TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4wv4-mgfq-598v
Summary: Code injection in nobelprizeparser
Severity: CRITICAL
CWE: CWE-94
Published: 2021-03-12T23:00:19Z

Code injection through use of eval.
Vulnerability: GHSA-jxcc-g75x-qgw9
Summary: Arbitrary File Write via Archive Extraction (Zip Slip)
Aliases: CVE-2021-23391
Severity: HIGH
CWE: CWE-668, CWE-29
Published: 2021-06-08T18:47:18Z

This affects all versions of package calipso. It is possible for a malicious module to overwrite files on an arbitrary file system through the module install functionality.
Vulnerability: GHSA-m4vv-p6fq-jhqp
Summary: Directory Traversal in @vivaxy/here
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T19:04:07Z

The @vivaxy/here module is a small web server that serves files with the process' working directory acting as the web root.

It is vulnerable to a directory traversal attack. 

This means that files on the local file system which exist outside of the web root may be disclosed to an attacker. This might include confidential files.

Mitigating Factors:
If the node process is run as a user with very limited filesystem permissions, there is significantly less risk of exposing confidential/private information.


Proof of Concept:
```
curl "http://${SERVER_IP}:${SERVER_PORT}/..%2f..%2fetc/passwd"
```


## Recommendation

Run `npm i @vivaxy/here` to install the latest version that addresses this vulnerability.
Vulnerability: GHSA-pm9v-325f-5g74
Summary: Malicious Package in saync
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:30:11Z

All versions of `saync ` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-h86x-mv66-gr5q
Summary: OS Command Injection in Locutus
Aliases: CVE-2020-13619
Severity: CRITICAL
CWE: CWE-78
Published: 2021-07-26T21:21:43Z

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution.
Vulnerability: GHSA-wq7q-5v6j-xfv6
Summary: Command Injection in picotts
Aliases: CVE-2021-23378
Severity: CRITICAL
CWE: CWE-77
Published: 2021-05-07T16:06:11Z

This affects all versions up to and including version 0.1.1 of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-3grc-fgh6-g5gp
Summary: Directory Traversal in http_static_simple
Aliases: CVE-2017-16134
Severity: HIGH
CWE: CWE-22, CWE-12
Published: 2018-07-23T22:08:39Z

Affected versions of `http_static_simple` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-gvg7-pp82-cff3
Summary: Cross-Site Scripting in c3
Aliases: CVE-2016-1000240
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-01T15:59:11Z

Affected versions of `c3` are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips. 



## Recommendation

Update to 0.4.11 or later.
Vulnerability: GHSA-73cw-jxmm-qpgh
Summary: Path Traversal in localhost-now
Severity: HIGH
CWE: CWE-22
Published: 2019-06-11T16:40:48Z

All versions of `localhost-now` are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2

Proof of concept:

```
$ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd" 
```


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Vulnerability: GHSA-xhjx-mfr6-9rr4
Summary: Command Injection in samsung-remote
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-01T21:20:28Z

Versions of `samsung-remote` before 1.3.5 are vulnerable to command injection. This vulnerability is exploitable if user input is passed into the `ip` option of the package constructor.


## Recommendation

Update to version 1.3.5 or later.
Vulnerability: GHSA-39q4-p535-c852
Summary: Uncontrolled Resource Consumption in locutus
Aliases: CVE-2021-23392
Severity: HIGH
CWE: CWE-400
Published: 2021-06-10T17:25:05Z

The package locutus before 2.0.15 are vulnerable to Regular Expression Denial of Service (ReDoS) via the gopher_parsedir function.
Vulnerability: GHSA-c2g6-57fp-22wp
Summary: Malicious Package in fuffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:48:35Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-pjxp-f379-6284
Summary: Malicious Package in @fangrong/xoc
Severity: CRITICAL
Published: 2020-09-03T19:13:27Z

Version 1.0.6 of `@fangrong/xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-hw4r-xr38-hm8j
Summary: Downloads Resources over HTTP in unicode-json
Aliases: CVE-2016-10610
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:59Z

Affected versions of `unicode-json` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Install version 2.0.0 or greater.
Vulnerability: GHSA-9c22-pwxw-p6hx
Summary: Initializer reentrancy may lead to double initialization
Severity: LOW
Published: 2021-12-14T21:47:33Z

### Impact

Initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call.

Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible in the scenario described above, breaking the expectation that there is a single execution.

Note that upgradeable proxies are commonly initialized together with contract creation, where reentrancy is not feasible, so the impact of this issue is believed to be minor.

### Patches

A fix is included in the version v4.4.1 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Avoid untrusted external calls during initialization.

### References
https://github.com/OpenZeppelin/openzeppelin-contracts/pull/3006

### Credits

This issue was identified and reported by @chaitinblockchain through [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-crfx-5phg-hmw9
Summary: Cross-Site Scripting in ids-enterprise
Severity: HIGH
CWE: CWE-79
Published: 2019-06-13T18:59:12Z

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
Vulnerability: GHSA-q674-xm3x-2926
Summary: Uncontrolled Resource Consumption in parse-link-header
Aliases: CVE-2021-23490
Severity: HIGH
CWE: CWE-400
Published: 2022-01-06T21:37:02Z

The package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
Vulnerability: GHSA-p2r2-h92r-w2mg
Summary: Directory Traversal in mfrserver
Aliases: CVE-2017-16213
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:11:03Z

Affected versions of `mfrserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-4q8f-5xxj-946r
Summary: Command Injection in addax
Severity: HIGH
CWE: CWE-77
Published: 2020-09-03T02:40:51Z

Versions of `addax` prior to 1.1.0 are vulnerable to Command Injection. The package does not validate user input on the `presignPath` function which receives input directly from the API endpoint. Exploiting the vulnerability requires authentication. This may allow attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 1.1.0 or later.
Vulnerability: GHSA-226w-6hhj-69hp
Summary: Malicious Package in cal_rd
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:06:52Z

Version 0.1.1 of `rc_cal` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-cfwc-xjfp-44jg
Summary: Command Injection in gnuplot
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-04T17:19:48Z

All versions of `gnuplot` are vulnerable to Command Injection. The package fails to sanitize plot titles, which may allow attackers to execute arbitrary code in the system if the title value is supplied by a user. The following proof-of-concept creates a `testing` file in the current directory:

```
var gnuplot = require('gnuplot');

const title = '"\nset title system("touch testing")\n#';

gnuplot()
.set('term png')
.set('output "out.png"')
.set(`title "${title}"`)
.set('xrange [-10:10]')
.set('yrange [-2:2]')
.set('zeroaxis')
.plot('(x/4)**2, sin(x), 1/x')
.end();
```


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-x8rq-rc7x-5fg5
Summary: uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF)
Aliases: CVE-2022-0086
Severity: HIGH
CWE: CWE-918
Published: 2022-01-06T22:24:35Z

uppy's companion module is vulnerable to Server-Side Request Forgery (SSRF) via IPv4-mapped IPv6 addresses.
Vulnerability: GHSA-vcjj-xf2r-mwvc
Summary: XSS in knockout
Aliases: CVE-2019-14862
Severity: MODERATE
CWE: CWE-79
Published: 2020-04-01T15:47:45Z

There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
Vulnerability: GHSA-px4h-xg32-q955
Summary: ReDoS in normalize-url
Aliases: CVE-2021-33502
Severity: HIGH
CWE: CWE-400
Published: 2021-06-08T23:11:43Z

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Vulnerability: GHSA-6x33-pw7p-hmpq
Summary: Denial of Service in http-proxy
Severity: HIGH
Published: 2020-09-04T17:59:49Z

Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function.   

For a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception:  
```curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"```


## Recommendation

Upgrade to version 1.18.1 or later
Vulnerability: GHSA-657v-jjf8-83gh
Summary: Malicious Package in jsmsha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:14:55Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-vm64-cfqx-3698
Summary: Code Injection in jsen
Aliases: CVE-2020-7777
Severity: HIGH
CWE: CWE-94
Published: 2022-02-10T20:18:37Z

This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In particular the required field of the schema is not properly sanitized. The resulting string that is build based on the schema definition is then passed to a Function.apply();, leading to an Arbitrary Code Execution.
Vulnerability: GHSA-xp9c-82x8-7f67
Summary: Prototype Pollution in Node-Red
Aliases: CVE-2021-21297
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-02-26T16:31:05Z

### Impact

Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime.

### Patches

The vulnerability is patched in the 1.2.8 release.

### Workarounds

A workaround is to ensure only authorised users are able to access the editor url.

### For more information
If you have any questions or comments about this advisory:
* Email us at [team@nodered.org](mailto:team@nodered.org)

### Acknowledgements

Thanks to the Tencent Woodpecker Security Team for disclosing this vulnerability.
Vulnerability: GHSA-qjmq-8hjr-qcv6
Summary: SQL Injection when creating an application with Reactive SQL backend 
Aliases: CVE-2022-24815
Severity: HIGH
CWE: CWE-89
Published: 2022-04-07T15:18:05Z

### Impact
SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. 

If you have generated a microservice Gateway using the affected version, you might be impacted as Gateways are reactive by default.

Currently, SQL injection is possible in the `findAllBy(Pageable pageable, Criteria criteria)` method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria.

## Impacted applications
- Monolith and microservice applications with SQL database and reactive with Spring WebFlux combination (other combinations are not affected and the issue is only present when you generate entities)
- Gateway applications with SQL database (issue will appear only when generating entities)

### Patches
Patched in v7.8.1

The `findAllBy(Pageable pageable, Criteria criteria)` method has been removed from the entity repositories and `org.springframework.data.relational.core.query.Criteria` support in the underlying methods has been replaced with `org.springframework.data.relational.core.sql.Condition`. This means you won't be able to do custom filtering in the generated applications.

If you have existing reactive applications generated by the impacted version, we advise you to audit for use of `Criteria` and take appropriate actions.

### Workarounds

The problem lies in the `EntityManager.java` class when creating the where clause via `Conditions.just(criteria.toString())`.

`just` accepts the literal string provided. Criteria's `toString` method returns a plain string and this combination is vulnerable to sql injection as the string is not sanitized and will contain whatever used passed as input using any plain SQL

So be careful when combining criterias and conditions. As a workaround we have removed the possibility to pass any user-provided criteria to the `createSelect` method of `EntityManager`.

### Example 

```java
Criteria criteria = Criteria.where("name").is("foobar';DROP TABLE example;--"); // parameter is user provided input
criteria.toString(); // --> "'foobar';DROP TABLE example;--'"
```

### References
[More details in this Issue report](https://github.com/jhipster/generator-jhipster/issues/18269)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JHipster issue tracker](https://github.com/jhipster/generator-jhipster/issues)
Vulnerability: GHSA-8gwj-8hxc-285w
Summary: Prototype Pollution in json-ptr
Aliases: CVE-2021-23509
Severity: MODERATE
CWE: CWE-843, CWE-1321
Published: 2021-11-08T17:43:27Z

This affects the package `json-ptr` before `3.0.0`. A type confusion vulnerability can lead to a bypass of CVE-2020-7766 when the user-provided keys used in the pointer parameter are arrays.
Vulnerability: GHSA-g2q5-5433-rhrf
Summary: Embedded malware in rc
Severity: CRITICAL
CWE: CWE-506
Published: 2021-11-04T16:24:44Z

The npm package `rc` had versions published with malicious code. Users of affected versions (1.2.9, 1.3.9, and 2.3.9) should downgrade to 1.2.8 as soon as possible and check their systems for suspicious activity.
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-58f5-hfqc-jgch
Summary: Padding Oracle Attack due to Observable Timing Discrepancy in jose
Aliases: CVE-2021-29443
Severity: MODERATE
CWE: CWE-696, CWE-203
Published: 2021-04-19T14:57:22Z

jose is an npm library providing a number of cryptographic operations.
### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

All major release versions have had a patch released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `^1.28.1 || ^2.0.5 || >=3.11.4`.

Users should upgrade their v1.x dependency to [`^1.28.1`](https://github.com/panva/jose/releases/tag/v1.28.1), their v2.x dependency to [`^2.0.5`](https://github.com/panva/jose/releases/tag/v2.0.5), and their v3.x dependency to [`^3.11.4`](https://github.com/panva/jose/releases/tag/v3.11.4)

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Vulnerability: GHSA-7f53-fmmv-mfjv
Summary: Regular expression denial of service in react-native
Aliases: CVE-2020-1920
Severity: HIGH
CWE: CWE-400
Published: 2021-07-20T17:33:28Z

A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.
Vulnerability: GHSA-2r2c-g63r-vccr
Summary: Improper Verification of Cryptographic Signature in `node-forge`
Aliases: CVE-2022-24773
Severity: MODERATE
CWE: CWE-347
Published: 2022-03-18T23:10:48Z

### Impact

RSA PKCS#1 v1.5 signature verification code is not properly checking `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
Vulnerability: GHSA-wg6g-ppvx-927h
Summary: Prototype Pollution in cached-path-relative
Aliases: CVE-2021-23518
Severity: HIGH
CWE: CWE-1321
Published: 2022-01-27T14:27:53Z

The package cached-path-relative before 1.1.0 is vulnerable to Prototype Pollution via the cache variable that is set as {} instead of Object.create(null) in the cachedPathRelative function, which allows access to the parent prototype properties when the object is used to create the cached relative path. When using the origin path as __proto__, the attribute of the object is accessed instead of a path. **Note:** This vulnerability derives from an incomplete fix in https://security.snyk.io/vuln/SNYK-JS-CACHEDPATHRELATIVE-72573
Vulnerability: GHSA-mpjf-8cmf-p789
Summary: Cross-Site Scripting in jingo
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T21:25:46Z

Versions of `jingo` prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as `<script>alert(1)</script>` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.


## Recommendation

Upgrade to version 1.9.2
Vulnerability: GHSA-h87q-g2wp-47pj
Summary: Signatures are mistakenly recognized to be valid in jsrsasign
Severity: MODERATE
CWE: CWE-347
Published: 2022-02-09T22:41:19Z

In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack.
Vulnerability: GHSA-hvf8-h2qh-37m9
Summary: IPC messages delivered to the wrong frame in Electron
Aliases: CVE-2020-26272
Severity: MODERATE
CWE: CWE-668
Published: 2021-01-28T19:11:34Z

### Impact
IPC messages sent from the main process to a subframe in the renderer process, through `webContents.sendToFrame`, `event.reply` or when using the `remote` module, can in some cases be delivered to the wrong frame.

If your app does ANY of the following, then it is impacted by this issue:
- Uses `remote`
- Calls `webContents.sendToFrame`
- Calls `event.reply` in an IPC message handler

### Patches
This has been fixed in the following versions:

- 9.4.0
- 10.2.0
- 11.1.0
- 12.0.0-beta.9

### Workarounds
There are no workarounds for this issue.

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
Vulnerability: GHSA-224h-p7p5-rh85
Summary: Directory Traversal in wenluhong1
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:32:26Z

Affected versions of `wenluhong1` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hh27-ffr2-f2jc
Summary: Open redirect in url-parse
Aliases: CVE-2021-3664
Severity: MODERATE
CWE: CWE-601
Published: 2021-08-10T16:07:08Z

# Overview

Affected versions of npm `url-parse` are vulnerable to URL Redirection to Untrusted Site.

# Impact

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.
Vulnerability: GHSA-6fjr-m7v6-fpg9
Summary: Exfiltrates data on installation in jquey
Aliases: CVE-2017-16204
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-06T21:41:38Z

The `jquey` package is malware that attempts to discover and exfiltrate sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

If you have found `jquey` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-r24h-634p-m72x
Summary: Validation Bypass in schema-inspector
Aliases: CVE-2019-10781
Severity: CRITICAL
CWE: CWE-668
Published: 2020-06-10T20:02:47Z

In schema-inspector before 1.6.9, a maliciously crafted JavaScript object can bypass the `sanitize()` and the `validate()` function used within schema-inspector.
Vulnerability: GHSA-rj5f-7c8x-gjg4
Summary: Prototype Pollution in promisehelpers
Aliases: CVE-2020-7723
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:26:07Z

All versions of package promisehelpers up to and including version 0.0.5 are vulnerable to Prototype Pollution via the insert function.
Vulnerability: GHSA-gh4g-3gm9-5wrq
Summary: Cross-Site Scripting in shave
Aliases: CVE-2019-12313
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-29T18:38:08Z

Versions of `shave` prior to 2.5.3 are vulnerable to Cross-Site Scripting. The `shave` package overwrites HTML elements and in doing so fails to properly encode the output. If encoded HTML input is passed into `shave` the output will be decoded which may lead to Cross-Site Scripting.


## Recommendation

Upgrade to version 2.5.3 or later.
Vulnerability: GHSA-f9cm-qmx5-m98h
Summary: Prototype Pollution in merge
Aliases: CVE-2018-16469
Severity: LOW
CWE: CWE-400
Published: 2018-11-01T14:45:42Z

Versions of `merge` before 1.2.1 are vulnerable to prototype pollution. The `merge.recursive` function can be tricked into adding or modifying properties of the Object prototype.


## Recommendation

Update to version 1.2.1 or later.
Vulnerability: GHSA-273r-rm8g-7f3x
Summary: Uncaught Exception in mercurius
Aliases: CVE-2021-43801
Severity: HIGH
CWE: CWE-754
Published: 2021-12-13T21:33:04Z

### Impact

Any users from Mercurius@8.10.0 to 8.11.1 are subjected to a denial of service attack by sending a malformed JSON to `/graphql` unless they are using a custom error handler.

### Patches

The vulnerability has been fixed in https://github.com/mercurius-js/mercurius/pull/678 and shipped as v8.11.2.

### Workarounds

Use a custom error handler.

### References

See https://github.com/mercurius-js/mercurius/issues/677

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/mercurius-js/mercurius
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-vxr4-rxw7-g7v6
Summary: Prototype Pollution in comb.
Aliases: CVE-2021-23561
Severity: MODERATE
CWE: CWE-1321
Published: 2021-12-16T14:30:56Z

All versions of package comb are vulnerable to Prototype Pollution via the deepMerge() function.
Vulnerability: GHSA-7j93-2h6r-hm49
Summary: Cross-Site Scripting in http-file-server
Aliases: CVE-2019-5458
Severity: HIGH
CWE: CWE-79
Published: 2019-07-31T04:22:36Z

All versions of `http-file-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-8v5f-hp78-jgxq
Summary: Signature Verification Bypass in jwt-simple
Severity: HIGH
CWE: CWE-347
Published: 2019-06-06T15:30:33Z

Versions of `jwt-simple` prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the `decode()` function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).


## Recommendation

Upgrade to version 0.5.3 or later.
Vulnerability: GHSA-6fmm-47qc-p4m4
Summary: Unauthorized File Access in harp
Aliases: CVE-2019-5438
Severity: MODERATE
CWE: CWE-22
Published: 2019-06-13T16:12:26Z

All versions of `harp` are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-w6cx-qg2q-rvq8
Summary: Path Traversal in @finastra/ssr-pages
Aliases: CVE-2022-24718
Severity: HIGH
CWE: CWE-22
Published: 2022-03-01T22:09:18Z

A path traversal issue can occur when providing untrusted input to the `svg` property as an argument to the `build(MessagePageOptions)` function.

### References
- https://github.com/Finastra/ssr-pages/pull/1
- https://github.com/Finastra/ssr-pages/pull/1/commits/c3e4c563384ae3ba3892f37dd190218577620780
Vulnerability: GHSA-9vrw-m88g-w75q
Summary: Denial of Service in @hapi/accept
Severity: HIGH
Published: 2020-09-03T15:45:53Z

Versions of `@hapi/accept` prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 3.2.4 or 5.0.1.
Vulnerability: GHSA-h24p-2c3m-5qf4
Summary: Malicious Package in owl-orchard-apple-sunshine
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:23:23Z

All versions of `owl-orchard-apple-sunshine` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-pf2j-9qmp-jqr2
Summary: SQL Injection and MAID in TypeORM
Aliases: CVE-2020-8158
Severity: CRITICAL
CWE: CWE-471, CWE-89
Published: 2021-05-07T16:46:42Z

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
Vulnerability: GHSA-86mr-6m89-vgj3
Summary: Buffer Overflow in node-weakauras-parser
Severity: MODERATE
CWE: CWE-120
Published: 2020-09-03T15:51:38Z

Affected versions of `node-weakauras-parser` are vulnerable to a Buffer Overflow. The `encode_weakaura` function fails to properly validate the input size. A buffer of 13835058055282163711 bytes causes an overflow on 64-bit systems.


## Recommendation

Upgrade to versions 1.0.5, 2.0.2, 3.0.1 or later.
Vulnerability: GHSA-m86m-5m44-pc93
Summary: Denial of Service in grpc-ts-health-check
Severity: LOW
Published: 2020-09-03T19:05:46Z

Versions of `grpc-ts-health-check` prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status.


## Recommendation

Upgrade to version 2.0.0 or later.
Vulnerability: GHSA-7w8j-85wm-6xfq
Summary: Prototype Pollution in jquery-bbq
Aliases: CVE-2021-20086
Severity: HIGH
CWE: CWE-1321
Published: 2021-05-24T19:51:58Z

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to inject properties into Object.prototype.
Vulnerability: GHSA-46q2-93hm-52p5
Summary: Directory Traversal in serverlyr
Aliases: CVE-2017-16089
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:53:37Z

Affected versions of `serverlyr` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-282f-qqgm-c34q
Summary: Prototype Pollution in node-jsonpointer
Aliases: CVE-2021-23807
Severity: MODERATE
CWE: CWE-843, CWE-1321
Published: 2021-11-08T17:44:45Z

This affects the package `jsonpointer` before `5.0.0`. A type confusion vulnerability can lead to a bypass of a previous Prototype Pollution fix when the pointer components are arrays.
Vulnerability: GHSA-j336-34q7-cgj3
Summary: Downloads Resources over HTTP in healthcenter
Aliases: CVE-2016-10684
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:42:06Z

Affected versions of `healthcenter` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `healthcenter`.


## Recommendation

This package has been deprecated, and moved to a new package on npm: [`appmetrics`](https://npmjs.com/package/appmetrics).

In order to mitigate this vulnerability, please install the `appmetrics` package in place of `healthcenter` via the following commands:
```
npm uninstall healthcenter -s
npm install appmetrics -s
```
Vulnerability: GHSA-p3rp-vmj9-gv6v
Summary: Incorrect sanitisation function leads to `XSS` in mermaid
Aliases: CVE-2021-43861
Severity: HIGH
CWE: CWE-79, CWE-20
Published: 2022-01-06T19:45:59Z

### Impact
Malicious diagrams can contain javascript code that can be run at diagram readers machines.

### Patches
The users should upgrade to version 8.13.8

### Workarounds
You need to upgrade in order to avoid this issue.
Vulnerability: GHSA-m5pj-vjjf-4m3h
Summary: Arbitrary Code Execution in grunt
Aliases: CVE-2020-7729
Severity: HIGH
CWE: CWE-1188
Published: 2021-05-06T18:27:18Z

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.
Vulnerability: GHSA-6xc2-mj39-q599
Summary: Privilege Escalation in strapi
Aliases: CVE-2019-18818
Severity: HIGH
CWE: CWE-640
Published: 2019-12-02T18:20:41Z

Versions of `strapi` prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.


## Recommendation

Upgrade to version 3.0.0-beta.17.5 or later.
Vulnerability: GHSA-r6fw-8m27-43c9
Summary: Command injection in portkiller
Aliases: CVE-2021-23379
Severity: HIGH
CWE: CWE-77
Published: 2021-05-06T15:53:20Z

This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-pvmx-g8h5-cprj
Summary: Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
Aliases: CVE-2021-41164
Severity: HIGH
CWE: CWE-79
Published: 2021-11-17T21:55:10Z

### Affected packages
The vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4.

### Impact
A potential vulnerability has been discovered in CKEditor 4 Advanced Content Filter (ACF) core module. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.17.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Maurice Dauer ([laytonctf](https://twitter.com/laytonctf)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-5h5r-23r4-m87h
Summary: Cross-Site Scripting in gitbook
Aliases: CVE-2017-16019
Severity: LOW
CWE: CWE-79
Published: 2020-09-01T16:04:39Z

Affected versions of `gitbook` do not properly sanitize user input outside of backticks, which may result in cross-site scripting in the online reader.


## Recommendation

Update to version 3.2.2 or later.
Vulnerability: GHSA-ccw5-7vfh-p5hm
Summary: Directory Traversal in dmmcquay.lab6
Aliases: CVE-2017-16208
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:14:15Z

Affected versions of `dmmcquay.lab6` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-fjqr-fx3f-g4rv
Summary: Electron protocol handler browser vulnerable to Command Injection
Aliases: CVE-2018-1000118
Severity: HIGH
CWE: CWE-78
Published: 2018-03-26T16:41:20Z

Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006, specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.
Vulnerability: GHSA-3p8f-j2vw-7hw9
Summary: Hijacked Environment Variables in mssql-node
Aliases: CVE-2017-16059
Severity: MODERATE
CWE: CWE-506
Published: 2018-11-09T17:43:44Z

The `mssql-node` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this module is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-x5x2-mfc7-r22f
Summary: Directory Traversal in picard
Aliases: CVE-2017-16194
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:40:20Z

Affected versions of `picard` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-fr6q-jv7j-35g3
Summary: Path Traversal in w-zip
Aliases: CVE-2022-0401
Severity: CRITICAL
CWE: CWE-22
Published: 2022-02-02T00:01:46Z

Path Traversal in NPM w-zip prior to 1.0.12.
Vulnerability: GHSA-3wh2-2pp3-2823
Summary: Malicious Package in simple-alipay
Severity: CRITICAL
Published: 2020-09-01T20:35:18Z

Version 1.0.1 of `simple-alipay` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.1 of this module is found installed you will want to replace it with a version before or after 1.0.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-8h2f-7jc4-7m3m
Summary: Open Redirect in urijs
Aliases: CVE-2022-0868
Severity: MODERATE
CWE: CWE-601
Published: 2022-03-07T00:00:40Z

urijs prior to version 1.19.10 is vulnerable to open redirect. This is the result of a bypass for the fix to CVE-2022-0613.
Vulnerability: GHSA-jfgq-g48x-jq83
Summary: Downloads Resources over HTTP in iedriver
Aliases: CVE-2016-10562
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:20Z

Affected versions of `iedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `iedriver`.


## Recommendation

Update to iedriver version 3.0.0 or greater.
Vulnerability: GHSA-8p52-7cxv-6c95
Summary: Downloads Resources over HTTP in curses
Aliases: CVE-2016-10615
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:56:47Z

Affected versions of `curses` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `curses`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-76qf-6mvw-c5hm
Summary: Malicious Package in js-base64-int
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:45:42Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-856x-cp3q-47vg
Summary: Insecure Default Configuration in airbrake
Aliases: CVE-2016-10530
Severity: MODERATE
CWE: CWE-200
Published: 2019-02-18T23:58:13Z

Affected versions of `airbrake` default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive information.


## Recommendation

Update to version 0.4.0 or later, or upgrade from the now-deprecated `airbrake` module to its replacement, [`airbrake-js`](https://www.npmjs.com/package/airbrake-js).
Vulnerability: GHSA-86ch-6w7v-v6xf
Summary: Denial of Service in soketi
Aliases: CVE-2022-21667
Severity: HIGH
CWE: CWE-755
Published: 2022-01-08T00:24:44Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

There was a wrong behavior when reading POST requests, making the server crash if it couldn't read the body. In case a POST request was sent to any endpoint of the server with an empty body, **even unauthenticated with the Pusher Protocol**, it would simply just crash the server for trying to send a response after the request closed.

All users that run the server are affected by it and it's highly recommended to upgrade to the latest patch.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Updating to at least 0.24.1 or the latest version.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No. Upgrading is the only solution.

### References
_Are there any links users can visit to find out more?_

https://github.com/soketi/soketi/releases/tag/0.24.1

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the issues board](https://github.com/soketi/soketi/issues)
* Email us at [alex@renoki.org](mailto:alex@renoki.org)
Vulnerability: GHSA-wfhx-6pcm-7m55
Summary: Path Traversal in ponse
Severity: HIGH
CWE: CWE-22
Published: 2020-09-03T16:46:22Z

Versions of `ponse` prior to 2.0.2 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 2.0.2 or later.
Vulnerability: GHSA-ff29-f57w-2mm3
Summary: Downloads Resources over HTTP in geoip-lite-country
Aliases: CVE-2016-10568
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:03Z

Affected versions of `geoip-lite-country` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 1.1.4 or later.