aswin1906/github-advisory-2021.csv huggingface dataset:
`SparseFillEmptyRows` heap OOB
Published: 2021-11-10T18:45:55Z
Aliases: CVE-2021-41224

### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L194-L241) of `SparseFillEmptyRows` can be made to trigger a heap OOB access:

```python
import tensorflow as tf
  
data=tf.raw_ops.SparseFillEmptyRows(
  indices=[[0,0],[0,0],[0,0]],
  values=['sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss'],
  dense_shape=[5,3],
  default_value='o')
```
  
This occurs whenever the size of `indices` does not match the size of `values`.

### Patches
We have patched the issue in GitHub commit [67bfd9feeecfb3c61d80f0e46d89c170fbee682b](https://github.com/tensorflow/tensorflow/commit/67bfd9feeecfb3c61d80f0e46d89c170fbee682b).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Apache Ozone exposes OM, SCM and Datanode metadata
Published: 2021-11-23T18:17:50Z
Aliases: CVE-2021-41532

In Apache Ozone before 1.2.0, Recon HTTP endpoints provide access to OM, SCM and Datanode metadata. Due to a bug, any unauthenticated user can access the data from these endpoints.
Cross-site Scripting in pegasus/google-for-jobs
Published: 2021-11-15T17:39:18Z
Aliases: CVE-2021-43561

An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.
CSV Injection in symfony/serializer
Published: 2021-11-24T21:01:23Z
Aliases: CVE-2021-41270

Description
-----------

CSV Injection, also known as Formula Injection, occurs when websites embed untrusted input inside CSV files. When a spreadsheet program opens a CSV, any cell starting with `=` is interpreted by the software as a formula and could be abused by an attacker.

In Symfony 4.1, we've added the opt-in `csv_escape_formulas` option in `CsvEncoder`, to prefix all cells starting by  `=`, `+`, `-` or `@` by a tab `\t`. 

Since then, OWASP added 2 chars in that list: 
- Tab (0x09)
- Carriage return (0x0D)

This makes our previous prefix char (Tab `\t`) part of the vulnerable characters, and [OWASP suggests](https://owasp.org/www-community/attacks/CSV_Injection) using the single quote `'` for prefixing the value.

Resolution
----------

Symfony now follows the OWASP recommendations and use the single quote `'` to prefix formulas and adds the prefix to cells starting by `\t`, `\r` as well as `=`, `+`, `-` and `@`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/3da6f2d45e7536ccb2a26f52fbaf340917e208a8) for branch 4.4.

Credits
-------

We would like to thank Jake Barwell for reporting the issue and Jérémy Derussé for fixing the issue.
Improper certificate management in AWS IoT Device SDK v2
Published: 2021-11-24T21:11:16Z
Aliases: CVE-2021-40829

Connections initialized by the AWS IoT Device SDK v2 for Java (versions prior to 1.4.2), Python (versions prior to 1.6.1), C++ (versions prior to 1.12.7) and Node.js (versions prior to 1.5.3) did not verify server certificate hostname during TLS handshake when overriding Certificate Authorities (CA) in their trust stores on MacOS. This issue has been addressed in aws-c-io submodule versions 0.10.5 onward. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.4.2 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on macOS. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on macOS. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on macOS. Amazon Web Services AWS-C-IO 0.10.4 on macOS.
Improper Verification of Cryptographic Signature in starkbank-ecdsa
Published: 2021-11-10T20:58:42Z
Aliases: CVE-2021-43571

The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Improper Privilege Management in Apache Ozone
Published: 2021-11-23T17:57:14Z
Aliases: CVE-2021-36372

In Apache Ozone versions prior to 1.2.0, Initially generated block tokens are persisted to the metadata database and can be retrieved with authenticated users with permission to the key. Authenticated users may use them even after access is revoked.
Incorrect Authorization in Apache Ozone
Published: 2021-11-23T18:17:59Z
Aliases: CVE-2021-39233

In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be called by any client.
Authentication bypass issue in the Operator Console
Published: 2021-11-15T23:16:49Z
Aliases: CVE-2021-41266

During an internal security audit, we detected an authentication bypass issue in the Operator Console when an external IDP is enabled. The security issue has been reported internally. We have not observed this exploit in the wild or reported elsewhere in the community at large. All users are advised to upgrade ASAP.

### Impact

All users on release v0.12.2 and before are affected.

### Patches

This issue was fixed by PR https://github.com/minio/console/pull/1217, users should upgrade to latest release.

### Workarounds

Add `automountServiceAccountToken: false` to the operator-console deployment in Kubernetes so no service account token will get mounted inside the pod, then disable the external identity provider authentication by unset the `CONSOLE_IDP_URL`, `CONSOLE_IDP_CLIENT_ID`, `CONSOLE_IDP_SECRET` and `CONSOLE_IDP_CALLBACK` environment variable and instead use the Kubernetes service account token.

### References

#1217 for more information on the fix and how it was fixed.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [console issues](https://github.com/minio/console/issues)
* Email us at [security@minio.io](mailto:security@minio.io)
A use of uninitialized value vulnerability in Tensorflow
Published: 2021-11-10T18:44:11Z
Aliases: CVE-2021-41225

### Impact
TensorFlow's Grappler optimizer has a [use of unitialized variable](https://github.com/tensorflow/tensorflow/blob/3457a2b122e50b4d44ceaaed5a663d635e5c22df/tensorflow/core/grappler/optimizers/auto_parallel.cc#L155-L164):

```cc
  const NodeDef* dequeue_node;
  for (const auto& train_node : train_nodes) {
    if (IsDequeueOp(*train_node)) {
      dequeue_node = train_node;
      break;
    }
  }

  if (dequeue_node) {
    ...
  }
```

If the `train_nodes` vector (obtained from the saved model that gets optimized) does not contain a `Dequeue` node, then `dequeue_node` is left unitialized.

### Patches
We have patched the issue in GitHub commit [68867bf01239d9e1048f98cbad185bf4761bedd3](https://github.com/tensorflow/tensorflow/commit/68867bf01239d9e1048f98cbad185bf4761bedd3).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Qian Feng from Baidu Security Team.
Vulnerability in dump function leads to arbitrary code execution via filePath parameters
Published: 2021-11-02T15:42:24Z
Aliases: CVE-2020-36377

aaptjs is a node wraper for aapt. An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Unauthorized access to data in @sap-cloud-sdk/core
Published: 2021-11-10T16:51:41Z
Aliases: CVE-2021-41251

### Impact
This affects applications on SAP Business Technology Platform that use the SAP Cloud SDK and enabled caching of destinations.
In some cases, when user information was missing, destinations were cached without user information, allowing other users to retrieve the same destination with its permissions.
By default, destination caching is disabled. If it is enabled the maximum lifetime is 5 minutes which limits the attack vector.

### Patches
The problem was fixed by #1769 and #1770. The security for caching has been increased. The changes are released in version 1.52.0.

### Workarounds
Disable destination caching (it is disabled by default).

### References
[destination cache API docs](https://sap.github.io/cloud-sdk/api/1.51.0/modules/sap_cloud_sdk_core#destinationCache)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/SAP/cloud-sdk-js
Server-Side Request Forgery in Concrete CMS
Published: 2021-11-23T18:18:35Z
Aliases: CVE-2021-22969

Concrete CMS (formerly concrete5) versions below 8.5.7 has a SSRF mitigation bypass using DNS Rebind attack giving an attacker the ability to fetch cloud IAAS (ex AWS) IAM keys.To fix this Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading rather than relying on DNS.Discoverer.
Authentication Bypass by CSRF Weakness
Published: 2021-11-18T20:09:32Z
Aliases: CVE-2021-41274

### Impact
CSRF vulnerability that allows user account takeover.

All applications using any version of the frontend component of  `solidus_auth_devise` are affected if `protect_from_forgery` method is both: 
- Executed whether as:
  - A `before_action` callback (the default)
  - A `prepend_before_action` (option `prepend: true` given) before the `:load_object` hook in `Spree::UserController` (most likely order to find).
- Configured to use `:null_session` or `:reset_session` strategies (`:null_session` is the default in case the no strategy is given, but `rails --new` generated skeleton use `:exception`).

That means that applications that haven't been configured differently from what it's generated with Rails aren't affected.

### Patches
Users should promptly update to `solidus_auth_devise` version `2.5.4`.

### Workarounds
A couple of options:

- If possible, change your strategy to `:exception`:
  ```ruby
  class ApplicationController < ActionController::Base
    protect_from_forgery with: :exception
  end
  ```

- Add the following to `config/application.rb` to at least run the `:exception` strategy on the affected controller:
  ```ruby
  config.after_initialize do
    Spree::UsersController.protect_from_forgery with: :exception
  end
  ```

- We've also released new Solidus versions monkey patching `solidus_auth_devise` with the quick fix. Those versions are `v3.1.3`, `v.3.0.3` & `v2.11.12`. See [GHSA-5629-8855-gf4g](https://github.com/solidusio/solidus/security/advisories/GHSA-5629-8855-gf4g) for details.

### References
- [CSRF on the Rails guides](https://guides.rubyonrails.org/security.html#cross-site-request-forgery-csrf)
- [Solidus security](https://solidus.io/security/)

### Thanks
We'd like to thank [vampire000](https://hackerone.com/vampire000) for reporting this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [solidus_auth_devise](https://github.com/solidusio/solidus_auth_devise/issues) or a discussion in [solidus](https://github.com/solidusio/solidus/discussions)
* Email us at [security@solidus.io](mailto:security@soliidus.io)
* Contact the core team on [Slack](http://slack.solidus.io/)
Segfault due to negative splits in `SplitV`
Published: 2021-11-10T18:48:15Z
Aliases: CVE-2021-41222

### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/split_v_op.cc#L49-L205) of `SplitV` can trigger a segfault is an attacker supplies negative arguments:

```python
import tensorflow as tf

tf.raw_ops.SplitV(
  value=tf.constant([]),
  size_splits=[-1, -2]
  ,axis=0,
  num_split=2)
``` 
  
This occurs whenever `size_splits` contains more than one value and at least one value is negative.
  
### Patches 
We have patched the issue in GitHub commit [25d622ffc432acc736b14ca3904177579e733cc6](https://github.com/tensorflow/tensorflow/commit/25d622ffc432acc736b14ca3904177579e733cc6).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Improper Neutralization of Formula Elements in a CSV File in html-2-csv
Published: 2021-11-30T22:22:16Z
Aliases: CVE-2021-23654

This affects all versions of package html-to-csv. When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this a malicious actor can embed or generate a malicious link or execute commands via CSV files.
Incorrect Authorization in Apache Ozone
Published: 2021-11-23T17:56:30Z
Aliases: CVE-2021-39234

In Apache Ozone versions prior to 1.2.0, Authenticated users knowing the ID of an existing block can craft specific request allowing access those blocks, bypassing other security checks like ACL.
Cookie persistence after password changes in symfony/security-bundle
Published: 2021-11-24T20:05:22Z
Aliases: CVE-2021-41268

Description
-----------

Since the rework of the Remember me cookie in Symfony 5.3, the cookie is not invalidated anymore when the user changes its password. 

Attackers can therefore maintain their access to the account even if the password is changed as long as they have had the chance to login once and get a valid remember me cookie.

Resolution
----------

Symfony now makes the password part of the signature by default. In that way, when the password changes then the cookie is not valid anymore.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/36a808b857cd3240244f4b224452fb1e70dc6dfc) for branch 5.3.

Credits
-------

We would like to thank Thibaut Decherit for reporting the issue and Wouter J for fixing the issue.
Clarify `mediaType` handling
Published: 2021-11-18T16:02:41Z

### Impact
In the OCI Image Specification version 1.0.1 and prior, manifest and index documents are not self-describing and documents with a single digest could be interpreted as either a manifest or an index.

### Patches
The Image Specification will be updated to recommend that both manifest and index documents contain a `mediaType` field to identify the type of document.
Release [v1.0.2](https://github.com/opencontainers/image-spec/releases/tag/v1.0.2) includes these updates.

### Workarounds
Software attempting to deserialize an ambiguous document may reject the document if it contains both “manifests” and “layers” fields or “manifests” and “config” fields.

### References
https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/opencontainers/image-spec
* Email us at [security@opencontainers.org](mailto:security@opencontainers.org)
* https://github.com/opencontainers/image-spec/commits/v1.0.2
Remote unauthenticated attackers able to upload files in Onionshare
Published: 2021-11-19T20:39:44Z
Aliases: CVE-2021-41868

OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionality.
Out-of-bounds read in Pillow
Published: 2021-11-03T18:04:53Z
Aliases: CVE-2020-10378

In `libImaging/PcxDecode.c` in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where `state->shuffle` is instructed to read beyond `state->buffer`.
ERC1155Supply vulnerability in OpenZeppelin Contracts
Published: 2021-11-15T23:28:18Z

When ERC1155 tokens are minted, a callback is invoked on the receiver of those tokens, as required by the spec. When including the `ERC1155Supply` extension, total supply is not updated until after the callback, thus during the callback the reported total supply is lower than the real number of tokens in circulation.

### Impact
If a system relies on accurately reported supply, an attacker may be able to mint tokens and invoke that system after receiving the token balance but before the supply is updated.

### Patches
A fix is included in version 4.3.3 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds
If accurate supply is relevant, do not mint tokens to untrusted receivers.

### Credits
The issue was identified and reported by @ChainSecurityAudits.

### For more information
Read [TotalSupply Inconsistency in ERC1155 NFT Tokens](https://medium.com/chainsecurity/totalsupply-inconsistency-in-erc1155-nft-tokens-8f8e3b29f5aa) by @ChainSecurityAudits for a more detailed breakdown.

If you have any questions or comments about this advisory, email us at security@openzeppelin.com.
The disqualify lead action may be executed without CSRF token check
Published: 2021-11-19T20:18:54Z
Aliases: CVE-2021-39198

### Summary
The attacker is able to disqualify any Lead with a Cross-Site Request Forgery (CSRF) attack.

### Workarounds
There are no workarounds that address this vulnerability.
API token verification can be bypassed in NodeBB 
Published: 2021-11-30T22:21:05Z
Aliases: CVE-2021-43786

### Impact
Incorrect logic present in the token verification step unintentionally allowed master token access to the API.

### Patches
The vulnerability has been patch as of v1.18.5.

### Workarounds
Cherry-pick commit hash 04dab1d550cdebf4c1567bca9a51f8b9ca48a500 to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
PCX P mode buffer overflow in Pillow
Published: 2021-11-03T18:05:04Z
Aliases: CVE-2020-5312

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.
Request injection in Spring Cloud Gateway
Published: 2021-11-10T19:45:02Z
Aliases: CVE-2021-22051

Applications using Spring Cloud Gateway are vulnerable to specifically crafted requests that could make an extra request on downstream services. Users of affected versions should apply the following mitigation: 3.0.x users should upgrade to 3.0.5+, 2.2.x users should upgrade to 2.2.10.RELEASE or newer.
Files or Directories Accessible to External Parties in kubernetes
Published: 2021-11-01T17:32:28Z
Aliases: CVE-2021-25741

A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem.
Infinite loop in Apache MINA
Published: 2021-11-03T17:30:35Z
Aliases: CVE-2021-41973

In Apache MINA, a specifically crafted, malformed HTTP request may cause the HTTP Header decoder to loop indefinitely. The decoder assumed that the HTTP Header begins at the beginning of the buffer and loops if there is more data than expected. Please update MINA to 2.1.5 or greater.
Exposure of sensitive information in concrete5/core
Published: 2021-11-23T17:54:39Z
Aliases: CVE-2021-22967

In Concrete CMS (formerly concrete 5) below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit message”.
Inefficient Regular Expression Complexity in validator.js
Published: 2021-11-03T17:34:45Z
Aliases: CVE-2021-3765

validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity
Improper Verification of Cryptographic Signature in starkbank-ecdsa
Published: 2021-11-10T20:58:03Z
Aliases: CVE-2021-43569

The verify function in the Stark Bank .NET ECDSA library (ecdsa-dotnet) 1.3.1 fails to check that the signature is non-zero, which allows attackers to forge signatures on arbitrary messages.
Heap OOB in `SparseBinCount`
Published: 2021-11-10T18:41:47Z
Aliases: CVE-2021-41226

### Impact
The [implementation](https://github.com/tensorflow/tensorflow/blob/e71b86d47f8bc1816bf54d7bddc4170e47670b97/tensorflow/core/kernels/bincount_op.cc#L353-L417) of `SparseBinCount` is vulnerable to a heap OOB:

```python
import tensorflow as tf
  
  
tf.raw_ops.SparseBincount(
  indices=[[0],[1],[2]]
  values=[0,-10000000]
  dense_shape=[1,1]
  size=[1]
  weights=[3,2,1]
  binary_output=False)
```

This is because of missing validation between the elements of the `values` argument and the shape of the sparse output:


```cc
for (int64_t i = 0; i < indices_mat.dimension(0); ++i) {
  const int64_t batch = indices_mat(i, 0);
  const Tidx bin = values(i);
  ...
  out(batch, bin) = ...;
}
```

### Patches
We have patched the issue in GitHub commit [f410212e373eb2aec4c9e60bf3702eba99a38aba](https://github.com/tensorflow/tensorflow/commit/f410212e373eb2aec4c9e60bf3702eba99a38aba).

The fix will be included in TensorFlow 2.7.0. We will also cherrypick this commit on TensorFlow 2.6.1, TensorFlow 2.5.2, and TensorFlow 2.4.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.
Insufficient Session Expiration in @cyyynthia/tokenize
Published: 2021-11-10T16:44:12Z

### Impact
A bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the `lastTokenReset` field.

### Patches
Version 1.1.3 contains a patch that'll invalidate these faulty tokens and make new ones behave as expected.

### Workarounds
None. Tokens do not hold the necessary information to perform invalidation anymore.

### References
PR #1

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/cyyynthia/tokenize](https://github.com/cyyynthia/tokenize)
* Email us at [cynthia@cynthia.dev](mailto:cynthia@cynthia.dev)
Exposure of Resource to Wrong Sphere in salt
Published: 2021-11-21T00:00:58Z
Aliases: CVE-2021-21996

An issue was discovered in SaltStack Salt before 3003.3. A user who has control of the source, and source_hash URLs can gain full file system access as root on a salt minion.
Cross-site Scripting in django-helpdesk
Published: 2021-11-23T17:55:46Z
Aliases: CVE-2021-3950

django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')