)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-static](https://github.com/fastify/fastify-static)
* Contact the [security team](https://github.com/fastify/fastify/blob/main/SECURITY.md#the-fastify-security-team)
S3 storage write is not aborted on errors leading to unbounded memory usage
Published: 2021-10-06T17:47:35Z

### Impact

Anyone using storage.blob.s3 introduced in 0.5.0 with storage.imapsql.
```
storage.imapsql local_mailboxes {
  ...
  msg_store s3 {
    ...
  }
}
```

### Patches

The relevant commit is pushed to master and will be included in the 0.5.1 release.

No special handling of the issue has been done due to the small amount of affected users.

### Workarounds

None.

### References

* Original report: https://github.com/foxcpp/maddy/issues/395
* Fix: https://github.com/foxcpp/maddy/commit/07c8495ee4394fabbf5aac4df8aebeafb2fb29d8
Path Traversal in @backstage/plugin-scaffolder-backend 
Published: 2021-10-19T15:28:03Z
Aliases: CVE-2021-41151

### Impact

A malicious actor could read sensitive files from the environment where Scaffolder tasks are run. The attack is executed by crafting a custom Scaffolder template with a `publish:github:pull-request` action using a particular source path. When the template is executed the sensitive files would be included in the published pull request.

This vulnerability is mitigated by the fact that an attacker would need access to create and register templates in the Backstage catalog, and that the attack is very visible given that the exfiltration happens via a pull request.

### Patches

The vulnerability is patched in the `0.15.9` release of `@backstage/plugin-scaffolder-backend`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
BuddyPress privilege escalation via REST API
Published: 2021-10-06T17:46:55Z
Aliases: CVE-2021-21389

### Impact
It's possible for a non-privileged, regular user to obtain administrator rights by exploiting an issue in the BuddyPress REST API members endpoint.

### Patches
The vulnerability has been fixed in BuddyPress 7.2.1. Existing installations of the plugin should be updated to this version to mitigate the issue.

### References
https://buddypress.org/2021/03/buddypress-7-2-1-security-release/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [HackerOne](https://hackerone.com/wordpress)
Insufficiently restricted permissions on plugin directories
Published: 2021-10-04T20:14:47Z
Aliases: CVE-2021-41103

### Impact
A bug was found in containerd where container root directories and some plugins had insufficiently restricted permissions, allowing otherwise unprivileged Linux users to traverse directory contents and execute programs. When containers included executable programs with extended permission bits (such as setuid), unprivileged Linux users could discover and execute those programs. When the UID of an unprivileged Linux user on the host collided with the file owner or group inside a container, the unprivileged Linux user on the host could discover, read, and modify those files.

### Patches
This vulnerability has been fixed in containerd 1.4.11 and containerd 1.5.7. Users should update to these version when they are released and may restart containers or update directory permissions to mitigate the vulnerability.

### Workarounds
Limit access to the host to trusted users. Update directory permission on container bundles directories. 

### For more information
If you have any questions or comments about this advisory: 
* Open an issue in [github.com/containerd/containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Showdoc File Upload Vulnerability
Published: 2021-10-25T19:43:24Z
Aliases: CVE-2021-41745

A file upload vulnerability exists in Showdoc 2.8.3, which can be exploited by an attacker to gain server privileges.
Buffer Overflow in Pillow
Published: 2021-10-05T20:24:41Z
Aliases: CVE-2021-34552

Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c.
Missing Release of Resource after Effective Lifetime in Apache Tomcat
Published: 2021-10-15T18:51:34Z
Aliases: CVE-2021-42340

The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
Cross-Site Request Forgery in snipe-it
Published: 2021-10-21T17:48:55Z
Aliases: CVE-2021-3858

snipe-it is vulnerable to Cross-Site Request Forgery (CSRF).
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:23:21Z
Aliases: CVE-2019-5064

An exploitable heap buffer overflow vulnerability exists in the data structure persistence functionality of OpenCV, version 4.1.0 (corresponds with OpenCV-Python version 4.1.2.30). A specially crafted JSON file can cause a buffer overflow, resulting in multiple heap corruptions and potentially code execution. An attacker can provide a specially crafted file to trigger this vulnerability.
Inconsistent input sanitisation leads to XSS vectors
Published: 2021-10-14T21:19:23Z
Aliases: CVE-2021-41132

### Background

A variety of templates do not perform proper sanitization through HTML escaping.
Due to the lack of sanitization and use of ``jQuery.html()``, there are a whole host of XSS possibilities with specially crafted input to a variety of fields.

### Impact

OMERO.web before 5.11.0 and OMERO.figure before 4.4.1.

### Patches
Users should upgrade OMERO.web to 5.11.0 or higher and OMERO.figure to 4.4.1 or higher.
Denial of service in DataCommunicator class in Vaadin 8
Published: 2021-10-13T18:54:09Z
Aliases: CVE-2021-33609

Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name
Published: 2021-10-12T16:05:11Z

### Impact
`preview-docs` command allows path traversal if current working dir contains files with question mark `?` in name and attacker knows the name.

### Patches
It was patched starting from 1.0.0-beta.59

### Workarounds
Do not run openapi-cli preview-docs command in the folder which contains files with question mark `?` in name.

### References
https://github.com/Redocly/openapi-cli/pull/347

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [@redocly/openapi-cli](https://github.com/Redocly/openapi-cli)
* Email us at [security@redocly.com](mailto:security@redocly.com)
Code Injection in SLO Generator
Published: 2021-10-05T17:53:59Z
Aliases: CVE-2021-22557

SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173
Improper sanitization of target names
Published: 2021-10-19T20:16:15Z
Aliases: CVE-2021-41149

### Impact
The tough library, prior to 0.12.0, does not properly sanitize target names when caching a repository, or when saving specific targets to an output directory. When targets are cached or saved, files could be overwritten with arbitrary content anywhere on the system.

AWS would like to thank https://github.com/jku for reporting this issue.

### Patches
A fix is available in version 0.12.0.

### Workarounds
No workarounds to this issue are known.
Cross-site Scripting in Froala Editor
Published: 2021-10-06T17:47:05Z
Aliases: CVE-2021-30109

Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.
Electron's sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
Published: 2021-10-12T21:59:13Z
Aliases: CVE-2021-39184

### Impact
This vulnerability allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases.

All current stable versions of Electron are affected.

### Patches
This was fixed with #30728, and the following Electron versions contain the fix:

- 15.0.0-alpha.10
- 14.0.0
- 13.3.0
- 12.1.0
- 11.5.0

### Workarounds
If your app enables `contextIsolation`, this vulnerability is significantly more difficult for an attacker to exploit.

Further, if your app does not depend on the `createThumbnailFromPath` API, then you can simply disable the functionality. In the main process, before the 'ready' event:
```js
delete require('electron').nativeImage.createThumbnailFromPath
```

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
Directory traversal in mkdocs
Published: 2021-10-12T18:48:24Z
Aliases: CVE-2021-40978

The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive information.
Prototype pollution vulnerability in 'libnested'
Published: 2021-10-12T16:27:02Z
Aliases: CVE-2020-28283

Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Cross-Site-Request-Forgery in Backend
Published: 2021-10-05T20:23:47Z
Aliases: CVE-2021-41113

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2)

### Problem
It has been discovered that the new TYPO3 v11 feature that allows users to create and share [deep links in the backend user interface](https://typo3.org/article/typo3-version-112-escape-the-orbit#c12178) is vulnerable to cross-site-request-forgery.

The impact is the same as described in [TYPO3-CORE-SA-2020-006 (CVE-2020-11069)](https://typo3.org/security/advisory/typo3-core-sa-2020-006). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system.

To successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time.

The following [Same-Site cookie settings](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/8.7.x/Feature-90351-ConfigureTYPO3-shippedCookiesWithSameSiteFlag.html) in _$GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite]_ are required for an attack to be successful:

* _SameSite=_***strict***: malicious evil.**example.org** invoking TYPO3 application at good.**example.org**
* _SameSite=_***lax*** or ***none***: malicious **evil.com** invoking TYPO3 application at **example.org**

### Solution
Update your instance to TYPO3 version 11.5.0 which addresses the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 core & security team members Benni Mack and Oliver Hader who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-014](https://typo3.org/security/advisory/typo3-core-sa-2021-014)
* [CVE-2020-11069](https://nvd.nist.gov/vuln/detail/CVE-2020-11069) reintroduced in TYPO3 v11.2.0
Cross-Site Request Forgery in firefly-iii
Published: 2021-10-28T23:14:21Z
Aliases: CVE-2021-3900

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
Cross-site scripting in application/controllers/dropbox.php in JustWriting
Published: 2021-10-04T20:13:25Z
Aliases: CVE-2021-41467

Cross-site scripting (XSS) vulnerability in application/controllers/dropbox.php in JustWriting 1.0.0 and below allow remote attackers to inject arbitrary web script or HTML via the challenge parameter.
Prototype Pollution in config-handler
Published: 2021-10-12T18:30:37Z
Aliases: CVE-2021-23448

All versions of package config-handler are vulnerable to Prototype Pollution when loading config files.
Stored XSS with custom URLs in PrestaShop module ps_linklist
Published: 2021-10-12T16:01:36Z
Aliases: CVE-2020-5273

### Impact
Stored XSS when using custom URLs.

### Patches
The problem is fixed in 3.1.0

### References
[Cross-site Scripting (XSS) - Stored (CWE-79)](https://cwe.mitre.org/data/definitions/79.html)
Cross site scripting in kindeditor
Published: 2021-10-18T19:44:32Z
Aliases: CVE-2021-42227

Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).
Divide By Zero in OpenCV.
Published: 2021-10-12T22:21:56Z
Aliases: CVE-2019-15939

An issue was discovered in OpenCV 4.1.0 (OpenCV-Python 4.1.0.25). There is a divide-by-zero error in cv::HOGDescriptor::getDescriptorSize in modules/objdetect/src/hog.cpp.
Privilege Defined With Unsafe Actions in Keycloak
Published: 2021-10-21T17:46:27Z
Aliases: CVE-2019-10170

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.
Integer Overflow or Wraparound in OpenCV
Published: 2021-10-12T22:02:45Z
Aliases: CVE-2017-12864

In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function ReadNumber did not checkout the input length, which lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding with OpenCV-Python version 3.3.0.9) and earlier.
Exposure of Sensitive Information to an Unauthorized Actor in ansible
Published: 2021-10-12T16:31:59Z
Aliases: CVE-2019-10217

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.
Directory Traversal in Babel
Published: 2021-10-21T17:49:59Z
Aliases: CVE-2021-42771

Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directory traversal, leading to code execution.
HTTP Host Header Injection
Published: 2021-10-05T20:23:35Z
Aliases: CVE-2021-41114

### Meta
* CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C` (3.5)

### Problem
It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP _Host_ header. TYPO3 uses the HTTP _Host_ header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment.

This vulnerability is the same as described in [TYPO3-CORE-SA-2014-001 (CVE-2014-3941)](https://typo3.org/security/advisory/typo3-core-sa-2014-001/). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting _$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern']_ (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.

### Solution
Update your instance to TYPO3 version 11.5.0 which addresses the problem described.

### Credits
Thanks to TYPO3 framework merger Benjamin Franzke who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2021-015](https://typo3.org/security/advisory/typo3-core-sa-2021-015)
* [CVE-2014-3941](https://nvd.nist.gov/vuln/detail/CVE-2014-3941) reintroduced in TYPO3 v11.0.0
Improper sanitization of delegated role names
Published: 2021-10-19T20:16:26Z
Aliases: CVE-2021-41150

### Impact
The tough library, prior to 0.12.0, does not properly sanitize delegated role names when caching a repository, or when loading a repository from the filesystem. When the repository is cached or loaded, files ending with the .json extension could be overwritten with role metadata anywhere on the system.

AWS would like to thank https://github.com/jku for reporting this issue.

### Patches
A fix is available in version 0.12.0.

### Workarounds
No workarounds to this issue are known.

### References
https://github.com/theupdateframework/python-tuf/security/advisories/GHSA-wjw6-2cqr-j4qr
Validity check missing in Frontier
Published: 2021-10-13T18:53:38Z
Aliases: CVE-2021-41138

### Impact

In the newly introduced signed Frontier-specific extrinsic for `pallet-ethereum`, a large part of transaction validation logic was only called in transaction pool validation, but not in block execution. Malicious validators can take advantage of this to put invalid transactions into a block.

The attack is limited in that the signature is always validated, and the majority of the validation is done again in the subsequent `pallet-evm` execution logic. However, do note that a chain ID replay attack was possible. In addition, spamming attacks are of main concerns, while they are limited by Substrate block size limits and other factors.

### Patches

The issue is patched in commit 146bb48849e5393004be5c88beefe76fdf009aba.

### References

Patch PR: https://github.com/paritytech/frontier/pull/495

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Frontier repo](https://github.com/paritytech/frontier/issues)

### Special thanks

Special thanks to @librelois, @nanocryk and the Moonbeam team for reporting and fixing this security vulnerability.
Double Free in OpenCV
Published: 2021-10-12T22:00:08Z
Aliases: CVE-2016-1516

OpenCV 3.0.0 has a double free issue that allows attackers to execute arbitrary code. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV-Python and and OpenCV-Contrib-Python 3.3.1.11).
Out-of-bounds write in ChakraCore
Published: 2021-07-28T18:58:03Z
Aliases: CVE-2020-0826

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0827, CVE-2020-0828, CVE-2020-0829, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848.
SQL injection in pimcore/pimcore
Published: 2021-07-13T17:42:31Z
Aliases: CVE-2021-23405

This affects the package pimcore/pimcore before 10.0.7. This issue exists due to the absence of check on the storeId parameter in the method collectionsActionGet and groupsActionGet method within the ClassificationstoreController class.