aswin1906/github-advisory-2021.csv huggingface dataset:
Sylius PayPal Plugin allows unauthorized access to Credit card form, exposing payer name and not requiring 3DS
Published: 2021-10-06T17:49:11Z
Aliases: CVE-2021-41120

### Impact
URL to the payment page done after checkout was created with autoincremented payment id (`/pay-with-paypal/{id}`) and therefore it was easy to access for anyone, not even the order's customer. The problem was, the Credit card form has prefilled "credit card holder" field with the Customer's first and last name.
Additionally, the mentioned form did not require a 3D Secure authentication, as well as did not checked the result of the 3D Secure authentication.

### Patches
The problem has been patched in Sylius/PayPalPlugin **1.2.4** and **1.3.1**

### Workarounds
One can override a `sylius_paypal_plugin_pay_with_paypal_form` route and change its URL parameters to (for example) `{orderToken}/{paymentId}`, then override the `Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction` service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method.
Additionally, one could override the `@SyliusPayPalPlugin/payWithPaypal.html.twig` template, to add `contingencies: ['SCA_ALWAYS']` line in `hostedFields.submit(...)` function call (line 421). It would then have to be handled in the function callback.

### For more information
If you have any questions or comments about this advisory:
- Open an issue in Sylius/PayPalPlugin issues
- Email us at security at sylius dot com
HTTP authentication credentials potentially leaked to target websites 
Published: 2021-10-06T17:46:22Z
Aliases: CVE-2021-41125

### Impact

If you use [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth) (i.e. the `http_user` and `http_pass` spider attributes) for HTTP authentication, all requests will expose your credentials to the request target.

This includes requests generated by Scrapy components, such as `robots.txt` requests sent by Scrapy when the `ROBOTSTXT_OBEY` setting is set to `True`, or as requests reached through redirects.

### Patches

Upgrade to Scrapy 2.5.1 and use the new `http_auth_domain` spider attribute to control which domains are allowed to receive the configured HTTP authentication credentials.

If you are using Scrapy 1.8 or a lower version, and upgrading to Scrapy 2.5.1 is not an option, you may upgrade to Scrapy 1.8.1 instead.

### Workarounds

If you cannot upgrade, set your HTTP authentication credentials on a per-request basis, using for example the [`w3lib.http.basic_auth_header`](https://w3lib.readthedocs.io/en/latest/w3lib.html#w3lib.http.basic_auth_header) function to convert your credentials into a value that you can assign to the `Authorization` header of your request, instead of defining your credentials globally using [`HttpAuthMiddleware`](http://doc.scrapy.org/en/latest/topics/downloader-middleware.html#module-scrapy.downloadermiddlewares.httpauth).

### For more information
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/scrapy/scrapy/issues)
* [Email us](mailto:opensource@zyte.com)
Verification check bypass in Gate One
Published: 2021-10-12T22:34:28Z
Aliases: CVE-2020-19003

An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.
Cross-site Scripting in jsoneditor
Published: 2021-10-12T16:22:30Z
Aliases: CVE-2020-23849

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.
Cross-Site Request Forgery in firefly-iii
Published: 2021-10-28T23:14:14Z
Aliases: CVE-2021-3901

firefly-iii is vulnerable to Cross-Site Request Forgery (CSRF).
XSS in the `of` option of the `.position()` util in jquery-ui
Published: 2021-10-26T14:55:12Z
Aliases: CVE-2021-41184

### Impact
Accepting the value of the `of` option of the [`.position()`](https://api.jqueryui.com/position/) util from untrusted sources may execute untrusted code. For example, invoking the following code:
```js
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='doEvilThing()' src='/404' />",
	collision: "none"
} );
```
will call the `doEvilThing()` function.

### Patches
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector.

### Workarounds
A workaround is to not accept the value of the `of` option from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
Prototype pollution vulnerability in 'deepref'
Published: 2021-10-12T16:27:35Z
Aliases: CVE-2020-28274

Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.
Client metadata path-traversal
Published: 2021-10-19T20:14:36Z
Aliases: CVE-2021-41131

### Impact
In both clients (`tuf/client` and `tuf/ngclient`), there is a path traversal vulnerability that in the worst case can overwrite files ending in `.json` anywhere on the client system on a call to `get_one_valid_targetinfo()`. It occurs because the rolename is used to form the filename, and may contain path traversal characters (ie `../../name.json`).

The impact is mitigated by a few facts:
* It only affects implementations that allow arbitrary rolename selection for delegated targets metadata
* The attack requires the ability to A) insert new metadata for the path-traversing role and B) get the role delegated by an existing targets metadata
* The written file content is heavily restricted since it needs to be a valid, signed targets file. The file extension is always .json.

### Patches
A fix is available in version 0.19 or newer.

### Workarounds
None that do not require code changes. Clients can restrict the allowed character set for rolenames, or they can store metadata in files named in a way that is not vulnerable: neither of these approaches is possible without modifying python-tuf.

### References
- [The issue where this was discovered](https://github.com/theupdateframework/python-tuf/issues/1527)
- [Proof of Concept demonstrating the flaw](https://github.com/jku/path-traversal-poc)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [python-tuf](https://github.com/theupdateframework/python-tuf/issues)
* Contact the maintainers by email or Slack
Cross site scripting in froala-editor
Published: 2021-10-28T23:14:06Z
Aliases: CVE-2020-22864

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.
Reachable Assertion in OpenCV.
Published: 2021-10-12T22:03:41Z
Aliases: CVE-2018-5269

In OpenCV 3.3.1 (corresponds with OpenCV-Python 3.3.1.11), an assertion failure happens in cv::RBaseStream::setPos in modules/imgcodecs/src/bitstrm.cpp because of an incorrect integer cast.
Inadequate Encryption Strength in python-keystoneclient
Published: 2021-10-12T16:31:43Z
Aliases: CVE-2013-2166

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass.
Out-of-bounds Read in OpenCV
Published: 2021-10-12T22:03:23Z
Aliases: CVE-2017-18009

In OpenCV 3.3.1 (corresponding with OpenCV-Python 3.3.1.11), a heap-based buffer over-read exists in the function cv::HdrDecoder::checkSignature in modules/imgcodecs/src/grfmt_hdr.cpp.
Cross-site Scripting in Limesurvey
Published: 2021-10-12T16:40:28Z
Aliases: CVE-2021-42112

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
Cobbler before 3.3.0 allows authorization bypass for modification of settings.
Published: 2021-10-05T17:53:29Z
Aliases: CVE-2021-40325

Cobbler before 3.3.0 allows authorization bypass for modification of settings.
SQL Injection and Cross-site Scripting in class-validator
Published: 2021-10-12T16:35:45Z
Aliases: CVE-2019-18413

In TypeStack class-validator, `validate()` input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional `forbidUnknownValues` parameter that can be used to reduce the risk of this bypass, this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability, attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input.

The default settings for `forbidUnknownValues` has been changed to `true` in 0.14.0.

NOTE: a software maintainer agrees with the "is not documented" finding but suggests that much of the responsibility for the risk lies in a different product.
Cross-site Scripting in XXL-JOB
Published: 2021-10-12T16:41:36Z
Aliases: CVE-2020-29204

XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java.
Cross-site Scripting in PiranhaCMS
Published: 2021-10-27T18:53:03Z
Aliases: CVE-2021-25977

In PiranhaCMS, versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title, a low privileged user can trigger arbitrary JavaScript execution.
OS Command Injection in ftpd
Published: 2021-10-12T22:33:59Z
Aliases: CVE-2013-2512

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
ASP.NET Core Denial of Service Vulnerability
Published: 2021-10-06T00:23:01Z
Aliases: CVE-2021-31957

# Withdrawn

This advisory was initially published and mapped incorrectly to nuget `Microsoft.NETCore.App.Ref`. We later reanalyzed this advisory and found it does not have a direct mapping to a NuGet package.  Thus we have withdrawn this advisory.

The underlying ASP.NET Core Denial of Service Vulnerability and CVE-2021-31957 remain legitimate.

# Description.

Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 5.0 and .NET Core 3.1. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability.

A denial of service vulnerability exists when ASP.NET Core improperly handles client disconnect. An attacker who successfully exploited this vulnerability could cause a denial of service against an ASP.NET Core web application. The vulnerability can be exploited remotely, without authentication.


### Patches

* If you're using .NET 5.0, you should download and install Runtime 5.0.7 or SDK 5.0.204 (for Visual Studio 2019 v16.8) or SDK 5.0.301 (for Visual Studio 2019 16.10) from https://dotnet.microsoft.com/download/dotnet-core/5.0.

* If you're using .NET Core 3.1, you should download and install Runtime 3.1.16 or SDK 3.1.116 (for Visual Studio 2019 v16.4) or 3.1.410 (for Visual Studio 2019 v16.5 or later) from https://dotnet.microsoft.com/download/dotnet-core/3.1.



#### Other Details

- Announcement for this issue can be found at https://github.com/dotnet/announcements/issues/188
- An Issue for this can be found at https://github.com/dotnet/aspnetcore/issues/33369
- MSRC details for this can be found at https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-31957
Improper Input Validation in Jakarta Expression Language
Published: 2021-10-06T17:48:38Z
Aliases: CVE-2021-28170

In the Jakarta Expression Language implementation 3.0.3 and earlier, a bug in the ELParserTokenManager enables invalid EL expressions to be evaluated as if they were valid.
Code injection in Kubernetes Java Client
Published: 2021-10-12T17:50:25Z
Aliases: CVE-2021-25738

Loading specially-crafted yaml with the Kubernetes Java Client library can lead to code execution.
Exposure of Sensitive Information to an Unauthorized Actor in Moodle
Published: 2021-10-21T17:49:08Z
Aliases: CVE-2020-25703

The participants table download in Moodle always included user emails, but should have only done so when users' emails are not hidden. Versions affected: 3.9 to 3.9.2, 3.8 to 3.8.5 and 3.7 to 3.7.8. This is fixed in moodle 3.9.3, 3.8.6, 3.7.9, and 3.10.
Specification non-compliance in JUMPI
Published: 2021-10-19T15:28:35Z
Aliases: CVE-2021-41153

### Impact 

In `evm` crate `< 0.31.0`, `JUMPI` opcode's condition is checked after the destination validity check. However, according to Geth and OpenEthereum, the condition check should happen before the destination validity check.

### Patches

This is a **high** severity security advisory if you use `evm` crate for Ethereum mainnet. In this case, you should update your library dependency immediately to on or after `0.31.0`.

This is a **low** severity security advisory if you use `evm` crate in Frontier or in a standalone blockchain, because there's no security exploit possible with this advisory. It is **not** recommended to update to on or after `0.31.0` until all the normal chain upgrade preparations have been done. If you use Frontier or other `pallet-evm` based Substrate blockchain, please ensure to update your `spec_version` before updating this. For other blockchains, please make sure to follow a hard-fork process before you update this.

### Workarounds

If you are dependent on an older version of `evm` and cannot update due to API interface changes, please contact Wei by email (wei@that.world), who will be happy to help you to publish patch releases for older `evm` versions.

### References

Fix PR: https://github.com/rust-blockchain/evm/pull/67

### For more information

If you have any questions or comments about this advisory:
* Open an issue in the `evm` repo.

### Special thanks

Special thanks to @rakita for reporting this issue.
Denial of service in DataCommunicator class in Vaadin 8
Published: 2021-10-13T18:54:50Z

Missing check in `DataCommunicator` class in `com.vaadin:vaadin-server` versions 8.0.0 through 8.14.0 (Vaadin 8.0.0 through 8.14.0) allows authenticated network attacker to cause heap exhaustion by requesting too many rows of data.
Maliciously Crafted Model Archive Can Lead To Arbitrary File Write
Published: 2021-10-22T16:19:13Z
Aliases: CVE-2021-41127

### Impact
An Archive Extraction (Zip Slip) vulnerability in the functionality that allows a user to load a trained model archive in Rasa 2.8.9 and older allows an attacker arbitrary write capability within specific directories using a malicious crafted archive file.

### Patches
The vulnerability is fixed in Rasa 2.8.10

### Workarounds
Mitigating steps for vulnerable end users are to ensure that they do not upload untrusted model files, and restrict CLI or API endpoint access where a malicious actor could target a deployed Rasa instance.

### For more information
If you have any questions or comments about this advisory:
* Email [the Rasa Security Team](mailto:security@rasa.com)
Out-of-bounds Read in OpenCV 
Published: 2021-10-12T22:00:51Z
Aliases: CVE-2017-12598

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has an out-of-bounds read error in the cv::RBaseStream::readBlock function in modules/imgcodecs/src/bitstrm.cpp when reading an image file by using cv::imread, as demonstrated by the 8-opencv-invalid-read-fread test case.
SilverStripe GraphQL Server permission checker not inherited by query subclass.
Published: 2021-10-12T18:49:23Z
Aliases: CVE-2021-28661

Default SilverStripe GraphQL Server (aka silverstripe/graphql) 3.x through 3.4.1 permission checker not inherited by query subclass.
Prototype pollution in getobject
Published: 2021-10-12T16:26:37Z
Aliases: CVE-2020-28282

Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
CSV Injection Vulnerability
Published: 2021-10-18T19:04:16Z
Aliases: CVE-2021-41824

### Impact
In some circumstances, it was possible to export data in CSV format that could trigger a payload in old versions of Excel.

If you are accepting user input from untrusted sources and will be exporting that data in CSV format from element index pages and there is a chance users will open that on old versions of Excel, then you should update.

### Patches
This has been patched in Craft 3.7.14.

### References
* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3714---2021-09-28
* https://twitter.com/craftcmsupdates/status/1442928690145366018

### For more information

If you have any questions or comments about this advisory, email us at support@craftcms.com

----------

Credits: BAE Systems AI Vulnerability Research Team – Azrul Ikhwan Zulkifli
missing clamps for decimal args in external functions
Published: 2021-10-06T17:48:46Z
Aliases: CVE-2021-41122

### Impact

The following code does not properly validate that its input is in bounds.

```python
@external
def foo(x: decimal) -> decimal:
    return x
```

### Patches
0.3.0 / #2447

### Workarounds
Don't use decimal args
Denial of Service (DoS) in mongo-express
Published: 2021-10-06T17:47:46Z
Aliases: CVE-2021-23372

All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.
XML External Entity Reference in org.opencms:opencms-core
Published: 2021-10-12T17:23:40Z
Aliases: CVE-2021-3312

An XML external entity (XXE) vulnerability in Alkacon OpenCms 11.0, 11.0.1 and 11.0.2 allows remote authenticated users with edit privileges to exfiltrate files from the server's file system by uploading a crafted SVG document.
Critical severity vulnerability in Ignition
Published: 2021-10-12T16:29:13Z
Aliases: CVE-2020-13909

The Ignition page before version 2.0.5 for Laravel mishandles globals, _get, _post, _cookie, and _env.

NOTE: in the 1.x series, versions 1.16.15 and later are unaffected as a consequence of the CVE-2021-43996 fix.
Remote code execution in ruby-jss
Published: 2021-10-06T17:48:27Z
Aliases: CVE-2021-33575

The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.load during XML document processing.
Integer Overflow or Wraparound in OpenCV.
Published: 2021-10-12T22:03:32Z
Aliases: CVE-2017-1000450

In opencv/modules/imgcodecs/src/utils.cpp, functions FillUniColor and FillUniGray do not check the input length, which can lead to integer overflow. If the image is from remote, may lead to remote code execution or denial of service. This affects Opencv 3.3 (corresponding with OpenCV-Python 3.3.0.9) and earlier.
Cross-site scripting in Unicorn framework
Published: 2021-10-12T17:51:11Z
Aliases: CVE-2021-42053

The Unicorn framework through 0.35.3 for Django allows XSS via component.name.
Cross-site Scripting in SilverStripe Framework
Published: 2021-10-12T18:42:30Z
Aliases: CVE-2021-36150

SilverStripe Framework through 4.8.1 allows XSS.
Authz Module Non-Determinism
Published: 2021-10-21T17:46:57Z
Aliases: CVE-2021-41135

### Impact

Consensus failure for 0.43.x and 0.44.{0,1} users. 
Funds and balances are safe.

### Patches

0.44.2

### Workarounds

Manually patch the code.

---

Full details posted in https://forum.cosmos.network/t/cosmos-sdk-vulnerability-retrospective-security-advisory-jackfruit-october-12-2021/5349.
Cross-site Scripting in shuup
Published: 2021-10-04T20:11:03Z
Aliases: CVE-2021-25963

In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.
Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV
Published: 2021-10-12T22:02:21Z
Aliases: CVE-2017-12862

In modules/imgcodecs/src/grfmt_pxm.cpp, the length of buffer AutoBuffer _src is small than expected, which will cause copy buffer overflow later. If the image is from remote, may lead to remote code execution or denial of service. This affects OpenCV 3.3 (corresponding to OpenCV-Python 3.3.0.9) and earlier.
OS Command Injection in node-opencv
Published: 2021-10-12T22:06:57Z
Aliases: CVE-2019-10061

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
Denial of Service in OpenCV
Published: 2021-10-12T22:01:16Z
Aliases: CVE-2017-12600

OpenCV (Open Source Computer Vision Library) through 3.3 (corresponding to OpenCV-Python 3.3.0.9) has a denial of service (CPU consumption) issue, as demonstrated by the 11-opencv-dos-cpu-exhaust test case.
Deleted Admin Can Sign In to Admin Interface
Published: 2021-10-06T17:46:40Z
Aliases: CVE-2021-41126

### Impact
Assuming an administrator once had previous access to the admin interface, they may still be able to sign in to the backend using October CMS v2.0.

### Patches
The issue has been patched in v2.1.12

### Workarounds

- Reset the password of the deleted accounts to prevent them from signing in.

- Please contact hello@octobercms.com for code change instructions if you are unable to upgrade.

### References

Credits to:
• Daniel Bidala

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)
Cross-site scripting in forkcms
Published: 2021-10-25T19:43:05Z
Aliases: CVE-2020-23049

Fork CMS Content Management System v5.8.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the `Displayname` field when using the `Add`, `Edit` or `Register' functions. This vulnerability allows attackers to execute arbitrary web scripts or HTML.
Cross-site scripting vulnerability in TinyMCE
Published: 2021-10-22T16:24:02Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the schema validation logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or editor APIs. This malicious content could then end up in content published outside the editor, if no server-side sanitization was performed. This impacts all users who are using TinyMCE 5.8.2 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.9.0 by ensuring schema validation was still performed after unwrapping invalid elements.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.9.0 or higher
- Manually sanitize the content using the `BeforeSetContent` event (see below)

#### Example: Manually sanitize content
```js
editor.on('BeforeSetContent', function(e) {
  var sanitizedContent = ...; // Manually sanitize content here
  e.content = sanitizedContent;
});
```

### Acknowledgements
Tiny Technologies would like to thank William Bowling for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes59/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
Improper Restriction of Excessive Authentication Attempts in py-bcrypt
Published: 2021-10-12T16:31:22Z
Aliases: CVE-2013-1895

The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.