TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-h44f-769q-j6px
Summary: Malicious Package in requet
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:33:14Z

All versions of `requet` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-5947-m4fg-xhqg
Summary: Prototype Pollution in lodash.mergewith
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T18:08:10Z

Versions of `lodash.mergewith` before 4.6.1 are vulnerable to Prototype Pollution. The function 'mergeWith' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.
Vulnerability: GHSA-9p64-h5q4-phpm
Summary: Remote Code Execution in office-converter
Severity: HIGH
CWE: CWE-20
Published: 2020-09-02T15:44:58Z

All versions of `office-converter` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-9jm3-5835-537m
Summary: Command Injection in apex-publish-static-files
Aliases: CVE-2018-16462
Severity: CRITICAL
CWE: CWE-77
Published: 2018-11-01T14:48:50Z

Versions of `apex-publish-static-files` before 2.0.1 are vulnerable to command injection. This is exploitable if user input is passed into the `connectString` option in the `publish` method.


## Recommendation

Update to version 2.0.1 or later.
Vulnerability: GHSA-xqp8-w826-hh6x
Summary: Crash server with query parameter
Aliases: CVE-2021-39187
Severity: HIGH
CWE: CWE-74, CWE-20, CWE-755
Published: 2021-09-02T16:51:14Z

### Impact
Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch.

### Patches
Upgrade to Parse Server 4.10.3
Vulnerability: GHSA-236h-rqv8-8q73
Summary: GraphQL: Security breach on Viewer query
Aliases: CVE-2020-15126
Severity: HIGH
CWE: CWE-863
Published: 2020-07-22T23:06:47Z

### Impact
An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object.

### Patches
This vulnerability has been patched in Parse Server 4.3.0.

### Workarounds
No

### References
See [commit 78239ac](https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa) for details.
Vulnerability: GHSA-8462-q7x7-g2x4
Summary: High severity vulnerability that affects bson
Aliases: CVE-2018-13863
Severity: HIGH
CWE: CWE-400, CWE-185
Published: 2018-09-17T20:44:58Z

The MongoDB bson JavaScript module (also known as js-bson) versions 0.5.0 to 1.0.x before 1.0.5 is vulnerable to a Regular Expression Denial of Service (ReDoS) in lib/bson/decimal128.js. The flaw is triggered when the Decimal128.fromString() function is called to parse a long untrusted string.
Vulnerability: GHSA-7h8x-wmq2-7mff
Summary: Command injection in launchpad
Aliases: CVE-2021-23330
Severity: CRITICAL
CWE: CWE-77
Published: 2021-04-13T15:20:20Z

All versions of package launchpad are vulnerable to Command Injection via stop.
Vulnerability: GHSA-q48g-p5cx-c7c7
Summary: Directory Traversal in yzt
Aliases: CVE-2017-16221
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:36:42Z

Affected versions of `yzt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-xmh9-rg6f-j3mr
Summary: Verification flaw in Solid identity-token-verifier
Severity: MODERATE
CWE: CWE-290
Published: 2021-03-12T22:39:01Z

### Impact
#### Severity
Any Pod on a Solid server using a vulnerable version of the identity-token-verifier library is at risk of a spoofed Demonstration of Proof-of-Possession (DPoP) token binding. This vulnerability could give total and complete access to a targeted Pod.

#### Summary
A verification flaw in the implementation of the identity token verifier library (https://github.com/solid/identity-token-verifier) allows DPoP proofs to be spoofed. 

DPoP proofs are used to bind access tokens to a private key meant to be in sole possession of a specific user. Instead of verifying against the hash of an embedded public key, the library instead verifies against a field that an attacker can modify to spoof another user’s DPoP. 

A stolen DPoP proof, when used in the right context, therefore allows the rebinding of a DPoP-bound access token. Any attacker in possession of a targeted access token could build an attack environment to replay it on any Pod service with this vulnerability.  


### Patches
A new version 0.5.2 of identity-token-verifier fixes the verification: https://github.com/solid/identity-token-verifier/blob/7e18d86d65ee681e8ae912b6a032a1bae3cae570/src/lib/DPoP.ts#L25-L35

### Workarounds
None

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [identity-token-verifier](https://github.com/solid/identity-token-verifier/) repository.
* Email: info@solidproject.org
Vulnerability: GHSA-4f9m-pxwh-68hg
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:20:14Z

Versions of `swagger-ui` prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 3.20.9 or later.
Vulnerability: GHSA-hc9w-4p87-j549
Summary: Prototype Pollution in cached-path-relative
Aliases: CVE-2018-16472
Severity: HIGH
CWE: CWE-400
Published: 2018-11-07T20:46:25Z

Version of `cached-path-relative` before 1.0.2 are vulnerable to prototype pollution.


## Recommendation

Update to version 1.0.2 or later.
Vulnerability: GHSA-h33p-5j96-w8qh
Summary: OS Command Injection in gulkp-styledocco
Aliases: CVE-2020-7607
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-07T16:14:48Z

gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument &#39;options&#39; of the exports function in &#39;index.js&#39; can be controlled by users without any sanitization.
Vulnerability: GHSA-rw53-q8x7-ccx8
Summary: Malicious Package in buffer-xkr
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:55:17Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-mh6f-8j2x-4483
Summary: Critical severity vulnerability that affects event-stream and flatmap-stream
Severity: CRITICAL
CWE: CWE-506
Published: 2018-11-26T23:58:21Z

The NPM package `flatmap-stream` is considered malicious.  A malicious actor added this package as a dependency to the NPM `event-stream` package in version `3.3.6`.  Users of `event-stream` are encouraged to downgrade to the last non-malicious version, `3.3.4`, or upgrade to the latest  4.x version. 

Users of `flatmap-stream` are encouraged to remove the dependency entirely.
Vulnerability: GHSA-j8r2-2x94-2q67
Summary: Cross-Site Scripting in diagram-js-direct-editing
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:19:09Z

Versions of `diagram-js-direct-editing` prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.4.3 or later.
Vulnerability: GHSA-8m5v-f2wp-wqr9
Summary: Malicious Package in ali-contributors
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:30:36Z

All versions of `ali-contributors` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qcff-ffx3-m25c
Summary: Command Injection in meta-git
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-04T17:31:44Z

All versions of `meta-git` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `clone` command is vulnerable through the branch name.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-6gg3-pmm7-97xc
Summary: DOM-based XSS in auth0-lock
Aliases: CVE-2020-15119
Severity: LOW
CWE: CWE-79
Published: 2020-08-19T21:05:03Z

### Overview
Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.

- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input.  
- For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.

When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using auth0-lock
- You are using Passwordless or Enterprise connection mode

### How to fix that?
Upgrade to version `11.26.3`

### Will this update impact my users?
The fix provided in patch will not affect your users.

### Credit
https://github.com/mvisat
Vulnerability: GHSA-w9hw-v97w-g5f5
Summary: Malicious Package in bitconi-ops
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:43:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4g53-vp7q-gfjv
Summary: constructEvent does not verify header
Severity: HIGH
Published: 2021-05-28T19:18:28Z

### Impact
Anyone verifying a Stripe webhook request via this library's `constructEvent` function.

### Patches
Upgrade to 1.1.4. 

### Workarounds
Use `await verifyHeader(...)` directly instead of `constructEvent`.

### References
https://github.com/worker-tools/stripe-webhook/issues/1
Vulnerability: GHSA-j377-2x76-558h
Summary: Improper Input Validation in is-email
Aliases: CVE-2021-36716
Severity: HIGH
CWE: CWE-400, CWE-20
Published: 2021-12-10T17:25:21Z

is-email helps validate an email address. A ReDoS (regular expression denial of service) flaw was found in the Segment is-email package before 1.0.1 for Node.js. An attacker that is able to provide crafted input to the isEmail(input) function may cause an application to consume an excessive amount of CPU.
Vulnerability: GHSA-x7q3-67vc-wvcf
Summary: Downloads Resources over HTTP in grunt-images
Aliases: CVE-2016-10645
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2018-08-15T19:05:14Z

Affected versions of `grunt-images` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `grunt-images`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-v9p9-535w-4285
Summary: Prototype Pollution in litespeed.js and appwrite/server-ce
Aliases: CVE-2021-23682
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-02-17T00:00:32Z

This affects the package litespeed.js before 0.3.12; the package appwrite/server-ce from 0.12.0 and before 0.12.2, before 0.11.1. When parsing the query string in the getJsonFromUrl function, the key that is set in the result object is not properly sanitized leading to a Prototype Pollution vulnerability.
Vulnerability: GHSA-9rwj-8mh9-4876
Summary: Malicious Package in carloprojectdiscord
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:19:37Z

All versions of `carloprojectdiscord` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-9qrg-h9g8-c65q
Summary: Prototype Pollution in deep-setter
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:14:26Z

All versions of `deep-setter` are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-23xp-j737-282v
Summary: Path Traversal in takeapeek
Aliases: CVE-2018-16473
Severity: HIGH
CWE: CWE-22
Published: 2018-11-06T23:12:30Z

All versions of `takeapeek` are vulnerable to path traversal exposing files and directories.


## Recommendation

As no fix is currently available for this vulnerability is it is our recommendation to use another static file server.
Vulnerability: GHSA-f72h-wf57-7xwh
Summary: Malicious Package in buffer-xo2
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:58:34Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-fg5w-w99f-rj6w
Summary: Command Injection in @ronomon/opened
Aliases: CVE-2021-29300
Severity: CRITICAL
CWE: CWE-77
Published: 2021-06-08T23:15:35Z

The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.
Vulnerability: GHSA-qr4m-jcvc-3382
Summary: Prototype Pollution in dot-notes
Aliases: CVE-2020-7717
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:12:00Z

All versions of package dot-notes up to and including version 3.2.0 are vulnerable to Prototype Pollution via the create function.
Vulnerability: GHSA-chwr-hf3w-c984
Summary: Regular Expression Denial of Service in dat.gui
Aliases: CVE-2020-7755
Severity: HIGH
CWE: CWE-400
Published: 2021-05-10T18:44:38Z

All versions of package dat.gui are vulnerable to Regular Expression Denial of Service (ReDoS) via specifically crafted rgb and rgba values.
Vulnerability: GHSA-wrvr-8mpx-r7pp
Summary: Regular Expression Denial of Service in mime
Aliases: CVE-2017-16138
Severity: MODERATE
CWE: CWE-400
Published: 2018-07-20T16:20:52Z

Affected versions of `mime` are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.


## Recommendation

Update to version 2.0.3 or later.
Vulnerability: GHSA-7p6w-x2gr-rrf8
Summary: Cross-Site Scripting in ag-grid-community
Severity: HIGH
CWE: CWE-79
Published: 2020-09-02T21:28:05Z

Versions of `ag-grid-community` prior to 14.0.0 are vulnerable to Cross-Site Scripting (XSS). Grid contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid. 


## Recommendation

Upgrade to version 14.0.0 or later
Vulnerability: GHSA-6fc8-4gx4-v693
Summary: ReDoS in Sec-Websocket-Protocol header
Aliases: CVE-2021-32640
Severity: MODERATE
CWE: CWE-345, CWE-400
Published: 2021-05-28T19:19:03Z

### Impact

A specially crafted value of the `Sec-Websocket-Protocol` header can be used to significantly slow down a ws server.

### Proof of concept

```js
for (const length of [1000, 2000, 4000, 8000, 16000, 32000]) {
  const value = 'b' + ' '.repeat(length) + 'x';
  const start = process.hrtime.bigint();

  value.trim().split(/ *, */);

  const end = process.hrtime.bigint();

  console.log('length = %d, time = %f ns', length, end - start);
}
```

### Patches

The vulnerability was fixed in ws@7.4.6 (https://github.com/websockets/ws/commit/00c425ec77993773d823f018f64a5c44e17023ff) and backported to ws@6.2.2 (https://github.com/websockets/ws/commit/78c676d2a1acefbc05292e9f7ea0a9457704bf1b) and ws@5.2.3 (https://github.com/websockets/ws/commit/76d47c1479002022a3e4357b3c9f0e23a68d4cd2).

### Workarounds

In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the [`--max-http-header-size=size`](https://nodejs.org/api/cli.html#cli_max_http_header_size_size) and/or the [`maxHeaderSize`](https://nodejs.org/api/http.html#http_http_createserver_options_requestlistener) options.

### Credits

The vulnerability was responsibly disclosed along with a fix in private by [Robert McLaughlin](https://github.com/robmcl4) from University of California, Santa Barbara.
Vulnerability: GHSA-xq98-5rcf-5wqh
Summary: Directory Traversal in badjs-sourcemap-server
Aliases: CVE-2017-16036
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T15:43:02Z

Affected versions of `badjs-sourcemap-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-9x64-5r7x-2q53
Summary: Malicious Package in flatmap-stream
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T21:21:32Z

Version 0.1.1 of `flatmap-stream` is considered malicious.

This module runs an encrypted payload targeting a very specific application, `copay` and because they shared the same description it would have likely worked for `copay-dash`.

The injected code:

- Read in AES encrypted data from a file disguised as a test fixture
- Grabbed the npm package description of the module that imported it, using an automatically set environment variable
- Used the package description as a key to decrypt a chunk of data pulled in from the disguised file

The decrypted data was part of a module, which was then compiled in memory and executed.

This module performed the following actions:

- Decrypted another chunk of data from the disguised file
- Concatenated a small, commented prefix from the first decrypted chunk to the end of the second decrypted chunk
- Performed minor decoding tasks to transform the concatenated block of code from invalid JS to valid JS (we believe this was done to evade detection by dynamic analysis tools)
- Wrote this processed block of JS out to a file stored in a dependency that would be packaged by the build scripts: 

The chunk of code that was written out was the actual malicious code, intended to be run on devices owned by the end users of Copay.

This code would do the following:

- Detect the current environment: Mobile/Cordova/Electron
- Check the Bitcoin and Bitcoin Cash balances on the victim's copay account
- If the current balance was greater than 100 Bitcoin, or 1000 Bitcoin Cash:
  - Harvest the victim's account data in full
  - Harvest the victim's copay private keys
  - Send the victim's account data/private keys off to a collection


## Recommendation

If you find this module in your environment it's best to remove it. The malicious version of event-stream and flatmap-stream have been removed from the npm Registry.
Vulnerability: GHSA-rhvc-x32h-5526
Summary: No CSRF Validation in droppy
Aliases: CVE-2016-10529
Severity: HIGH
CWE: CWE-352
Published: 2019-02-18T23:39:32Z

Affected versions of `droppy`  are vulnerable to cross-site socket forgery. The package does not perform verification for cross-domain websocket requests, and as a result, an attacker can create a web page that opens up a websocket connection on behalf of the user visiting the page. The attacker can then perform any action that the target user could, including adding a new admin account under their control, or deleting others.


## Recommendation

Update to version 3.5.0 or later.
Vulnerability: GHSA-m428-jqc4-2p5j
Summary: Prototype Pollution in phpjs
Aliases: CVE-2020-7700
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T17:28:46Z

All versions of phpjs up to and including 1.3.2 are vulnerable to Prototype Pollution via parse_str. phpjs is no longer maintained and users are advised to use Locutus as a replacement (https://github.com/locutusjs/locutus)
Vulnerability: GHSA-46fh-8fc5-xcwx
Summary: Prototype Pollution in lodash.defaultsdeep
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T18:09:16Z

Versions of `lodash.defaultsdeep` before 4.6.1 are vulnerable to Prototype Pollution. The function 'defaultsDeep' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.
Vulnerability: GHSA-q643-w9jp-q2qg
Summary: Hardcoded Initialization Vector in parsel
Severity: HIGH
Published: 2020-09-04T17:34:59Z

All versions of `parsel` have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.
Vulnerability: GHSA-c2vr-2c89-ph88
Summary: Downloads Resources over HTTP in node-bsdiff-android
Aliases: CVE-2016-10641
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2018-09-18T13:49:54Z

Affected versions of `node-bsdiff-android` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-qfcv-5whw-7pcw
Summary: Exposure of Sensitive Information to an Unauthorized Actor in AEgir
Aliases: CVE-2020-11059
Severity: CRITICAL
CWE: CWE-200
Published: 2020-05-27T21:09:15Z

### Impact
`aegir publish` and `aegir build` may leak secrets from environmental variables in the browser bundle published to npm.

### Patches
The code has been patched, users should upgrade to >= 21.10.1

### Workarounds
Run `printenv` to check your environment variables and revoke any secrets.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [aegir](https://github.com/ipfs/aegir)
Vulnerability: GHSA-72fv-qgj6-2w2p
Summary: Cross-site Scripting in NodeBB
Aliases: CVE-2015-9286
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-01T18:37:08Z

Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.
Vulnerability: GHSA-9cph-cqqh-36pw
Summary: Malicious Package in babel-loqder
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:29:25Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rch7-f4h5-x9rj
Summary: Identity Spoofing in libp2p-secio
Severity: CRITICAL
CWE: CWE-290
Published: 2019-08-23T00:04:52Z

Affected versions of `libp2p-secio` does not correctly verify that the `PeerId` of `DstPeer` matches the `PeerId` discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability. 


## Recommendation

Update to version 0.9.0 or later.
Vulnerability: GHSA-mm62-wxc8-cf7m
Summary: Code Execution Through IIFE in serialize-to-js
Aliases: CVE-2017-5954
Severity: CRITICAL
CWE: CWE-502
Published: 2018-07-18T18:27:41Z

Affected versions of `serialize-to-js` may be vulnerable to arbitrary code execution through an Immediately Invoked Function Expression (IIFE). 

## Proof of Concept
```
var payload = "{e: (function(){ eval('console.log(`exploited`)') })() }"
var serialize = require('serialize-to-js');
serialize.deserialize(payload);
```


## Recommendation

Update to version 1.0.0, or later, and review [this disclaimer](https://www.npmjs.com/package/serialize-to-js#deserialize) from the author.
Vulnerability: GHSA-9r27-994c-4xch
Summary: discord-html not escaping HTML code blocks when lacking a language identifier
Severity: HIGH
Published: 2020-02-24T17:34:02Z

### Impact
Any website using discord-markdown with user-generated markdown is vulnerable to having code injected into the page where the markdown is displayed.

### Patches
This has been patched in version 2.3.1

### Workarounds
Escape the characters `&lt;&gt;&amp;` before sending plain code blocks to discord-markdown.

### References
https://github.com/brussell98/discord-markdown/issues/13
Vulnerability: GHSA-h7pc-85cg-wmch
Summary: Downloads Resources over HTTP in kindlegen
Aliases: CVE-2016-10575
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:35:10Z

Affected versions of `kindlegen` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `kindlegen`.


## Recommendation

Update to version 1.1.0 or greater.
Vulnerability: GHSA-w222-53c6-c86p
Summary: Remote Code Execution in electron
Aliases: CVE-2018-1000006
Severity: HIGH
CWE: CWE-78
Published: 2018-01-23T03:57:44Z

Affected versions of `electron` may be susceptible to a remote code execution flaw when certain conditions are met:
1. The electron application is running on Windows.
2. The electron application registers as the default handler for a protocol, such as `nodeapp://`.

This vulnerability is caused by a failure to sanitize additional arguments to chromium in the command line handler for Electron.

MacOS and Linux are not vulnerable.


## Recommendation

Update electron to a version that is not vulnerable. If updating is not possible, the electron team has provided the following guidance:


If for some reason you are unable to upgrade your Electron version, you can append `--` as the last argument when calling `app.setAsDefaultProtocolClient`, which prevents Chromium from parsing further options. The double dash `--` signifies the end of command options, after which only positional parameters are accepted.
```
app.setAsDefaultProtocolClient(protocol, process.execPath, [
  '--your-switches-here',
  '--'
])
```
Vulnerability: GHSA-jp27-cwp2-5qqr
Summary: Hijacked Environment Variables in jquery.js
Aliases: CVE-2017-16045
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-23T20:54:24Z

The `jquery.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-582f-p4pg-xc74
Summary: Regular Expression Denial of Service in csv-parse
Aliases: CVE-2019-17592
Severity: HIGH
CWE: CWE-400, CWE-20
Published: 2019-10-15T20:06:16Z

Versions of `csv-parse` prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The `__isInt()` function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the `cast` option.


## Recommendation

Upgrade to version 4.4.6 or later.
Vulnerability: GHSA-xh8g-j88w-6v59
Summary: Malicious Package in cionstring
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:42:16Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-34r7-q49f-h37c
Summary: Incorrect Handling of Non-Boolean Comparisons During Minification in uglify-js
Aliases: CVE-2015-8857
Severity: CRITICAL
CWE: CWE-1254
Published: 2017-10-24T18:33:36Z

Versions of `uglify-js` prior to 2.4.24 are affected by a vulnerability which may cause crafted JavaScript to have altered functionality after minification.

## Recommendation

Upgrade UglifyJS to version >= 2.4.24.
Vulnerability: GHSA-3cpj-mj3q-82wr
Summary: Malicious Package in bs58chek
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:49:43Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-5635-9mvj-r6hp
Summary: Malicious Package in vue-backbone
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T02:34:39Z

Version 0.1.2 of `vue-backbone` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-3wj8-vp9h-rm6m
Summary: Remote Code Execution (RCE)
Aliases: CVE-2021-23344
Severity: CRITICAL
CWE: CWE-94
Published: 2021-03-19T21:32:20Z

The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.
Vulnerability: GHSA-3fw4-4h3m-892h
Summary: OS Command Injection in serial-number
Aliases: CVE-2019-10804
Severity: HIGH
CWE: CWE-78
Published: 2021-04-13T15:22:19Z

serial-number through 1.3.0 allows execution of arbritary commands. The &quot;cmdPrefix&quot; argument in serialNumber function is used by the &quot;exec&quot; function without any validation.
Vulnerability: GHSA-mq76-m7gv-xhfm
Summary: Downloads Resources over HTTP in sauce-connect
Aliases: CVE-2016-10599
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:34:00Z

Affected versions of `sauce-connect` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `sauce-connect`.


## Recommendation

No patch is currently available for this vulnerability, and this package has not been updated since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-cr3q-pqgq-m8c2
Summary: Spoofing attack in swagger-ui
Aliases: CVE-2018-25031
Severity: MODERATE
CWE: CWE-20
Published: 2022-03-12T00:00:36Z

Swagger UI before 4.1.3 could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
Vulnerability: GHSA-8hrq-9wm7-v3jw
Summary: Malicious Package in btffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:39:41Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-vh5w-fg69-rc8m
Summary: Improper Input Validation in Google Closure Library
Aliases: CVE-2020-8910
Severity: MODERATE
CWE: CWE-20
Published: 2021-05-07T16:06:34Z

A URL parsing issue in goog.uri of the Google Closure Library versions up to and including v20200224 allows an attacker to send malicious URLs to be parsed by the library and return the wrong authority. Mitigation -- update your library to version v20200315.
Vulnerability: GHSA-5xjx-4xcm-hpcm
Summary: Prototype Pollution in ts-nodash
Aliases: CVE-2021-23403
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-12-10T18:53:42Z

`ts-nodash` before version 1.2.7 is vulnerable to Prototype Pollution via the Merge() function due to lack of validation input.
Vulnerability: GHSA-c6c4-jmqx-3r33
Summary: Open Redirect in xdLocalStorage
Aliases: CVE-2020-11611
Severity: MODERATE
CWE: CWE-601
Published: 2021-12-09T19:30:14Z

An issue was discovered in xdLocalStorage through 2.0.5. The buildMessage() function in xdLocalStorage.js specifies the wildcard (*) as the targetOrigin when calling the postMessage() function on the iframe object. Therefore any domain that is currently loaded within the iframe can receive the messages that the client sends.
Vulnerability: GHSA-g7mw-5cq6-fv82
Summary: Cross-Site Scripting in wangeditor
Severity: HIGH
CWE: CWE-79
Published: 2020-09-02T21:20:40Z

All versions of `wangeditor` are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-c6rp-xvqv-mwmf
Summary: Cross-site Scripting in epubjs
Aliases: CVE-2021-33040
Severity: HIGH
CWE: CWE-79
Published: 2022-01-21T23:52:17Z

managers/views/iframe.js in FuturePress EPub.js before 0.3.89 allows XSS.
Vulnerability: GHSA-rwg6-3fmj-w4wx
Summary: Hijacked Environment Variables in tkinter
Aliases: CVE-2017-16061
Severity: CRITICAL
CWE: CWE-506, CWE-433
Published: 2018-11-01T14:47:21Z

The `tkinter` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-q26w-wjj2-22vv
Summary: Cross-site scripting in Joplin
Aliases: CVE-2020-28249
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-10T18:47:36Z

Joplin allows XSS via a LINK element in a note.
Vulnerability: GHSA-94m7-w873-6wwf
Summary: Malicious Package in modlibrary
Severity: CRITICAL
Published: 2020-09-01T20:28:56Z

Version 0.1.1 of `modlibrary` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.1.1 of this module is found installed you will want to replace it with a version before or after 0.1.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-v3r2-3fp4-rp46
Summary: Prototype pollution in paypal-adaptive
Aliases: CVE-2020-7643
Severity: MODERATE
CWE: CWE-400
Published: 2021-12-10T20:05:57Z

paypal-adaptive through 0.4.2 manipulation of JavaScript objects resulting in Prototype Pollution. The PayPal function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Vulnerability: GHSA-f3pc-c2gf-hvgw
Summary: Malicious Package in requets
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:13:14Z

All versions of `requets` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-v6cj-r88p-92rm
Summary: Buffer Overflow in centra
Severity: HIGH
CWE: CWE-119
Published: 2019-09-30T19:31:59Z

## Denial of Service

### Impact

Affected Centra versions will, when not in stream mode, buffer responses to requests into memory with no size limit. This issue affects anyone requesting content from untrusted sources.

### Patches

Version 2.4.0 resolves the issue by limiting the size of buffered response body.

### Workarounds

Attempting workarounds isn't recommended. Updating is preferred.

### For more information

If you have any questions or comments about this advisory, open an issue in [ethanent/centra](https://github.com/ethanent/centra).
Vulnerability: GHSA-788m-pj96-7w2c
Summary: Cross-Site Scripting in fomantic-ui
Severity: HIGH
CWE: CWE-79
Published: 2020-09-02T21:23:51Z

Versions of `fomantic-ui` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.


## Recommendation

Upgrade to version 2.7.0 or later.
Vulnerability: GHSA-8f9f-pc5v-9r5h
Summary: Malicious takeover of previously owned ENS names
Aliases: CVE-2020-5232
Severity: CRITICAL
CWE: CWE-285
Published: 2020-01-30T23:55:04Z

### Impact
A user who owns an ENS domain can set a "trapdoor", allowing them to transfer ownership to another user, and later regain ownership without the new owner's consent or awareness.

### Patches

A new ENS deployment is being rolled out that fixes this vulnerability in the ENS registry. The registry is newly deployed at [0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e](https://etherscan.io/address/0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e).

### Workarounds
Do not accept transfers of ENS domains from other users on the old registrar.
Vulnerability: GHSA-r628-mhmh-qjhw
Summary: Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning
Aliases: CVE-2021-32803
Severity: HIGH
CWE: CWE-23, CWE-22
Published: 2021-08-03T19:00:40Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

`node-tar` aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks.  Additionally, in order to prevent unnecessary `stat` calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the `node-tar` directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where `node-tar` checks for symlinks occur.

By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass `node-tar` symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

### Patches

3.2.3 || 4.4.15 || 5.0.7 || 6.1.2

### Workarounds

Users may work around this vulnerability without upgrading by creating a custom `filter` method which prevents the extraction of symbolic links.

```js
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})
```

Users are encouraged to upgrade to the latest patch versions, rather than attempt to sanitize tar input themselves.
Vulnerability: GHSA-563h-697m-j7x5
Summary: Malicious Package in device-mqtt
Severity: CRITICAL
Published: 2020-09-03T19:18:58Z

Version 1.0.11 of `device-mqtt` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-62gr-4qp9-h98f
Summary: Regular Expression Denial of Service in Handlebars
Aliases: CVE-2019-20922
Severity: HIGH
CWE: CWE-400
Published: 2022-02-10T20:38:22Z

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.
Vulnerability: GHSA-g6ww-v8xp-vmwg
Summary: Prototype pollution in pathval
Aliases: CVE-2020-7751
Severity: HIGH
CWE: CWE-20, CWE-1321
Published: 2022-02-10T20:21:24Z

A prototype pollution vulnerability affects all versions of package pathval under 1.1.1.
Vulnerability: GHSA-46c4-8wrp-j99v
Summary: Improper Validation and Sanitization in url-parse
Aliases: CVE-2020-8124
Severity: MODERATE
CWE: CWE-20
Published: 2022-01-06T20:30:34Z

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
Vulnerability: GHSA-rh6c-q938-3r9q
Summary: Moderate severity vulnerability that affects validator
Aliases: CVE-2013-7452
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via a crafted javascript URI.
Vulnerability: GHSA-j3ff-xp6c-6gcc
Summary: Failure to validate signature during handshake
Aliases: CVE-2022-24759
Severity: HIGH
CWE: CWE-347
Published: 2022-03-18T18:57:53Z

### Impact
`@chainsafe/libp2p-noise` before 4.1.2 and 5.0.3 was not correctly validating signatures during the handshake process.
This may allow a man-in-the-middle to pose as other peers and get those peers banned.

### Patches
Users should upgrade to 4.1.2 or 5.0.3

### Workarounds
No workarounds, just patch upgrade

### References
https://github.com/ChainSafe/js-libp2p-noise/pull/130
Vulnerability: GHSA-c7m7-4257-h698
Summary: Prototype Pollution in templ8
Aliases: CVE-2020-7702
Severity: CRITICAL
CWE: CWE-915
Published: 2021-05-06T17:29:13Z

All versions of package templ8 up to and including 0.0.44 are vulnerable to Prototype Pollution via the parse function.
Vulnerability: GSD-2022-1000074
Summary: malicious code in PyPi Humanqueen version all
Published: 2022-02-02T18:53:12.653286Z

In the PyPi Easyfuncsys package there is malicious code that appears to be stealing Discord tokens allowing it to access Discord as that user, additionally it appears to be stealing leveldb files.