TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-cq6w-w5rj-p9x8
Summary: Cross-site Scripting in Froala Editor
Aliases: CVE-2021-30109
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-06T17:47:05Z

Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS). Under certain conditions, a base64 crafted string leads to persistent Cross-site scripting (XSS) vulnerability within the hyperlink creation module.
Vulnerability: GHSA-3h9m-9g3g-5wqx
Summary: Malicious Package in buffer-xov
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:13:14Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-qqxp-xp9v-vvx6
Summary: Moderate severity vulnerability that affects jquery-ui
Aliases: CVE-2012-6662
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:37Z

Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.
Vulnerability: GHSA-4hv7-3q38-97m8
Summary: Arbitrary code execution in djv
Aliases: CVE-2020-28464
Severity: CRITICAL
CWE: CWE-94
Published: 2021-04-13T15:24:47Z

This affects the package djv before 2.1.4. By controlling the schema file, an attacker can run arbitrary JavaScript code on the victim machine.
Vulnerability: GHSA-fvcj-hvfw-7f2v
Summary: Improper Authentication
Aliases: CVE-2021-1725
Severity: HIGH
CWE: CWE-287
Published: 2021-03-08T15:49:53Z

### Impact
A maliciously crafted claim may be incorrectly authenticated by the bot. Impacts bots that are not configured to be used as a Skill. This vulnerability requires an attacker to have internal knowledge of the bot.

### Patches
The problem has been patched in all affected versions. Please see the list of patched versions for the most appropriate one for your individual case.

### Workarounds
Users who do not wish or are not able to upgrade can add an authentication configuration containing ClaimsValidator, which throws an exception if the Claims are Skill Claims.

For detailed instructions, see the link in the References section.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Microsoft Bot Builder SDK](https://github.com/microsoft/botbuilder-dotnet)
* Email us at [bf-reports@microsoft.com](mailto:bf-reports@microsoft.com)
Vulnerability: GHSA-3c87-r9f7-qfgq
Summary: Downloads Resources over HTTP in macaca-chromedriver-zxa
Aliases: CVE-2016-10623
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:56:56Z

Affected versions of `macaca-chromedriver-zxa` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `macaca-chromedriver-zxa`.


## Recommendation

The best mitigation is to manually set the download URL to a safe HTTPS server via the `CHROMEDRIVER_CDNURL` environment variable.

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rm7c-x424-g2mw
Summary: Malicious Package in asyync
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:36:31Z

All versions of `asyync` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-j4vm-hg8g-g9qv
Summary: Malicious Package in antd-cloud
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:33:50Z

All versions of `antd-cloud` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-h6m3-cx24-9626
Summary: Malicious Package in js-sla3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:11:45Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-g452-6rfc-vrvx
Summary: Prototype Pollution in open-graph
Aliases: CVE-2021-23419
Severity: MODERATE
CWE: CWE-915
Published: 2021-09-01T18:31:53Z

This affects the package open-graph before 0.2.6. The function parse could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor payload.
Vulnerability: GHSA-4j6x-w426-6rc6
Summary: Default Express middleware security check is ignored in production
Severity: HIGH
Published: 2019-11-08T17:31:17Z

## Default Express middleware security check is ignored in production

### Impact
All Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected.

### Patches
@cubejs-backend/api-gateway@0.11.17

### Workarounds
Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/cube-js/cube.js/issues
* Reach out us in community Slack: https://slack.cube.dev/
Vulnerability: GHSA-g376-whg7-896m
Summary: Directory Traversal in yjmyjmyjm
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:45:53Z

Affected versions of `yjmyjmyjm` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-g78f-549w-c354
Summary: Prototype Pollution in multi-ini
Aliases: CVE-2020-28448
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-04-13T15:23:59Z

This affects the package multi-ini before 2.1.1. It is possible to pollute an object's prototype by specifying the proto object as part of an array.
Vulnerability: GHSA-5xgh-643p-cp2g
Summary: Moderate severity vulnerability that affects yapi-vendor
Aliases: CVE-2018-17574
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-21T22:19:59Z

An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.
Vulnerability: GHSA-hhqj-cfjx-vj25
Summary: Cross site scripting in reveal.js
Aliases: CVE-2022-0776
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-02T00:00:20Z

The onmessage event listener in /plugin/notes/speaker-view.html does not check the origin of postMessage before adding the content to the webpage. The vulnerable code allows any origin to postMessage on the browser window and feeds attacker's input to parts using which attacker can execute arbitrary javascript code on victim's browser window hosting reveal.js
Vulnerability: GHSA-c35v-qwqg-87jc
Summary: Timing Attack in express-basic-auth
Severity: LOW
CWE: CWE-208
Published: 2019-06-06T15:32:32Z

Versions of `express-basic-auth` prior to 1.2.0 are vulnerable to Timing Attacks. The package uses nating string comparison instead of a constant time string compare which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-x56p-c8cg-q435
Summary: Open Redirect in Next.js versions
Aliases: CVE-2020-15242
Severity: MODERATE
CWE: CWE-601
Published: 2020-10-08T19:28:07Z

### Impact

- **Affected**: Users of Next.js between 9.5.0 and 9.5.3 
- **Not affected**: Deployments on Vercel ([https://vercel.com](https://vercel.com)) are not affected
- **Not affected**: Deployments using `next export`

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/vercel/next.js/releases/tag/v9.5.4

### References

https://github.com/vercel/next.js/releases/tag/v9.5.4
Vulnerability: GHSA-qjfh-xc44-rm9x
Summary: Path Traversal in file-static-server
Severity: HIGH
CWE: CWE-22
Published: 2020-09-03T16:49:43Z

All versions of `file-static-server` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-6c3f-p5wp-34mh
Summary: OS Command Injection in async-git
Aliases: CVE-2021-3190
Severity: CRITICAL
CWE: CWE-78
Published: 2021-01-29T18:14:00Z

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted user input before passing it to one of the vulnerable functions as a workaround or update async-git to version 1.13.1.
Vulnerability: GHSA-cwg9-c9cr-p5fq
Summary: Improper Neutralization of Input in Theia console
Aliases: CVE-2021-28161
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-13T15:18:53Z

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected.
Vulnerability: GHSA-x3wr-v4wx-5qpc
Summary: Prototype Pollution
Aliases: CVE-2021-25948
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-06-21T17:14:01Z

Prototype pollution vulnerability in ‘expand-hash’ versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-8796-gc9j-63rv
Summary: File upload local preview can run embedded scripts after user interaction
Severity: MODERATE
CWE: CWE-74
Published: 2021-05-17T20:51:16Z

### Impact

When uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file, but only after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users.

### Patches

This has been fixed by https://github.com/matrix-org/matrix-react-sdk/pull/5981, which is included in 3.21.0.

### Workarounds

There are no known workarounds.
Vulnerability: GHSA-m25q-fwg4-9v2p
Summary: Malicious Package in awesome_react_utility
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:47:07Z

Version 1.0.2 of `awesome_react_utility` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qfh2-6f7q-gr86
Summary: Cross-Site Scripting in sexstatic
Aliases: CVE-2018-3755
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-01T16:30:38Z

All versions of `sexstatic` are vulnerable to stored cross-site scripting (xss). This is exploitable if an attacker can control a filename that is served by `sexstatic`.



## Recommendation

As there is no fix is currently available for this vulnerability it is our recommendation to not install or used this module at this time.
Vulnerability: GHSA-wx69-rvg3-x7fc
Summary: XSS via prototype pollution in NodeBB 
Aliases: CVE-2021-43787
Severity: CRITICAL
CWE: CWE-79
Published: 2021-11-30T22:21:01Z

### Impact
A prototype pollution vulnerability in the uploader module allowed a malicious user to inject arbitrary data (i.e. javascript) into the DOM, theoretically allowing for an account takeover when used in conjunction with a path traversal vulnerability disclosed at the same time as this report.

### Patches
The vulnerability has been patched as of v1.18.5.

### Workarounds
Cherry-pick commit hash 1783f918bc19568f421473824461ff2ed7755e4c to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Vulnerability: GHSA-rgfv-v3jh-7ffp
Summary: Prototype Pollution in deeps
Aliases: CVE-2020-7716
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:11:52Z

All versions of package deeps up to and including version 1.4.5 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-whcm-29f4-j4mx
Summary: Directory Traversal in zwserver
Aliases: CVE-2017-16149
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:56:50Z

Affected versions of `zwserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-w83x-fp72-p9qc
Summary: Command Injection in geojson2kml
Aliases: CVE-2020-28429
Severity: CRITICAL
CWE: CWE-77
Published: 2021-05-10T15:59:33Z

All versions up to and including version 0.1.1 of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","& touch JHU",function(){})
Vulnerability: GHSA-4m3p-x2hp-2pgx
Summary: Malicious Package in bitcroe-lib
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:45:23Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-84p7-fh9c-6g8h
Summary: Prototype Pollution in mixme
Severity: HIGH
CWE: CWE-1321
Published: 2021-09-20T19:52:24Z

### Impact
When copying properties from a source object to a target object, the target object can gain access to certain properties of the source object and modify their content.

### Patches
The problem was patch with a more agressive discovery of secured properties to filter out.
Vulnerability: GHSA-8rxg-9g6f-vq9p
Summary: Malicious Package in another-date-range-picker
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:46:01Z

Version 4.1.48 of `another-date-range-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 4.1.48 of this module is found installed you will want to replace it with a version before or after 4.1.48. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-756f-6j3f-48q9
Summary: Directory Traversal in calmquist.static-server
Aliases: CVE-2017-16165
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:45:51Z

Affected versions of `calmquist.static-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-94xh-2fmc-xf5j
Summary: command injection vulnerability
Aliases: CVE-2020-7752
Severity: HIGH
CWE: CWE-78
Published: 2020-10-27T20:30:20Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.27.11

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite()

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)
Vulnerability: GHSA-xf64-2f9p-6pqq
Summary: Information Exposure in type-graphql
Severity: LOW
CWE: CWE-209
Published: 2020-09-04T17:24:08Z

Versions of `type-graphql` prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.


## Recommendation

Upgrade to version 0.17.6 or later.
Vulnerability: GHSA-7q9f-x6rm-qmxr
Summary: Command Injection in compass-compile
Aliases: CVE-2020-7635
Severity: CRITICAL
CWE: CWE-74
Published: 2021-12-09T19:27:46Z

compass-compile through 0.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.
Vulnerability: GHSA-f2rc-6xjq-95gq
Summary: Directory Traversal in shenliru
Aliases: CVE-2017-16161
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:24:57Z

Affected versions of `shenliru` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jh67-3wqw-cvhr
Summary: Malicious Package in js-sxa3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:13:52Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-qj73-v688-wqxf
Summary: Hijacked Environment Variables in proxy.js
Aliases: CVE-2017-16076
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:19:13Z

The `proxy.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-pgmg-gf5p-54j8
Summary: Prototype Pollution in gammautils
Aliases: CVE-2020-7718
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:26:14Z

"All versions of package gammautils up to and including version 0.0.81 are vulnerable to Prototype Pollution via the deepSet and deepMerge functions."
Vulnerability: GHSA-rjf2-j2r6-q8gr
Summary: Prototype Pollution in vm2
Aliases: CVE-2021-23449
Severity: CRITICAL
CWE: CWE-915, CWE-1321
Published: 2021-10-19T15:28:45Z

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.
Vulnerability: GHSA-cpgr-wmr9-qxv4
Summary: Cross-Site Scripting in serve
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:20:14Z

Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

Upgrade to version 10.0.2 or later.
Vulnerability: GHSA-3vg2-4qxc-ch4j
Summary: Directory Traversal in unicorn-list
Aliases: CVE-2017-16131
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:49:38Z

Affected versions of `unicorn-list` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-m52x-29pq-w3vv
Summary: Cross-Site Scripting in pannellum
Aliases: CVE-2019-16763
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-22T18:18:03Z

Versions of `pannellum ` prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers to execute arbitrary code in a victim's browser. 


## Recommendation

Upgrade to version 2.5.6 or later.
Vulnerability: GHSA-646x-m363-9rh4
Summary: Hijacked Environment Variables in node-opensl
Aliases: CVE-2017-16063
Severity: MODERATE
CWE: CWE-506
Published: 2018-10-03T20:27:55Z

The `node-opensl` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-gf8v-vxf9-7c66
Summary: Downloads Resources over HTTP in cloudpub-redis
Aliases: CVE-2016-10672
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:26Z

Affected versions of `cloudpub-redis` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cloudpub-redis`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-2f29-pmpx-vj62
Summary: Directory Traversal in serverwg
Aliases: CVE-2017-16101
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:52:33Z

`serverwg` is a simple http server.

`serverwg` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```
and response:
```
HTTP/1.1 200 OK
Date: Wed, 17 May 2017 22:52:08 GMT
Connection: keep-alive

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-3rh7-vm4x-q2hp
Summary: Hijacked Environment Variables in sqlserver
Aliases: CVE-2017-16055
Severity: MODERATE
CWE: CWE-506
Published: 2018-11-09T17:49:22Z

The `sqlserver` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-8j65-4pcq-xq95
Summary: Options structure open to XSS if passed unfiltered
Aliases: CVE-2021-29489
Severity: HIGH
CWE: CWE-79
Published: 2021-05-06T15:45:03Z

### Impact
In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. Especially when using the `useHTML` flag, HTML string options would be inserted unfiltered directly into the DOM. When `useHTML` was false, malicious code could be inserted by using various character replacement tricks or malformed HTML.

If your chart configuration comes from a trusted source like a static setup or pre-filtered HTML (or no markup at all in the configuration), you are not impacted.

### Patches
In version 9, the whole rendering layer was refactored to use an DOMParser, an AST and tag and HTML allow-listing to make sure only safe content entered the DOM. In addition, prototype pollution was stopped.

### Workarounds
Implementers who are not able to upgrade may apply [DOMPurify](https://github.com/cure53/DOMPurify) recursively [to the options structure](https://jsfiddle.net/highcharts/zd3wcm5L/) to filter out malicious markup.

### References
* Details on the improved [Highcharts security](https://www.highcharts.com/docs/chart-concepts/security)
* [The AST and TextBuilder refactoring](https://github.com/highcharts/highcharts/pull/14913)
* [The fix for prototype pollution](https://github.com/highcharts/highcharts/pull/14884)

### For more information
If you have any questions or comments about this advisory:
* Visit our [support page](https://www.highcharts.com/blog/support/)
* For more Email us at [security@highcharts.com](mailto:security@highcharts.com)
Vulnerability: GHSA-wg5r-c793-w5w2
Summary: Downloads Resources over HTTP in mystem-wrapper
Aliases: CVE-2016-10671
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:28Z

Affected versions of `mystem-wrapper` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem-wrapper`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3ww4-cp53-6g2x
Summary: Cross Site Request Forgery in kindeditor
Aliases: CVE-2021-42228
Severity: HIGH
CWE: CWE-352
Published: 2021-10-18T19:44:06Z

Cross Site Request Forgery (CSRF) vulnerability exists in KindEditor 4.1.x. First, you upload an html file containing csrf on the website that uses a google editor, (you only need to search in google: inurl:/examples/uploadbutton.html) and then use the authority of this website to trick users into clicking your malicious html link.
Vulnerability: GHSA-vx3p-948g-6vhq
Summary: Regular Expression Denial of Service (ReDoS)
Aliases: CVE-2021-27290
Severity: HIGH
CWE: CWE-400
Published: 2021-03-19T21:24:36Z

npm `ssri` 5.2.2-6.0.1 and 7.0.0-8.0.0, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Vulnerability: GHSA-j6x7-42x2-hpcf
Summary: Malicious Package in buffer-xoz
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:14:20Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-4q2f-8g74-qm56
Summary: Cross-Site Scripting in takeapeek
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T17:18:05Z

All versions of `takeapeek` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-9mmw-3fmh-96g3
Summary: Malicious Package in calk
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:23:38Z

All versions of `calk` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-43f8-2h32-f4cj
Summary: Regular Expression Denial of Service in hosted-git-info
Aliases: CVE-2021-23362
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-06T16:10:39Z

The npm package `hosted-git-info` before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity
Vulnerability: GHSA-67mq-h2r9-rh2m
Summary: Prototype pollution in multi-ini
Aliases: CVE-2020-28460
Severity: HIGH
CWE: CWE-1321
Published: 2021-04-13T15:23:41Z

This affects the package multi-ini before 2.1.2. It is possible to pollute an object's prototype by specifying the constructor.proto object as part of an array. This is a bypass of CVE-2020-28448.
Vulnerability: GHSA-mw6q-98mp-g8g8
Summary: Cross-site Scripting in bootstrap-table
Aliases: CVE-2021-23472
Severity: LOW
CWE: CWE-79, CWE-843
Published: 2021-11-08T17:54:46Z

This affects all versions of package bootstrap-table. A type confusion vulnerability can lead to a bypass of input sanitization when the input provided to the escapeHTML function is an array (instead of a string) even if the escape attribute is set.
Vulnerability: GHSA-4whq-r978-2x68
Summary: Arbitrary code execution in ExifTool
Severity: HIGH
CWE: CWE-74
Published: 2021-05-04T17:43:52Z

### Impact

Arbitrary code execution can occur when running `exiftool` against files with hostile metadata payloads.

### Patches

ExifTool has already been patched in version 12.24. exiftool-vendored, which vendors ExifTool, includes this patch in v14.3.0.

### Workarounds

No.

### References

https://twitter.com/wcbowling/status/1385803927321415687
https://nvd.nist.gov/vuln/detail/CVE-2021-22204

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [exiftool-vendored](https://github.com/photostructure/exiftool-vendored.js)
Vulnerability: GHSA-v6wh-2wvh-c8x5
Summary: Regular Expression Denial of Service in djvalidator
Aliases: CVE-2020-7779
Severity: HIGH
CWE: CWE-400
Published: 2022-02-09T23:15:46Z

All versions of package djvalidator are vulnerable to Regular Expression Denial of Service (ReDoS) by sending crafted invalid emails - for example, --@------------------------------------------------------------------------------------------------------------------------!.
Vulnerability: GHSA-5rrq-pxf6-6jx5
Summary: Prototype Pollution in node-forge debug API.
Severity: LOW
CWE: CWE-1321
Published: 2022-01-08T00:22:42Z

### Impact
The `forge.debug` API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised.  It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

### Patches
The `forge.debug` API and related functions were removed in 1.0.0.

### Workarounds
Don't use the `forge.debug` API directly or indirectly with untrusted input.

### References
- https://www.huntr.dev/bounties/1-npm-node-forge/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge).
* Email us at support@digitalbazaar.com.
Vulnerability: GHSA-8v38-pw62-9cw2
Summary: Incorrect returned href via an '@' sign but no user info and hostname
Aliases: CVE-2022-0639
Severity: MODERATE
CWE: CWE-639
Published: 2022-02-18T00:00:33Z

A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular,
`````
parse(\"http://@/127.0.0.1\")
`````
Will return:
`````
{
 slashes: true,
 protocol: 'http:',
 hash: '',
 query: '',
 pathname: '/127.0.0.1',
 auth: '',
 host: '',
 port: '',
 hostname: '',
 password: '',
 username: '',
 origin: 'null',
 href: 'http:///127.0.0.1'
 }
`````
If the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request, the decision may be incorrect.
Vulnerability: GHSA-48hw-37g6-3gw4
Summary: Malicious Package in mx-nested-menu
Severity: CRITICAL
Published: 2020-09-03T02:35:41Z

Version 0.1.30 of `mx-nested-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-7wpw-2hjm-89gp
Summary: Prototype Pollution in merge
Aliases: CVE-2020-28499
Severity: HIGH
CWE: CWE-915
Published: 2021-05-04T20:18:47Z

All versions of package merge <2.1.1 are vulnerable to Prototype Pollution via _recursiveMerge .
Vulnerability: GHSA-wjpc-cgvw-xx23
Summary: Prototype Pollution in sey
Aliases: CVE-2021-23663
Severity: MODERATE
CWE: CWE-1321
Published: 2021-12-16T14:29:34Z

All versions of package `sey` are vulnerable to Prototype Pollution via the deepmerge() function.
Vulnerability: GHSA-pv55-r6j3-wp94
Summary: Malicious Package in eslint-config-eslint
Severity: CRITICAL
Published: 2020-09-01T20:45:57Z

Version 5.0.2 of `eslint-config-eslint` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to a remote server.


## Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens
Vulnerability: GHSA-6956-83fg-5wc5
Summary: Prototype Pollution in set-in
Aliases: CVE-2022-25354
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the `setIn` method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)
Vulnerability: GHSA-p9f8-gqjf-m75j
Summary: Uncontrolled Resource Consumption in fastify-multipart
Aliases: CVE-2020-8136
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-06T17:28:36Z

Prototype pollution vulnerability in `fastify-multipart` < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.
Vulnerability: GHSA-3r9x-mjrm-2725
Summary: Prototype pollution vulnerability in 'libnested'
Aliases: CVE-2020-28283
Severity: CRITICAL
Published: 2021-10-12T16:27:02Z

Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-cxmj-qjv6-vx9p
Summary: Low severity vulnerability that affects mcstatic
Aliases: CVE-2018-16482
Severity: LOW
CWE: CWE-22
Published: 2019-02-07T18:15:44Z

A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.
Vulnerability: GHSA-wgfq-7857-4jcc
Summary: Uncontrolled Resource Consumption in json-bigint
Aliases: CVE-2020-8237
Severity: HIGH
CWE: CWE-400
Published: 2021-05-07T16:47:19Z

Prototype pollution in json-bigint npm package < 1.0.0 may lead to a denial-of-service (DoS) attack.
Vulnerability: GHSA-qx2f-477c-35rq
Summary: Regular Expression Denial of Service in method-override
Aliases: CVE-2017-16136
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:06:04Z

Affected versions of `method-override` are vulnerable to a regular expression denial of service vulnerability when untrusted user input is passed into the `X-HTTP-Method-Override` header.


## Recommendation

Update to version 2.3.10 or later
Vulnerability: GHSA-hwh3-fhf6-73x9
Summary: Malicious Package in bictoinjs-lib
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:36:09Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4xcv-9jjx-gfj3
Summary: Denial of Service in mem
Severity: MODERATE
CWE: CWE-400
Published: 2019-07-05T21:07:58Z

Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS).  The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.


## Recommendation

Upgrade to version 4.0.0 or later.
Vulnerability: GHSA-8gc6-65mm-xr6r
Summary: Malicious Package in bp66
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:46:28Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rc4q-9m69-gqp8
Summary: Lack of protection against cookie tossing attacks in fastify-csrf
Aliases: CVE-2021-29624
Severity: MODERATE
CWE: CWE-352, CWE-565
Published: 2021-05-17T20:53:30Z

### Impact

Users that used fastify-csrf with the "double submit" mechanism using cookies with an application deployed across multiple subdomains, e.g. "heroku"-style platform as a service. 

### Patches

Version 3.1.0 of the fastify-csrf fixes it. 
See https://github.com/fastify/fastify-csrf/pull/51 and https://github.com/fastify/csrf/pull/2.

The user of the module would need to supply a `userInfo` when generating the CSRF token to fully implement the protection on their end. This is needed only for applications hosted on different subdomains.

### Workarounds

None available.

### References

1. https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html
2. https://owasp.org/www-pdf-archive/David_Johansson-Double_Defeat_of_Double-Submit_Cookie.pdf

### Credits

This vulnerability was found by Xhelal Likaj <xhelallikaj20@gmail.com>.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fastify-csrf](https://github.com/fastify/fastify-csrf)
* Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)
Vulnerability: GHSA-f7ph-p5rv-phw2
Summary: Cross-Site Scripting in nunjucks
Aliases: CVE-2016-10547
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-06T23:13:37Z

Affected versions of `nunjucks` do not properly escape specially structured user input in template vars when in auto-escape mode, resulting in a cross-site scripting vulnerability.

## Proof of Concept

By using an array for the keys in a template var, escaping is bypassed.
```javascript
name[]=<script>alert(1)</script>
```

A full PoC is available in the references section.


## Recommendation

Update to version 2.4.3 or later.
Vulnerability: GHSA-6vwx-mwp8-fh44
Summary: Cross-site Scripting in reveal.js
Aliases: CVE-2020-8127
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-10T18:47:10Z

Insufficient validation in cross-origin communication (postMessage) in reveal.js version 3.9.1 and earlier allow attackers to perform cross-site scripting attacks.
Vulnerability: GHSA-qg8p-v9q4-gh34
Summary: Potential Command Injection in shell-quote
Aliases: CVE-2016-10541
Severity: CRITICAL
CWE: CWE-78
Published: 2019-02-18T23:58:29Z

Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.



## Proof of Concept:

The following characters are not escaped properly: `>`,`;`,`{`,`}`

Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of `{}` and using the `,` instead of ` ` to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible. 

```
   const quote = require('shell-quote').quote;
   console.log(quote(['a;{echo,test,123,234}']));
   // Actual                    "a;{echo,test,123,234}"
   // Expected                  "a\;\{echo,test,123,234\}"
   // Functional Equivalent     "a; echo 'test' '123' '1234'"
```



## Recommendation

Update to version 1.6.1 or later.
Vulnerability: GHSA-5327-gfq5-8f4m
Summary: Malicious Package in buffer-xmr
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:56:23Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-27gm-ghr9-4v95
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: HIGH
CWE: CWE-79
Published: 2020-01-30T21:22:15Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in: the core parser, `paste` and `visualchars` plugins. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.6 or lower and TinyMCE 5.1.3 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.7 and 5.1.4 by improved parser logic and HTML sanitization.

### Workarounds
The workarounds available are:
- disable the impacted plugins
- manually sanitize the content using the `BeforeSetContent` event (see below)
- upgrade to either TinyMCE 4.9.7 or TinyMCE 5.1.4

#### Example: Manually sanitize content
```js
editor.on('BeforeSetContent', function(e) {
  var sanitizedContent = ...; // Manually sanitize content here
  e.content = sanitizedContent;
});
```

### Acknowledgements
Tiny Technologies would like to thank Michał Bentkowski for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes514/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-cr56-66mx-293v
Summary: Cross-Site Scripting in @toast-ui/editor
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T15:53:50Z

Versions of `@toast-ui/editor` prior to 2.2.0 are vulnerable to Cross-Site Scripting (XSS).  There are multiple bypasses to the package's built-in XSS sanitization. This may allow attackers to execute arbitrary JavaScript on a victim's browser.

## Recommendation

Upgrade to version 2.2.0 or later.