TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4qhx-g9wp-g9m6
Summary: Failure to sanitize quotes which can lead to sql injection in squel
Severity: CRITICAL
CWE: CWE-74, CWE-89
Published: 2019-06-14T16:09:01Z

All versions of `squel` are vulnerable to sql injection.

The `squel` package does not properly escape user provided input when provided using the `setFields` method. This could lead to sql injection if the query was then executed.

Proof of concept demonstrating the injection of a single quote into a generated sql statement from user provided input.
```
> console.log(squel.insert().into('buh').setFields({foo: "bar'baz"}).toString());
INSERT INTO buh (foo) VALUES ('bar'baz')
```


## Recommendation

There is no fix at this time and the issue has been reported publicly. Consider using another query builder that provides strong guarantees for input sanitization to prevent sql injection attacks.
Vulnerability: GHSA-x44x-r84w-8v67
Summary: Lack of URL normalization may lead to authorization bypass when URL access rules are used
Aliases: CVE-2020-24660
Severity: MODERATE
CWE: CWE-287
Published: 2020-09-09T18:45:55Z

### Impact
When access rules are used inside a protected host, some URL encodings may bypass filtering system.

### Patches
Version 0.5.2 includes a patch that fixes the vulnerability

### Workarounds
No way for users to fix or remediate the vulnerability without upgrading

### References
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [this repository](https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/issues) or [LemonLDAP::NG GitLab](https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues)
* Email us at [lemonldap-ng-users@ow2.org](mailto:lemonldap-ng-users@ow2.org)
Vulnerability: GHSA-rwmv-c7v8-v9vf
Summary: Malicious Package in bitcoimd-rpc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:36:45Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-j6p2-cx3w-6jcp
Summary: Cross-Site Scripting in backbone
Aliases: CVE-2016-10537
Severity: HIGH
CWE: CWE-79
Published: 2019-02-18T23:39:55Z

Affected versions of `backbone` are vulnerable to cross-site scripting when users are allowed to supply input to the `Model#Escape` function, and the output is then written to the DOM. 

The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as `&#60;` into account.


## Recommendation

Update to version 0.5.0 or later.
Vulnerability: GHSA-8cv5-p934-3hwp
Summary: Denial of service in fast-csv
Aliases: CVE-2020-26256
Severity: LOW
CWE: CWE-400
Published: 2020-12-08T21:42:53Z

### Impact
Possible ReDoS (Regular Expression Denial of Service) when using `ignoreEmpty` option when parsing.

### Patches
This has been patched in `v4.3.6`

### Workarounds
You will only be affected by this if you use the `ignoreEmpty` parsing option. If you do use this option it is recommended that you upgrade to the latest version `v4.3.6`

### References

This vulnerability was found using a [CodeQL](https://securitylab.github.com/tools/codeql) query which identified `EMPTY_ROW_REGEXP` regular expression as vulnerable.
[Link to query run](https://lgtm.com/query/8609731774537641779/). 

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fast-csv](https://github.com/C2FO/fast-csv)
Vulnerability: GHSA-8pwx-j4r6-5v38
Summary: Malicious Package in hdkye
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:05:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4vj3-f849-5r48
Summary: Arbitrary File Read in Snyk Broker
Aliases: CVE-2020-7653
Severity: MODERATE
CWE: CWE-59
Published: 2020-06-03T22:02:21Z

All versions of snyk-broker before 4.80.0 are vulnerable to Arbitrary File Read. It allows arbitrary file reads for users with access to Snyk's internal network by creating symlinks to match whitelisted paths.
Vulnerability: GHSA-4v2w-h9jm-mqjg
Summary: Prototype Pollution in systeminformation
Aliases: CVE-2020-26245
Severity: MODERATE
CWE: CWE-471, CWE-78
Published: 2020-11-27T16:07:15Z

### Impact
command injection vulnerability by prototype pollution

### Patches
Problem was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. Please upgrade to version >= 4.30.2

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)
Vulnerability: GHSA-c3h5-qchh-46hh
Summary: Directory Traversal in yyooopack
Aliases: CVE-2017-16167
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:30:17Z

Affected versions of `yyooopack` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-593v-wcqx-hq2w
Summary: Incorrect version tags linked to external repository
Severity: CRITICAL
Published: 2021-09-07T22:57:58Z

### Impact
A security incident caused a number of incorrect version tags to be pushed to the Parse Server repository. These version tags linked to a personal fork of a contributor who had write access to the repository. The code to which these tags linked has not been reviewed or approved by Parse Platform. Even though no releases were published with these incorrect versions, it was possible to define a Parse Server dependency that pointed to these version tags, for example if you defined this dependency: 
```js
"parse-server": "git@github.com:parse-community/parse-server.git#4.9.3"
```

We have since deleted the incorrect version tags, but they may still show up in your personal fork on GitHub or locally. We do not know when these tags have been pushed to the Parse Server repository, but we first became aware of this issue on July 21, 2021. We are not aware of any malicious code or concerns related to privacy, security or legality (e.g. proprietary code). However, it has been reported that some functionality does not work as expected and the introduction of security vulnerabilities cannot be ruled out.

You may be also affected if you used the Bitnami image for Parse Server. Bitnami picked up the incorrect version tag `4.9.3` and published a new Bitnami image for Parse Server. 
 
**If you are using any of the affected versions, we urgently recommend to upgrade to version `4.10.0`.**


These are the incorrect tags:
```
4.0.0-beta1
4.0.0-beta2
4.0.0-beta3
4.0.0-beta4
4.0.0-beta5
4.0.0-beta6
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.3
4.0.4
4.0.6
4.0.7
4.0.8
4.0.9
4.6.0
4.6.0-beta
4.7.0
4.8.0
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.9.0
4.9.1
4.9.2
4.9.3
```

### Patches
Upgrade to version `4.10.0`.

### Workarounds
Downgrade to version `4.5.2`.

### References
n/a
Vulnerability: GHSA-r36x-p5pv-9mfx
Summary: Downloads Resources over HTTP in prebuild-lwip
Aliases: CVE-2016-10652
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:45:25Z

Affected versions of `prebuild-lwip` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-332q-7ff2-57h2
Summary: Prototype Pollution in undefsafe
Aliases: CVE-2019-10795
Severity: MODERATE
CWE: CWE-74
Published: 2022-02-09T22:34:01Z

undefsafe before 2.0.3 is vulnerable to Prototype Pollution. The 'a' function could be tricked into adding or modifying properties of Object.prototype using a `__proto__` payload.
Vulnerability: GHSA-52mq-6jcv-j79x
Summary: User content sandbox can be confused into opening arbitrary documents
Aliases: CVE-2021-21320
Severity: LOW
CWE: CWE-345
Published: 2021-03-03T02:23:56Z

### Impact

The user content sandbox can be abused to trick users into opening unexpected documents after several user interactions. The content can be opened with a `blob` origin from the Matrix client, so it is possible for a malicious document to access user messages and secrets.

### Patches

This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5657, which is included in 3.15.0.

### Workarounds

There are no known workarounds.
Vulnerability: GHSA-8687-vv9j-hgph
Summary: Improper Input Validation in Automattic Mongoose
Aliases: CVE-2019-17426
Severity: CRITICAL
CWE: CWE-20
Published: 2019-10-22T20:19:54Z

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
Vulnerability: GHSA-m6j2-v3gq-45r5
Summary: Cross-site Scripting in aurelia-framework
Aliases: CVE-2019-10062
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T23:42:39Z

The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements, which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example.
Vulnerability: GHSA-cq77-8jpx-892g
Summary: Command Injection in killing
Aliases: CVE-2021-23381
Severity: HIGH
CWE: CWE-77
Published: 2021-05-06T15:53:32Z

This affects all versions of package killing up to and including 1.0.6. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-jcmh-9fvm-j39w
Summary: Malicious Package in body-parse-xml
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:42:23Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-j3g2-m5jj-6336
Summary: Unsafe Merging of CORS Configuration Conflict in hapi
Aliases: CVE-2015-9243
Severity: MODERATE
CWE: CWE-284
Published: 2020-09-01T15:20:00Z

Versions of `hapi` prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended.




## Recommendation

Update hapi to version 11.1.4 or later.
Vulnerability: GHSA-23fp-fmrv-f5px
Summary: Uncontrolled Resource Consumption in strapi
Aliases: CVE-2020-8123
Severity: MODERATE
CWE: CWE-400
Published: 2021-12-10T17:22:01Z

A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
Vulnerability: GHSA-mh82-55cm-6gfh
Summary: Prototype pollution vulnerability in js-extend
Aliases: CVE-2021-25945
Severity: CRITICAL
CWE: CWE-915, CWE-1321
Published: 2021-06-08T23:16:03Z

Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-cmcx-xhr8-3w9p
Summary: Denial of Service in uap-core when processing crafted User-Agent strings
Aliases: CVE-2020-5243
Severity: HIGH
CWE: CWE-20
Published: 2020-02-20T23:26:10Z

### Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

### Patches

Please update uap-core to &amp;amp;gt;= v0.7.3

Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.

### Details

Each vulnerable regular expression reported here contains 3 overlapping capture groups. Backtracking has approximately cubic time complexity with respect to the length of the user-agent string.

#### Regex 1:

```
\bSmartWatch *\( *([^;]+) *; *([^;]+) *;
```

is vulnerable in portion ` *([^;]+) *` and can be attacked with

```python
&amp;amp;quot;SmartWatch(&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```
e.g.
```
SmartWatch(                                   z
```


#### Regex 2:

```
; *([^;/]+) Build[/ ]Huawei(MT1-U06|[A-Z]+\d+[^\);]+)[^\);]*\)
```

is vulnerable in portion `\d+[^\);]+[^\);]*` and can be attacked with

```python
&amp;amp;quot;;A Build HuaweiA&amp;amp;quot; + (&amp;amp;quot;4&amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```


#### Regex 3:

```
(HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(LG)E *; *([^;]*) *;[^;]*;[^;]*;\)
```

is vulnerable in portion ` *([^;]*) *` and can be attacked with

```python
&amp;amp;quot;HbbTV/0.0.0 (;LGE;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```

#### Regex 4:

```
(HbbTV)/[0-9]+\.[0-9]+\.[0-9]+ \([^;]*; *(?:CUS:([^;]*)|([^;]+)) *; *([^;]*) *;.*;
```

is vulnerable in portions ` *(?:CUS:([^;]*)|([^;]+)) *` and ` *([^;]*) *` and can be attacked with

```python
&amp;amp;quot;HbbTV/0.0.0 (;CUS:;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
&amp;amp;quot;HbbTV/0.0.0 (;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
&amp;amp;quot;HbbTV/0.0.0 (;z;&amp;amp;quot; + (&amp;amp;quot; &amp;amp;quot; * 3500) + &amp;amp;quot;z&amp;amp;quot;
```

Reported by Ben Caller @bcaller
Vulnerability: GHSA-549f-73hh-mj38
Summary: Command Injection in gitlabhook
Aliases: CVE-2019-5485
Severity: CRITICAL
CWE: CWE-78
Published: 2019-09-16T22:24:02Z

All versions of `gitlabhook` are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-c4qr-gmr9-v23w
Summary: Prefix escape
Aliases: CVE-2021-21322
Severity: LOW
CWE: CWE-20
Published: 2021-03-03T02:18:08Z

### Impact

By crafting a specific URL, it is possible to escape the prefix of the proxied backend service.
If the base url of the proxied server is `/pub/`, a user expect that accessing `/priv` on the target service would not be possible. Unfortunately, it is.

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)

### Patches

All releases after v4.3.1 include the fix.

### Workarounds

There are no workaround available.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-reply-from](https://github.com/fastify/fastify-reply-from)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-8j7x-pr59-m5h8
Summary: Malicious Package in whiteproject
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:31:18Z

All versions of `whiteproject` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-7696-qr5q-pg37
Summary: Malicious Package in zs-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:19:08Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-7h43-gx24-p529
Summary: Prototype pollution in json8
Aliases: CVE-2020-7770
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-10T19:17:05Z

This affects the package json8 before 1.0.3. The function adds in the target object the property specified in the path, however it does not properly check the key being set, leading to a prototype pollution.
Vulnerability: GHSA-jgqf-hwc5-hh37
Summary: Root Path Disclosure in send
Aliases: CVE-2015-8859
Severity: MODERATE
CWE: CWE-200
Published: 2017-10-24T18:33:36Z

Versions of `send` prior to 0.11.2 are affected by an information leakage vulnerability which may allow an attacker to enumerate paths on the server filesystem.



## Recommendation

Update to version 0.11.1 or later.
Vulnerability: GHSA-73wv-v82c-xmqv
Summary: Malicious Package in buffep-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:50:51Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-rhc3-76jw-4f2x
Summary: Denial of Service in @commercial/ammo
Severity: HIGH
Published: 2020-09-04T17:58:46Z

Versions of `@commercial/ammo` prior to 2.1.1 are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 2.1.1 or later.
Vulnerability: GHSA-hfc6-79wv-5hpw
Summary: Malicious Package in blingjs
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:48:13Z

Version 0.0.4 of `blingjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.4 of this module is found installed you will want to replace it with a version before or after 0.0.4. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-6x77-rpqf-j6mw
Summary: High severity vulnerability that affects ejs
Aliases: CVE-2017-1000189
Severity: HIGH
CWE: CWE-20
Published: 2018-03-05T18:54:33Z

nodejs ejs version older than 2.5.5 is vulnerable to a denial-of-service due to weak input validation in the ejs.renderFile()
Vulnerability: GHSA-p788-rj37-357w
Summary: Insecure Defaults Leads to Potential MITM in ezseed-transmission
Aliases: CVE-2016-1000224
Severity: MODERATE
CWE: CWE-295, CWE-300
Published: 2020-09-01T15:26:35Z

Affected versions of `ezseed-transmission` download and run a script over an HTTP connection.

An attacker in a privileged network position could launch a Man-in-the-Middle attack and intercept the script, replacing it with malicious code, completely compromising the system running `ezseed-transmission`.



## Recommendation

Update to version 0.0.15 or later.
Vulnerability: GHSA-jjv7-qpx3-h62q
Summary: Denial-of-Service Memory Exhaustion in qs
Aliases: CVE-2014-7191
Severity: HIGH
Published: 2017-10-24T18:33:36Z

Versions prior to 1.0 of `qs` are affected by a denial of service condition. This condition is triggered by parsing a crafted string that deserializes into very large sparse arrays, resulting in the process running out of memory and eventually crashing.


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-gwpf-62xp-vrg6
Summary: Information Exposure in cordova-android
Aliases: CVE-2016-6799
Severity: HIGH
CWE: CWE-532
Published: 2020-09-11T21:14:49Z

Versions of `cordova-android` prior to 6.0.0 are vulnerable to Information Exposure through log files. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition to the current log. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.


## Recommendation

Upgrade to version 6.0.0 or later.
Vulnerability: GHSA-p9vv-3945-x93h
Summary: Cross-Site Scripting in semantic-ui-search
Severity: HIGH
CWE: CWE-79
Published: 2020-09-02T15:47:10Z

All versions of `semantic-ui-search` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-mrx7-8hxf-f853
Summary: Cross-Site Scripting in swagger-ui
Aliases: CVE-2016-1000233
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T15:36:27Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting. This vulnerability exists because `swagger-ui` automatically executes external Javascript that is loaded in via the `url` query string parameter when a `Content-Type: application/javascript` header is included.

An attacker can create a server that replies with a malicious script and the proper content-type, and then craft a `swagger-ui` URL that includes the location to their server/script in the `url` query string parameter. When viewed, such a link would execute the attacker's malicious script.


## Recommendation

Update to 2.2.1 or later.
Vulnerability: GHSA-vrr3-5r3v-7xfw
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in casperjs
Aliases: CVE-2020-7679
Severity: HIGH
CWE: CWE-915
Published: 2021-05-17T21:00:52Z

The mergeObjects utility function is susceptible to Prototype Pollution.
Vulnerability: GHSA-7mc5-chhp-fmc3
Summary: Regular Expression Denial of Service in negotiator
Aliases: CVE-2016-10539
Severity: HIGH
CWE: CWE-400
Published: 2018-10-09T00:30:30Z

Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value.




## Recommendation

Update to version 0.6.1 or later.
Vulnerability: GHSA-3c9c-2p65-qvwv
Summary: Prototype pollution in aurelia-path
Aliases: CVE-2021-41097
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-09-27T20:12:16Z

### Impact
The vulnerability exposes Aurelia application that uses `aurelia-path` package to parse a string. The majority of this will be Aurelia applications that employ the `aurelia-router` package. An example is this could allow an attacker to change the prototype of base object class `Object` by tricking an application to parse the following URL: `https://aurelia.io/blog/?__proto__[asdf]=asdf`

### Patches
The problem should be patched in version `1.1.7`. Any version earlier than this is vulnerable.

### Workarounds
A partial work around is to free the Object prototype:
```ts
Object.freeze(Object.prototype)
```
Vulnerability: GHSA-73c6-vwjh-g3qh
Summary: Malicious Package in crpyto-js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:40:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-8gr3-2gjw-jj7g
Summary: Hidden functionality in node-ipc
Severity: LOW
CWE: CWE-912
Published: 2022-03-16T23:54:33Z

The package node-ipc version 9.2.2 is vulnerable to hidden functionality that was introduced by the maintainer. The package uses a dependency that writes a file to disk that does not pertain to the functionality of the package and is not included in versions < 9.2.2.
Vulnerability: GHSA-v63x-xc9j-hhvq
Summary: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Aliases: CVE-2019-10769
Severity: CRITICAL
CWE: CWE-94, CWE-20
Published: 2019-12-11T02:01:44Z

All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input. This may allow attackers to execute arbitrary code in the system.


## Recommendation

The package is not meant to receive user input. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-pxpf-v376-7xx5
Summary: tagify can pass a malicious placeholder to initiate the cross-site scripting (XSS) payload
Aliases: CVE-2022-25854
Severity: MODERATE
Published: 2022-04-30T00:00:33Z

This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the cross-site scripting (XSS) payload.
Vulnerability: GHSA-48gc-5j93-5cfq
Summary: Path Traversal in serve
Severity: HIGH
CWE: CWE-22
Published: 2020-09-11T21:15:54Z

Versions of `serve` prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files.


## Recommendation

Upgrade to version 10.1.2 or later.
Vulnerability: GHSA-476p-r2wx-2wch
Summary: Downloads Resources over HTTP in ntfserver
Aliases: CVE-2016-10650
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:05Z

Affected versions of `ntfserver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `ntfserver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-f8vf-6hwg-hw55
Summary: Malicious Package in bictore-lib
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:38:21Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-g7w9-vm5m-48q8
Summary: Downloads Resources over HTTP in arcanist
Aliases: CVE-2016-10683
Severity: MODERATE
CWE: CWE-311
Published: 2019-02-18T23:42:09Z

Affected versions of `arcanist` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `arcanist`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-vm67-7vmg-66vm
Summary: Arbitrary Command Injection in portprocesses
Aliases: CVE-2021-23348
Severity: MODERATE
CWE: CWE-77, CWE-78
Published: 2021-04-06T17:24:50Z

### Impact

An Arbitrary Command Injection vulnerability was reported in `portprocesses` impacting versions <= 1.0.4.

### Example (Proof of Concept)

The following example demonstrates the vulnerability and will run `touch success` therefore creating a file named `success`.

```js
const portprocesses = require("portprocesses");

portprocesses.killProcess("$(touch success)");
```
Vulnerability: GHSA-prmc-5v5w-c465
Summary: Client TLS credentials sent raw to server in npm package nats
Severity: CRITICAL
CWE: CWE-522
Published: 2021-04-06T17:32:38Z

Nats is a Node.js client for the NATS messaging system.

## Problem Description

_Preview versions_ of two NPM packages and one Deno package from the NATS project contain an information disclosure flaw, leaking options to the NATS server; for one package, this includes TLS private credentials.

The _connection_ configuration options in these JavaScript-based implementations were fully serialized and sent to the server in the client's `CONNECT` message, immediately after TLS establishment.

The nats.js client supports Mutual TLS and the credentials for the TLS client key are included in the connection configuration options; disclosure of the client's TLS private key to the server has been observed.

Most authentication mechanisms are handled after connection, instead of as part of connection, so other authentication mechanisms are unaffected.
For clarity: NATS account NKey authentication **is NOT affected**.

Neither the nats.ws nor the nats.deno clients support Mutual TLS: the affected versions listed below are those where the logic flaw is
present.  We are including the nats.ws and nats.deno versions out of an abundance of caution, as library maintainers, but rate as minimal the likelihood of applications leaking sensitive data.


## Affected versions

### Security impact

* NPM package nats.js:
  + **mainline is unaffected**
  + beta branch is vulnerable from 2.0.0-201, fixed in 2.0.0-209

### Logic flaw

* NPM package nats.ws:
  + status: preview
  + flawed from 1.0.0-85, fixed in 1.0.0-111

* Deno repository https://github.com/nats-io/nats.deno
  + status: preview
  + flawed in all git tags prior to fix
  + fixed with git tag v1.0.0-9


## Impact

For deployments using TLS client certificates (for mutual TLS), private key material for TLS is leaked from the client application to the
server.  If the server is untrusted (run by a third party), or if the client application also disables TLS verification (and so the true identity of the server is unverifiable) then authentication credentials are leaked.

## Workaround

*None*

## Solution

Upgrade your package dependencies to fixed versions, and then reissue any TLS client credentials (with new keys, not just new certificates) and revoke the old ones.
Vulnerability: GHSA-7w7c-867m-4mqc
Summary: Malicious Package in rceat
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:04:55Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-2mvm-66q7-m256
Summary: Downloads Resources over HTTP in selenium-download
Aliases: CVE-2016-10559
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:40:25Z

Affected versions of `selenium-download` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-download`.


## Recommendation

Update to version 2.0.7 or later.
Vulnerability: GHSA-23r4-5mxp-c7g5
Summary: New anonymous user session acts as if it's created with password
Aliases: CVE-2021-39138
Severity: MODERATE
CWE: CWE-287
Published: 2021-08-23T19:41:52Z

### Impact

Developers that use the REST API to signup users and also allow users to login anonymously. When an anonymous user is first signed up using REST, the server creates session incorrectly, particularly the `authProvider` field in `_Session` class under `createdWith` shows the user logged in creating a password. If a developer later depends on the `createdWith` field to provide a different level of access between a password user and anonymous user, the server incorrectly classified the session type as being created with a `password`.

The server currently doesn't use `createdWith` to make decisions on how things work internally, so if a developer isn't using `createdWith` directly, there's nothing to worry about. The vulnerability only affects users who depend on `createdWith` by using it directly.   

### Patches
Upgrade to version 4.5.1.

### Workarounds
Don't use the `createdWith` Session field to make decisions if you allow anonymous login.

### References
n/a
Vulnerability: GHSA-4fr2-j4g9-mppf
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in deephas
Aliases: CVE-2020-28271
Severity: CRITICAL
CWE: CWE-915
Published: 2021-09-24T15:42:21Z

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-559q-92vx-xvjp
Summary: Malicious Package in qingting
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:44:36Z

All versions of `qingting` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-cg42-4wrc-gp47
Summary: Code Injection in node-extend
Aliases: CVE-2020-7673
Severity: CRITICAL
CWE: CWE-94
Published: 2021-05-17T21:00:37Z

node-extend through 0.2.0 is vulnerable to Arbitrary Code Execution. User input provided to the argument `A` of `extend` function`(A,B,as,isAargs)` located within `lib/extend.js` is executed by the `eval` function, resulting in code execution.
Vulnerability: GHSA-4w2v-q235-vp99
Summary: Server-Side Request Forgery in Axios
Aliases: CVE-2020-28168
Severity: HIGH
CWE: CWE-918
Published: 2021-01-04T20:59:40Z

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Vulnerability: GHSA-j9f8-8h89-j69x
Summary: Remote Code Execution in node-os-utils
Severity: HIGH
CWE: CWE-94
Published: 2019-06-11T16:16:34Z

Versions of `node-os-utils` prior to 1.1.0 are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

Upgrade to version 1.1.0 or later.
Vulnerability: GHSA-xq8r-r72r-pqwm
Summary: Downloads Resources over HTTP in roslib-socketio
Aliases: CVE-2016-10681
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:13:18Z

Affected versions of `roslib-socketio` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `roslib-socketio`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-m75h-cghq-c8h5
Summary: Heap Based Buffer Overflow in libyaml
Aliases: CVE-2013-6393
Severity: CRITICAL
CWE: CWE-119
Published: 2020-08-31T22:51:50Z

Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags.





## Recommendation

- Update to version 0.2.3 that includes a version of LibYAML that contains a fix for this issue.
Vulnerability: GHSA-fmvm-x8mv-47mj
Summary: Improper CSP in Image Optimization API for Next.js versions between 10.0.0 and 12.1.0
Aliases: CVE-2022-23646
Severity: MODERATE
CWE: CWE-451
Published: 2022-02-17T17:19:18Z

Next.js is a React framework. Starting with version 10.0.0 and prior to version 12.1.0, Next.js is vulnerable to User Interface (UI) Misrepresentation of Critical Information. In order to be affected, the `next.config.js` file must have an `images.domains` array assigned and the image host assigned in `images.domains` must allow user-provided SVG. If the `next.config.js` file has `images.loader` assigned to something other than default, the instance is not affected. Version 12.1.0 contains a patch for this issue. As a workaround, change `next.config.js` to use a different `loader configuration` other than the default.

### Impact
- **Affected**: All of the following must be true to be affected
  - Next.js between version 10.0.0 and 12.0.10
  - The `next.config.js` file has [images.domains](https://nextjs.org/docs/api-reference/next/image#domains) array assigned
  - The image host assigned in [images.domains](https://nextjs.org/docs/api-reference/next/image#domains) allows user-provided SVG
- **Not affected**: The `next.config.js` file has [images.loader](https://nextjs.org/docs/api-reference/next/image#loader-configuration) assigned to something other than default

### Patches
[Next.js 12.1.0](https://github.com/vercel/next.js/releases/tag/v12.1.0)

### Workarounds
Change `next.config.js` to use a different [loader configuration](https://nextjs.org/docs/api-reference/next/image#loader-configuration) other than the default, for example:

```js
module.exports = {
  images: {
    loader: 'imgix',
    path: 'https://example.com/myaccount/',
  },
}
```

Or if you want to use the [`loader`](https://nextjs.org/docs/api-reference/next/image#loader) prop on the component, you can use `custom`:
```js
module.exports = {
  images: {
    loader: 'custom',
  },
}
```
Vulnerability: GHSA-674r-xx4c-gj7x
Summary: Malicious Package in sb58
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:04:05Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-74cp-qw7f-7hpw
Summary: Path Traversal in statics-server
Severity: MODERATE
CWE: CWE-22
Published: 2019-06-05T14:10:23Z

All versions of `statics-server` are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-h4mf-75hf-67w4
Summary: Information disclosure in parse-server
Aliases: CVE-2020-5251
Severity: HIGH
CWE: CWE-285, CWE-200
Published: 2020-03-04T20:20:27Z

1. you can fetch all the users' objects, by using regex in the NoSQL query.
Using the NoSQL, you can use a regex on sessionToken `("_SessionToken":{"$regex":"r:027f"}}` and find valid accounts this way.

Using this method, it's possible to retrieve accounts without interaction from the users.

GET /parse/users/me HTTP/1.1
```
{
  "_ApplicationId": "appName",
  "_JavaScriptKey": "javascriptkey",
  "_ClientVersion": "js2.10.0",
  "_InstallationId": "ca713ee2-6e60-d023-a8fe-14e1bfb2f300",
  "_SessionToken": {
    "$regex": "r:5"
  }
}
```
When trying it with an update query the same thing luckily doesn't seem to work:
POST /parse/classes/_User/PPNk59jPPZ

2. There is another similar vulnerability in verify email and the request password reset.

If you sign up with someone else's email address, you can simply use regex in the token param to verify the account: `http://localhost:1337/parse/apps/kickbox/verify_email?token[$regex]=a&username=some@email.com`

The same thing can be done for reset password: `http://localhost:1337/parse/apps/kickbox/request_password_reset?token[$regex]=a&username=some@email.com`

You may need to do it a few times with a different letter/number, but as long as the tokens contain the character it will succeed.
Vulnerability: GHSA-9x7m-9hpg-xxmw
Summary: Prototype Pollution in putil-merge
Aliases: CVE-2021-25953
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-12-10T17:24:16Z

Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-c6f3-3c98-2j2f
Summary: Malicious Package in jquerz
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:39:46Z

Version 1.0.1 of `jquerz` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-7gc6-qh9x-w6h8
Summary: Incorrect Authorization in cross-fetch
Aliases: CVE-2022-1365
Severity: MODERATE
CWE: CWE-359, CWE-863
Published: 2022-04-17T00:00:32Z

When fetching a remote url with Cookie if it get Location response header then it will follow that url and try to fetch that url with provided cookie . So cookie is leaked here to thirdparty.
Ex: you try to fetch example.com with cookie and if it get redirect url to attacker.com then it fetch that redirect url with provided cookie .
Vulnerability: GHSA-q4v7-4rhw-9hqm
Summary: Code Execution through IIFE in node-serialize
Aliases: CVE-2017-5941
Severity: CRITICAL
CWE: CWE-502
Published: 2018-07-18T18:27:56Z

Affected versions of `node-serialize` can be abused to execute arbitrary code via an [immediately invoked function expression](https://en.wikipedia.org/wiki/Immediately-invoked_function_expression) (IIFE) if untrusted user input is passed into `unserialize()`.


## Recommendation

There is no direct patch for this issue. The package author has reviewed this advisory, and provided the following recommendation:

```
To avoid the security issues, at least one of the following methods should be taken:

1. Make sure to send serialized strings internally, isolating them from potential hackers. For example, only sending the strings from backend to fronend and always using HTTPS instead of HTTP.

2. Introduce public-key cryptosystems (e.g. RSA) to ensure the strings not being tampered with.
```
Vulnerability: GHSA-23vw-mhv5-grv5
Summary: Denial of Service in @hapi/hapi
Severity: HIGH
Published: 2020-09-03T15:48:43Z

Versions of `@hapi/hapi` prior to 18.4.1 or 19.1.1 are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to versions 18.4.1, 19.1.1 or later.