TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-f9wg-5f46-cjmw
Summary: NextAuth.js default redirect callback vulnerable to open redirects
Aliases: CVE-2022-24858
Severity: MODERATE
CWE: CWE-290, CWE-601
Published: 2022-04-22T20:49:09Z

`next-auth` v3 users before version 3.29.2 are impacted. (We recommend upgrading to v4 in most cases. See our [migration guide](https://next-auth.js.org/getting-started/upgrade-v4)).`next-auth` v4 users before version 4.3.2 are impacted. Upgrading to 3.29.2 or 4.3.2 will patch this vulnerability. If you are not able to upgrade for any reason, you can add a configuration to your `callbacks` option:

```js
// async redirect(url, baseUrl) { // v3
async redirect({ url, baseUrl }) { // v4
    // Allows relative callback URLs
    if (url.startsWith("/")) return new URL(url, baseUrl).toString()
    // Allows callback URLs on the same origin
    else if (new URL(url).origin === baseUrl) return url
    return baseUrl
}
```
If you already have a `redirect` callback, make sure that you match the incoming `url` origin against the `baseUrl`.
Vulnerability: GHSA-8qh7-xw58-3ww7
Summary: Malicious Package in radic-util
Severity: CRITICAL
Published: 2020-09-11T21:25:37Z

Version 1.0.2 of `radic-util` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-wr66-vrwm-5g5x
Summary: Denial of Service Vulnerability in next.js
Aliases: CVE-2022-21721
Severity: MODERATE
CWE: CWE-400, CWE-20
Published: 2022-01-28T23:09:22Z

### Impact

Vulnerable code could allow a bad actor to trigger a denial of service attack for anyone running a Next.js app at version >= 12.0.0, and using i18n functionality.

- **Affected:** All of the following must be true to be affected by this CVE
  - Next.js versions above v12.0.0
  - Using next start or a custom server
  - Using the built-in i18n support
- **Not affected:**
  - Deployments on Vercel (vercel.com) are not affected along with similar environments where invalid requests are filtered before reaching Next.js.

### Patches

A patch has been released, `next@12.0.9`, that mitigates this issue. We recommend all affected users upgrade as soon as possible.

### Workarounds

We recommend upgrading whether you can reproduce or not although you can ensure `/${locale}/_next/` is blocked from reaching the Next.js instance until you upgrade.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [next](https://github.com/vercel/next.js)
* Email us at [security@vercel.com](mailto:security@vercel.com)
Vulnerability: GHSA-mq9h-cwc2-6j5r
Summary: Malicious Package in midway-dataproxy
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:42:27Z

All versions of `midway-dataproxy` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qhf6-vqq9-q2p7
Summary: Directory Traversal in gaoxiaotingtingting
Aliases: CVE-2017-16108
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:58:58Z

Affected versions of `gaoxiaotingtingting` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-qpjp-7rp2-9c3f
Summary: Moderate severity vulnerability that affects validator
Aliases: CVE-2013-7451
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.
Vulnerability: GHSA-fpm5-vv97-jfwg
Summary: Uncontrolled Resource Consumption in firebase
Aliases: CVE-2020-7765
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-18T01:57:24Z

This affects the package @firebase/util before 0.3.4. This vulnerability relates to the deepExtend function within the DeepCopy.ts file. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Vulnerability: GHSA-cr67-78jr-j94p
Summary: Local File Inclusion in domokeeper
Severity: MODERATE
Published: 2020-09-03T18:14:47Z

All versions of `domokeeper` are vulnerable to Local File Inclusion. The `/plugin/` route passes a GET parameter unsanitized to a `require()` call. It then returns the output of `require()` in the server response. This may allow attackers to load unintended code in the application. It also allows attackers to exfiltrate information in `.json` files.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-73rg-x683-m3qw
Summary: Buffer overflow  in canvas
Aliases: CVE-2020-8215
Severity: HIGH
CWE: CWE-120
Published: 2021-05-07T16:05:16Z

A buffer overflow is present in canvas versions before 1.6.11, which could lead to a Denial of Service or execution of arbitrary code when it processes a user-provided image.
Vulnerability: GHSA-8w57-jfpm-945m
Summary: Denial of Service in http-proxy-agent
Severity: HIGH
Published: 2019-06-11T16:16:07Z

Versions of `http-proxy-agent` before 2.1.0 are vulnerable to denial of service and uninitialized memory leak when unsanitized options are passed to `Buffer`.


## Recommendation

Update to version 2.1.0 or later.
Vulnerability: GHSA-8vmc-g99q-xj94
Summary: Directory Traversal in dcdcdcdcdc
Aliases: CVE-2017-16190
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:23:52Z

Affected versions of `dcdcdcdcdc` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-ch82-gqh6-9xj9
Summary: Prototype Pollution in get-setter
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:13:19Z

All versions of `get-setter` are vulnerable to prototype pollution. The function `set` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-wp2p-q35g-3rjj
Summary: Malicious Package in soket.io
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T21:13:01Z

All versions of `soket.io` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-m647-5wf9-3jp3
Summary: OS Command Injection in closure-compiler-stream
Aliases: CVE-2020-7603
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-07T16:16:06Z

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument &quot;options&quot; of the exports function in &quot;index.js&quot; can be controlled by users without any sanitization.
Vulnerability: GHSA-6fh5-8wq8-w3wr
Summary: Prototype Pollution in unflatten
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:09:55Z

All versions of `unflatten` are vulnerable to prototype pollution. The function `unflatten` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-cwp7-92h5-82wx
Summary: Downloads Resources over HTTP in haxe-dev
Aliases: CVE-2016-10637
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:10Z

Affected versions of `haxe-dev` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe-dev`.


## Recommendation

This package is actively maintained, yet after 2 years, the maintainer has not provided a patch for the vulnerability. This likely means that the maintainer has decided to accept the risk, and this vulnerability will never be patched.

Because of this, the best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-725f-3pw7-rq6x
Summary: Malicious Package in 8.9.4
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:09:47Z

Versions 1.0.2, 1.0.3, 1.0.4 and 1.0.5 of `8.9.4` contain malicious code as a preinstall script. The package reads the system's SSH keys but does not upload it to a remote server.


## Recommendation

Remove the package from your environment. There is no evidence of further compromise at the moment.
Vulnerability: GHSA-q4qq-fm7q-cwp5
Summary: Multiple XSS Filter Bypasses in validator
Aliases: CVE-2013-7454
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Versions of `validator` prior to 1.1.0 are affected by several cross-site scripting vulnerabilities due to bypasses discovered in the blacklist-based filter.


## Proof of Concept
Various inputs that could bypass the filter were discovered:

Improper parsing of nested tags:

```
<s <onmouseover="alert(1)"> <;s onmouseover="alert(1)">This is a test

```

Incomplete filtering of javascript: URIs:

```
<a href="javascriptJ a V a S c R iPt::alert(1)" "
">test</a>
```

UI Redressing:

```
<div style="z-index: 9999999; background-color: green; width: 100%; height: 100%">
<h1>You have won</h1>Please click the link and enter your login details:
<a href="http://example.com/">http://good.com</a>
</div>
```

Bypass via Nested Forbidden Strings:

```
<scrRedirecRedirect 302t 302ipt type="text/javascript">prompt(1);</scrRedirecRedirect 302t 302ipt>
```

Additional bypasses were discovered by Krzysztof Kotowicz in 2012 when auditing CodeIgniter's XSS filtering function, which this code was based off of.


## Recommendation

If you are a developer currently using the xss filter function from the validator package, you should consider replacing it with the escape filter function from the same package. This function replaces all instances of angle brackets (<, >), ampersands, and quotation marks, so no HTML tags will be processed.
Vulnerability: GHSA-gf8q-jrpm-jvxq
Summary: URL parsing in node-forge could lead to undesired behavior.
Severity: LOW
Published: 2022-01-08T00:22:02Z

### Impact
The regex used for the `forge.util.parseUrl` API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.

### Patches
`forge.util.parseUrl` and other very old related URL APIs were removed in 1.0.0 in favor of letting applications use the more modern WHATWG URL Standard API.

### Workarounds
Ensure code does not directly or indirectly call `forge.util.parseUrl` with untrusted input.

### References
- https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at support@digitalbazaar.com
Vulnerability: GHSA-vxf5-wxwp-m7g9
Summary: Open Redirect in Next.js
Aliases: CVE-2021-37699
Severity: MODERATE
CWE: CWE-601
Published: 2021-08-12T14:51:14Z

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when `pages/_error.js` was statically generated, allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

### Impact

- **Affected:** Users of Next.js between `10.0.5` and `10.2.0`
- **Affected:** Users of Next.js between `11.0.0` and `11.0.1` using `pages/_error.js` without `getInitialProps`
- **Affected:** Users of Next.js between `11.0.0` and `11.0.1` using `pages/_error.js` and `next export`
- **Not affected**: Deployments on Vercel ([vercel.com](https://vercel.com)) are not affected
- **Not affected:** Deployments **with** `pages/404.js`
- Note that versions prior to 0.9.9 package `next` npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

We recommend upgrading to the latest version of Next.js to improve the overall security of your application.

### Patches

https://github.com/vercel/next.js/releases/tag/v11.1.0
Vulnerability: GHSA-gfv4-2vhm-486m
Summary: Hijacked Environment Variables in node-fabric
Aliases: CVE-2017-16052
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-23T20:50:10Z

The `node-fabric` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-jqfh-8hw5-fqjr
Summary: Improper Handling of Exceptional Conditions in detect-character-encoding
Aliases: CVE-2021-39157
Severity: HIGH
CWE: CWE-755
Published: 2021-08-25T14:44:48Z

### Impact

In detect-character-encoding v0.6.0 and earlier, data matching no charset causes the Node.js process to crash.

### Patches

The problem has been patched in [detect-character-encoding v0.7.0](https://github.com/sonicdoe/detect-character-encoding/releases/tag/v0.7.0).

### CVSS score

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)

Base Score: 7.5 (High)
Temporal Score: 7.2 (High)

Since detect-character-encoding is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, accepting data from untrusted sources over a network and passing it directly to detect-character-encoding. Depending on your specific implementation, the vulnerability’s severity in your program may be different.

### Proof of concept

```js
const express = require("express");
const bodyParser = require("body-parser");
const detectCharacterEncoding = require("detect-character-encoding");

const app = express();

app.use(bodyParser.raw());

app.post("/", (req, res) => {
  const charsetMatch = detectCharacterEncoding(req.body);

  res.end(charsetMatch.encoding);
});

app.listen(3000);
```

`printf "\xAA" | curl --request POST --header "Content-Type: application/octet-stream" --data-binary @- http://localhost:3000` crashes the server.
Vulnerability: GHSA-28xx-8j99-m32j
Summary: Malicious Package in nginxbeautifier
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T20:37:25Z

Version 1.0.14 of `nginxbeautifier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.14 of this module is found installed you will want to replace it with a version before or after 1.0.14. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-5pq8-2q24-mj3p
Summary: Downloads Resources over HTTP in fis-parser-sass-bin
Aliases: CVE-2016-10660
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:45:03Z

Affected versions of `fis-parser-sass-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fis-parser-sass-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-qgmg-gppg-76g5
Summary: Inefficient Regular Expression Complexity in validator.js
Aliases: CVE-2021-3765
Severity: MODERATE
CWE: CWE-1333
Published: 2021-11-03T17:34:45Z

validator.js prior to 13.7.0 is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-446m-mv8f-q348
Summary: Regular Expression Denial of Service in moment
Aliases: CVE-2017-18214
Severity: HIGH
CWE: CWE-400
Published: 2018-03-05T18:35:09Z

Affected versions of `moment` are vulnerable to a low severity regular expression denial of service when parsing dates as strings.


## Recommendation

Update to version 2.19.3 or later.
Vulnerability: GHSA-c4fm-46gm-4469
Summary: Malicious Package in sparkies
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T20:00:05Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-hgwm-pv9h-q5m7
Summary: Potential XSS in jQuery dependency in Mirador
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-18T18:03:29Z

### Impact
Mirador users less than v3.0.0 (alpha-rc) versions that have an unpatched jQuery. When adopters update jQuery they will find some of Mirador functionality to be broken.

### Patches
Mirador adopters should update to v3.0.0, no updates exist for v2.x releases.

### Workarounds
Yes, Mirador users could fork and create their own custom build of Mirador and make the bug fixes themselves.

### References
https://github.com/advisories/GHSA-gxr4-xjj5-5px2
https://github.com/advisories/GHSA-jpcq-cgw6-v4j6


https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/
Vulnerability: GHSA-wr2c-ppj9-f2fv
Summary: Downloads Resources over HTTP in webdrvr
Aliases: CVE-2016-10601
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:33:54Z

Affected versions of `webdrvr` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webdrvr`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-h372-w3xp-2jg3
Summary: Directory Traversal in section2.madisonjbrooks12
Aliases: CVE-2017-16172
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:54:34Z

Affected versions of `section2.madisonjbrooks12` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hv9c-qwqg-qj3v
Summary: Remote Code Execution in electron
Aliases: CVE-2018-15685
Severity: HIGH
CWE: CWE-1188
Published: 2018-08-23T19:12:08Z

GitHub Electron 1.7.15, 1.8.7, 2.0.7, and 3.0.0-beta.6, in certain scenarios involving IFRAME elements and "nativeWindowOpen: true" or "sandbox: true" options, is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.

More information to determine if you are impacted can be found on the [electron blog](https://electronjs.org/blog/web-preferences-fix).


## Recommendation

Upgrade Electron to >=3.0.0-beta.7, >=2.0.8, >=1.8.8, or >=1.7.16."
Vulnerability: GHSA-5v7r-jg9r-vq44
Summary: Insecure Cryptography Algorithm in simple-crypto-js
Severity: MODERATE
CWE: CWE-327
Published: 2020-09-03T21:19:46Z

Versions of `simple-crypto-js` prior to 2.3.0 use AES-CBC with PKCS#7 padding, which is vulnerable to padding oracle attacks. This may allow attackers to break the encryption and access sensitive data.


## Recommendation

Upgrade to version 2.3.0 or later.
Vulnerability: GHSA-2wrq-wmqf-8vcc
Summary: Downloads Resources over HTTP in operadriver
Aliases: CVE-2016-10565
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:35:48Z

operadriver is a Opera Driver for Selenium.

operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

Update to version 0.2.3 or later.
Vulnerability: GHSA-xj6f-x7jm-85ff
Summary: Downloads Resources over HTTP in openframe-ascii-image
Aliases: CVE-2016-10690
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:41:54Z

Affected versions of `openframe-ascii-image` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `openframe-ascii-image`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-ph58-4vrj-w6hr
Summary: XSS vulnerability that affects bootstrap
Aliases: CVE-2018-20677
Severity: MODERATE
CWE: CWE-79
Published: 2019-01-17T13:57:56Z

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Vulnerability: GHSA-255r-pghp-r5wh
Summary: Malicious Package in hdeky
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:05:34Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-735c-r4vc-6gm9
Summary: Downloads Resources over HTTP in bionode-sra
Aliases: CVE-2016-10613
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:56:45Z

Affected versions of `bionode-sra` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. The author of this package has suggested using [urllib-sync](https://www.npmjs.com/package/urllib-sync).

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-4gw3-8f77-f72c
Summary: Regular expression denial of service in codemirror
Aliases: CVE-2020-7760
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-10T18:46:27Z

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2.
 The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/*.*?*/)*
Vulnerability: GHSA-6m4r-cgm3-6q7q
Summary: Cross-Site Scripting in status-board
Aliases: CVE-2019-15478
Severity: MODERATE
CWE: CWE-79
Published: 2019-09-23T18:32:54Z

All versions of `status-board` are vulnerable to Cross-Site Scripting. The `renderJsDashboard()` function concatenates the `safeDashboard` variable to the HTTP response message with insufficient sanitization. If this variable is controlled by user input it may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-hg2p-2cvq-4ppv
Summary: Cross-site scripting in lazysizes
Aliases: CVE-2020-7642
Severity: LOW
CWE: CWE-79
Published: 2021-12-10T20:06:23Z

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript.
Vulnerability: GHSA-f89g-whpf-6q9m
Summary: Cross-Site Scripting in i18next
Aliases: CVE-2017-16008
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:46:56Z

Affected versions of `i18next` allow untrusted user input to be injected into dictionary key names, resulting in a cross-site scripting vulnerability.

## Proof of Concept
```
var init = i18n.init({debug: true}, function(){
  var test = i18n.t('__firstName__ __lastName__', {
        escapeInterpolation: true,
        firstName: '__lastNameHTML__',
        lastName: '<script>',
  });
  console.log(test);
});
// equals "<script> &lt;script&gt;"
```


## Recommendation

Update to version 1.10.3 or later.
Vulnerability: GHSA-3fw8-66wf-pr7m
Summary: methodOverride Middleware Reflected Cross-Site Scripting in connect
Aliases: CVE-2013-7370
Severity: LOW
CWE: CWE-79
Published: 2020-08-31T22:41:27Z

Connect is a stack of middleware that is executed in order in each request.

The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".

Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.


###Example:
```
~ curl "localhost:3000" -d "_method=<script src=http://nodesecurity.io/xss.js></script>"
Cannot <SCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS></SCRIPT> /
```

## Recommendation

Update to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.
Vulnerability: GHSA-7c82-mp33-r854
Summary: Cross-site scripting in bootstrap-select
Aliases: CVE-2019-20921
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-07T16:47:54Z

bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.
Vulnerability: GHSA-4mv4-gmmf-q382
Summary: Cross-Site Scripting in datatables
Aliases: CVE-2015-6584
Severity: HIGH
CWE: CWE-79
Published: 2020-08-31T22:42:29Z

Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.


## Recommendation

Update to a version greater than 1.10.8.
Vulnerability: GHSA-5cp4-xmrw-59wf
Summary: XSS via JQLite DOM manipulation functions in AngularJS
Severity: MODERATE
CWE: CWE-79
Published: 2020-08-05T21:47:02Z

### Summary
XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.

### Description

JQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.

One of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).

If `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.

This is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).

### Proof of concept

```javascript
const inertPayload = `<div><style><style/><img src=x onerror="alert(1337)"/>` 
```
Note that the style element is not closed and `<img` would be a text node inside the style if inserted into the DOM as-is.
As such, some HTML sanitizers would leave the `<img` as is without processing it and stripping the `onerror` attribute.

```javascript
angular.element(document).append(inertPayload);
```
This will alert, as `<style/>` will be replaced with `<style></style>` before adding it to the DOM, closing the style element early and reactivating `img`.

### Patches
The issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery <3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).

### Workarounds
Changing sanitizer configuration not to allow certain tag grouping (e.g. `<option><style></option>`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.

### References
https://github.com/advisories/GHSA-mhp6-pxh8-r675
https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://snyk.io/vuln/SNYK-JS-ANGULAR-570058
Vulnerability: GHSA-3f99-hvg4-qjwj
Summary: Insecure random number generation in keypair
Aliases: CVE-2021-41117
Severity: HIGH
CWE: CWE-335
Published: 2021-10-11T17:09:05Z

## Description and Impact

A bug in the pseudo-random number generator used by [keypair](https://github.com/juliangruber/keypair) versions up to and including 1.0.3 could allow for weak RSA key generation. This could enable an attacker to decrypt confidential messages or gain authorized access to an account belonging to the victim. We recommend replacing any RSA keys that were generated using keypair version 1.0.3 or earlier.

## Fix

* The [bug](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L1008) in the pseudo-random number generator is fixed in commit [`9596418`](https://github.com/juliangruber/keypair/commit/9596418d3363d3e757676c0b6a8f2d35a9d1cb18).
* If the crypto module is available, it is used instead of the pseudo-random number generator. Also fixed in [`9596418`](https://github.com/juliangruber/keypair/commit/9596418d3363d3e757676c0b6a8f2d35a9d1cb18)

## Additional Details

The specific [line](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L1008) with the flaw is:

```javascript
b.putByte(String.fromCharCode(next & 0xFF))
```

The [definition](https://github.com/juliangruber/keypair/blob/87c62f255baa12c1ec4f98a91600f82af80be6db/index.js#L350-L352) of `putByte` is 

```javascript
util.ByteBuffer.prototype.putByte = function(b) {
  this.data += String.fromCharCode(b);
};
```

Simplified, this is `String.fromCharCode(String.fromCharCode(next & 0xFF))`. This results in most of the buffer containing zeros. An example generated buffer:

(Note: truncated for brevity)

```
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x04\x00\x00\x00....\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
```

Since it is masking with 0xFF, approximately 97% of the bytes are converted to zeros. The impact is that each byte in the RNG seed has a 97% chance of being 0 due to incorrect conversion.

## Credit

This issue was reported to GitHub Security Lab by Ross Wheeler of Axosoft. It was discovered by Axosoft engineer Dan Suceava, who noticed that [keypair](https://github.com/juliangruber/keypair) was regularly generating duplicate RSA keys. GitHub security engineer [@vcsjones (Kevin Jones)](https://github.com/vcsjones) independently investigated the problem and identified the cause and source code location of the bug.
Vulnerability: GHSA-hxcc-f52p-wc94
Summary: Insecure serialization leading to RCE in serialize-javascript
Aliases: CVE-2020-7660
Severity: HIGH
CWE: CWE-502
Published: 2020-08-11T17:21:13Z

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". 

An object such as `{"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"}` was serialized as `{"foo": /1"/, "bar": "a\/1"/}`, which allows an attacker to escape the `bar` key. This requires the attacker to control the values of both `foo` and `bar` and guess the value of `<UID>`. The UID has a keyspace of approximately 4 billion making it a realistic network attack.
Vulnerability: GHSA-cvx3-pqmj-x57x
Summary: Downloads Resources over HTTP in scalajs-standalone-bin
Aliases: CVE-2016-10634
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:13Z

Affected versions of `scalajs-standalone-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `scalajs-standalone-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-27g8-r9vw-765x
Summary: Private Field data leak
Aliases: CVE-2021-32624
Severity: HIGH
CWE: CWE-200
Published: 2021-05-27T18:39:03Z

This security advisory relates to a newly discovered capability in our query infrastructure to directly or indirectly expose the values of private fields, bypassing the configured access control.

This is an access control related oracle attack in that the attack method guides an attacker during their attempt to reveal information they do not have access to. The complexity of completing the attack is limited by some length-dependent behaviors and the fidelity of the exposed information.

### Impact

Under some circumstances, field values or field value meta data can be determined, despite the field or list having `read` access control configured. If you use private fields or lists, you may be impacted.

### Patches

None, at this time

### Workarounds

None, at this time

### References

None

### For more information

For the protection of the community and private deployments, we think that the best course of action will be to not disclose further details on any open GitHub issues related to this advisory until a hot-fix or work-around has been deployed or published.

If needed, you can email us at keystone@thinkmill.com.au
Vulnerability: GHSA-xr53-m937-jr9c
Summary: Cross-Site Scripting in ngx-md
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T15:49:14Z

Versions of `ngx-md` prior to 6.0.3 are vulnerable to Cross-Site Scripting.  Links are not properly restricted to http/https and can contain JavaScript which may lead to arbitrary code execution. Markdown input such as `[Click Me](javascript:alert('Injected!'%29)` is rendered as a `Click Me` link that executes JavaScript.


## Recommendation

Upgrade to version 6.0.3 or later.
Vulnerability: GHSA-hgpf-97c5-74fc
Summary: Regular expression denial of service in @absolunet/kafe
Aliases: CVE-2020-7761
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-10T19:08:29Z

This affects the package @absolunet/kafe before 3.2.10. It allows cause a denial of service when validating crafted invalid emails.
Vulnerability: GHSA-cwcx-rxgc-cmw3
Summary: Prototype pollution in 101
Aliases: CVE-2021-25943
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-17T20:57:40Z

Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-p3jx-g34v-q56j
Summary: Malicious Package in j3-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:54:02Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-fgfj-rj24-mj7q
Summary: Malicious Package in kraken-api
Severity: CRITICAL
Published: 2020-09-02T21:47:08Z

Version 0.1.8 of `kraken-api` contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-v3px-6cc8-f8j3
Summary: Path traversal in servey
Aliases: CVE-2020-8214
Severity: HIGH
CWE: CWE-22
Published: 2021-05-07T15:56:19Z

A path traversal vulnerability in servey versions prior to 3.3.2 allows an attacker to read content of any arbitrary file.
Vulnerability: GHSA-3fc5-9x9m-vqc4
Summary: Privilege Escalation in express-cart
Severity: CRITICAL
Published: 2019-06-03T17:31:32Z

Versions of `express-cart` before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users.


## Recommendation

Update to version 1.1.6 or later.
Vulnerability: GHSA-mc23-976p-j42x
Summary: Low severity vulnerability that affects xterm
Aliases: CVE-2019-0542
Severity: LOW
Published: 2019-01-14T16:19:55Z

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.
Vulnerability: GHSA-487w-pqcm-63hq
Summary: Command injection in buns
Aliases: CVE-2020-7794
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2021-01-13T18:22:13Z

There is a command injection vulnerability in all versions of package buns. The injection point is located in line 678 in index file lib/index.js in the exported function install(requestedModule).
Vulnerability: GHSA-6g6m-m6h5-w9gf
Summary: Authorization bypass in express-jwt
Aliases: CVE-2020-15084
Severity: HIGH
CWE: CWE-285
Published: 2020-06-30T16:05:24Z

### Overview
Versions before and including 5.3.3, we are not enforcing the **algorithms** entry to be specified in the configuration.
When **algorithms** is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. 

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

You are using express-jwt
AND 
You do not have **algorithms**  configured in your express-jwt configuration.
AND
You are using libraries such as jwks-rsa as the **secret**. 

### How to fix that?
Specify **algorithms** in the express-jwt configuration. The following is an example of a proper configuration

``` 
const checkJwt = jwt({
  secret: jwksRsa.expressJwtSecret({
    rateLimit: true,
    jwksRequestsPerMinute: 5,
    jwksUri: `https://${DOMAIN}/.well-known/jwks.json`
  }),
  // Validate the audience and the issuer.
  audience: process.env.AUDIENCE,
  issuer: `https://${DOMAIN}/`,
  // restrict allowed algorithms
  algorithms: ['RS256']
}); 
```

### Will this update impact my users?
The fix provided in patch will not affect your users if you specified the algorithms allowed. The patch now makes **algorithms** a required configuration. 


### Credit
IST Group
Vulnerability: GHSA-g53w-52xc-2j85
Summary: Cross-Site Scripting in react
Aliases: CVE-2013-7035
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-04T16:52:57Z

Affected versions of `react` are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.


## Recommendation

If you are using `react` 0.5.x, upgrade to version 0.5.2 or later.
If you are using `react` 0.4.x, upgrade to version 0.4.2 or later.
Vulnerability: GHSA-gm9x-q798-hmr4
Summary: Command Injection in git-tags-remote
Severity: HIGH
CWE: CWE-78
Published: 2020-07-29T14:53:40Z

All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the `repo` value passed to the function is user-controlled.  

The following proof-of-concept creates a file in `/tmp`:  
```
const gitTagsRemote = require('git-tags-remote');

gitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo "Injection Success" > /tmp/command-injection.test')
.then(tags => console.log(tags));
```
Vulnerability: GHSA-4q79-fch7-g78q
Summary: Downloads Resources over HTTP in grunt-webdriver-qunit
Aliases: CVE-2016-10606
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:48:11Z

Affected versions of `grunt-webdriver-qunit` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `grunt-webdriver-qunit`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.