TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-xxxq-chmp-67g4
Summary: RSA PKCS#1 decryption vulnerability with prepending zeros in jsrsasign
Aliases: CVE-2020-14967
Severity: CRITICAL
CWE: CWE-119
Published: 2020-06-26T16:27:08Z

### Impact
Jsrsasign supports RSA PKCS#1 v1.5 (i.e. RSAES-PKCS1-v1_5) and RSA-OAEP encryption and decryption. Its encrypted message is represented as BigInteger. When there is a valid encrypted message, a crafted message with prepending zeros can be decrypted by this vulnerability.

- If you don't use RSA PKCS1-v1_5 or RSA-OAEP decryption, this vulnerability is not affected.
- Risk to forge contents of encrypted message is very low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.

### Patches
Users using RSA PKCS1-v1_5 or RSA-OAEP decryption should upgrade to 8.0.18.

### Workarounds
Reject RSA PKCS1-v1_5 or RSA-OAEP encrypted message with unnecessary prepending zeros.

### References
https://nvd.nist.gov/vuln/detail/CVE-2020-14967
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14967
https://vuldb.com/?id.157124
https://kjur.github.io/jsrsasign/api/symbols/KJUR.crypto.Cipher.html#.decrypt
https://github.com/kjur/jsrsasign/issues/439
Vulnerability: GHSA-w9mf-24h3-9wxf
Summary: Downloads Resources over HTTP in windows-iedriver
Aliases: CVE-2016-10689
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:41:58Z

Affected versions of `windows-iedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-iedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-mv26-cx23-vrfg
Summary: Server-Side Request Forgery in @peertube/embed-api
Aliases: CVE-2022-0508
Severity: MODERATE
CWE: CWE-918
Published: 2022-02-09T00:00:31Z

@peertube/embed-api version 4.0.0 and prior is vulnerable to server-side request forgery.
Vulnerability: GHSA-66mv-xh68-h6v2
Summary: Denial of Service in @commercial/hapi
Severity: HIGH
Published: 2020-09-03T15:48:53Z

Affected versions of `@commercial/hapi` are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to versions 16.8.2, 17.9.2, 18.4.1, 19.1.1 or later.
Vulnerability: GHSA-8f89-2fwj-5v5r
Summary: Improper Input Validation in klona
Aliases: CVE-2020-8125
Severity: HIGH
CWE: CWE-20
Published: 2021-04-13T15:41:24Z

Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.
Vulnerability: GHSA-54cr-gv8w-8324
Summary: Malicious Package in xoc
Severity: CRITICAL
Published: 2020-09-01T20:36:22Z

Version 1.0.7 of `xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.7 of this module is found installed you will want to replace it with a version before or after 1.0.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-9wcg-jrwf-8gg7
Summary: Prototype Pollution in express-fileupload
Aliases: CVE-2020-7699
Severity: CRITICAL
CWE: CWE-915
Published: 2020-08-05T14:53:16Z

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
Vulnerability: GHSA-g3qw-9pgp-xpj4
Summary: Out-of-bounds Read in njwt
Severity: LOW
CWE: CWE-125
Published: 2020-09-01T21:08:44Z

Versions of `njwt` prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the `base64urlEncode` function. 

On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Service vulnerability.


## Recommendation

Upgrade to version 1.0.0.
Vulnerability: GHSA-2h3h-vw8r-82rp
Summary: Weak JSON Web Token in yapi-vendor
Aliases: CVE-2021-27884
Severity: MODERATE
CWE: CWE-330
Published: 2021-03-26T16:49:26Z

Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens. This occurs because Math.random in Node.js is used as a source of randomness in jwt signing. Math.random does not provide cryptographically secure random numbers. This has been patched in version 1.9.3.
Vulnerability: GHSA-95cg-3r4g-7w6j
Summary: Malicious Package in js-rha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:01:29Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-cwfw-4gq5-mrqx
Summary: Regular Expression Denial of Service (ReDoS) in braces
Aliases: CVE-2018-1109
Severity: LOW
CWE: CWE-400
Published: 2022-01-06T20:42:03Z

A vulnerability was found in Braces versions prior to 2.3.1. Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Vulnerability: GHSA-w7q7-vjp8-7jv4
Summary: SQL Injection in typeorm
Severity: HIGH
CWE: CWE-89
Published: 2019-06-06T15:30:16Z

Versions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

Upgrade to version 0.1.15
Vulnerability: GHSA-8v67-x8q5-3x3g
Summary: Cross-Site Scripting in simditor
Aliases: CVE-2018-19048
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-14T04:01:27Z

Versions of `simditor` prior to 2.3.22 are vulnerable to Cross-Site Scripting. The package does not sanitize user input that is rendered with `innerHTML`, allowing attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.3.22 or later.
Vulnerability: GHSA-c4hh-fg8x-6h9p
Summary: Malicious Package in buffer-xnr
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:57:29Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-3x83-p476-vv95
Summary: Downloads Resources over HTTP in selenium-standalone-painful
Aliases: CVE-2016-10679
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:40Z

Affected versions of `selenium-standalone-painful` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-standalone-painful`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-wwwg-6r7f-9c9h
Summary: Malicious Package in file-logging
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:43:28Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-69r6-7h4f-9p7q
Summary: Malicious Package in discord.js-user
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T20:41:01Z

All versions of `discord.js-user` contain malicious code. The package uploads the user's Discord token to a remote server.


## Recommendation

Remove the package from your environment. Ensure any compromised tokens are invalidated.
Vulnerability: GHSA-m2h2-264f-f486
Summary: angular vulnerable to regular expression denial of service (ReDoS)
Aliases: CVE-2022-25844
Severity: MODERATE
CWE: CWE-1333
Published: 2022-05-03T00:00:44Z

AngularJS lets users write client-side web applications. The package angular after 1.7.0 is vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value.

**Note:**
1. This package has been deprecated and is no longer maintained.
2. The vulnerable versions are 1.7.0 and higher.
Vulnerability: GHSA-hqhp-5p83-hx96
Summary: Regular Expression Denial of Service in prismjs
Aliases: CVE-2021-3801
Severity: MODERATE
CWE: CWE-400
Published: 2021-09-20T20:44:48Z

Prism is a lightweight, robust, and elegant syntax highlighting library. The prismjs package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted HTML comment as input may cause an application to consume an excessive amount of CPU.
Vulnerability: GHSA-9xw9-pvgv-6p76
Summary: Insufficient Error Handling in http-proxy
Aliases: CVE-2017-16014
Severity: MODERATE
CWE: CWE-703
Published: 2018-11-09T17:47:52Z

Affected versions of `http-proxy` are vulnerable to a denial of service attack, wherein an attacker can force an error which will cause the server to crash.


## Recommendation

Update to version 0.7.0 or later.
Vulnerability: GHSA-cr79-9pwf-r6f5
Summary: Downloads Resources over HTTP in prince
Aliases: CVE-2016-10591
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:34:24Z

Affected versions of `prince` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `prince`.


## Recommendation

Update to version 1.4.6 or later.
Vulnerability: GHSA-692h-g37c-qv44
Summary: Malicious Package in sj-tw-sec
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:25:30Z

All versions of `sj-tw-sec` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-67mm-m3wx-j7fr
Summary: Command injection in gitlog
Aliases: CVE-2021-26541
Severity: CRITICAL
CWE: CWE-77
Published: 2021-04-13T15:15:29Z

The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.
Vulnerability: GHSA-38f5-ghc2-fcmv
Summary: Code Injection in cryo
Aliases: CVE-2018-3784
Severity: HIGH
CWE: CWE-94
Published: 2018-08-21T17:02:43Z

All versions of `cryo` are vulnerable to code injection due to an Insecure implementation of deserialization.


## Proof of concept

```
var Cryo = require('cryo');
var frozen = '{"root":"_CRYO_REF_3","references":[{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\"); return 1111;}"},{"contents":{},"value":"_CRYO_FUNCTION_function () {console.log(\\"defconrussia\\");return 2222;}"},{"contents":{"toString":"_CRYO_REF_0","valueOf":"_CRYO_REF_1"},"value":"_CRYO_OBJECT_"},{"contents":{"__proto__":"_CRYO_REF_2"},"value":"_CRYO_OBJECT_"}]}'
var hydrated = Cryo.parse(frozen);
console.log(hydrated);
```


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-69mf-2cw2-38m8
Summary: Malicious Package in js-shc3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:04:40Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-xg75-3277-gvvj
Summary: Directory Traversal in serve
Aliases: CVE-2019-5417
Severity: HIGH
CWE: CWE-22
Published: 2019-03-25T18:04:01Z

Versions of `serve` before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files.


## Recommendation

Upgrade to version 7.1.3 or later
Vulnerability: GHSA-65p7-pjj8-ggmr
Summary: Member account takeover
Severity: MODERATE
Published: 2021-09-23T23:18:42Z

### Impact

An error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the new address via magic link sent to the new email address.

Ghost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 3.18.0 and 4.15.0 with members functionality enabled.

### Patches

Fixed in 4.15.1, all 4.x sites should upgrade as soon as possible.
Fixed in 3.42.6, all 3.x sites should upgrade as soon as possible.

### Workarounds

The patch in 4.15.1 and 3.42.6 adds a new authenticated endpoint for updating member email addresses. Updating Ghost is the quickest complete solution.

As a workaround, if for any reason you cannot update your Ghost instance, you can block the `POST /members/api/send-magic-link/` endpoint, which will also disable member login and signup for your site.

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@ghost.org](mailto:security@ghost.org)
Vulnerability: GHSA-cgjv-rghq-qhgp
Summary: Path Traversal in algo-httpserv
Severity: HIGH
CWE: CWE-22
Published: 2019-09-11T23:00:57Z

Versions of `algo-httpserv` prior to 1.1.2 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 1.1.2 or later.
Vulnerability: GHSA-vfvf-mqq8-rwqc
Summary: Sanitization bypass using HTML Entities in marked
Aliases: CVE-2016-10531
Severity: HIGH
CWE: CWE-79
Published: 2019-02-18T23:58:20Z

Affected versions of `marked` are susceptible to a cross-site scripting vulnerability in link components when `sanitize:true` is configured. 

## Proof of Concept

This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted.

For example:

A link URI such as
```
javascript&#x58document;alert&#40;1&#41;
```
Renders a valid link that when clicked will execute `alert(1)`.


## Recommendation

Update to version 0.3.6 or later.
Vulnerability: GHSA-j3cr-j9jx-mf4p
Summary: Downloads Resources over HTTP in redis-srvr
Aliases: CVE-2016-10639
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:07Z

Affected versions of `redis-srvr` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `redis-srvr`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-jjgw-jf33-7fg9
Summary: Directory Traversal in mfrs
Aliases: CVE-2017-16193
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:22:48Z

Affected versions of `mfrs` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jcjx-c3j3-44pr
Summary: Insufficient Session Expiration in @cyyynthia/tokenize
Severity: HIGH
CWE: CWE-613
Published: 2021-11-10T16:44:12Z

### Impact
A bug introduced in version 1.1.0 made Tokenize generate faulty tokens with NaN as a generation date. As a result, tokens would not properly expire and remain valid regardless of the `lastTokenReset` field.

### Patches
Version 1.1.3 contains a patch that'll invalidate these faulty tokens and make new ones behave as expected.

### Workarounds
None. Tokens do not hold the necessary information to perform invalidation anymore.

### References
PR #1

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/cyyynthia/tokenize](https://github.com/cyyynthia/tokenize)
* Email us at [cynthia@cynthia.dev](mailto:cynthia@cynthia.dev)
Vulnerability: GHSA-rv6q-p3x7-43fx
Summary: Malicious Package in bitcoimjs-lib
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:37:50Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xr8h-53xr-jhcm
Summary: Path Traversal in marked-tree
Aliases: CVE-2020-7682
Severity: HIGH
CWE: CWE-22
Published: 2021-05-07T16:06:43Z

This affects all versions up to and including version 0.8.1 of package marked-tree. There is no path sanitization in the path provided at fs.readFile in index.js.
Vulnerability: GHSA-7889-rm5j-hpgg
Summary: Clipboard feature vulnerability allowing to inject arbitrary HTML into the editor using paste functionality
Aliases: CVE-2021-32809
Severity: MODERATE
CWE: CWE-79, CWE-94
Published: 2021-08-23T19:40:57Z

### Affected packages
The vulnerability has been discovered in [clipboard](https://ckeditor.com/cke4/addon/clipboard) plugin. All plugins with [clipboard](https://ckeditor.com/cke4/addon/clipboard) plugin dependency are affected:

* [clipboard](https://ckeditor.com/cke4/addon/clipboard)
* [pastetext](https://ckeditor.com/cke4/addon/pastetext)
* [pastetools](https://ckeditor.com/cke4/addon/pastetools)
* [widget](https://ckeditor.com/cke4/addon/widget)
* [uploadwidget](https://ckeditor.com/cke4/addon/uploadwidget)
* [autolink](https://ckeditor.com/cke4/addon/autolink)
* [tableselection](https://ckeditor.com/cke4/addon/tableselection)

### Impact
A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Anton Subbotin ([skavans](https://github.com/skavans)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-8g3r-968r-c644
Summary: Malicious Package in jw-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:15:58Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-363h-vj6q-3cmj
Summary: Rosetta-Flash JSONP Vulnerability in hapi
Aliases: CVE-2014-4671
Severity: MODERATE
CWE: CWE-352
Published: 2020-08-31T22:45:35Z

This description taken from the pull request provided by Patrick Kettner.



Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy.





## Recommendation

- Update hapi to version 6.1.1 or later.

Alternatively, a solution previously implemented by Google, Facebook, and Github is to prepend callbacks with an empty inline comment. This will cause the flash parser to break on invalid inputs and prevent the issue, and how the issue has been resolved internally in hapi.
Vulnerability: GHSA-9mx2-prfp-8hqp
Summary: Prototype Pollution in simpl-schema
Aliases: CVE-2020-7742
Severity: HIGH
CWE: CWE-1321
Published: 2021-05-10T18:38:47Z

This affects the package simpl-schema before 1.10.2. Attacker controlled input into a schema could result in remote code execution within the scope of the surrounding application.
Vulnerability: GHSA-hrpq-r399-whgw
Summary: Sandbox Breakout / Arbitrary Code Execution in safe-eval
Aliases: CVE-2020-7710
Severity: CRITICAL
CWE: CWE-94
Published: 2020-08-25T23:40:53Z

All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. 

Evaluating the payload 
```
(function (){
  var ex = new Error
  ex.__proto__ = null
  ex.stack = {
    match: x => {
      return x.constructor.constructor("throw process.env")()
    }
  }
  return ex
})()
``` 

prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-xwg3-gjxh-c8pm
Summary: Malicious Package in ngx-context-menu
Severity: CRITICAL
Published: 2020-09-03T19:14:32Z

Version 0.0.26 of `ngx-context-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-97pv-4338-r5vp
Summary: Cross-site Scripting in file-upload-with-preview
Aliases: CVE-2021-23439
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-07T23:08:54Z

This affects the package file-upload-with-preview before 4.2.0. A file containing malicious JavaScript code in the name can be uploaded (a user needs to be tricked into uploading such a file).
Vulnerability: GHSA-qpwf-4fx5-crqq
Summary: Directory Traversal in earlybird
Aliases: CVE-2017-16154
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:19:36Z

Affected versions of `earlybird` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-w3f3-4j22-2v3p
Summary: Malicious Package in destroyer-of-worlds
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:27:02Z

The package `destroyer-of-worlds` contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop. The script targeted UNIX systems.


## Recommendation

Remove the package from your environment and perform additional incident response on your system's files and processes.
Vulnerability: GHSA-2h3x-95c6-885r
Summary: Malicious Package in river-mock
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:46:46Z

All versions of `river-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3269-x4pw-vffg
Summary: OS Command Injection in diskusage-ng
Aliases: CVE-2020-7631
Severity: CRITICAL
CWE: CWE-78
Published: 2022-01-07T00:21:08Z

diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.
Vulnerability: GHSA-2ggq-vfcp-gwhj
Summary: Cross-Site Scripting in @hapi/boom
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-04T17:33:53Z

Versions of `@hapi/boom` prior t 0.3.8 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.3.8 or later.
Vulnerability: GHSA-5q88-cjfq-g2mh
Summary: codecov NPM module allows remote attackers to execute arbitrary commands
Aliases: CVE-2020-7597
Severity: HIGH
CWE: CWE-78
Published: 2020-02-19T17:29:39Z

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.
Vulnerability: GHSA-g753-jx37-7xwh
Summary: ECDSA signature vulnerability of Minerva timing attack in jsrsasign
Severity: MODERATE
CWE: CWE-362
Published: 2020-06-30T16:05:08Z

### Impact
ECDSA side-channel attack named [Minerava](https://minerva.crocs.fi.muni.cz/) have been found and it was found that it affects to jsrsasign.

Execution time of thousands signature generation have been observed then EC private key which is scalar value may be recovered since point and scalar multiplication time depends on bits of scalar. In jsrsasign 8.0.13 or later, execution time of EC point and scalar multiplication is almost constant and fixed for the issue.

- Minerva is one of timing attack or side channel attack for EC.
- If you don't use ECDSA class, you are not affected the vulnerability.
- The vulnerability is that attacker may guess private key by checking processing time of EC key generation or ECDSA signing.
- The cause issue is that point multiplication processing time in ECDSA signing is depends on private key value.
- After 8.0.13, processing time of point multiplication in ECDSA signing have become constant for key value in theory.

### Patches
Users using ECDSA signature generation should upgrade to 8.0.13 or later.

### Workarounds
There is no workarounds in jsrsasign. Update jsrsasign or use other ECDSA library.

### ACKNOWLEDGEMENT
Thanks to Jan Jancar @J08nY, Petr Svenda and Vladimir Sedlacek of Masaryk University in Czech Republic to find and report this vulnerability.

### References
https://minerva.crocs.fi.muni.cz/
https://www.npmjs.com/advisories/1505
https://github.com/kjur/jsrsasign/issues/411
Vulnerability: GHSA-7cv6-gvx3-m54m
Summary: Cross-Site Scripting in keystone
Aliases: CVE-2017-15881
Severity: MODERATE
CWE: CWE-79
Published: 2017-11-16T01:47:02Z

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly encode rendered HTML on admin-created blog posts. This allows attackers to execute arbitrary JavaScript in the victim's browser. Exploiting this vulnerability requires having access to an admin account.


## Recommendation

Update to version 4.0.0 or later.
Vulnerability: GHSA-2m8v-572m-ff2v
Summary: Command Injection Vulnerability
Aliases: CVE-2021-21315
Severity: MODERATE
CWE: CWE-78
Published: 2021-02-16T16:51:04Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a parameter check. Please upgrade to version >= 5.3.1

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Vulnerability: GHSA-4wch-fwmx-cf47
Summary: Directory Traversal in augustine
Aliases: CVE-2017-0930
Severity: HIGH
CWE: CWE-22
Published: 2018-09-18T13:50:25Z

Affected versions of `augustine` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

## Proof of Concept
```
GET //etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No direct patch is available at this time. 

Currently, the best mitigation for this flaw is to use a different, functionally equivalent static file server package.
Vulnerability: GHSA-xpqw-fqpw-35fc
Summary: Directory Traversal in wangguojing123
Aliases: CVE-2017-16150
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:57:54Z

Affected versions of `wangguojing123` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-77q4-m83q-w76v
Summary: Missing Origin Validation in browserify-hmr
Aliases: CVE-2018-14730
Severity: HIGH
CWE: CWE-200
Published: 2020-09-01T21:18:20Z

Versions of `browserify-hmr` prior to 0.4.0 are missing origin validation on the websocket server. 

This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation

Upgrade to version 0.4.0 or later.
Vulnerability: GHSA-97x5-cc53-cv4v
Summary: Cross site scripting in froala-editor
Aliases: CVE-2020-22864
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-28T23:14:06Z

A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor allows attackers to execute arbitrary web scripts or HTML.
Vulnerability: GHSA-4859-gpc7-4j66
Summary: Command Injection in dot
Severity: MODERATE
CWE: CWE-77
Published: 2019-06-05T21:24:29Z

All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.
Vulnerability: GHSA-876r-hj45-fw7g
Summary: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Severity: CRITICAL
Published: 2020-09-03T21:18:41Z

All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system.


## Recommendation

The package is not suited to receive arbitrary user input. Consider using an alternative package.
Vulnerability: GHSA-3gpc-w23c-w59w
Summary: Sandbox Breakout / Arbitrary Code Execution in pitboss-ng
Severity: CRITICAL
Published: 2020-09-04T15:02:06Z

All versions of `pitboss-ng` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.
  
## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-94hh-pjjg-rwmr
Summary: Padding Oracle Attack due to Observable Timing Discrepancy in jose-browser-runtime
Aliases: CVE-2021-29444
Severity: MODERATE
CWE: CWE-203
Published: 2021-04-19T14:58:49Z

### Impact

[AES_CBC_HMAC_SHA2 Algorithm](https://tools.ietf.org/html/rfc7518#section-5.2) (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) decryption would always execute both HMAC tag verification and CBC decryption, if either failed `JWEDecryptionFailed` would be thrown. But a possibly observable difference in timing when padding error would occur while decrypting the ciphertext makes a padding oracle and an adversary might be able to make use of that oracle to decrypt data without knowing the decryption key by issuing on average 128*b calls to the padding oracle (where b is the number of bytes in the ciphertext block).

### Patches

A patch was released which ensures the HMAC tag is verified before performing CBC decryption. The fixed versions are `>=3.11.4`.

Users should upgrade to `^3.11.4`.

### Credits
Thanks to Morgan Brown of Microsoft for bringing this up and Eva Sarafianou (@esarafianou) for helping to score this advisory.
Vulnerability: GHSA-pp75-xfpw-37g9
Summary: Prototype pollution in grpc and @grpc/grpc-js
Aliases: CVE-2020-7768
Severity: HIGH
CWE: CWE-915
Published: 2021-05-10T19:16:14Z

"The package grpc before 1.24.4 and the package @grpc/grpc-js before 1.1.8 are vulnerable to Prototype Pollution via loadPackageDefinition."
Vulnerability: GHSA-f7qw-5pvg-mmwp
Summary: Prototype Pollution in lutils-merge
Severity: MODERATE
CWE: CWE-400
Published: 2019-06-13T18:58:44Z

All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

The package is deprecated and no fixes are available. Consider using an alternative package.
Vulnerability: GHSA-362x-34h3-h6h6
Summary: Downloads Resources over HTTP in box2d-native
Aliases: CVE-2016-10617
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:56:48Z

Affected versions of `box2d-native` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `box2d-native`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-h6mq-3cj6-h738
Summary: Reverse Tabnabbing in showdown
Severity: LOW
CWE: CWE-1022
Published: 2020-09-03T23:21:16Z

Versions of `showdown` prior to 1.9.1 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.


## Recommendation

Upgrade to version 1.9.1 or later.
Vulnerability: GHSA-7qm6-9v49-38m9
Summary: Prototype Pollution in record-like-deep-assign
Aliases: CVE-2021-23402
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-12-10T18:55:39Z

All versions of package record-like-deep-assign are vulnerable to Prototype Pollution via the main functionality.
Vulnerability: GHSA-9j9m-8wjc-ff96
Summary:  Insufficient Session Expiration in apostrophe
Aliases: CVE-2021-25979
Severity: CRITICAL
CWE: CWE-613
Published: 2021-11-10T17:02:44Z

Apostrophe CMS versions between 2.63.0 to 3.3.1 affected by an insufficient session expiration vulnerability, which allows unauthenticated remote attackers to hijack recently logged-in users' sessions.
Vulnerability: GHSA-rcv7-4w2m-gj9v
Summary: Malicious Package in sj-tw-test-security
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:24:26Z

All versions of `sj-tw-test-security` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-97mg-3cr6-3x4c
Summary: Remote Code Execution in mongodb-query-parser
Severity: CRITICAL
Published: 2020-09-04T17:27:23Z

Versions of `mongodb-query-parser` prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system.  Parsing the following payload executes `touch test-file`: 

```'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'```



## Recommendation

Upgrade to version 2.0.0 or later.
Vulnerability: GHSA-jf55-rgpx-p6rx
Summary: Malicious Package in iie-viz
Severity: CRITICAL
Published: 2020-09-03T19:12:22Z

Version 1.0.4 of `iie-viz` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-hfmf-q43v-2ffj
Summary: Improper Key Verification in openpgp
Aliases: CVE-2019-9154
Severity: HIGH
CWE: CWE-347
Published: 2019-08-23T21:42:18Z

Versions of `openpgp` prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The `openpgp` package does not verify whether a subpacket is hashed. Furthermore, due to the order of parsing a signature packet information from unhashed subpackets overwrites information from hashed subpackets. This may allow an attacker to modify the contents of a key certification signature or revocation signature. Doing so could convince a victim to use an obsolete key for encryption. An attack require a victim to import a manipulated key or update an existing key with a manipulated version.


## Recommendation

Upgrade to version 4.2.0 or later. 
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Vulnerability: GHSA-mc9x-v9xg-25pm
Summary: Exfiltrates data on installation in coffescript
Aliases: CVE-2017-16205
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-06T20:12:54Z

The `coffescript` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.



## Recommendation

If you have found `coffescript` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-3j7m-hmh3-9jmp
Summary: Cross-Site Scripting in sanitize-html
Aliases: CVE-2016-1000237
Severity: MODERATE
CWE: CWE-79
Published: 2020-04-16T03:14:47Z

Affected versions of `sanitize-html` do not sanitize input recursively, which may allow an attacker to execute arbitrary Javascript.


## Recommendation

Update to version 1.4.3 or later.
Vulnerability: GHSA-3f5c-4qxj-vmpf
Summary: High severity vulnerability that affects next
Aliases: CVE-2017-16877
Severity: HIGH
CWE: CWE-22
Published: 2017-12-05T02:04:14Z

ZEIT Next.js before 2.4.1 has directory traversal under the /_next and /static request namespace, allowing attackers to obtain sensitive information.
Vulnerability: GHSA-29mw-wpgm-hmr9
Summary: Regular Expression Denial of Service (ReDoS) in lodash
Aliases: CVE-2020-28500
Severity: MODERATE
CWE: CWE-400
Published: 2022-01-06T20:30:46Z

All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. Steps to reproduce (provided by reporter Liyuan Chen): var lo = require('lodash'); function build_blank (n) { var ret = "1" for (var i = 0; i < n; i++) { ret += " " } return ret + "1"; } var s = build_blank(50000) var time0 = Date.now(); lo.trim(s) var time_cost0 = Date.now() - time0; console.log("time_cost0: " + time_cost0) var time1 = Date.now(); lo.toNumber(s) var time_cost1 = Date.now() - time1; console.log("time_cost1: " + time_cost1) var time2 = Date.now(); lo.trimEnd(s) var time_cost2 = Date.now() - time2; console.log("time_cost2: " + time_cost2)
Vulnerability: GHSA-25mp-g6fv-mqxx
Summary: Unexpected server crash in Next.js.
Aliases: CVE-2021-43803
Severity: HIGH
CWE: CWE-20
Published: 2021-12-07T21:12:09Z

Next.js is a React framework. In versions of Next.js prior to 12.0.5 or 11.1.3, invalid or malformed URLs could lead to a server crash. In order to be affected by this issue, the deployment must use Next.js versions above 11.1.0 and below 12.0.5, Node.js above 15.0.0, and next start or a custom server. Deployments on Vercel are not affected, along with similar environments where invalid requests are filtered before reaching Next.js. Versions 12.0.5 and 11.1.3 contain patches for this issue. Note that prior version 0.9.9 package `next` hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.
Vulnerability: GHSA-q3w9-g74q-vp5f
Summary: Denial of Service in express-fileupload
Severity: LOW
Published: 2020-09-03T21:14:12Z

Versions of `express-fileupload` prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed (up to 30s in internal testing) if the request contains a large `filename` of `.` characters.




## Recommendation

Upgrade to version 1.1.6-alpha.6 or later.
Vulnerability: GHSA-cwcp-6c48-fm7m
Summary: Unsafe eval() in summit
Aliases: CVE-2017-16020
Severity: MODERATE
CWE: CWE-94
Published: 2020-09-01T16:39:38Z

Affected versions of `summit` allow attackers to execute arbitrary commands via collection names when using the `PouchDB` driver.



## Recommendation

No direct patch is available at this time.

Currently, the best option to mitigate the issue is to avoid using the `PouchDB` driver, as the package author has abandoned this feature entirely.
Vulnerability: GHSA-3fr8-mwpp-8h9p
Summary: Cross-site scripting in TileServer GL
Aliases: CVE-2020-15500
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-17T21:01:15Z

An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page, causing reflected XSS.
Vulnerability: GHSA-2mhh-w6q8-5hxw
Summary: Remote Memory Disclosure in ws
Aliases: CVE-2016-10518
Severity: LOW
CWE: CWE-201
Published: 2019-02-18T23:56:42Z

Versions of `ws` prior to 1.0.1 are affected by a remote memory disclosure vulnerability.

In certain rare circumstances, applications which allow users to control the arguments of a `client.ping()` call will cause `ws` to send the contents of an allocated but non-zero-filled buffer to the server. This may disclose sensitive information that still exists in memory after previous use of the memory for other tasks.



## Proof of Concept
```
var ws = require('ws')

var server = new ws.Server({ port: 9000 })
var client = new ws('ws://localhost:9000')

client.on('open', function () {
  console.log('open')
  client.ping(50) // this sends a non-zeroed buffer of 50 bytes

  client.on('pong', function (data) {
    console.log('got pong')
    console.log(data) // Data from the client. 
  })
})
```


## Recommendation

Update to version 1.0.1 or greater.
Vulnerability: GHSA-xmc8-cjfr-phx3
Summary: Regular Expression Denial of Service in highcharts
Aliases: CVE-2018-20801
Severity: HIGH
CWE: CWE-185
Published: 2019-03-18T15:59:32Z

Versions of `highcharts` prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 6.1.0 or higher.