aswin1906/github-advisory-2021.csv huggingface dataset:
Rebuild-bot workflow may allow unauthorised repository modifications
Published: 2021-04-06T18:36:40Z
Aliases: CVE-2021-21423

### Impact

`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `NodeProject` project type (including any project type derived from it) include a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the "main" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the "main" repository.

The rebuild-bot workflow is triggered by comments including `@projen rebuild` on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an `issue_comment` event, and thus always executes with a `GITHUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by `pull_request` events, which always execute with a `GITHUB_TOKEN` belonging to the repository from which the pull-request is made).

Repositories that do not have branch protection configured on their default branch (typically `main` or `master`) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed `GITHUB_TOKEN` would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch. 

### Patches

The issue was mitigated in version `0.16.41` of the `projen` tool, which removes the `issue_comment` trigger from this workflow. Version `0.17.0` of projen completely removes the `rebuild-bot.yml` workflow.

### Workarounds

The recommended way to address the vulnerability is to upgrade `projen`. Users who cannot upgrade `projen` may also remove the `.github/workflows/rebuild-bot.yml` file and add it to their `.gitignore` file (via `projenrc.js`) to mitigate the issue.

### References

The `rebuild-bot.yml` workflow managed by `projen` is only one occurrence of a GitHub Workflows mis-configuration, but it may also be present in other workflows not managed by `projen` (either hand-written, or managed by other tools). For more information on this class of issues, the [Keeping your GitHub Actions and workflows secure: Preventing pwn requests][1] article provides a great overview of the problem.
 

[1]: https://securitylab.github.com/research/github-actions-preventing-pwn-requests
Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
Published: 2021-04-07T20:36:46Z
Aliases: CVE-2020-10685

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.
User (Encrypted) Password Field Being Serialised
Published: 2021-04-13T15:12:26Z

### Impact
Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed.

### Patches
Issue has been patched in version 0.3.7-beta and onwards.

### Workarounds
Add the 'password' field to the Users model file in the hidden array:

```php

    /**
     * The attributes that should be hidden for arrays.
     *
     * @var array
     */
    protected $hidden = [
        'remember_token',
        'password',
    ];
```


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [pwweb/laravel-core](https://github.com/pwweb/laravel-core)
* Email us at [security@pw-websolutions.com](mailto:security@pw-websolutions.com)
Insufficient Verification of Data Authenticity in Eclipse Theia
Published: 2021-04-13T15:18:01Z
Aliases: CVE-2019-17636

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the hosts filesystem, given their path, without restrictions on the requesters origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.
Command injection in eslint-fixer
Published: 2021-04-13T15:19:14Z
Aliases: CVE-2021-26275

The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted.
Cross-site scripting in SiCKRAGE
Published: 2021-04-20T16:31:54Z
Aliases: CVE-2021-25925

in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive information.
Server-Side Request Forgery in private-ip
Published: 2021-04-13T15:18:17Z
Aliases: CVE-2020-28360

Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.
Command injection in corenlp-js-prefab
Published: 2021-04-13T15:22:58Z
Aliases: CVE-2020-28439

This affects all versions of package corenlp-js-prefab. The injection point is located in line 10 in 'index.js.' It depends on a vulnerable package 'corenlp-js-interface.'
libtaxii Server-Side Request Forgery vulnerability
Published: 2021-04-30T17:34:48Z
Aliases: CVE-2020-27197

"TAXII libtaxii through 1.1.117, as used in EclecticIQ OpenTAXII through 0.2.0 and other products, allows SSRF via an initial http:// substring to the parse method, even when the no_network setting is used for the XML parser. NOTE: the vendor points out that the parse method "wraps the lxml library" and that this may be an issue to "raise ... to the lxml group.""
OS Command Injection in im-metadata
Published: 2021-04-13T15:17:36Z
Aliases: CVE-2019-10788

im-metadata through 3.0.1 allows remote attackers to execute arbitrary commands via the "exec" argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the "exec" function.
Potential XSS injection in the newsletter conditions field
Published: 2021-04-06T17:24:14Z
Aliases: CVE-2021-21418

### Impact
An employee can inject javascript in the newsletter condition field that will then be executed on the front office

### Patches
The issue has been fixed in 2.6.1
Timing side channel vulnerability in UIDL request handler in Vaadin 7 and 8
Published: 2021-04-19T14:51:06Z
Aliases: CVE-2021-31403

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:vaadin-server` versions 7.0.0 through 7.7.23 (Vaadin 7.0.0 through 7.7.23), and 8.0.0 through 8.12.2 (Vaadin 8.0.0 through 8.12.2) allows attacker to guess a security token via timing attack

- https://vaadin.com/security/cve-2021-31403
Padding Oracle Attack due to Observable Timing Discrepancy in jose
Published: 2021-04-19T14:57:22Z
Aliases: CVE-2021-29443

jose is an npm library providing a number of cryptographic operations.
### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `^1.28.1 || ^2.0.5 || >=3.11.4`.

Users should upgrade their v1.x dependency to [`^1.28.1`](https://github.com/panva/jose/releases/tag/v1.28.1), their v2.x dependency to [`^2.0.5`](https://github.com/panva/jose/releases/tag/v2.0.5), and their v3.x dependency to [`^3.11.4`](https://github.com/panva/jose/releases/tag/v3.11.4)

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
.NET Core Information Disclosure
Published: 2021-04-21T19:16:06Z
Aliases: CVE-2018-8292

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.
Improper Certificate Validation in TweetStream
Published: 2021-04-13T15:42:36Z
Aliases: CVE-2020-24393

TweetStream 2.6.1 uses the library eventmachine in an insecure way that does not have TLS hostname validation. This allows an attacker to perform a man-in-the-middle attack.
Leak of information via Store-API aggregations in shopware/platform and shopware/core
Published: 2021-04-13T15:13:26Z

### Impact

Leak of information via Store-API

### Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
Any logged in user could edit any other logged in user.
Published: 2021-04-19T15:14:33Z
Aliases: CVE-2021-29452

### Impact
Everyone who is running a12n-server. 

A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change.

### Patches
Patched in v0.18.2
Incorrect permission enforcement in UmbracoCms
Published: 2021-04-13T15:48:05Z
Aliases: CVE-2020-29454

Editors/LogViewerController.cs in Umbraco through 8.9.1 allows a user to visit a logviewer endpoint even if they lack Applications.Settings access.
Cross-site scripting in actionpack
Published: 2021-04-07T20:58:47Z
Aliases: CVE-2020-8264

In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.

Workarounds
-----------
Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: `config.middleware.delete ActionDispatch::ActionableExceptions`
OSGi applications using Vaadin 12-14 and 19 vulnerable to server classes and resources exposure
Published: 2021-04-19T14:50:49Z
Aliases: CVE-2021-31407

Vulnerability in OSGi integration in `com.vaadin:flow-server` versions 1.2.0 through 2.4.7 (Vaadin 12.0.0 through 14.4.9), and 6.0.0 through 6.0.1 (Vaadin 19.0.0) allows attacker to access application classes and resources on the server via crafted HTTP request.

- https://vaadin.com/security/cve-2021-31407
Cross-site scripting in Apache CXF
Published: 2021-04-22T16:15:23Z
Aliases: CVE-2020-13954

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack via the styleSheetPath, which allows a malicious actor to inject javascript into the web page. This vulnerability affects all versions of Apache CXF prior to 3.4.1 and 3.3.8. Please note that this is a separate issue to CVE-2019-17573.
Cross-Site Request Forgery (CSRF) in trestle-auth
Published: 2021-04-13T17:01:50Z
Aliases: CVE-2021-29435

### Impact
A vulnerability in trestle-auth versions 0.4.0 and 0.4.1 allows an attacker to create a form that will bypass Rails' built-in CSRF protection when submitted by a victim with a trestle-auth admin session. This potentially allows an attacker to alter protected data, including admin account credentials.

### Patches
The vulnerability has been fixed in trestle-auth 0.4.2 released to RubyGems.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [trestle-auth](https://github.com/TrestleAdmin/trestle-auth/issues)
* Email the maintainer at [sam@sampohlenz.com](mailto:sam@sampohlenz.com)
Timing side channel vulnerability in UIDL request handler in Vaadin 10, 11-14, and 15-18
Published: 2021-04-19T14:47:47Z

Non-constant-time comparison of CSRF tokens in UIDL request handler in `com.vaadin:flow-server` versions 1.0.0 through 1.0.13 (Vaadin 10.0.0 through 10.0.16), 1.1.0 prior to 2.0.0 (Vaadin 11 prior to 14), 2.0.0 through 2.4.6 (Vaadin 14.0.0 through 14.4.6), 3.0.0 prior to 5.0.0 (Vaadin 15 prior to 18), and 5.0.0 through 5.0.2 (Vaadin 18.0.0 through 18.0.5) allows attacker to guess a security token via timing attack.

- https://vaadin.com/security/cve-2021-31404
Command injection in gitlog
Published: 2021-04-13T15:15:29Z
Aliases: CVE-2021-26541

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.
Denial of Service (DoS) in restify-paginate
Published: 2021-04-12T18:59:11Z
Aliases: CVE-2020-27543

The restify-paginate package 0.0.5 for Node.js allows remote attackers to cause a Denial-of-Service by omitting the HTTP Host header. A Restify-based web service would crash with an uncaught exception.
Arbitrary code execution in kill-by-port
Published: 2021-04-13T15:32:43Z
Aliases: CVE-2021-23363

This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Improper Input Validation in SocksJS-Node
Published: 2021-04-13T15:27:51Z
Aliases: CVE-2020-7693

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Fixes a bug in Zend Framework's Stream HTTP Wrapper
Published: 2021-04-22T16:10:49Z
Aliases: CVE-2021-21426

### Impact
CVE-2021-3007: Backport of Zend_Http_Response_Stream, added certain type checking as a way to prevent exploitation. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3007

This vulnerability is caused by the unsecured deserialization of an object. In versions higher than Zend Framework 3.0.0, the attacker abuses the Zend3 feature that loads classes from objects in order to upload and execute malicious code in the server. The code can be uploaded using the “callback” parameter, which in this case inserts a malicious code instead of the “callbackOptions” array.


### Patches
_Has the problem been patched? What versions should users upgrade to?_
v20.0.9 v19.4.13
Directory Traversal in Django
Published: 2021-04-08T18:11:48Z
Aliases: CVE-2021-28658

In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.
Cross-site scripting in papermerge
Published: 2021-04-20T16:37:56Z
Aliases: CVE-2020-29456

Multiple cross-site scripting (XSS) vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in Papermerge, a malicious document can be sent by email and is automatically uploaded into the Papermerge web application. Therefore, no authentication is required to exploit XSS if email consumption is configured. Otherwise authentication is required.
Logic error in Legion of the Bouncy Castle BC Java
Published: 2021-04-30T16:14:15Z
Aliases: CVE-2020-28052

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Regular Expression Denial of Service (ReDoS) in es6-crawler-detect
Published: 2021-04-13T15:19:39Z
Aliases: CVE-2020-28501

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.
REXML round-trip instability
Published: 2021-04-30T17:30:37Z
Aliases: CVE-2021-28965

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.
Potential sensitive information disclosed in error reports
Published: 2021-04-06T17:28:59Z
Aliases: CVE-2021-21416

django-registration is a user-registration application for Django. 

### Impact

The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly apply filters to sensitive data, with the result that sensitive data could be included in error reports rather than removed automatically by Django.

Triggering this requires the following conditions:

* A site is using django-registration < 3.1.2
* The site has detailed error reports (such as Django's [emailed error reports to site staff/developers](https://docs.djangoproject.com/en/3.1/howto/error-reporting/#email-reports)) enabled
* A server-side error (HTTP 5xx) occurs during an attempt by a user to register an account

Under these conditions, recipients of the detailed error report will see all submitted data from the account-registration attempt, which may include the user's proposed credentials (such as a password).

### Patches

As of version 3.1.2, django-registration properly applies Django's `sensitive_post_parameters()` decorator to the base user-registration view, which will cause all data from the HTTP request body to be filtered from detailed error reports in the event of a server-side crash during user account registration.

Note that as applied, this filters *all* HTTP request data from error reports. To selectively allow some fields but not others, see Django's own documentation (in references) and the notes below for how to apply `sensitive_post_parameters()` manually to a particular codebase's `RegistrationView` subclass(es).

### Workarounds

Users who cannot upgrade quickly can apply the `django.views.decorators.debug.sensitive_post_parameters()` decorator to their own registration views. The decorator should be applied on the `dispatch()` method of the appropriate `RegistrationView` class, using Django's `method_decorator()` helper. For example:

```python
from django.utils.decorators import method_decorator
from django.views.decorators.debug import sensitive_post_parameters

from django_registration.views import RegistrationView

class MyRegistrationView(RegistrationView):
    """
    A RegistrationView subclass manually protected against sensitive information disclosure
    in error reports.

    """
    @method_decorator(sensitive_post_parameters())
    def dispatch(self, *args, **kwargs):
        return super().dispatch(*args, **kwargs)
```

### References

* Django's documentation on [error reporting in production](https://docs.djangoproject.com/en/3.1/howto/error-reporting/)
* [How Django's sensitive-data filters work](https://docs.djangoproject.com/en/3.1/howto/error-reporting/#filtering-error-reports)
Improper Input Validation in network-manager
Published: 2021-04-13T15:17:45Z
Aliases: CVE-2019-10786

network-manager through 1.0.2 allows remote attackers to execute arbitrary commands via the "execSync()" argument.
Gon gem lack of escaping certain input when outputting as JSON
Published: 2021-04-30T17:29:15Z
Aliases: CVE-2020-25739

An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate, json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.
Cross-site Scripting (XSS) in @scullyio/scully
Published: 2021-04-13T15:28:01Z
Aliases: CVE-2020-28470

This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.
Improper Certificate Validation in Puppet
Published: 2021-04-13T15:42:19Z
Aliases: CVE-2020-7942

Previously, Puppet operated on the model that a node with a valid certificate was entitled to all information in the system and that a compromised certificate allowed access to everything in the infrastructure. When a node's catalog falls back to the `default` node, the catalog can be retrieved for a different node by modifying facts for the Puppet run. This issue can be mitigated by setting `strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet 6.13.0 changes the default behavior for strict_hostname_checking from false to true. It is recommended that Puppet Open Source and Puppet Enterprise users that are not upgrading still set strict_hostname_checking to true to ensure secure behavior.
Pgsync Contains Cleartext Transmission of Sensitive Information
Published: 2021-04-27T15:54:52Z
Aliases: CVE-2021-31671

pgsync before 0.6.7 is affected by Information Disclosure of sensitive information. Syncing the schema with the `--schema-first` and `--schema-only` options is mishandled. For example, the sslmode connection parameter may be lost, which means that SSL would not be used.
Command injection in spritesheet-js
Published: 2021-04-13T15:30:16Z
Aliases: CVE-2020-7782

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.