aswin1906/github-advisory-2021.csv huggingface dataset:
Improper Control of Generation of Code ('Code Injection') in @asyncapi/modelina
Published: 2021-09-21T18:41:59Z
Aliases: CVE-2023-23619

### Impact
Anyone who is using the default presets and/or does not handle the functionality themself.

### Patches
It is impossible to fully guard against this, because users have access to the original raw information. However, as of version 1, if you only access the constrained models, you will not encounter this issue.

Further similar situations are NOT seen as a security issue, but intended behavior.

### Workarounds
Fully custom presets that change the entire rendering process which can then escape the user input.

### For more information
Even though that I changed all the presets here, the vulnerability is still present throughout. I am using a JSON Schema here for simplicity.
```ts
const jsonSchemaDoc = {
  $id: 'CustomClass',
  type: 'object',
  properties: {
      'property: any; \n constructor(){console.log("injected")} \n private _temp': { type: 'string' },
  }
};
generator = new TypeScriptGenerator(
  { 
    presets: [
      {
        class: {
            property({ propertyName, content }) {
              return `private ${propertyName}: any;`;
            },
            ctor() {
              return '';
            },
            getter() {
              return '';
            },
            setter() {
              return '';
            }
        }
      }
    ]
  }
);
const inputModel = await generator.process(jsonSchemaDoc);
```
This would render
```ts
export class CustomClass {
  private property: any; 
   constructor(){console.log("injected")} 
   private _temp: any;
  private additionalProperties: any;
}
```
Deserialization of Untrusted Data in com.jsoniter:jsoniter
Published: 2021-09-20T23:18:54Z
Aliases: CVE-2021-23441

# Withdrawn

was withdrawn by its CNA. Further investigation showed that it was not a security issue. 

## Original Description

All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.
Type confusion in mpath
Published: 2021-09-02T22:02:25Z
Aliases: CVE-2021-23438

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition `ignoreProperties.indexOf(parts[i]) !== -1` returns `-1` if `parts[i]` is `['__proto__']`. This is because the method that has been called if the input is an array is `Array.prototype.indexOf()` and not `String.prototype.indexOf()`. They behave differently depending on the type of the input.
Malicious password-reset in Akaunting
Published: 2021-09-01T18:31:36Z
Aliases: CVE-2021-36804

Akaunting version 2.1.12 and earlier suffers from a password reset spoofing vulnerability, wherein an attacker can proxy password reset requests through a running Akaunting instance, if that attacker knows the target's e-mail address. This issue was fixed in version 2.1.13 of the product. Please note that this issue is ultimately caused by the defaults provided by the Laravel framework, specifically how proxy headers are handled with respect to multi-tenant implementations. In other words, while this is not technically a vulnerability in Laravel, this default configuration is very likely to lead to practically identical identical vulnerabilities in Laravel projects that implement multi-tenant applications.
Regular Expression Denial of Service in millisecond
Published: 2021-09-22T20:35:08Z

Versions of `millisecond` prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.


## Proof of concept
```
var ms = require('millisecond');
var genstr = function (len, chr) {
   var result = "";
   for (i=0; i<=len; i++) {
       result = result + chr;
   }

   return result;
}

ms(genstr(process.argv[2], "5") + " minutea");
```


## Recommendation

Update to version 0.1.2 or later.
XSS vulnerability on asset view
Published: 2021-09-01T18:40:31Z
Aliases: CVE-2021-27912

### Impact
Mautic versions before 3.3.4 / 4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets. 

### Patches
Upgrade to 3.3.4 or 4.0.0

### Workarounds
No

### References
https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Prototype Pollution in deephas
Published: 2021-09-24T15:42:21Z
Aliases: CVE-2020-28271

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
Cross-site Scripting in LaraCMS
Published: 2021-10-04T20:13:11Z
Aliases: CVE-2020-20129

LaraCMS contains a stored cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content editor.
Inclusion of Functionality from Untrusted Control Sphere in CKEditor 4
Published: 2021-10-13T15:34:09Z
Aliases: CVE-2021-26272

It was possible to execute a ReDoS-type attack inside CKEditor 4 before 4.16 by persuading a victim to paste crafted URL-like text into the editor, and then press Enter or Space (in the Autolink plugin).
Cross Site Request Forgery in kindeditor
Published: 2021-10-18T19:44:06Z
Aliases: CVE-2021-42228

Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google editor, (you only need to search in google: inurl:/examples/uploadbutton.html) and then use the authority of this website to trick users into clicking your malicious html link.
Improper Input Validation in OpenCV
Published: 2021-10-12T22:00:31Z
Aliases: CVE-2016-1517

OpenCV 3.0.0 allows remote attackers to cause a denial of service (segfault) via vectors involving corrupt chunks. This issue was fixed in OpenCV version 3.3.1 (corresponding to OpenCV 3.3.1.11).
MD5 hash support in github.com/foxcpp/maddy
Published: 2021-10-12T16:06:30Z

### Impact

This vulnerability affects maddy 0.5.1, 0.5.0 users using auth.shadow module
and an extremely outdated system that still allows MD5 hashes in 
/etc/shadows.

### Patches

Patch is available as part of the 0.5.2 release.

### Workarounds

Ensure MD5 hashes are not present in /etc/shadow.
Prototype pollution in object-hierarchy-access
Published: 2021-10-12T16:40:58Z
Aliases: CVE-2020-28270

Overview:Prototype pollution vulnerability in ‘object-hierarchy-access’ versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:22:17Z
Aliases: CVE-2019-9423

In opencv calls that use libpng, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges required. User interaction is not required for exploitation. Product: AndroidVersions: Android-10Android ID: A-110986616
Cross-site scripting in demos/demo.mysqli.php in getID3
Published: 2021-10-04T20:13:55Z
Aliases: CVE-2021-40926

Cross-site scripting (XSS) vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter.
Improper Verification of Cryptographic Signature in fastecdsa
Published: 2021-10-12T16:30:37Z
Aliases: CVE-2020-12607

An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s<sup>-1</sup>, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.
Drupal core Unrestricted Upload of File with Dangerous Type
Published: 2021-10-12T16:28:25Z
Aliases: CVE-2020-13671

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
Hashicorp Vault Privilege Escalation Vulnerability
Published: 2021-10-12T16:39:01Z
Aliases: CVE-2021-41802

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.
Out-of-bounds Read in OpenCV 
Published: 2021-10-12T22:01:08Z
Aliases: CVE-2017-12599

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the function icvCvt_BGRA2BGR_8u_C4C3R when reading an image file by using cv::imread.
Splash authentication credentials potentially leaked to target websites 
Published: 2021-10-06T17:49:23Z
Aliases: CVE-2021-41124

### Impact

If you use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `http_user` and `http_pass` spider attributes) for Splash authentication, any non-Splash request will expose your credentials to the request target. This includes `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`.

### Patches

Upgrade to scrapy-splash 0.8.0 and use the new `SPLASH_USER` and `SPLASH_PASS` settings instead to set your Splash authentication credentials safely.

### Workarounds

If you cannot upgrade, set your Splash request credentials on a per-request basis, [using the `splash_headers` request parameter](https://github.com/scrapy-plugins/scrapy-splash/tree/0.8.x#http-basic-auth), instead of defining them globally using the [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth).

Alternatively, make sure all your requests go through Splash. That includes disabling the [robots.txt middleware](https://docs.scrapy.org/en/latest/topics/downloader-middleware.html#topics-dlmw-robots).

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy-plugins/scrapy-splash/issues)
* [Email us](mailto:opensource@zyte.com)
Insecure random number generation in keypair
Published: 2021-10-11T17:09:05Z
Aliases: CVE-2021-41117

## Description and Impact

A bug in the pseudo-random number generator used by [keypair](https://github.com/juliangruber/keypair) versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recommend replacing any RSA keys that were generated using keypair version 1.0.3 or earlier.

## Fix

* The [bug](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L1008) in the pseudo-random number generator is fixed in commit [`9596418`](https://github.com/juliangruber/keypair/commit/9596418d3363d3e757676c0b6a8f2d35a9d1cb18).
* If the crypto module is available, it is used instead of the pseudo-random number generator. Also fixed in [`9596418`](https://github.com/juliangruber/keypair/commit/9596418d3363d3e757676c0b6a8f2d35a9d1cb18)

## Additional Details

The specific [line](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L1008) with the flaw is:

```javascript
b.putByte(String.fromCharCode(next & 0xFF))
```

The [definition](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L350-L352) of `putByte` is 

```javascript
util.ByteBuffer.prototype.putByte = function(b) {
  this.data += String.fromCharCode(b);
};
```

Simplified, this is `String.fromCharCode(String.fromCharCode(next & 0xFF))`. This results in most of the buffer containing zeros. An example generated buffer:

(Note: truncated for brevity)

```
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x04\x00\x00\x00....\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
```

Since it is masking with 0xFF, approximately 97% of the bytes are converted to zeros. The impact is that each byte in the RNG seed has a 97% chance of being 0 due to incorrect conversion.

## Credit

This issue was reported to GitHub Security Lab by Ross Wheeler of Axosoft. It was discovered by Axosoft engineer Dan Suceava, who noticed that [keypair](https://github.com/juliangruber/keypair) was regularly generating duplicate RSA keys. GitHub security engineer [@vcsjones (Kevin Jones)](https://github.com/vcsjones) independently investigated the problem and identified the cause and source code location of the bug.
Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui
Published: 2021-10-22T16:21:07Z

### Impact
`rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated.

Rucio server / daemons are not affected by this issue, it is isolated to the webui.

### Patches
This issue is fixed in the `1.26.7` release of the `rucio-webui`.

### Workarounds
Installation of the `1.25.7` `webui` release. The `1.25` and previous webui release lines are not affected by this issue.

### References
https://github.com/rucio/rucio/issues/4928
Policies not properly enforced in bluemonday
Published: 2021-10-19T20:15:30Z
Aliases: CVE-2021-42576

The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated with the SELECT, STYLE, and OPTION elements.
XSS in `*Text` options of the Datepicker widget in jquery-ui
Published: 2021-10-26T14:55:21Z
Aliases: CVE-2021-41183

### Impact
Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
```js
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
```
will call `doEvilThing` with 6 different parameters coming from all `*Text` options.

### Patches
The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML.

### Workarounds
A workaround is to not accept the value of the `*Text` options from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
Embedded malware in ua-parser-js
Published: 2021-10-22T20:38:14Z

The npm package `ua-parser-js` had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/faisalman/ua-parser-js/issues/536) for details as they unfold.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm
Published: 2021-10-27T18:52:06Z
Aliases: CVE-2021-40865

An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE). Apache Storm 2.2.x users should upgrade to version 2.2.1 or 2.3.0. Apache Storm 2.1.x users should upgrade to version 2.1.1. Apache Storm 1.x users should upgrade to version 1.2.4
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:02:51Z
Aliases: CVE-2017-14136

OpenCV (Open Source Computer Vision Library) 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds write error in the function FillColorRow1 in utils.cpp when reading an image file by using cv::imread. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12597.
Cross-site Scripting in snipe-it
Published: 2021-10-21T17:48:26Z
Aliases: CVE-2021-3879

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Out-of-bounds Write in OpenCV.
Published: 2021-10-12T22:23:41Z
Aliases: CVE-2018-5268

In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer overflow happens in cv::Jpeg2KDecoder::readComponent8u in modules/imgcodecs/src/grfmt_jpeg2000.cpp when parsing a crafted image file.
Prototype Pollution in vm2
Published: 2021-10-19T15:28:45Z
Aliases: CVE-2021-23449

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.
Cobbler before 3.3.0 allows log poisoning
Published: 2021-10-05T17:53:20Z
Aliases: CVE-2021-40323

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
XSS in the `altField` option of the Datepicker widget in jquery-ui
Published: 2021-10-26T14:55:02Z
Aliases: CVE-2021-41182

### Impact
Accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
```js
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
```
will call the `doEvilThing` function.

### Patches
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector.

### Workarounds
A workaround is to not accept the value of the `altField` option from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
Cross-site Scripting in snipe-it
Published: 2021-10-21T17:49:18Z
Aliases: CVE-2021-3863

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Out-of-bounds Read in OpenCV
Published: 2021-10-12T22:22:58Z
Aliases: CVE-2019-19624

An out-of-bounds read was discovered in OpenCV before 4.1.1 (OpenCV-Python before 4.1.0.25). Specifically, variable coarsest_scale is assumed to be greater than or equal to finest_scale within the calc()/ocl_calc() functions in dis_flow.cpp. However, this is not true when dealing with small images, leading to an out-of-bounds read of the heap-allocated arrays Ux and Uy.
Remote code execution in dask
Published: 2021-10-27T18:53:48Z
Aliases: CVE-2021-42343

An issue was discovered in Dask (aka python-dask) through 2021.09.1. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
Out-of-bounds Write in OpenCV
Published: 2021-10-12T22:02:04Z
Aliases: CVE-2017-12605

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python and OpenCV-Contrib-Python 3.3.0.9) has an out-of-bounds write error in the FillColorRow8 function in utils.cpp when reading an image file by using cv::imread.
Improper Access Control in github.com/treeverse/lakefs
Published: 2021-10-28T16:27:03Z

### Impact

1. [medium] A user with write permissions to a portion of a repository may use the S3 gateway to copy any object in the repository if they know its name.
1. [medium] A user with permission to write any one of tags, branches, or commits on a repository may write all of them.
1. [low] A user with permission to read any one of tags, branches, or commits on a repository may read all of them.
1. [low] A user allowed to list objects in a repository _or_ read repository meta-data may retrieve graveler information about the location on underlying storage of all objects stored in any commit that they can view.  If the user additionally has the capability to read underlying storage, they will be able to retrieve metadata associated with all objects in that commit.

### For more information

If you have any questions or comments about this advisory please:
* Email us at security@treeverse.io.
* Open an issue on https://github.com/treeverse/lakeFS/issues/new.
Prototype Pollution in x-assign
Published: 2021-10-21T17:50:44Z
Aliases: CVE-2021-23452

This vulnerability affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.
Credential Disclosure in System.DirectoryServices.Protocols
Published: 2021-10-12T17:49:25Z
Aliases: CVE-2021-41355

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A Information Disclosure vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on Linux.

### Patches
Any .NET application that uses `System.DirectoryServices.Protocols` with a vulnerable version listed below on system based on Linux.

Package name | Vulnerable versions | Secure versions
------------ | ---------------- | -------------------------
System.DirectoryServices.Protocols | 5.0.0  | 5.0.1

### Other Details

- Announcement for this issue can be found at dotnet/announcements#202
- An Issue for this can be found at https://github.com/dotnet/runtime/issues/60301
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-41355
SQL Injection in medoo
Published: 2021-10-12T16:32:38Z
Aliases: CVE-2019-10762

columnQuote in medoo before 1.7.5 allows remote attackers to perform a SQL Injection due to improper escaping.