aswin1906/github-advisory-2021.csv huggingface dataset:
SSRF in Sydent due to missing validation of hostnames
Published: 2021-04-19T14:54:15Z
Aliases: CVE-2021-29431

### Impact

Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting.

It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration.

### Patches

Fixed in 9e57334, 8936925, 3d531ed, 0f00412

### Workarounds

A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.

### For more information

If you have any questions or comments about this advisory, email us at security@matrix.org.
Improper Authentication in react-adal
Published: 2021-04-13T15:22:37Z
Aliases: CVE-2020-7787

This affects versions of react-adal < 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by how the nonce, session and refresh values are stored in the browser local storage or session storage. Each key is automatically appended by ||. When the received nonce and session keys are generated, the list of values is stored in the browser storage, separated by ||, with || always appended to the end of the list. Since || will always be the last 2 characters of the stored values, an empty string ("") will always be in the list of the valid values. Therefore, if an empty session parameter is provided in the callback URL, and a specially-crafted JWT token contains an nonce value of "" (empty string), then adal.js will consider the JWT token as authentic.
Padding Oracle Attack due to Observable Timing Discrepancy in jose-node-esm-runtime
Published: 2021-04-19T14:59:06Z
Aliases: CVE-2021-29445

### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`.

Users should upgrade to `^3.11.4`.

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Path Traversal in Ansible
Published: 2021-04-20T16:43:33Z
Aliases: CVE-2020-1737

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Exposure of Resource to Wrong Sphere and 	Insecure Temporary File in Ansible
Published: 2021-04-20T16:46:12Z
Aliases: CVE-2020-1733

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
Cross-site scripting in sickrage
Published: 2021-04-20T16:31:43Z
Aliases: CVE-2021-25926

In SiCKRAGE, versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore, an attacker can steal a user's sessionID to masquerade as a victim user, to carry out any actions in the context of the user.
VVE-2021-0002: Incorrect `returndatasize` when using simple forwarder proxies deployed prior to EIP-1167 adoption
Published: 2021-04-19T15:11:54Z

## Background

@tjayrush reported a data handling issue with certain Web3 libraries using Vyper-deploy forwarder proxy contracts using our Vyper's built-in `create_forwarder_to` function prior to our change to support EIP-1167 style forwarder proxies.

### Impact
If you are an end user of a forwarder-style proxy deployed using Vyper's built-in `create_forwarder_to` function AND you have a function that returns >4096 bytes AND you do no return data sanitation on the value returned, you could potentially see a data corruption issue.

Otherwise, if you are handling the result of a return call AND you expect a specific `RETURNDATASIZE` that is less than 4096 (such as `SafeERC20.safeTransfer`) then the call will fail that check.

### Patches
The issue was patched when we upgraded to EIP-1167 style forwarder proxies in #2281.

### Workarounds
If you are making a call to a contract method that is expected to return <= 4096 bytes, there is no issue as the ABI decoders in both Solidity and Vyper will truncate the data properly. Web3 libraries will also do this, unless you are doing `eth_call` or `eth_sendTransaction` directly.

If you are using a Solidity library that checks `RETURNDATASIZE` of an external call to a forwarder proxy deployed prior to this patch, it will fail on that assertion (such as `SafeERC20.safeTransfer`). The workaround is to always do a greater than or equal to check, rather than a strict equals to check.
Improper Restriction of XML External Entity Reference in Plone
Published: 2021-04-07T21:13:00Z
Aliases: CVE-2020-28734

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
Timing side channel vulnerability in endpoint request handler in Vaadin 15-19
Published: 2021-04-19T14:50:38Z
Aliases: CVE-2021-31406

Non-constant-time comparison of CSRF tokens in endpoint request handler in `com.vaadin:flow-server` versions 3.0.0 through 5.0.3 (Vaadin 15.0.0 through 18.0.6), and com.vaadin:fusion-endpoint version 6.0.0 (Vaadin 19.0.0) allows attacker to guess a security token for Fusion endpoints via timing attack.

- https://vaadin.com/security/cve-2021-31406
Creation of Temporary File in Directory with Insecure Permissions in the OpenAPI Generator Maven plugin
Published: 2021-04-29T21:51:37Z
Aliases: CVE-2021-21429

### Impact

Using `File.createTempFile` in JDK will result in creating and using insecure temporary files that can leave application and system data vulnerable to attacks. This vulnerability only impacts unix-like systems where the local system temporary directory is shared between all users. This vulnerability does not impact Windows or modern versions of MacOS.

OpenAPI Generator Maven plug-in creates insecure temporary files during the code generation process. It creates insecure temporary files to store the OpenAPI specification files provided by the users and these temporary files can be read by any users in the system.

The impact of this vulnerability is information disclosure of the contents of the specification file to other local users.

### Patches
The issue has been patched with `Files.createTempFile` and released in the v5.1.0 stable version.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [OpenAPI Generator Github repo](https://github.com/openAPITools/openapi-generator/)
* Email us at [security@openapitools.org](mailto:security@openapitools.org)
Grav's Twig processing allowing dangerous PHP functions by default
Published: 2021-04-16T19:53:12Z
Aliases: CVE-2021-29440

### Impact

Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. 
As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.

### Patches

The issue was addressed by preventing dangerous functions from being called in Twig templates. A configuration option has been added to manually allow arbitrary PHP functions (`system.twig.safe_functions`) and filters (`system.twig.safe_filters`). 

Futures major versions of Grav may disable this functionality by default. 

### Workarounds

Blocking access to the `/admin` path from untrusted sources will reduce the probability of exploitation. 

### References

- https://portswigger.net/research/server-side-template-injection
- https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities

### For more information

If you have any questions or comments about this advisory, you can contact:
  - The original reporters, by sending an email to vulnerability.research [at] sonarsource.com;
  - The maintainers, by opening an issue on this repository.
Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime
Published: 2021-04-19T14:58:49Z
Aliases: CVE-2021-29444

### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`.

Users should upgrade to `^3.11.4`.

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
[thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values
Published: 2021-04-06T17:22:41Z
Aliases: CVE-2021-21412

### Impact

Potential for arbitrary code execution in `#gpg`-tagged property values (only if `decrypt: true` option is enabled)

### Patches

[A fix](https://github.com/thi-ng/umbrella/commit/3e14765d6bfd8006742c9e7860bc7d58ae94dfa5) has already been released as v0.4.0

### Workarounds

By default, EGF parse functions do NOT attempt to decrypt values (since GPG is only available in non-browser env).

However, if GPG encrypted values are used/required:

1. Perform a regex search for `#gpg`-tagged values in the EGF source file/string and check for backtick (\`) chars in the encrypted value string
2. Replace/remove them or skip parsing if present...

### References

https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7#advisory-comment-65261

### For more information

If you have any questions or comments about this advisory, please open an issue in the [thi.ng/umbrella repo](https://github.com/thi-ng/umbrella/issues), of which this package is part of.
Regular expression Denial of Service in multiple packages
Published: 2021-04-06T17:28:41Z
Aliases: CVE-2021-21391


### Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 27.0.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 5 team would like to thank Yeting Li for recognizing and reporting these vulnerabilities.
Cross-Site Scripting
Published: 2021-04-30T17:27:53Z
Aliases: CVE-2021-26722

LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search bar.
bottle HTTP Request smuggling
Published: 2021-04-07T21:05:21Z
Aliases: CVE-2020-28473

The package bottle before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Logic error in authentication in proxy.py
Published: 2021-04-07T21:01:25Z
Aliases: CVE-2021-3116

before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
Stored cross-site scripting in Grid component in Vaadin 7 and 8
Published: 2021-04-19T14:49:48Z
Aliases: CVE-2019-25028

Missing variable sanitization in `Grid` component in `com.vaadin:vaadin-server` versions 7.4.0 through 7.7.19 (Vaadin 7.4.0 through 7.7.19), and 8.0.0 through 8.8.4 (Vaadin 8.0.0 through 8.8.4) allows attacker to inject malicious JavaScript via unspecified vector.

- https://vaadin.com/security/cve-2019-25028
Improper Input Validation in klona
Published: 2021-04-13T15:41:24Z
Aliases: CVE-2020-8125

Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
Regular expression denial of service (ReDoS) in EmailField component in Vaadin 14 and 15-17
Published: 2021-04-19T14:47:34Z
Aliases: CVE-2021-31405

Unsafe validation RegEx in `EmailField` component in `com.vaadin:vaadin-text-field-flow` versions 2.0.4 through 2.3.2 (Vaadin 14.0.6 through 14.4.3), and 3.0.0 through 4.0.2 (Vaadin 15.0.0 through 17.0.10) allows attackers to cause uncontrolled resource consumption by submitting malicious email addresses.

- https://vaadin.com/security/cve-2021-31405
Prototype Pollution in asciitable.js
Published: 2021-04-13T15:24:59Z
Aliases: CVE-2020-7771

The package asciitable.js before 1.0.3 is vulnerable to Prototype Pollution via the main function.

### PoC
```js
var a = require("asciitable.js"); 
var b = JSON.parse('{"__proto__":{"test":123}}'); 
a({},b); 
console.log({}.test)
```
Arbitrary Command Injection in portprocesses
Published: 2021-04-06T17:24:50Z
Aliases: CVE-2021-23348

### Impact

An Arbitrary Command Injection vulnerability was reported in `portprocesses` impacting versions <= 1.0.4.

### Example (Proof of Concept)

The following example demonstrates the vulnerability and will run `touch success` therefore creating a file named `success`.

```js
const portprocesses = require("portprocesses");

portprocesses.killProcess("$(touch success)");
```
Client TLS credentials sent raw to server in npm package nats
Published: 2021-04-06T17:32:38Z

Nats is a Node.js client for the NATS messaging system.

## Problem Description

_Preview versions_ of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials.

The _connection_ configuration options in these JavaScript-based implementations were fully serialized and sent to the server in the client's `CONNECT` message, immediately after TLS establishment.

The nats.js client supports Mutual TLS and the credentials for the TLS client key are included in the connection configuration options; disclosure of the client's TLS private key to the server has been observed.

Most authentication mechanisms are handled after connection, instead of as part of connection, so other authentication mechanisms are unaffected.
For clarity: NATS account NKey authentication **is NOT affected**.

Neither the nats.ws nor the nats.deno clients support Mutual TLS: the affected versions listed below are those where the logic flaw is
present.  We are including the nats.ws and nats.deno versions out of an abundance of caution, as library maintainers, but rate as minimal the likelihood of applications leaking sensitive data.


## Affected versions

### Security impact

* NPM package nats.js:
  + **mainline is unaffected**
  + beta branch is vulnerable from 2.0.0-201, fixed in 2.0.0-209

### Logic flaw

* NPM package nats.ws:
  + status: preview
  + flawed from 1.0.0-85, fixed in 1.0.0-111

* Deno repository https://github.com/nats-io/nats.deno
  + status: preview
  + flawed in all git tags prior to fix
  + fixed with git tag v1.0.0-9


## Impact

For deployments using TLS client certificates (for mutual TLS), private key material for TLS is leaked from the client application to the
server.  If the server is untrusted (run by a third party), or if the client application also disables TLS verification (and so the true identity of the server is unverifiable) then authentication credentials are leaked.

## Workaround

*None*

## Solution

Upgrade your package dependencies to fixed versions, and then reissue any TLS client credentials (with new keys, not just new certificates) and revoke the old ones.
Command Injection in async-git
Published: 2021-04-12T19:50:20Z
Aliases: CVE-2020-28490

The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: `git.reset('atouch HACKEDb')`
After order payment process manipulation in shopware/platform and shopware/core 
Published: 2021-04-13T15:13:48Z

### Impact

After order payment process manipulation

### Patches
We recommend to update to the current version 6.3.5.3. You can get the update to 6.3.5.3 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds

For older versions of 6.1 and 6.2, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.

https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-04-2021
OS Command Injection in rpi
Published: 2021-04-13T15:23:29Z
Aliases: CVE-2019-10796

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization.
Improper Input Validation in PyYAML
Published: 2021-04-20T16:14:24Z
Aliases: CVE-2020-1747

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Published: 2021-04-22T16:11:01Z
Aliases: CVE-2021-21427

### Impact
This vulnerability allows an administrator unauthorized access to restricted resources. 

We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html. 


### Patches
_Has the problem been patched? What versions should users upgrade to?_
> v20.0.9 v19.4.13
Exposure of Sensitive Information to an Unauthorized Actor in ansible
Published: 2021-04-20T16:43:53Z
Aliases: CVE-2020-1746

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the `bind_pw` in the parameters field. The highest threat from this vulnerability is data confidentiality.
Denial of Service in get-ip-range
Published: 2021-04-13T15:15:57Z
Aliases: CVE-2021-27191

The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion. Update get-ip-range dependency to 4.0.0 or above.
Open Redirect in autobahn
Published: 2021-04-20T16:13:45Z
Aliases: CVE-2020-35678

Autobahn|Python before 20.12.3 allows redirect header injection.
Improper Authentication in Apache Hadoop
Published: 2021-04-30T17:29:30Z
Aliases: CVE-2018-11765

In Apache Hadoop versions 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, 2.8.0 to 2.8.5, any users can access some servlets without authentication when Kerberos authentication is enabled and SPNEGO through HTTP is not enabled.
Improper Certificate Validation
Published: 2021-04-12T18:51:17Z
Aliases: CVE-2021-20327

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
Lack of Input Validation in zendesk_api_client_php for Zendesk Subdomain
Published: 2021-04-29T21:53:06Z
Aliases: CVE-2021-30492

### Impact
Lack of input validation of the Zendesk subdomain could expose users of the library to Server Side Request Forgery (SSRF).

### Resolution
Validate the provided Zendesk subdomain to be a valid subdomain in:
* getAuthUrl
* getAccessToken
Remote code execution in mongo-express
Published: 2021-04-13T15:41:01Z
Aliases: CVE-2020-24391

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
LDAP Injection in is-user-valid
Published: 2021-04-13T15:30:27Z
Aliases: CVE-2021-23335

All versions of package is-user-valid are vulnerable to LDAP Injection which can lead to either authentication bypass or information exposure.
Missing Authentication for Critical Function in Apache Calcite
Published: 2021-04-22T16:14:14Z
Aliases: CVE-2020-13955

"HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to man-in-the-middle attacks. Calcite uses this method internally to connect with Druid and Splunk so information leakage may happen when using the respective Calcite adapters. The method itself is in a utility class so people may use it to create vulnerable HTTPS connections for other applications. From Apache Calcite 1.26 onwards, the hostname verification will be performed using the default JVM truststore."
Improper Restriction of XML External Entity Reference in Plone
Published: 2021-04-07T21:14:00Z
Aliases: CVE-2020-28736

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).