TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-3627-w2qr-5fxr
Summary: Downloads Resources over HTTP in fuseki
Aliases: CVE-2016-10576
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:52:07Z

Affected versions of `fuseki` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fuseki`.


## Recommendation

Update to version 1.0.1 or later.
Vulnerability: GHSA-w364-8vfv-gvf5
Summary: Downloads Resources over HTTP in phantomjs-cheniu
Aliases: CVE-2016-10661
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:52Z

Affected versions of `phantomjs-cheniu` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `phantomjs-cheniu`.


## Recommendation

No patch is currently available for this vulnerability.

As this package is just a fork of Medium's [`phantomjs-prebuilt`](https://github.com/Medium/phantomjs) package, the best mitigation is currently to install the `Medium` version of [`phantomjs-prebuilt`](https://github.com/Medium/phantomjs). This can be done via the following command:
```
npm i phantomjs-prebuilt
```
Vulnerability: GHSA-23vf-5g53-hm9q
Summary: Directory Traversal in list-n-stream
Aliases: CVE-2017-16084
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T14:57:31Z

Affected versions of `list-n-stream` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to version 0.0.11 or later.
Vulnerability: GHSA-pgjj-866w-fc5c
Summary: Risk of code injection
Aliases: CVE-2021-21278
Severity: HIGH
CWE: CWE-74
Published: 2021-10-12T16:03:43Z

### Impact
Some routes use `eval` or `Function constructor`, which may be injected by the target site with unsafe code, causing server-side security issues

### Patches
Temporarily removed the problematic route and added a `no-new-func` rule to eslint
Self-built users should upgrade to 7f1c430 and later as soon as possible

### Credits
Tencent Woodpecker Security Team

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/DIYgod/RSSHub/issues](https://github.com/DIYgod/RSSHub/issues)
* Email us at [i@diygod.me](mailto:i@diygod.me)
Vulnerability: GHSA-2xv3-h762-ccxv
Summary: Out-of-bounds Read in concat-with-sourcemaps
Severity: MODERATE
CWE: CWE-125
Published: 2019-05-29T19:18:02Z

Versions of `concat-with-sourcemaps` before 1.0.6 allocates uninitialized Buffers when a number is passed as a separator.


## Recommendation

Update to version 1.0.6 or later.
Vulnerability: GHSA-gjcw-v447-2w7q
Summary: Forgeable Public/Private Tokens in jws
Aliases: CVE-2016-1000223
Severity: HIGH
Published: 2020-09-01T15:23:18Z

Affected versions of the `jws` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the end result is a complete authentication bypass with minimal effort.




## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-pv8x-p9hq-j328
Summary: Arbitrary Code Execution in mathjs
Aliases: CVE-2017-1001003
Severity: CRITICAL
CWE: CWE-88
Published: 2017-12-18T22:27:53Z

math.js before 3.17.0 had an issue where private properties such as a constructor could be replaced by using unicode characters when creating an object.


## Recommendation

Upgrade to version 3.17.0 or later.
Vulnerability: GHSA-2mxc-m4c3-wqhq
Summary: Malicious Package in ruffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:50:46Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-j3qq-qvc8-c6g7
Summary: Malicious Package in foever
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T21:15:09Z

All versions of `foever` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-536f-268f-6gxc
Summary: Malicious Package in buffermxor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:17:36Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-vcfp-ppqw-mf23
Summary: Downloads Resources over HTTP in fis-sass-all
Aliases: CVE-2016-10686
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2018-08-17T20:20:46Z

Affected versions of `fis-sass-all` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fis-sass-all`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-35q2-47q7-3pc3
Summary: Potential exponential regex in monitor mode
Aliases: CVE-2021-29469
Severity: LOW
CWE: CWE-400
Published: 2021-04-27T15:56:03Z

### Impact
When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.

### Patches
The problem was fixed in commit [`2d11b6d`](https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e) and was released in version `3.1.1`.

### References
#1569 (GHSL-2021-026)
Vulnerability: GHSA-85fq-56wq-gmcf
Summary: Hijacked Environment Variables in mariadb
Aliases: CVE-2017-16046
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-18T18:28:17Z

The `mariadb` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-ccrp-c664-8p4j
Summary: Cross-Site Scripting in markdown-to-jsx
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T21:17:36Z

Versions of `markdown-to-jsx` prior to 6.11.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `data` or VBScript URIs and a base64-encoded payload.


## Recommendation

Upgrade to version 6.11.4 or later.
Vulnerability: GHSA-3pwh-5mmc-mwrx
Summary: Denial of Service in nes
Aliases: CVE-2017-16025
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:06:33Z

Affected versions of `nes` are vulnerable to denial of service when given an invalid `cookie` header, and websocket authentication is set to `cookie`. Submitting an invalid cookie on the websocket upgrade request will cause the node process to throw and exit.


## Recommendation

Update to version 6.4.1 or later.
Vulnerability: GHSA-3p94-vj97-fm4q
Summary: OS Command Injection in fsa
Aliases: CVE-2020-7615
Severity: MODERATE
CWE: CWE-78
Published: 2021-12-09T19:56:44Z

fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()', located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.
Vulnerability: GHSA-3wcq-x3mq-6r9p
Summary: Potential memory exposure in dns-packet
Aliases: CVE-2021-23386
Severity: HIGH
CWE: CWE-908, CWE-200
Published: 2021-05-24T19:51:04Z

This affects the package dns-packet before versions 1.3.2 and 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
Vulnerability: GHSA-8xqr-4cpm-wx7g
Summary: Cross-Site Scripting in react-svg
Severity: HIGH
CWE: CWE-79
Published: 2019-05-31T23:47:27Z

Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.


## Recommendation

Update to version 2.2.18 or later.
Vulnerability: GHSA-6qqf-vvcr-7qrv
Summary: Cryptographically Weak PRNG in generate-password
Severity: MODERATE
CWE: CWE-338
Published: 2019-05-23T09:27:22Z

Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.


## Recommendation

Update to version 1.4.1 or later.
Vulnerability: GHSA-5jgp-pg4f-q8vj
Summary: Malicious Package in node-ftp
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:55:42Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-g9r4-xpmj-mj65
Summary: Prototype Pollution in handlebars
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:06:32Z

Versions of `handlebars` prior to 3.0.8 or 4.5.3 are vulnerable to prototype pollution. It is possible to add or modify properties to the Object prototype through a malicious template. This may allow attackers to crash the application or execute Arbitrary Code in specific conditions.


## Recommendation

Upgrade to version 3.0.8, 4.5.3 or later.
Vulnerability: GHSA-f38p-c2gq-4pmr
Summary: Regular Expression Denial-of-Service in npm schema-inspector
Aliases: CVE-2021-21267
Severity: LOW
CWE: CWE-400, CWE-20
Published: 2021-03-19T20:14:21Z

### Impact
_What kind of vulnerability is it? Who is impacted?_
Email address validation is vulnerable to a denial-of-service attack where some input (for example `a@0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.`) will freeze the program or web browser page executing the code. This affects any current schema-inspector users using any version to validate email addresses. Users who do not do email validation, and instead do other types of validation (like string min or max length, etc), are not affected.

### Patches
_Has the problem been patched? What versions should users upgrade to?_
Users should upgrade to version 2.0.0, which uses a regex expression that isn't vulnerable to ReDoS. The new regex expression is more limited in what it can check, so it is more flexible than the one used before. Therefore, this was a new major version instead of a new patch version to warn people upgrading that they should make sure the email validation still works for their use case. 

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
If a user chooses to not upgrade, the only known workaround would be to stop using the email validation feature in the library. The user could, for example, accept the email address into their system but save it in a "not yet validated" state in their system until a verification email is sent to it (to determine whether the email is valid and belongs to the form submitter). Note that this is the preferred way of validating email addresses anyways.

### References
_Are there any links users can visit to find out more?_
https://gist.github.com/mattwelke/b7f42424680a57b8161794ad1737cd8f

### For more information
If you have any questions or comments about this advisory, you can create an issue in this repository.
Vulnerability: GHSA-8mfc-v7wv-p62g
Summary: Path Traversal in Yarn
Aliases: CVE-2020-8131
Severity: HIGH
CWE: CWE-22
Published: 2022-02-09T22:43:37Z

Arbitrary filesystem write vulnerability in Yarn 1.21.1 and earlier allows attackers to write to any path on the filesystem and potentially lead to arbitrary code execution by forcing the user to install a malicious package.
Vulnerability: GHSA-53xj-v576-3ch2
Summary: OS Command Injection in giting
Aliases: CVE-2019-10802
Severity: HIGH
CWE: CWE-78
Published: 2021-04-13T15:22:09Z

giting version prior to 0.0.8 allows execution of arbritary commands. The first argument &quot;repo&quot; of function &quot;pull()&quot; is executed by the package without any validation.
Vulnerability: GHSA-vf5m-q45w-8mh9
Summary: Malicious Package in js-qha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:00:25Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-78h7-fgq9-625x
Summary: Directory Traversal in quickserver
Aliases: CVE-2017-16196
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:40:14Z

Affected versions of `quickserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-7h26-63m7-qhf2
Summary: HTML comments vulnerability allowing to execute JavaScript code
Aliases: CVE-2021-41165
Severity: HIGH
CWE: CWE-79
Published: 2021-11-17T21:58:25Z

### Affected packages
The vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4.

### Impact
A potential vulnerability has been discovered in CKEditor 4 HTML processing core module. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.17.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank William Bowling ([wbowling](https://github.com/wbowling)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-rmxg-73gg-4p98
Summary: Cross-Site Scripting (XSS) in jquery
Aliases: CVE-2015-9251
Severity: MODERATE
CWE: CWE-79
Published: 2018-01-22T13:32:06Z

Affected versions of `jquery` interpret `text/javascript` responses from cross-origin ajax requests, and automatically execute the contents in `jQuery.globalEval`, even when the ajax request doesn't contain the `dataType` option.


## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-wxhq-pm8v-cw75
Summary: Regular Expression Denial of Service in clean-css
Severity: LOW
Published: 2019-06-05T20:50:16Z

Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 4.1.11 or higher.
Vulnerability: GHSA-5vp3-v4hc-gx76
Summary: UUPSUpgradeable vulnerability in @openzeppelin/contracts
Aliases: CVE-2021-41264
Severity: CRITICAL
CWE: CWE-665
Published: 2021-09-15T20:23:17Z

### Impact

Upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.

### Patches

A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

### References

[Post-mortem](https://forum.openzeppelin.com/t/uupsupgradeable-vulnerability-post-mortem/15680).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-v39h-qm32-8gwq
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in express-mock-middleware
Aliases: CVE-2020-7616
Severity: MODERATE
CWE: CWE-915
Published: 2021-12-09T19:57:29Z

express-mock-middleware through 0.0.6 is vulnerable to Prototype Pollution. Exported functions by the package can be tricked into adding or modifying properties of the `Object.prototype`. Exploitation of this vulnerability requires creation of a new directory where an attack code can be placed which will then be exported by `express-mock-middleware`. As such, this is considered to be a low risk.
Vulnerability: GHSA-cf66-xwfp-gvc4
Summary: Missing Origin Validation in webpack-dev-server
Aliases: CVE-2018-14732
Severity: HIGH
CWE: CWE-20
Published: 2019-01-04T17:40:59Z

Versions of `webpack-dev-server` before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation
For `webpack-dev-server` update to version 3.1.11 or later.
Vulnerability: GHSA-9fgx-q25h-jxrg
Summary: DOM XSS in Theme Preview
Aliases: CVE-2021-29484
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-29T21:53:18Z

### Impact
An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. 

Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. 

Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site - see patches & workarounds below.

### Patches
Fixed in 4.3.3, all 4.x sites should upgrade as soon as possible.
As the endpoint is unused, the patch simply removes it. 

### Workarounds
- Log out of Ghost Admin
- Suspend any users who cannot log out
- Block access to `/ghost/preview`

Example of how to block access in nginx:

```
location ~ /ghost/preview {
    rewrite ^(\/(.*\/)?ghost\/)(.*)$ $1 redirect;
}
```

This redirects the endpoint to `/ghost/`, which mimics the behaviour after the patch is applied.
Vulnerability: GHSA-mwcv-m549-5cm8
Summary: Hijacked Environment Variables in node-tkinter
Aliases: CVE-2017-16062
Severity: HIGH
CWE: CWE-506
Published: 2018-11-01T14:47:43Z

The `node-tkinter` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation



As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-3rh3-wfr4-76mj
Summary: Regular expression Denial of Service in multiple packages
Aliases: CVE-2021-21391
Severity: MODERATE
CWE: CWE-400
Published: 2021-04-06T17:28:41Z


### Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in multiple CKEditor 5 packages. The vulnerability allowed to abuse particular regular expressions, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 packages listed above at version <= 26.0.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 27.0.0.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 5 team would like to thank Yeting Li for recognizing and reporting these vulnerabilities.
Vulnerability: GHSA-hgmg-hhc8-g5wr
Summary: Regular expression Denial of Service in Markdown plugin
Aliases: CVE-2021-21254
Severity: LOW
CWE: CWE-400
Published: 2021-01-29T21:51:22Z

### Impact
A regular expression denial of service (ReDoS) vulnerability has been discovered in the CKEditor 5 Markdown plugin code. The vulnerability allowed to abuse a link recognition regular expression, which could cause a significant performance drop resulting in a browser tab freeze. It affects all users using the CKEditor 5 Markdown plugin at version <= 24.0.0. 

### Patches
The problem has been recognized and patched. The fix will be available in version 25.0.0.

### Workarounds
The user can work around the issue by:
- Upgrading CKEditor 5 to version 25.0.0.
- Disabling the Markdown plugin.

### More information
If you have any questions or comments about this advisory:
* Email us at [security@cksource.com](mailto:security@cksource.com)

### Acknowledgements
The CKEditor 5 team would like to thank Erik Krogh Kristensen from the GitHub team for recognizing this vulnerability and 
Alvaro Muñoz from GitHub for reporting it.
Vulnerability: GHSA-7px7-7xjx-hxm8
Summary: Moderate severity vulnerability that affects marked
Aliases: CVE-2017-1000427
Severity: MODERATE
CWE: CWE-79
Published: 2018-01-04T21:04:19Z

marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.
Vulnerability: GHSA-x4w5-r546-x9qh
Summary: Arbitrary File Read in html-pdf
Aliases: CVE-2019-15138
Severity: HIGH
CWE: CWE-79, CWE-668, CWE-73, CWE-200
Published: 2019-10-11T18:40:38Z

All versions of `html-pdf` are vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input with an XHR request such as `request.open("GET","file:///etc/passwd")` will result in a PDF document with the contents of `/etc/passwd`.


## Recommendation

No fix is currently available. There is a mitigation available in the provided reference.
Vulnerability: GHSA-65xx-c85x-wg76
Summary: Command Injection in plotter
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-04T17:20:52Z

All versions of `plotter` are vulnerable to Command Injection. The package fails to sanitize plot titles, which may allow attackers to execute arbitrary code in the system if the title value is supplied by a user. The following proof-of-concept creates a `testing` file in the current directory:

```
var plot = require('plotter').plot;

const title = 'Example "\nset title system("touch testing")#';

plot({
data: [ 3, 1, 2, 3, 4 ],
filename: 'output.pdf',
style: 'linespoints',
title: title,
logscale: true,
xlabel: 'time',
ylabel: 'length of string',
format: 'pdf'
});

```


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-9q64-mpxx-87fg
Summary: Open Redirect in ecstatic
Severity: HIGH
CWE: CWE-601
Published: 2020-04-01T16:35:08Z

Versions of `ecstatic` prior to 4.1.2, 3.3.2 or 2.2.2 are vulnerable to Open Redirect. The package fails to validate redirects, allowing attackers to craft requests that result in an `HTTP 301` redirect to any other domains.


## Recommendation

If using `ecstatic` 4.x, upgrade to 4.1.2 or later.
If using `ecstatic` 3.x, upgrade to 3.3.2 or later.
If using `ecstatic` 2.x, upgrade to 2.2.2 or later.
Vulnerability: GHSA-333x-qr3v-g4xx
Summary: Command injection in spritesheet-js
Aliases: CVE-2020-7782
Severity: CRITICAL
CWE: CWE-74
Published: 2021-04-13T15:30:16Z

This affects all versions of package spritesheet-js. It depends on a vulnerable package platform-command. The injection point is located in line 32 in lib/generator.js, which is triggered by main entry of the package.
Vulnerability: GHSA-2f6g-w5gj-c93h
Summary: Prototype Pollution in iniparserjs
Aliases: CVE-2021-23328
Severity: MODERATE
CWE: CWE-1321
Published: 2021-04-13T15:20:09Z

This affects all versions of package iniparserjs. This vulnerability relates when ini_parser.js is concentrating arrays. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program.
Vulnerability: GHSA-4rvg-955w-h68q
Summary: Path Traversal in angular-http-server
Aliases: CVE-2018-3713
Severity: HIGH
CWE: CWE-22
Published: 2018-07-26T14:47:40Z

Affected versions of `angular-http-server` are vulnerable to path traversal allowing a remote attacker to read files from the server that uses `angular-http-server`.

## Recommendation

Update to version 1.6.0 or later.

:exclamation: Note: This was originally thought to be fixed in version 1.4.3, though according to [this issue](https://github.com/ossf-cve-benchmark/ossf-cve-benchmark/issues/117#issuecomment-803872454) the vulnerability was not completely fixed until version 1.6.0.
Vulnerability: GHSA-28f4-mjfq-qrvf
Summary: Malicious Package in buffes-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:18:40Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-6rjc-4pwr-3vp7
Summary: Cross-Site Scripting in iobroker.web
Aliases: CVE-2019-10771
Severity: MODERATE
CWE: CWE-79
Published: 2019-12-02T18:14:30Z

Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 2.4.10 or later.
Vulnerability: GHSA-vh7m-p724-62c2
Summary: Signature Malleabillity in elliptic
Aliases: CVE-2020-13822
Severity: HIGH
CWE: CWE-190
Published: 2020-07-29T20:40:35Z

The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Vulnerability: GHSA-m5pf-5894-jmx7
Summary: Malicious Package in sailclothjs
Severity: CRITICAL
Published: 2020-09-03T19:08:00Z

Version 1.2.6 of `sailclothjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-325j-24f4-qv5x
Summary: Regular Expression Denial of Service in ssri
Aliases: CVE-2018-7651
Severity: MODERATE
CWE: CWE-400
Published: 2018-03-07T22:22:20Z

Version of `ssri` prior to 5.2.2 are vulnerable to regular expression denial of service (ReDoS) when using strict mode.


## Recommendation

Update to version 5.2.2 or later.
Vulnerability: GHSA-7frr-c83r-fm22
Summary: Malicious Package in buffez-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:20:49Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-g8wf-rcg3-qw4q
Summary: Directory Traversal in tinyserver2
Aliases: CVE-2017-16085
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T15:01:34Z

Affected versions of `tinyserver2` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

Update to v0.6.0 or later.
Vulnerability: GHSA-v659-54cx-g4qr
Summary: Prototype Pollution in deep-override
Aliases: CVE-2021-25941
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-17T20:57:25Z

Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-q5mq-6fjg-4mw8
Summary: SQL Injection in thinkjs
Aliases: CVE-2020-21176
Severity: HIGH
CWE: CWE-89
Published: 2021-11-19T20:42:32Z

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter.
Vulnerability: GHSA-8h55-49jm-739x
Summary: Directory Traversal in easyquick
Aliases: CVE-2017-16109
Severity: MODERATE
CWE: CWE-22
Published: 2018-08-29T23:21:46Z

Affected versions of `easyquick` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-gpg2-7r7j-4pm9
Summary: Malicious Package in buffer-xob
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:09:56Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-hf5h-hh56-3vrg
Summary: Denial of Service in uws
Aliases: CVE-2016-10544
Severity: HIGH
CWE: CWE-400
Published: 2020-09-01T16:02:29Z

Affected versions of `uws` do not properly handle large websocket messages when `permessage-deflate` is enabled, which may result in a denial of service condition.

If `uws` recieves a 256Mb websocket message when `permessage-deflate` is enabled, the server will compress the message prior to executing the length check, and subsequently extract the message prior to processing. This can result in a situation where an excessively large websocket message passes the length checks, yet still gets cast from a Buffer to a string, which will exceed v8's maximum string size and crash the process.


## Recommendation

Update to version 0.10.9 or later.

Alternatively, disable `permessage-deflate`.
Vulnerability: GHSA-c9f4-xj24-8jqx
Summary: Regular Expression Denial of Service in uglify-js
Aliases: CVE-2015-8858
Severity: HIGH
Published: 2017-10-24T18:33:36Z

Versions of `uglify-js` prior to 2.6.0 are affected by a regular expression denial of service vulnerability when malicious inputs are passed into the `parse()` method.


### Proof of Concept

```
var u = require('uglify-js');
var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}

u.parse("var a = " + genstr(process.argv[2], "1") + ".1ee7;");
```

### Results
```
$ time node test.js 10000
real	0m1.091s
user	0m1.047s
sys	0m0.039s

$ time node test.js 80000
real	0m6.486s
user	0m6.229s
sys	0m0.094s
```


## Recommendation

Update to version 2.6.0 or later.
Vulnerability: GHSA-mmhj-4w6j-76h7
Summary: Misuse of `Reference` and other transferable APIs may lead to access to nodejs isolate
Aliases: CVE-2021-21413
Severity: HIGH
CWE: CWE-913
Published: 2021-04-06T17:22:55Z

Versions of `isolated-vm` before v4.0.0, and especially before v3.0.0, have API pitfalls which may make it easy for implementers to expose supposed secure isolates to the permissions of the main nodejs isolate.

`Reference` objects allow access to the underlying reference's full prototype chain. In an environment where the implementer has exposed a `Reference` instance to an attacker they would be able to use it to acquire a `Reference` to the nodejs context's `Function` object.

Similar application-specific attacks could be possible by modifying the local prototype of other API objects.

Access to `NativeModule` objects could allow an attacker to load and run native code from anywhere on the filesystem. If combined with, for example, a file upload API this would allow for arbitrary code execution.

To address these issues the following changes were made in v4.0.0:
- Documentation was updated with more explicit guidelines on building secure applications.
- `Reference` instances will no longer follow prototype chains by default, nor will they invoke accessors or proxies.
- All `isolated-vm` API prototypes are now immutable.
- `NativeModule` constructor may only be invoked from a nodejs isolate.
Vulnerability: GHSA-p92x-r36w-9395
Summary: Type confusion in mpath
Aliases: CVE-2021-23438
Severity: CRITICAL
CWE: CWE-843
Published: 2021-09-02T22:02:25Z

This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['__proto__']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
Vulnerability: GHSA-gqfv-g9f6-3v3m
Summary: Directory Traversal in serveryaozeyan
Aliases: CVE-2017-16096
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:50:23Z

Affected versions of `serveryaozeyan` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-xrr6-6ww3-f3qm
Summary: Sandbox Breakout / Arbitrary Code Execution in value-censorship
Severity: MODERATE
Published: 2020-09-02T21:25:58Z

All versions of `value-censorship` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-c6h4-gc3f-hgjq
Summary: Prototype Pollution in js-data
Aliases: CVE-2021-23574
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-01-06T21:58:56Z

All versions of package js-data are vulnerable to Prototype Pollution via the deepFillIn and the set functions. This is an incomplete fix of [CVE-2020-28442](https://snyk.io/vuln/SNYK-JS-JSDATA-1023655).
Vulnerability: GHSA-f64g-whxf-w8f2
Summary: Malicious Package in buffar-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:44:06Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-c2v2-7rcg-2ch7
Summary: Regular Expression Denial of Service in ansi2html
Aliases: CVE-2015-9239
Severity: HIGH
CWE: CWE-400
Published: 2020-09-01T15:17:48Z

The `ansi2html` package is affected by a regular expression denial of service vulnerability when certain types of user input is passed in.


## Proof of concept
```
var ansi2html = require('ansi2html')

var start = process.hrtime();
ansi2html("[1111111111111111111111;0000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;00000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;000000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;0000000000000000000000000000");
console.log(process.hrtime(start));
```

Results of the above
```
00:29:53-adam_baldwin~/tmp$ node test
[ 0, 119615367 ]
[ 0, 149934565 ]
[ 0, 233325677 ]
[ 3, 46582479 ]
```


## Recommendation

At the time of this writing, February 2018, all versions of `ansi2html` remain vulnerable, and the package has not been updated for 4 years. 

In order to use this package safely, it is necessary to avoid passing user input to the package, or to limit the size of the input string to a size with a parse time you find acceptable. Unfortunately, the match time grows at quite a small character count, so it is unlikely for it to both allow strings of a useful size while protecting against the denial of service attack. 

In the case that user input of significant length must be parsed by ansi2html, the best mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.][available on npm](https://www.npmjs.com/search?q=ansi+html)
Vulnerability: GHSA-8v3j-jfg3-v3fv
Summary: Prototype Pollution in Sails.js
Aliases: CVE-2021-44908
Severity: MODERATE
CWE: CWE-1321
Published: 2022-03-18T00:01:11Z

Sails.js <= 1.5.2 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules(). A [patch](https://github.com/balderdashy/sails/commit/7c5379a656bb305c958df1dcc2b51a9668830358) is available in the `master` branch of Sails.js's GItHub repository.
Vulnerability: GHSA-c9j3-wqph-5xx9
Summary: Command Injection in egg-scripts
Aliases: CVE-2018-3786
Severity: LOW
CWE: CWE-77
Published: 2018-09-17T20:43:34Z

Versions of `egg-scripts` before 2.8.1 are vulnerable to command injection. This is only exploitable if a malicious argument is provided on the command line.


Example:
`eggctl start --daemon --stderr='/tmp/eggctl_stderr.log; touch /tmp/malicious'`


## Recommendation

Update to version 2.8.1 or later.
Vulnerability: GHSA-7p99-3798-f85c
Summary: URL Redirection to Untrusted Site ('Open Redirect') in express-openid-connect
Aliases: CVE-2022-24794
Severity: HIGH
CWE: CWE-601
Published: 2022-03-31T22:44:47Z

### Impact
Users of the `requiresAuth` middleware, either directly or through the default `authRequired` option, are vulnerable to an Open Redirect when the middleware is applied to a catch all route.

If all routes under `example.com` are protected with the `requiresAuth` middleware, a visit to `http://example.com//google.com` will be redirected to `google.com` after login because the original url reported by the Express framework is not properly sanitised.

### Am I affected?
You are affected by this vulnerability if you are using the `requiresAuth` middleware on a catch all route or the default `authRequired` option and `express-openid-connect` version `<=2.7.1`.

### How to fix that?
Upgrade to version `>=2.7.2`

### Will this update impact my users?
The fix provided in the patch will not affect your users.
Vulnerability: GHSA-x9gm-qxhh-rf75
Summary: Malicious Package in cordova-plugin-china-picker
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:51:28Z

Version 1.0.910 of `cordova-plugin-china-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.910 of this module is found installed you will want to replace it with a version before or after 1.0.910. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-cmch-296j-wfvw
Summary: Arbitrary File Write in iobroker.js-controller
Aliases: CVE-2019-10767
Severity: HIGH
CWE: CWE-22
Published: 2019-12-02T18:06:14Z

Versions of `iobroker.controller` prior to 2.0.25 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended `/adapter/<adapter-name>` folder, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.


## Recommendation

Upgrade to version 2.0.25 or later.
Vulnerability: GHSA-x6gq-467r-hwcc
Summary: Malicious Package in soket.js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T21:14:05Z

All versions of `soket.js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-p6mr-pxg4-68hx
Summary: Symlink Arbitrary File Overwrite in bower
Aliases: CVE-2019-5484
Severity: HIGH
CWE: CWE-22
Published: 2019-09-17T23:21:34Z

Versions of `bower` prior to 1.8.8 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `bower` does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory.



## Recommendation

Update to version 1.8.8 or later
Vulnerability: GHSA-58qp-5328-v7mh
Summary: Improper Input Validation and Loop with Unreachable Exit Condition ('Infinite Loop') in cumulative-distribution-function
Aliases: CVE-2021-29486
Severity: HIGH
CWE: CWE-835, CWE-20
Published: 2021-05-04T17:43:36Z

### Impact

* Apps using this library on improper data may crash or go into an infinite-loop
* In the case of a nodejs server-app using this library to act on invalid non-numeric data, the nodejs server may crash.  This may affect other users of this server and/or require the server to be rebooted for proper operation.  
* In the case of a browser app using this library to act on invalid non-numeric data, that browser may crash or lock up.

A flaw enabling an infinite-loop was discovered in the code for evaluating the cumulative-distribution-function
of input data.   Although the documentation explains that numeric data is required, some users may confuse an array
of strings like ["1","2","3","4","5"] for numeric data [1,2,3,4,5] when it is in fact string data.  An infinite loop is possible when the 
cumulative-distribution-function  is evaluated for a given point when the input data is string data rather than type `number`.  

This vulnerability enables an infinite-cpu-loop denial-of-service-attack on any app using npm:cumulative-distribution-function v1.0.3 or earlier if the attacker can supply malformed data to the library.  The vulnerability could also manifest if a data source to
be analyzed changes data type from Arrays of number (proper) to Arrays of string (invalid, but undetected by earlier version of the library).

### Patches

Users should upgrade to at least v2.0.0, or the latest version.

Tests for several types of invalid data have been created, and version 2.0.0 has been tested to reject this invalid data by
throwing a `TypeError()` instead of processing it.  Developers using this library may wish to adjust their app's code slightly to better tolerate or handle this TypeError.  Apps performing proper numeric data validation before sending data to this library should be mostly unaffected by this patch.  

### Workarounds

The vulnerability can be mitigated in older versions by ensuring that only finite numeric data of type `Array[number]` or `number` is passed to `cumulative-distribution-function` and its `f(x)` function, respectively.  

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the Github repository at https://github.com/DrPaulBrewer/cumulative-distribution-function
Vulnerability: GHSA-qhm8-m2c4-9mw7
Summary: Downloads Resources over HTTP in qbs
Aliases: CVE-2016-10656
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:45:11Z

Affected versions of `qbs` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `qbs`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.