aswin1906/github-advisory-2021.csv huggingface dataset:
Shallow copy bug in geth
Published: 2021-06-29T21:13:01Z
Aliases: CVE-2020-26241

### Impact
This is a Consensus vulnerability, which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. 

Geth’s pre-compiled `dataCopy` (at `0x00...04`) contract did a shallow copy on invocation. An attacker could deploy a contract that 

- writes `X` to an EVM memory region `R`,
- calls `0x00..04` with `R` as an argument,
- overwrites `R` to `Y`,
- and finally invokes the `RETURNDATACOPY` opcode.

When this contract is invoked, a consensus-compliant node would push `X` on the EVM stack, whereas Geth would push `Y`.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [go-ethereum](https://github.com/ethereum/go-ethereum)
* Email us at [security@ethereum.org](mailto:security@ethereum.org)
Cross-site scripting in LocalStack
Published: 2021-06-18T18:38:09Z
Aliases: CVE-2021-32091

A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack.
Insertion of Sensitive Information into Log File in ansible
Published: 2021-06-01T21:53:29Z
Aliases: CVE-2021-20178

A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.
Uncontrolled memory consumption
Published: 2021-06-15T15:54:32Z
Aliases: CVE-2021-31811

In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
Incorrect Default Permissions in Binance tss-lib
Published: 2021-06-29T21:32:11Z
Aliases: CVE-2020-12118

The keygen protocol implementation in Binance tss-lib before 1.2.0 allows attackers to generate crafted h1 and h2 parameters in order to compromise a signing round or obtain sensitive information from other parties.
Expression Language Injection in Apache Syncope
Published: 2021-06-16T17:18:58Z
Aliases: CVE-2020-1959

A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code.
Improper Check for Unusual or Exceptional Conditions in json-smart
Published: 2021-06-16T18:03:47Z
Aliases: CVE-2021-27568

An issue was discovered in netplex json-smart-v1 through 2015-10-23 and json-smart-v2 through 2.4. An exception is thrown from a function, but it is not caught, as demonstrated by NumberFormatException. When it is not caught, it may cause programs using the library to crash or expose sensitive information.
Cross-site Scripting in Jenkins Dashboard View Plugin
Published: 2021-06-16T17:24:41Z
Aliases: CVE-2021-21649

Jenkins Dashboard View Plugin prior to 2.16 and 2.12.1 does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission.

As part of this fix, the property for image URLs was changed from `url` to `imageUrl`. Existing [Configuration as Code](https://plugins.jenkins.io/configuration-as-code/) configurations are still supported, but exports will emit the new property.
Prototype pollution in safe-obj
Published: 2021-06-21T17:18:20Z
Aliases: CVE-2021-25928

Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Incorrect Authorization in ORY Oathkeeper
Published: 2021-06-24T20:16:02Z
Aliases: CVE-2021-32701

ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. When you make a request to an endpoint that requires the scope `foo` using an access token granted with that `foo` scope, introspection will be valid and that token will be cached. The problem comes when a second requests to an endpoint that requires the scope `bar` is made before the cache has expired. Whether the token is granted or not to the `bar` scope, introspection will be valid. A patch will be released with `v0.38.12-beta.1`. Per default, caching is disabled for the `oauth2_introspection` authenticator. When caching is disabled, this vulnerability does not exist. The cache is checked in [`func (a *AuthenticatorOAuth2Introspection) Authenticate(...)`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L152). From [`tokenFromCache()`](https://github.com/ory/oathkeeper/blob/6a31df1c3779425e05db1c2a381166b087cb29a4/pipeline/authn/authenticator_oauth2_introspection.go#L97) it seems that it only validates the token expiration date, but ignores whether the token has or not the proper scopes. The vulnerability was introduced in PR #424. During review, we failed to require appropriate test coverage by the submitter which is the primary reason that the vulnerability passed the review process.
Dragonfly contains remote code execution vulnerability
Published: 2021-06-02T21:42:49Z
Aliases: CVE-2021-33564

An argument injection vulnerability in the Dragonfly gem before 1.4.0 for Ruby allows remote attackers to read and write to arbitrary files via a crafted URL when the `verify_url` option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishandle use of the ImageMagick convert utility.
Out-of-bounds Read
Published: 2021-06-08T18:49:28Z
Aliases: CVE-2021-25288

An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i. This dates to Pillow 2.4.0.
Prototype pollution in Merge-deep
Published: 2021-06-07T22:09:26Z
Aliases: CVE-2021-26707

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Auto-merging Person Records Compromised
Published: 2021-06-21T17:07:47Z
Aliases: CVE-2021-32691

### Impact

New user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events).

### Patches

We have released a security patch on v2.20.0. The solution was to create a duplicate person and then patch the new person with their profile details.

### Workarounds

If you do not wish to upgrade your app to the new version, you can patch your server by overriding the `create` data source method on the `People` class.

```js
  create = async (profile) => {
    const rockUpdateFields = this.mapApollosFieldsToRock(profile);
    // auto-merge functionality is compromised
    // we are creating a new user and patching them with profile details
    const id = await this.post('/People', {
      Gender: 0, // required by Rock. Listed first so it can be overridden.
      IsSystem: false, // required by rock
    });
    await this.patch(`/People/${id}`, {
      ...rockUpdateFields,
    });
    return id;
  };
```

### For more information
If you have any questions or comments about this advisory:
* Email us at [support@apollos.app](mailto:support@apollos.app)
Arbitrary code injection in json-sanitizer
Published: 2021-06-16T17:34:18Z
Aliases: CVE-2021-23899

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents.
Cross-site Scripting in Gogs
Published: 2021-06-29T18:32:53Z
Aliases: CVE-2014-8683

Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown.
Unchecked hostname resolution could allow access to local network resources by users outside the local network
Published: 2021-06-23T18:04:50Z

### Impact
A newly implemented route allowing users to download files from remote endpoints was not properly verifying the destination hostname for user provided URLs. This would allow malicious users to potentially access resources on local networks that would otherwise be inaccessible.

This vulnerability requires valid authentication credentials and is therefore **not exploitable by unauthenticated users**. If you are running an instance for yourself or other trusted individuals this impact is unlikely to be of major concern to you. However, you should still upgrade for security sake.

### Patches
Users should upgrade to the latest version of Wings.

### Workarounds
There is no workaround available that does not involve modifying Panel or Wings code.
Helm uses crypto package vulnerable to panic from malformed X.509 certificate
Published: 2021-06-23T18:02:39Z
Aliases: CVE-2020-7919

The Helm core maintainers have identified a high severity security vulnerability in Go's `crypto` package affecting all versions prior to Helm 2.16.8 and Helm 3.1.0.

Thanks to @ravin9249 for identifying the vulnerability.

### Impact

Go before 1.12.16 and 1.13.x before 1.13.7 (and the `crypto/cryptobyte` package before 0.0.0-20200124225646-8b5121be2f68 for Go) allows attacks on clients resulting in a panic via a malformed X.509 certificate. This may allow a remote attacker to cause a denial of service.

### Patches

A patch to compile Helm against Go 1.14.4 has been provided for Helm 2 and is available in Helm 2.16.8. Helm 3.1.0 and newer are compiled against Go 1.13.7+.

### Workarounds

No workaround is available. Users are urged to upgrade.

### References

- https://nvd.nist.gov/vuln/detail/CVE-2020-7919
- https://github.com/helm/helm/pull/8288

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [the Helm repository](https://github.com/helm/helm/issues)
* For security-specific issues, email us at <cncf-helm-security@lists.cncf.io>
Command Injection in @ronomon/opened
Published: 2021-06-08T23:15:35Z
Aliases: CVE-2021-29300

The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.
Prototype pollution vulnerability in js-extend
Published: 2021-06-08T23:16:03Z
Aliases: CVE-2021-25945

Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
Denial of Service in miekg-dns
Published: 2021-06-29T21:45:07Z
Aliases: CVE-2017-15133

A denial of service flaw was found in miekg-dns before 1.0.4. A remote attacker could use carefully timed TCP packets to block the DNS server from accepting new connections.
Improper input validation in CNCF Cortex
Published: 2021-06-23T17:20:38Z
Aliases: CVE-2021-31232

The Alertmanager in CNCF Cortex before 1.8.1 has a local file disclosure vulnerability when -experimental.alertmanager.enable-api is used. The HTTP basic auth password_file can be used as an attack vector to send any file content via a webhook. The alertmanager templates can be used as an attack vector to send any file content because the alertmanager can load any text file specified in the templates list.
Regular expression denial of service in forms
Published: 2021-06-07T22:10:13Z
Aliases: CVE-2021-23388

The package forms before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.
SQL Injection in tribalsystems/zenario
Published: 2021-06-08T20:12:02Z
Aliases: CVE-2021-27672

SQL Injection in the "admin_boxes.ajax.php" component of Tribal Systems Zenario CMS v8.8.52729 allows remote attackers to obtain sesnitive database information by injecting SQL commands into the "cID" parameter when creating a new HTML component.
Uncontrolled Resource Consumption in Apache OpenMeetings server
Published: 2021-06-16T17:43:36Z
Aliases: CVE-2021-27576

If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0
Remote Command Execution in reg-keygen-git-hash-plugin
Published: 2021-06-08T18:47:06Z
Aliases: CVE-2021-32673

### Impact

`reg-keygen-git-hash-plugin` through 0.10.15 allow remote attackers to execute of arbitrary commands.

### Patches

Upgrade to version 0.10.16 or later.

### For more information

If you have any questions or comments about this advisory:
- Open an issue in [reg-viz/reg-suit](https://github.com/reg-viz/reg-suit)
Cross-site scripting in RESTEasy
Published: 2021-06-15T16:05:22Z
Aliases: CVE-2020-10688

A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.
Origin Validation Error in Apache Maven
Published: 2021-06-16T17:32:49Z
Aliases: CVE-2021-26291

Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves into a position to pretend to be that repository. Maven is changing the default behavior in 3.8.1+ to no longer follow http (non-SSL) repository references by default. More details available in the referenced urls. If you are currently using a repository manager to govern the repositories used by your builds, you are unaffected by the risks present in the legacy behavior, and are unaffected by this vulnerability and change to default behavior. See this link for more information about repository management: https://maven.apache.org/repository-management.html
Improper Authenication in Pion DTLS
Published: 2021-06-29T21:34:57Z
Aliases: CVE-2019-20786

handleIncomingPacket in conn.go in Pion DTLS before 1.5.2 lacks a check for application data with epoch 0, which allows remote attackers to inject arbitrary unencrypted data after handshake completion.
Prototype Pollution
Published: 2021-06-21T17:14:01Z
Aliases: CVE-2021-25948

Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Prototype Pollution in nedb
Published: 2021-06-21T17:13:06Z
Aliases: CVE-2021-23395

This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload.
Script injection
Published: 2021-06-04T19:09:35Z
Aliases: CVE-2021-32660

### Impact

A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data.

The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store.

### Patches

The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Command Injection in Centreon
Published: 2021-06-22T15:23:33Z
Aliases: CVE-2020-13252

Centreon before 19.04.15 allows remote attackers to execute arbitrary OS commands by placing shell metacharacters in RRDdatabase_status_path (via a main.get.php request) and then visiting the include/views/graphs/graphStatus/displayServiceStatus.php page.
Possible route enumeration in production mode via RouteNotFoundError view in Vaadin 10, 11-14, and 15-19
Published: 2021-06-28T16:55:58Z
Aliases: CVE-2021-31412

Improper sanitization of path in default `RouteNotFoundError` view in `com.vaadin:flow-server` versions 1.0.0 through 1.0.14 (Vaadin 10.0.0 through 10.0.18), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.6.1 (Vaadin 14.0.0 through 14.6.1), and 3.0.0 through 6.0.9 (Vaadin 15.0.0 through 19.0.8) allows network attacker to enumerate all available routes via crafted HTTP request when application is running in production mode and no custom handler for `NotFoundException` is provided.

- https://vaadin.com/security/cve-2021-31412
Uncontrolled Resource Consumption in JPA Server in HAPI FHIR
Published: 2021-06-16T17:21:11Z
Aliases: CVE-2021-32053

JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
Cross-site scripting in media2click
Published: 2021-06-08T20:11:52Z
Aliases: CVE-2021-31778

The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.
Creation of order credits was not validated by acl in admin orders
Published: 2021-06-28T16:57:32Z

### Impact
Creation of order credits was not validated by ACL in admin orders

### Patches
We recommend updating to the current version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659
Action Commands (run/shell/exec) Against Library URIs Ignore Configured Remote Endpoint
Published: 2021-06-01T21:20:53Z

# Impact
Due to incorrect use of a default URL, `singularity` action commands (`run`/`shell`/`exec`) specifying a container using a `library://` URI will always attempt to retrieve the container from the default remote endpoint (`cloud.sylabs.io`) rather than the configured remote endpoint.

An attacker may be able to push a malicious container to the default remote endpoint with a URI that is identical to the URI used by a victim with a non-default remote endpoint, thus executing the malicious container.

Only action commands (`run`/`shell`/`exec`) against `library://` URIs are affected. Other commands such as `pull` / `push` respect the configured remote endpoint.

# Patches
All users should upgrade to Singularity 3.7.4 or later.

# Workarounds
Users who only interact with the default remote endpoint or do not use the library:// url are not affected.

Installations with an execution control list configured to restrict execution to containers signed with specific secure keys are not affected.

# Acknowledgements
This issue was found by Mike Frisch and brought to our attention by Sylabs.  Sylabs is making a [coordinated disclosure](https://github.com/sylabs/singularity/security/advisories/GHSA-5mv9-q7fq-9394).

# For more information
General questions about the impact of the advisory can be asked in the:

[Singularity Slack Channel](https://join.slack.com/t/hpcng/shared_invite/zt-qda4h1ls-OP0Uouq6sSmVE6i_0NrWdw)
[Singularity Mailing List](https://groups.google.com/a/lbl.gov/g/singularity)
Any sensitive security concerns should be directed to: [singularity-security@hpcng.org](mailto:singularity-security@hpcng.org)
ReDoS in normalize-url
Published: 2021-06-08T23:11:43Z
Aliases: CVE-2021-33502

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Improper Verification of Cryptographic Signature
Published: 2021-06-28T17:16:56Z

### Impact
The `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature of a SHA-512 hash matching the SHA-512 hash of the message even if the signature is invalid.

### Patches
Upgrade to `v7.0.3` immediately to resolve this issue. Since the vulnerability lies within the verification method, the previous signatures are still valid. We highly recommend reverifying any signatures that were previously verified with the vulnerable `verifyWithMessage` method.

### Workarounds
In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`. For example, the return statement should start with `return this.verify(signed, password).verified && ` instead of `return this.verify(signed, password) && `.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/TogaTech/tEnvoy](https://github.com/TogaTech/tEnvoy)
Authentication granted to all firewalls instead of just one
Published: 2021-06-21T17:03:44Z
Aliases: CVE-2021-32693

Description
-----------

When an application defines multiple firewalls, the authenticated token delivered by one of the firewalls is available to all other firewalls. This can be abused when the application defines different providers for different parts of an application. In such a situation, a user authenticated on one part of the application is considered authenticated on the whole application.

Resolution
----------

We now ensure that the authenticated token is only available for the firewall that generates it.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/3084764ad82f29dbb025df19978b9cbc3ab34728) for branch 5.3.

Credits
-------

I would like to thank Bogdan, gndk, Paweł Warchoł, Warxcell, and Adrien Lamotte for reporting the issue and Wouter J for fixing the issue.
Apache Airflow Cross-site Scripting 
Published: 2021-06-18T18:29:54Z
Aliases: CVE-2020-13944

In Apache Airflow < 1.10.12, the `origin` parameter passed to some of the endpoints like `/trigger` and was vulnerable to a XSS exploit.
SQL Injection in Gogs
Published: 2021-06-29T18:32:48Z
Aliases: CVE-2014-8682

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.