aswin1906/github-advisory-2022 huggingface dataset:
Unprivileged pod using `hostPath` can side-step active LSM when it is SELinux
Advisory: GHSA-mvff-h3cj-wj9c
Aliases: CVE-2021-43816
Published: 2022-01-06T17:36:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

### Impact

Containers launched through containerd’s CRI implementation on Linux systems which use the SELinux security module and containerd versions since v1.5.0 can cause arbitrary files and directories on the host to be relabeled to match the container process label through the use of specially-configured bind mounts in a hostPath volume. This relabeling elevates permissions for the container, granting full read/write access over the affected files and directories. Kubernetes and crictl can both be configured to use containerd’s CRI implementation.

If you are not using containerd’s CRI implementation (through one of the mechanisms described above), you are not affected by this issue.

### Patches

This bug has been fixed in containerd 1.5.9.  Because file labels persist independently of containerd, users should both update to these versions as soon as they are released and validate that all files on their host are correctly labeled.

### Workarounds

Ensure that no sensitive files or directories are used as a hostPath volume source location.  Policy enforcement mechanisms such a Kubernetes Pod Security Policy [AllowedHostPaths](https://kubernetes.io/docs/concepts/policy/pod-security-policy/#volumes-and-file-systems) may be specified to limit the files and directories that can be bind-mounted to containers.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [containerd](https://github.com/containerd/containerd/issues/new/choose)
* Email us at [security@containerd.io](mailto:security@containerd.io)
Path traversal vulnerability in Jenkins Publish Over SSH Plugin
Advisory: GHSA-j8rg-4hjm-8r95
Aliases: CVE-2022-23113
Published: 2022-01-13T00:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins Publish Over SSH Plugin 1.22 and earlier performs a validation of the file name specifying whether it is present or not, resulting in a path traversal vulnerability allowing attackers with Item/Configure permission to discover the name of the Jenkins controller files.
Incorrect Permission Assignment for Critical Resource in Jenkins Mailer Plugin
Advisory: GHSA-558x-h7rg-997v
Aliases: CVE-2022-20614
Published: 2022-01-13T00:01:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Jenkins Mailer Plugin prior to 408.vd726a_1130320 and 1.34.2 does not perform a permission check in a method implementing form validation.

This allows attackers with Overall/Read access to use the DNS used by the Jenkins instance to resolve an attacker-specified hostname.

Additionally, this form validation method does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.

Mailer Plugin 408.vd726a_1130320 and 1.34.2 requires POST requests and Overall/Administer permission for the affected form validation method.
Agent-to-controller security bypass in Jenkins Debian Package Builder Plugin
Advisory: GHSA-8xjp-rp29-v5j8
Aliases: CVE-2022-23118
Published: 2022-01-13T00:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agent processes to invoke command-line git at an attacker-specified path on the controller.

This allows attackers able to control agent processes to invoke arbitrary OS commands on the controller.
Log entry injection in Spring Framework
Advisory: GHSA-6gf2-pvqw-37ph
Aliases: CVE-2021-22060
Published: 2022-01-12T23:04:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In Spring Framework versions 5.3.0 - 5.3.13, 5.2.0 - 5.2.18, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries. This is a follow-up to CVE-2021-22096 that protects against additional types of input and in more places of the Spring Framework codebase.
Out-of-bounds Write in actix-web
Advisory: GHSA-7x36-h62w-vw65
Aliases: CVE-2018-25026
Published: 2022-01-06T22:18:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the actix-web crate before 0.7.15 for Rust. It can add the Send marker trait to an object that cannot be sent between threads safely, leading to memory corruption.
livehelperchat is vulnerable to Cross-site Scripting
Advisory: GHSA-f7xw-46vh-5jw2
Aliases: CVE-2021-4132
Published: 2022-01-05T20:33:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
RCE in H2 Console
Advisory: GHSA-h376-j262-vhq6
Aliases: CVE-2021-42392
Published: 2022-01-06T23:55:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

### Impact
H2 Console in versions since 1.1.100 (2008-10-14) to 2.0.204 (2021-12-21) inclusive allows loading of custom classes from remote servers through JNDI.

H2 Console doesn't accept remote connections by default. If remote access was enabled explicitly and some protection method (such as security constraint) wasn't set, an intruder can load own custom class and execute its code in a process with H2 Console (H2 Server process or a web server with H2 Console servlet).

It is also possible to load them by creation a linked table in these versions, but it requires `ADMIN` privileges and user with `ADMIN` privileges has full access to the Java process by design. These privileges should never be granted to untrusted users.

### Patches
Since version 2.0.206 H2 Console and linked tables explicitly forbid attempts to specify LDAP URLs for JNDI. Only local data sources can be used.

### Workarounds
H2 Console should never be available to untrusted users.

`-webAllowOthers` is a dangerous setting that should be avoided.

H2 Console Servlet deployed on a web server can be protected with a security constraint:
https://h2database.com/html/tutorial.html#usingH2ConsoleServlet
If `webAllowOthers` is specified, you need to uncomment and edit `<security-role>` and `<security-constraint>` as necessary. See documentation of your web server for more details.

### References
This issue was found and privately reported to H2 team by [JFrog Security](https://www.jfrog.com/)'s vulnerability research team with detailed information.
Improper Validation and Sanitization in url-parse
Advisory: GHSA-46c4-8wrp-j99v
Aliases: CVE-2020-8124
Published: 2022-01-06T20:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
Improper Restriction of XML External Entity Reference in Apache NiFi
Advisory: GHSA-q4xf-3pmq-3hw8
Aliases: CVE-2020-13940
Published: 2022-01-06T20:41:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

In Apache NiFi 1.0.0 to 1.11.4, the notification service manager and various policy authorizer and user group provider objects allowed trusted administrators to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE).
Cross-site Scripting in LiveHelperChat
Advisory: GHSA-54qq-9chj-rxhv
Aliases: CVE-2022-0395
Published: 2022-01-29T00:00:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

LiveHelperChat prior to version 3.93 contains a cross-site scripting vulnerability.
Exposure of Sensitive Information to an Unauthorized Actor in microweber
Advisory: GHSA-7wv8-g97r-432h
Aliases: CVE-2022-0281
Published: 2022-01-21T18:06:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
Use of Uninitialized Resource in messagepack-rs.
Advisory: GHSA-vw5m-qw2r-m923
Aliases: CVE-2021-45690
Published: 2022-01-06T22:11:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the messagepack-rs crate through 2021-01-26 for Rust. deserialize_binary may read from uninitialized memory locations.
Improper Handling of Insufficient Permissions or Privileges in MySQL Connectors Java
Advisory: GHSA-g76j-4cxx-23h9
Aliases: CVE-2022-21363
Published: 2022-01-20T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.27 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).
Out-of-bounds Read in Onionshare
Advisory: GHSA-x7wr-283h-5h2v
Aliases: CVE-2022-21688
Published: 2022-01-21T23:20:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-014
- Vulnerability type: Out-of-bounds Read
- Threat level: Elevated

## Description:

The desktop application was found to be vulnerable to denial of service via an undisclosed vulnerability in the QT image parsing.

## Technical description:

Prerequisites:

- Onion address is known
- Public service or authentication is valid
- Desktop application is used
- History is displayed

The rendering of images found in OTF-001 (page 25) could be elevated to a Denial of Service, which requires only very few bytes to be sent as a path parameter to any of the Onionshare functions. Roughly 20 bytes lead to 2GB memory consumption and this can be triggered multiple times. To be abused, this vulnerability requires rendering in the history tab, so some user interaction is required. The issue is in the process of disclosure to the QT security mailing list. More details will be provided after a fixed QT build has been deployed.

## Impact:

An adversary with knowledge of the Onion service address in public mode or with authentication in private mode can perform a Denial of Service attack, which quickly results in out-of-memory for the server. This requires the desktop application with rendered history, therefore the impact is only elevated.

## Recommendation:

- Monitor for upstream fix
- Fix OTF-001 (page 25) as a workaround
Use of a Broken or Risky Cryptographic Algorithm in Max Mazurov Maddy
Advisory: GHSA-5r5w-h76p-m726
Aliases: CVE-2021-42583
Published: 2022-01-06T22:20:53Z

A Broken or Risky Cryptographic Algorithm exists in Max Mazurov Maddy before 0.5.2, which is an unnecessary risk that may result in the exposure of sensitive information.
Improper Access Control in Onionshare
Advisory: GHSA-99p8-9p2c-49j4
Aliases: CVE-2022-21695
Published: 2022-01-21T23:20:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-009
- Vulnerability type: Improper Access Control
- Threat level: Low

## Description:

Authenticated users (or unauthenticated in public mode) can send messages without being visible in the list of chat participants.

## Technical description:

Prerequisites:

- Existing chatroom
- Access to the chatroom (Public or known Private Key)
- Either a modified frontend client or manual requests from burp/curl

If a user opens the chatroom without emitting the join message he will not be present in session.users[x] list. Therefore there is no listing in the frontend and no chat participant knows another party joined the chat. It is still possible to send messages in the chatroom.

If a user decides to abuse OTF-003 (page 22) he can impersonate messages from existing users; others would not be able to distinguish original and faked messages. This is also a prerequisite for OTF-004 (page 19).

## Impact:

An adversary with access to the chat environment can send messages to the chat without being visible in the list of chat participants.

## Recommendation:

- Allow chat access only after emission of the join event.
- Implement proper session handling.
Cross Site Request Forgery in Moodle
Advisory: GHSA-xpfv-89vg-r562
Aliases: CVE-2022-0335
Published: 2022-01-28T22:07:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Use of Uninitialized Resource in smallvec
Advisory: GHSA-55m5-whcv-c49c
Aliases: CVE-2018-25023
Published: 2022-01-06T22:20:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions of this crate called mem::uninitialized() to create values of a user-supplied type T. This is unsound e.g. if T is a reference type (which must be non-null and thus may not remain uninitialized). The flaw was corrected by avoiding the use of mem::uninitialized(), using MaybeUninit instead.
Cross-site Scripting (XSS) in Apache Ambari Views
Advisory: GHSA-q7q9-w24q-cpgh
Aliases: CVE-2020-1936
Published: 2022-01-06T20:35:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

A cross-site scripting issue was found in Apache Ambari Views. This was addressed in Apache Ambari 2.7.4.
Use After Free in libpulse-binding
Advisory: GHSA-hxjf-h2mh-r6hj
Aliases: CVE-2018-25027
Published: 2022-01-06T22:20:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected versions contained a pair of use-after-free issues with the objects returned by the get_format_info and get_context methods of Stream objects. These objects were mistakenly being constructed without setting an important flag to prevent destruction of the underlying C objects they reference upon their own destruction.
Arbitrary file upload in Mingsoft MCMS
Advisory: GHSA-fr5w-98mc-jjvg
Aliases: CVE-2022-23315
Published: 2022-01-22T00:00:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

MCMS v5.2.4 was discovered to contain an arbitrary file upload vulnerability via the component `/ms/template/writeFileContent.do`.
Microweber Incorrect Permission Assignment for Critical Resource vulnerability
Advisory: GHSA-vcgf-vmpc-ph79
Aliases: CVE-2022-0277
Published: 2022-01-21T18:06:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

In Microweber prior to 1.2.11, a non-admin user is able to access other users' sensitive information.
Improper Privilege Management in shelljs
Advisory: GHSA-4rq4-32rv-6wp6
Aliases: CVE-2022-0144
Published: 2022-01-21T23:37:28Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

shelljs is vulnerable to Improper Privilege Management
Improper credentials masking in Jenkins HashiCorp Vault Plugin
Advisory: GHSA-h6x7-jq46-fp33
Aliases: CVE-2022-23109
Published: 2022-01-13T00:00:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Jenkins HashiCorp Vault Plugin 3.7.0 and earlier does not mask Vault credentials in Pipeline build logs or in Pipeline step descriptions when Pipeline: Groovy Plugin 2.85 or later is installed.
NLTK Vulnerable to REDoS
Advisory: GHSA-rqjh-jp2r-59cj
Aliases: CVE-2021-3842
Published: 2022-01-06T22:24:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NLTK is vulnerable to REDoS in some RegexpTaggers used in the functions `get_pos_tagger` and `malt_regex_tagger`.
Files on the host computer can be accessed from the Gradio interface
Advisory: GHSA-rhq2-3vr9-6mcr
Aliases: CVE-2021-43831
Published: 2022-01-21T23:43:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

### Impact
This is a vulnerability that affects anyone who creates and publicly shares Gradio interfaces using `gradio<2.4.8`. Because of the way that static files were being served, someone who generated a public Gradio link and shared it with others would potentially be exposing the files on the computer that generated the link, while the link was active. An attacker would be able to view the contents of a file on the computer if they knew the exact relative filepath. We do not have any evidence that this was ever exploited, but we treated the issue seriously and immediately took steps to mitigate it (see below)

### Response
1. We worked with @haby0 to immediately patch the issue and released a new version, `gradio 2.5.0`, within 24 hours of the issue being brought to our attention 
2. We enabled a notification that is printed to anyone using an older version of gradio telling them to upgrade (see screenshot below)
3. We expanded our test suite to test for this vulnerability ensuring that our patch does not get reverted in future releases of `gradio`

![image](https://user-images.githubusercontent.com/1778297/146251425-f36b519b-6d4a-4dfb-8d89-c1ed005979d3.png)

### Patches
The problem has been patched in `gradio>=2.5.0`.
invoiceninja is vulnerable to Cross-site Scripting
Advisory: GHSA-xg6r-5gx4-qxjm
Aliases: CVE-2021-3977
Published: 2022-01-06T21:58:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Missing Authorization in Crater Invoice
Advisory: GHSA-xh9g-cp3v-p8q4
Aliases: CVE-2022-0203
Published: 2022-01-27T00:01:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Crater Invoice prior to version 6.0.2 has a missing authorization vulnerability..
Command Injection in node-windows
Advisory: GHSA-53xv-c2hx-5w6q
Aliases: CVE-2021-45459
Published: 2022-01-05T20:39:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.
Regular Expression Denial of Service (ReDoS) in braces
Advisory: GHSA-cwfw-4gq5-mrqx
Aliases: CVE-2018-1109
Published: 2022-01-06T20:42:03Z

A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Denial of Service in ckb
Advisory: GHSA-cw98-cx2m-9qqg
Aliases: CVE-2021-45700
Published: 2022-01-06T22:10:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the ckb crate before 0.40.0 for Rust. Attackers can cause a denial of service (Nervos CKB blockchain node crash) via a dead call that is used as a DepGroup.
Mingsoft MCMS SQL injection vulnerability
Advisory: GHSA-phwq-9gc4-q5c8
Aliases: CVE-2021-46385
Published: 2022-01-27T00:00:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mingsoft MCMS contains a SQL injection vulnerability in the `/querydata` endpoint
Injection in UserFrosting
Advisory: GHSA-cv25-3gmg-c6m8
Aliases: CVE-2021-25994
Published: 2022-01-06T22:22:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

In Userfrosting, versions v0.3.1 to v4.6.2 are vulnerable to Host Header Injection. By luring a victim application user to click on a link, an unauthenticated attacker can use the “forgot password” functionality to reset the victim’s password and successfully take over their account.
Denial of Service Vulnerability in next.js
Advisory: GHSA-wr66-vrwm-5g5x
Aliases: CVE-2022-21721
Published: 2022-01-28T23:09:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version >= 12.0.0, and using i18n functionality.

- **Affected:** All of the following must be true to be affected by this CVE
  - Next.js versions above v12.0.0
  - Using next start or a custom server
  - Using the built-in i18n support
- **Not affected:**
  - Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

### Patches

A patch has been released, `next@12.0.9`, that mitigates this issue. We recommend all affected users upgrade as soon as possible.

### Workarounds

We recommend upgrading whether you can reproduce or not although you can ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until you upgrade.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [next](https://github.com/vercel/next.js)
* Email us at [security@vercel.com](mailto:security@vercel.com)
Cross-site Scripting in livehelperchat
Advisory: GHSA-8wcc-f2vq-h4gx
Aliases: CVE-2022-0370
Published: 2022-01-28T23:06:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Stored XSS is found in Settings>Live help configuration>Personal Theme>static content. Under the NAME field put a payload {{constructor.constructor('alert(1)')()}} while creating content, and you will see that the input gets stored, and every time the user visits, the payload gets executed.
Prototype Pollution in min-dash
Advisory: GHSA-fm93-fhh2-cg2c
Aliases: CVE-2021-23460
Published: 2022-01-27T14:21:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
Abomonation transmutes &T to and from &[u8] without sufficient constraints
Advisory: GHSA-5vwc-r48g-wj6c
Aliases: CVE-2021-45708
Published: 2022-01-06T22:08:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

An issue was discovered in the abomonation crate through version 0.7.3 for Rust. Because transmute operations are insufficiently constrained, there can be an information leak or ASLR bypass.
SQL Injection in JeecgBoot
Advisory: GHSA-26hm-r6mg-963c
Aliases: CVE-2021-46089
Published: 2022-01-26T00:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges. A patch has been released on the repository's `master` branch.
Use After Free in tremor-script
Advisory: GHSA-9qvw-46gf-4fv8
Aliases: CVE-2021-45702
Published: 2022-01-06T22:09:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in the tremor-script crate before 0.11.6 for Rust. A merge operation may result in a use-after-free.
Improper Input Validation and Injection in Apache Log4j2
Advisory: GHSA-8489-44mv-ggj8
Aliases: CVE-2021-44832
Published: 2022-01-04T16:14:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.


# Affected packages
Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.

This issue does not impact default configurations of Log4j2 and requires an attacker to have control over the Log4j2 configuration, which reduces the likelihood of being exploited.
Open Redirect in node-forge
Advisory: GHSA-8fr3-hfg3-gpgp
Aliases: CVE-2022-0122
Published: 2022-01-21T23:36:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

parseUrl functionality in node-forge mishandles certain uses of backslash such as `https:/\/\/\` and interprets the URI as a relative path.
Incorrect Authorization in calibreweb
Advisory: GHSA-vgmw-9cww-qq99
Aliases: CVE-2022-0273
Published: 2022-01-31T00:00:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

calibreweb prior to version 0.6.16 contains an Incorrect Authorization vulnerability.
Inefficient Regular Expression Complexity in marked
Advisory: GHSA-5v2h-r2cx-5xgj
Aliases: CVE-2022-21681
Published: 2022-01-14T21:04:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact

_What kind of vulnerability is it?_

Denial of service.

The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings.
PoC is the following.

```javascript
import * as marked from 'marked';

console.log(marked.parse(`[x]: x

\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](\\[\\](`));
```

_Who is impacted?_

Anyone who runs untrusted markdown through marked and does not use a worker with a time limit.

### Patches

_Has the problem been patched?_

Yes

_What versions should users upgrade to?_

4.0.10

### Workarounds

_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not run untrusted markdown through marked or run marked on a [worker](https://marked.js.org/using_advanced#workers) thread and set a reasonable time limit to prevent draining resources.

### References

_Are there any links users can visit to find out more?_

- https://marked.js.org/using_advanced#workers
- https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [marked](https://github.com/markedjs/marked)
Cross-site Scripting OrchardCore.Application.Cms.Targets
Advisory: GHSA-r8hp-5m7c-jhv4
Aliases: CVE-2022-0274
Published: 2022-01-21T23:08:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H

Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
Cross-Site Request Forgery in Jenkins
Advisory: GHSA-p92q-7fhh-mq35
Aliases: CVE-2022-20612
Published: 2022-01-21T23:37:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

A cross-site request forgery (CSRF) vulnerability in Jenkins 2.329 and earlier, LTS 2.319.1 and earlier allows attackers to trigger build of job without parameters when no security realm is set.
SQL injection in github.com/navidrome/navidrome
Advisory: GHSA-pmcr-2rhp-36hr
Aliases: CVE-2022-23857
Published: 2022-01-27T16:23:02Z

model/criteria/criteria.go in Navidrome before 0.47.5 is vulnerable to SQL injection attacks when processing crafted Smart Playlists. An authenticated user could abuse this to extract arbitrary data from the database, including the user table (which contains sensitive information such as the users' encrypted passwords).
Cross-site Scripting and Open Redirect in Products.ATContentTypes
Advisory: GHSA-g4c2-ghfg-g5rh
Aliases: CVE-2022-23599
Published: 2022-01-28T23:10:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

### Impact
Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish.
The technique is known as cache poisoning.
Any later visitor can get redirected when clicking on a link on this page.
Usually only anonymous users are affected, but this depends on your cache settings.

### Patches
A new version 3.0.6 of Products.ATContentTypes has been released with a fix.
This version works on Plone 5.2 (Python 2 only) and will be included in Plone 5.2.7.

Note that the Products.CMFPlone package has the same problem in the 4.3 series.
`plone.app.contenttypes` has the same problem in all versions, see [advisory](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x).
For all unpatched versions of the three packages, you can use the following workaround.

### Workaround
Make sure the image_view_fullscreen page is not stored in the cache.
In Plone:

* Login as Manager and go to Site Setup.
* Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable.
* Click on the tab 'Caching operations'.
* Under 'Legacy template mappings' locate the ruleset 'Content item view'.
* From the last column ('Templates')  remove 'image_view_fullscreen'.
* Click on Save.

### Reporter
This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!

### For more information
If you have any questions or comments about this advisory, email us at [security@plone.org](mailto:security@plone.org)
This is also the correct address to use when you want to report a possible vulnerability.
See [our security report policy](https://plone.org/security/report).
calibre-web is vulnerable to Cross-site Scripting
Advisory: GHSA-wrp6-9w7f-3wxg
Aliases: CVE-2021-4170
Published: 2022-01-21T23:55:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Stored XSS vulnerability in Jenkins Scriptler Plugin
Advisory: GHSA-5c6c-w4c4-vgvx
Aliases: CVE-2021-21668
Published: 2022-01-06T18:45:09Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Scriptler Plugin 3.1 and earlier does not escape script content.

This results in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission.

Scriptler Plugin 3.2 escapes script content.
Cross-site Scripting in pimcore
Advisory: GHSA-8x44-pwr2-rgc6
Aliases: CVE-2022-0348
Published: 2022-01-28T23:05:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Pimcore settings module is vulnerable to stored cross site scripting
Mustache remote code injection vulnerability
Advisory: GHSA-4rmr-c2jx-vx27
Aliases: CVE-2022-0323
Published: 2022-01-27T14:51:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In Mustache.php v2.0.0 through v2.14.0, Sections tag can lead to arbitrary php code execution even if strict_callables is true when section value is controllable.
Use of Uninitialized Resource in ash.
Advisory: GHSA-64wv-8vwp-xgw2
Aliases: CVE-2021-45688
Published: 2022-01-06T22:13:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the ash crate before 0.33.1 for Rust. util::read_spv may read from uninitialized memory locations.
Cross-site Scripting in pimcore
Advisory: GHSA-455w-gv5p-wgg3
Aliases: CVE-2022-0260
Published: 2022-01-26T22:10:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

pimcore is vulnerable to Stored XSS at Name field in the setting tab of the Global Targeting Rules.
Client-Side JavaScript Prototype Pollution in oro/platform
Advisory: GHSA-jx5q-g37m-h5hj
Aliases: CVE-2021-43852
Published: 2022-01-06T18:29:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

### Summary

By sending a specially crafted request, an attacker could inject properties into existing JavaScript language construct prototypes, such as objects. Later this injection may lead to JS code execution by libraries that are vulnerable to Prototype Pollution.

### Workarounds

Configure WAF to drop requests containing next strings: `__proto__` , `constructor[prototype]`, `constructor.prototype`
Unhandled exception when decoding form response JSON
Advisory: GHSA-wjfq-88q2-r34j
Published: 2022-01-21T23:02:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

### Impact
When handling form responses from the client (`ModalFormResponsePacket`), the Minecraft Windows client may send weird JSON that `json_decode()` can't understand. A workaround for this is implemented in `InGamePacketHandler::stupid_json_decode()`.

An `InvalidArgumentException` is thrown by this function when it fails to fix an error found in the JSON, which is not caught by the caller. This leads to a server crash.

### Patches
56fe71d939c38fe14e18a31a673a9331bcc0e4ca

### Workarounds
A plugin may handle `DataPacketReceiveEvent`, capture `ModalFormResponsePacket` and run the provided JSON through `stupid_json_decode`.

Note that this requires copying the body of the function to a plugin, since the function is currently private.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@pmmp.io](mailto:team@pmmp.io)
Cross-site Scripting in grav
Advisory: GHSA-735v-wx75-xmmm
Aliases: CVE-2022-0268
Published: 2022-01-27T18:27:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:L

In grav prior to version 1.7.28, a low privilege user can create a page with arbitrary javascript by bypassing insufficent XSS filtering.
Cross-site Scripting in Anchor CMS
Advisory: GHSA-7mq6-cp5m-f4j5
Aliases: CVE-2021-44116
Published: 2022-01-05T14:54:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations.
calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
Advisory: GHSA-wxr6-29pv-ch68
Aliases: CVE-2021-4164
Published: 2022-01-21T23:44:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

calibre-web is vulnerable to Cross-Site Request Forgery (CSRF)
XSS vulnerability in translations
Advisory: GHSA-rrgw-3hg3-9x8c
Published: 2022-01-12T21:49:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

### Summary

An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: 
 - Translation management UI.
 - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
 - Translations uploaded via Upload translation file on the All Languages grid

### Workarounds

There are no workarounds that address this vulnerability.
Prototype Pollution in node-forge util.setPath API
Advisory: GHSA-wxgw-qj99-44c2
Published: 2022-01-08T00:22:40Z

### Impact
`forge.util.setPath` had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.

### Patches
The `forge.util.setPath` API and related functions were removed in 0.10.0.

### Workarounds
Don't call `forge.util.setPath` directly or indirectly with untrusted keys.

### References
- https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-598677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge).
* Email us at support@digitalbazaar.com.
NULL Pointer Dereference in Protocol Buffers
Advisory: GHSA-77rm-9x9h-xj3g
Aliases: CVE-2021-22570
Published: 2022-01-27T00:01:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Nullptr dereference when a null char is present in a proto symbol. The symbol is parsed incorrectly, leading to an unchecked call into the proto file's name during generation of the resulting error message. Since the symbol is incorrectly parsed, the file is nullptr. We recommend upgrading to version 3.15.0 or greater.
Mingsoft MCMS vulnerable to Remote Code Execution via file upload.
Advisory: GHSA-cwx9-rp4w-4545
Aliases: CVE-2021-46386
Published: 2022-01-27T00:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mingsoft MCMS is a Java CMS. Versions prior to and including 5.2.5 contain a file upload vulnerability allowing for a jspx webshell to be uploaded via net.mingsoft.basic.action.web.FileAction#upload, resulting in remote code execution. It is unclear if this issue has been patched.
Improper Privilege Management in shelljs
Advisory: GHSA-64g7-mvw6-v9qj
Published: 2022-01-14T21:09:50Z

### Impact
Output from the synchronous version of `shell.exec()` may be visible to other users on the same system. You may be affected if you execute `shell.exec()` in multi-user Mac, Linux, or WSL environments, or if you execute `shell.exec()` as the root user.

Other shelljs functions (including the asynchronous version of `shell.exec()`) are not impacted.

### Patches
Patched in shelljs 0.8.5

### Workarounds
Recommended action is to upgrade to 0.8.5.

### References
https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c/

### For more information
If you have any questions or comments about this advisory:
* Ask at https://github.com/shelljs/shelljs/issues/1058
* Open an issue at https://github.com/shelljs/shelljs/issues/new
Cross-site Scripting in pimcore
Advisory: GHSA-8xx9-rxrj-2m2w
Aliases: CVE-2021-4139
Published: 2022-01-05T20:35:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
node-fetch forwards secure headers to untrusted sites
Advisory: GHSA-r683-j2x4-v87g
Aliases: CVE-2022-0235
Published: 2022-01-21T23:55:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

node-fetch forwards secure headers such as `authorization`, `www-authenticate`, `cookie`, & `cookie2` when redirecting to a untrusted site.
Pointer dereference in nanorand
Advisory: GHSA-r57r-j98g-587f
Aliases: CVE-2021-45705
Published: 2022-01-06T22:08:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the nanorand crate before 0.6.1 for Rust. There can be multiple mutable references to the same object because the TlsWyRand Deref implementation dereferences a raw pointer.
Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
Advisory: GHSA-vxh4-x6gv-mphf
Aliases: CVE-2022-0245
Published: 2022-01-21T23:25:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat.
Lookup operations do not take into account wildcards in SpiceDB
Advisory: GHSA-7p8f-8hjm-wm92
Aliases: CVE-2022-21646
Published: 2022-01-13T15:05:41Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

### Impact
Any user making use of a wildcard relationship under the right hand branch of an `exclusion` or within an `intersection` operation will see `Lookup`/`LookupResources` return a resource as "accessible" if it is *not* accessible by virtue of the inclusion of the wildcard in the intersection or the right side of the exclusion.

For example, given schema:

```zed
definition user {}

definition resource {
   relation viewer: user
   relation banned: user | user:*
   permission view = viewer - banned
}
```

If `user:*` is placed into the `banned` relation for a particular resource, `view` should return false for *all* resources. in `v1.3.0`, the wildcard is ignored entirely in lookup's dispatch, resulting in the `banned` wildcard being ignored in the exclusion.

### Workarounds
Don't make use of wildcards on the right side of intersections or within exclusions. 

### References
https://github.com/authzed/spicedb/issues/358

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [SpiceDB](https://github.com/authzed/spicedb)
* Ask a question in the [SpiceDB Discord](https://authzed.com/discord)
Cross-site Scripting in Apache Pluto
Advisory: GHSA-jg6j-jrxv-2hh9
Aliases: CVE-2021-36738
Published: 2022-01-08T00:46:17Z

The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact
Denial-of-service in Django
Advisory: GHSA-53qw-q765-4fww
Aliases: CVE-2021-45115
Published: 2022-01-12T19:20:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. `UserAttributeSimilarityValidator` incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.
Use of a Broken or Risky Cryptographic Algorithm in crypto2
Advisory: GHSA-9hfg-pxr6-q4vp
Aliases: CVE-2021-45709
Published: 2022-01-06T22:04:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The implementation does not enforce alignment requirements on input slices while incorrectly assuming 4-byte alignment through an unsafe call to std::slice::from_raw_parts_mut, which breaks the contract and introduces undefined behavior.

This affects Chacha20 encryption and decryption in crypto2.
Use of Uninitialized Resource in acc_reader.
Advisory: GHSA-799f-r78p-gq9c
Aliases: CVE-2020-36513
Published: 2022-01-06T22:17:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

An issue was discovered in the acc_reader crate through 2020-12-27 for Rust. read_up_to may read from uninitialized memory locations.
Incorrect Default Permissions in log4js
Advisory: GHSA-82v2-mx6x-wq7q
Aliases: CVE-2022-21704
Published: 2022-01-21T18:53:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

### Impact
Default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config.

### Patches
Fixed by:
* https://github.com/log4js-node/log4js-node/pull/1141
* https://github.com/log4js-node/streamroller/pull/87

Released to NPM in log4js@6.4.0

### Workarounds
Every version of log4js published allows passing the mode parameter to the configuration of file appenders, see the documentation for details.

### References

Thanks to [ranjit-git](https://www.huntr.dev/users/ranjit-git) for raising the issue, and to @lamweili for fixing the problem.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [logj4s-node](https://github.com/log4js-node/log4js-node)
* Ask a question in the [slack channel](https://join.slack.com/t/log4js-node/shared_invite/enQtODkzMDQ3MzExMDczLWUzZmY0MmI0YWI1ZjFhODY0YjI0YmU1N2U5ZTRkOTYyYzg3MjY5NWI4M2FjZThjYjdiOGM0NjU2NzBmYTJjOGI)
* Email us at [gareth.nomiddlename@gmail.com](mailto:gareth.nomiddlename@gmail.com)
loguru vulnerable to improper privilege management 
Advisory: GHSA-39ph-wr67-j4xq
Aliases: CVE-2022-0338
Published: 2022-01-26T00:01:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Improper Privilege Management in Conda loguru prior to 0.5.3.
An authenticated user can execute arbitrary command in Gerapy
Advisory: GHSA-756h-r2c9-qp5j
Aliases: CVE-2021-32849
Published: 2022-01-06T23:48:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

### Impact

An authenticated user can execute arbitrary command, see more in https://github.com/Gerapy/Gerapy/issues/211.

### Patches

Fixed in 0.9.9
Improper Access Control in Onionshare
Advisory: GHSA-gjj5-998g-v36v
Aliases: CVE-2022-21692
Published: 2022-01-21T23:20:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Between September 26, 2021 and October 8, 2021, [Radically Open Security](https://www.radicallyopensecurity.com/) conducted a penetration test of OnionShare 2.4, funded by the Open Technology Fund's [Red Team lab](https://www.opentech.fund/labs/red-team-lab/). This is an issue from that penetration test.

- Vulnerability ID: OTF-003
- Vulnerability type: Improper Access Control
- Threat level: Moderate

## Description:

Anyone with access to the chat environment can write messages disguised as another chat participant.

## Technical description:

Prerequisites:

- Alice and Bob are legitimate users
- A third user has access to the chat environment

![otf-003-a](https://user-images.githubusercontent.com/156128/140665707-1ecc897e-d33b-4f5b-b585-eb4475c1599f.png)

This screenshot shows Alice (`glimpse-depress`) and Bob (`blinker-doorpost`) joined a chatroom and are the only participants in the chatroom. Then the non-listed user squad-nursing writes a message in the chatroom without being visible in the list of users. The sending of the message itself is not required but was done here to show the initial access. The non-listed participant now renames himself to Bob and writes another message, seemingly coming from Bob.

This can be reproduced by slightly modifying the client-side JavaScript. The `joined` emit needs to be removed from the `socket.on(connect) `event handler. Therefore a client is not listed in the userlist and has no active session.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/resources/static/js/chat.js#L16-L18

This can be done either via a crafted client or runtime modification of the `chat.js` script in the browser's internal debugger.

It is still possible to call the text method and send text to the chat via websocket.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/chat_mode.py#L131-L139

It is also possible to call the `update_username` function and choose an existing username from the chat.

https://github.com/onionshare/onionshare/blob/d08d5f0f32f755f504494d80794886f346fbafdb/cli/onionshare_cli/web/chat_mode.py#L141-L162

Afterwards the hidden user can send messages that are displayed as coming from the impersonated user. There is no way to distinguish between the fake and original message.

## Impact:

An adversary with access to the chat environment can impersonate existing chat participants and write messages but not read the conversation. The similar exploit described in OTF-004 (page 19) has only slightly more requirements but also allows for reading.

## Recommendation:

- Implement proper session handling
Server side request forgery in @isomorphic-git/cors-proxy
Advisory: GHSA-v82v-rq72-phq9
Aliases: CVE-2021-23664
Published: 2022-01-26T22:13:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

The package @isomorphic-git/cors-proxy before 2.7.1 is vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.