TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-333x-9vgq-v2j4
Summary: Directory Traversal in geddy
Aliases: CVE-2015-5688
Severity: HIGH
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Versions 13.0.8 and earlier of geddy are vulnerable to a directory traversal attack via URI encoded attack vectors.

### Proof of Concept
```
http://localhost:4000/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
```


## Recommendation

Update geddy to version >= 13.0.8
Vulnerability: GHSA-32x6-qvw6-mxj4
Summary: Forwarding of confidentials headers to third parties in fluture-node
Aliases: CVE-2022-24719
Severity: LOW
CWE: CWE-359, CWE-601, CWE-200
Published: 2022-03-01T22:14:57Z

### Impact

Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing.

### Patches

The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin.

### Workarounds

Use a custom redirection strategy via the `followRedirectsWith` function. The custom strategy can be based on the new strategies available in fluture-node@4.0.2.

### References

- This vulnerability was discovered after the announcement of similar vulnerabilities in the `follow-redirects` package. There is more information there: https://github.com/advisories/GHSA-74fj-2j2h-c42q and https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db/
- Fixed in 125e4474f910c1507f8ec3232848626fbc0f55c4 and 0c99bc511533d48be17dc6bfe641f7d0aeb34d77
Vulnerability: GHSA-6chw-6frg-f759
Summary: Regular Expression Denial of Service in Acorn
Severity: HIGH
CWE: CWE-400
Published: 2020-04-03T21:48:38Z

Affected versions of acorn are vulnerable to Regular Expression Denial of Service.
A regex in the form of /[x-\ud800]/u causes the parser to enter an infinite loop.
The string is not valid UTF16 which usually results in it being sanitized before reaching the parser.
If an application processes untrusted input and passes it directly to acorn,
attackers may leverage the vulnerability leading to Denial of Service.
Vulnerability: GHSA-8xwg-wv7v-4vqp
Summary: Code Execution by Re-enabling Node.js integration in electron
Aliases: CVE-2018-1000136
Severity: HIGH
CWE: CWE-20
Published: 2018-03-26T16:41:17Z

Versions of electron 
A vulnerability has been discovered which allows Node.js integration to be re-enabled in some Electron applications that disable it.

For the application to be impacted by this vulnerability it must meet all of these conditions

- Runs on Electron 1.7, 1.8, or a 2.0.0-beta
- Allows execution of arbitrary remote code
- Disables Node.js integration
- Does not explicitly declare webviewTag: false in its webPreferences
- Does not enable the nativeWindowOption option
- Does not intercept new-window events and manually override event.newGuest without using the supplied options tag


## Recommendation

Update to `electron` version 1.7.13, 1.8.4, or 2.0.0.beta.5 or later

If you are unable to update your Electron version can mitigate the vulnerability with the following code.

```
app.on('web-contents-created', (event, win) => {
  win.on('new-window', (event, newURL, frameName, disposition,
                        options, additionalFeatures) => {
    if (!options.webPreferences) options.webPreferences = {};
    options.webPreferences.nodeIntegration = false;
    options.webPreferences.nodeIntegrationInWorker = false;
    options.webPreferences.webviewTag = false;
    delete options.webPreferences.preload;
  })
})

// and *IF* you don't use WebViews at all,
// you might also want
app.on('web-contents-created', (event, win) => {
  win.on('will-attach-webview', (event, webPreferences, params) => {
    event.preventDefault();
  })
})
```
Vulnerability: GHSA-3qh4-r86r-grvm
Summary: Arbitrary JavaScript Execution in typed-function
Aliases: CVE-2017-1001004
Severity: HIGH
CWE: CWE-94
Published: 2020-09-02T18:24:39Z

Versions of `typed-function` prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.


## Recommendation

Upgrade to version 0.10.6 or later.
Vulnerability: GHSA-9r3m-mhfm-39cm
Summary: Incorrect Calculation in bigint-money
Severity: LOW
CWE: CWE-682
Published: 2020-09-11T21:10:29Z

Versions of `bigint-money` prior to 0.6.2 are vulnerable to an Incorrect Calculation. The package incorrectly rounded certain numbers, which could have drastic consequences due to its usage in financial systems.


## Recommendation

Upgrade to version 0.6.2 or later.
Vulnerability: GHSA-33rv-m2gp-mm2r
Summary: Prototype pollution in safe-flat
Aliases: CVE-2021-25927
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-06-21T17:18:29Z

Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-6226-h7ff-ch6c
Summary: Widget feature vulnerability allowing to execute JavaScript code using undo functionality
Aliases: CVE-2021-32808
Severity: HIGH
CWE: CWE-79
Published: 2021-08-23T19:40:48Z

### Affected packages
The vulnerability has been discovered in [Widget](https://ckeditor.com/cke4/addon/clipboard) plugin if used alongside [Undo](https://ckeditor.com/cke4/addon/undo) feature.

### Impact
A potential vulnerability has been discovered in CKEditor 4 [Widget](https://ckeditor.com/cke4/addon/widget) package. The vulnerability allowed to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Anton Subbotin ([skavans](https://github.com/skavans)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-8jf2-cq6v-w234
Summary: Malicious Package in uglyfi.js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:10:53Z

Version 0.17.3 of `uglyfi.js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hhfg-6hfc-rvxm
Summary: Regular Expression Denial of Service in jsoneditor
Aliases: CVE-2021-3822
Severity: MODERATE
CWE: CWE-400, CWE-697, CWE-1333
Published: 2021-09-29T17:15:55Z

JSON Editor is a web-based tool to view, edit, format, and validate JSON. It has various modes such as a tree editor, a code editor, and a plain text editor. The jsoneditor package is vulnerable to ReDoS (regular expression denial of service). An attacker that is able to provide a crafted element as input to the getInnerText function may cause an application to consume an excessive amount of CPU. Below pinned line using vulnerable regex.
Vulnerability: GHSA-hvgc-mggg-pxr2
Summary: Malicious Package in js-sha7
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:02:33Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-gjwp-7v3g-99pj
Summary: Cross-site Request Forgery (CSRF) in joplin
Aliases: CVE-2021-23431
Severity: MODERATE
CWE: CWE-352
Published: 2021-09-02T17:09:05Z

The package joplin before 2.3.2 are vulnerable to Cross-site Request Forgery (CSRF) due to missing CSRF checks in various forms.
Vulnerability: GHSA-4xg9-g7qj-jhg4
Summary: Malicious Package in comander
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T20:46:36Z

All versions of `comander` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.
Vulnerability: GHSA-4r62-v4vq-hr96
Summary: Regular Expression Denial of Service (REDoS) in Marked
Aliases: CVE-2021-21306
Severity: MODERATE
CWE: CWE-400
Published: 2021-02-08T21:17:58Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

[Regular expression Denial of Service](https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS)

A Denial of Service attack can affect anyone who runs user generated code through `marked`.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

patched in v2.0.0

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

None.

### References
_Are there any links users can visit to find out more?_

https://github.com/markedjs/marked/issues/1927
https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [marked](https://github.com/markedjs/marked/issues)
Vulnerability: GHSA-4p55-xj37-fx7g
Summary: Improper Authorization in Strapi
Aliases: CVE-2020-27665
Severity: MODERATE
CWE: CWE-276
Published: 2020-10-29T18:29:31Z

In Strapi before 3.2.5, there is no admin::hasPermissions restriction for CTB (aka content-type-builder) routes.
Vulnerability: GHSA-28xh-wpgr-7fm8
Summary: Command Injection in open
Severity: CRITICAL
CWE: CWE-77
Published: 2019-06-20T15:35:49Z

Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.

The package does come with the following warning in the readme:

```
The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.
```


## Recommendation

`open` is now the deprecated `opn` package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.
Vulnerability: GHSA-fvq6-55gv-jx9f
Summary: SQL Injection in mysql
Aliases: CVE-2015-9244
Severity: MODERATE
CWE: CWE-89
Published: 2020-09-01T15:21:05Z

Versions of `mysql` prior to 2.0.0-alpha8 are affected by a SQL Injection vulnerability in the `mysql.escape()` function, which does not properly escape object keys.


## Recommendation

Update to version 2.0.0-alpha8 or later.
Vulnerability: GHSA-6c3j-c64m-qhgq
Summary: XSS in jQuery as used in Drupal, Backdrop CMS, and other products
Aliases: CVE-2019-11358
Severity: MODERATE
CWE: CWE-79, CWE-1321
Published: 2019-04-26T16:29:11Z

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
Vulnerability: GHSA-x5ph-4fr4-g7fw
Summary: Downloads Resources over HTTP in galenframework-cli
Aliases: CVE-2016-10560
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:21Z

Affected versions of `galenframework-cli` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `galenframework-cli`.


## Recommendation

Update to version 2.3.1 or later.
Vulnerability: GHSA-x3w4-mrmv-cw2x
Summary: Malicious Package in buffev-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:19:44Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-2v5f-23xc-v9qr
Summary: Cross-site scripting
Aliases: CVE-2021-3377
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-11T22:50:39Z

The npm package ansi_up converts ANSI escape codes into HTML. In ansi_up v4, ANSI escape codes can be used to create HTML hyperlinks. Due to insufficient URL sanitization, this feature is affected by a cross-site scripting (XSS) vulnerability. This issue is fixed in v5.0.0.
Vulnerability: GHSA-cqr7-78pj-3g7j
Summary: File Descriptor Leak Can Cause DoS Vulnerability in hapi
Aliases: CVE-2014-3742
Severity: HIGH
Published: 2017-10-24T18:33:36Z

Versions 2.0.x and 2.1.x of hapi are vulnerable to a denial of service attack via a file descriptor leak. 

When triggered repeatedly, this leak will cause the server to run out of file descriptors and the node process to die. The effort required to take down a server depends on the process file descriptor limit. No other side effects or exploits have been identified.



## Recommendation

- Please upgrade to version 2.2.x or above as soon as possible.
Vulnerability: GHSA-xc6g-ggrc-qq4r
Summary: Cross-Site Scripting in sanitize-html
Aliases: CVE-2017-16016
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:47:23Z

Affected versions of `sanitize-html` are vulnerable to cross-site scripting when allowedTags includes at least one `nonTextTag`.

## Proof of Concept

```
var sanitizeHtml = require('sanitize-html');

var dirty = '!<textarea>&lt;/textarea&gt;<svg/onload=prompt`xs`&gt;</textarea>!';
var clean = sanitizeHtml(dirty, {
    allowedTags: [ 'textarea' ]
});

console.log(clean);

// !<textarea></textarea><svg/onload=prompt`xs`></textarea>!
```


## Recommendation

Update to version 1.11.4 or later.
Vulnerability: GHSA-5mhv-9qw8-j63g
Summary: Hijacked Environment Variables in mssql.js
Aliases: CVE-2017-16056
Severity: MODERATE
CWE: CWE-506
Published: 2018-11-09T17:43:03Z

The `mssql.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-wj6h-7chw-x4h2
Summary: Command injection in get-git-data
Aliases: CVE-2020-7619
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-10T15:59:14Z

get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data.
Vulnerability: GHSA-gh78-48h3-frjq
Summary: Improper exception handling in Aedes
Aliases: CVE-2020-13410
Severity: HIGH
CWE: CWE-755
Published: 2021-05-06T18:10:46Z

An issue was discovered in MoscaJS Aedes 0.42.0 and fixed in 0.42.1. lib/write.js does not properly consider exceptions during the writing of an invalid packet to a stream.
Vulnerability: GHSA-4v9q-hm2p-68c4
Summary: Spoofing attack due to unvalidated KDC in node-krb5
Aliases: CVE-2016-1000238
Severity: MODERATE
Published: 2020-09-01T15:57:01Z

Affected versions of `node-krb5` do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials.


## Recommendation

It appears that this will remain unfixed indefinitely, as the Github issue for this vulnerability has been open since 2015, with no work on it since then.

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=kerberos).
Vulnerability: GHSA-8j8c-7jfh-h6hx
Summary: Code Injection in js-yaml
Severity: HIGH
CWE: CWE-94
Published: 2019-06-04T20:14:07Z

Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected.

An example payload is 
`{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1` 
which returns the object 
{
  "1553107949161": 1
}


## Recommendation

Upgrade to version 3.13.1.
Vulnerability: GHSA-g4m3-rpxr-h7vg
Summary: Malicious Package in mogodb-core
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:52:25Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-4j59-hfw6-6w7h
Summary: Downloads Resources over HTTP in cmake
Aliases: CVE-2016-10642
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2018-08-15T19:30:48Z

Affected versions of `cmake` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cmake`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available, or installing the cmake binaries via a system package manager, such as `apt-get`.

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-q4h8-7qff-gh6c
Summary: Server-side request forgery in Ghost CMS
Aliases: CVE-2020-8134
Severity: MODERATE
CWE: CWE-918
Published: 2021-05-06T18:28:08Z

Server-side request forgery (SSRF) vulnerability in Ghost CMS < 3.10.0 allows an attacker to scan local or external network or otherwise interact with internal systems.
Vulnerability: GHSA-4rgj-8mq3-hggj
Summary: Denial of Service in @hapi/subtext
Severity: HIGH
Published: 2020-09-03T20:32:11Z

Versions of `@hapi/subtext` prior to 6.1.2 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 6.1.2 or later.
Vulnerability: GHSA-m7rg-8wvq-846v
Summary: Prototype pollution
Aliases: CVE-2021-25947
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-06-07T21:49:14Z

Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-chh2-rvhg-wqwr
Summary: Malicious Package in json-serializer
Severity: CRITICAL
Published: 2020-09-03T21:02:10Z

Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-j9q7-3rhf-4ppv
Summary: Downloads Resources over HTTP in windows-selenium-chromedriver
Aliases: CVE-2016-10687
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:11:08Z

Affected versions of `windows-selenium-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-selenium-chromedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-9wjh-jr2j-6r4x
Summary: Remote Code Execution in pi_video_recording
Severity: HIGH
CWE: CWE-20
Published: 2020-09-02T15:55:58Z

All versions of `pi_video_recording` are vulnerable to Remote Code Execution. Due to insufficient input validation the server executes arbitrary code through the /api/record/start endpoint.  After running the server, `curl -POST -H "Content-Type: application/json" -d '{"filename": " || touch /tmp/worked;"}' http://localhost:5000/api/record/start`creates a file in the /tmp/ directory


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-h2r4-4xgf-3865
Summary: Downloads Resources over HTTP in product-monitor
Aliases: CVE-2016-10567
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:35:32Z

Affected versions of `product-monitor` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `product-monitor`.


## Recommendation

Update to versions 2.2.5 or later.
Vulnerability: GHSA-c53x-wwx2-pg96
Summary: Cross-Site Scripting in @berslucas/liljs
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-03T17:03:58Z

Versions of  `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

Upgrade to version 1.0.2 or later.
Vulnerability: GHSA-pm52-wwrw-c282
Summary: Command Injection in wiki-plugin-datalog
Severity: HIGH
CWE: CWE-94
Published: 2019-06-13T18:59:06Z

Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system.


## Recommendation

Upgrade to version 0.1.6 or later.
Vulnerability: GHSA-wm7q-rxch-43mx
Summary: Byass due to validation before canonicalization in serve
Severity: HIGH
Published: 2020-09-01T19:38:33Z

Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames.



Example:
Here we have a server that ignores the file test.txt.
```
const serve = require('serve')
const server = serve(__dirname, {
      port: 1337,
      ignore: ['test.txt']
})
```

Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file. 

`curl http://localhost:1337/t%65st.txt`

Additionally this technique can be used to get directory listings of ignored directories.


## Recommendation

Update to version 6.5.2 or later.
Vulnerability: GHSA-f499-jv47-9wxf
Summary: Directory Traversal in desafio
Aliases: CVE-2017-16164
Severity: MODERATE
CWE: CWE-22
Published: 2018-08-06T21:40:02Z

Affected versions of `desafio` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

no patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-x8qc-rrcw-4r46
Summary: Symlink reference outside of node_modules in npm
Aliases: CVE-2019-16776
Severity: LOW
CWE: CWE-22
Published: 2019-12-13T15:39:26Z

Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.  

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.3 or later.
Vulnerability: GHSA-qmjg-g86h-6rc9
Summary: Hijacked Environment Variables in d3.js
Aliases: CVE-2017-16044
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-23T21:00:28Z

The `d3.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-p77h-hv6g-fmfp
Summary: Sensitive Data Exposure in ibm_db
Severity: MODERATE
Published: 2020-09-03T20:43:16Z

Versions of `ibm_db` prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode.


## Recommendation

Upgrade to version 2.6.0 or later and ensure sensitive information was not logged.
Vulnerability: GHSA-g9cg-h3jm-cwrc
Summary: Prototype Pollution in @hapi/subtext
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T15:47:23Z

Versions of `@hapi/subtext` prior to 6.1.3 or 7.0.3 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

Upgrade to versions 6.1.3, 7.0.3 or later.
Vulnerability: GHSA-7h42-5vj2-cq39
Summary: High severity vulnerability that affects tiny-json-http
Aliases: CVE-2018-1000096
Severity: HIGH
CWE: CWE-295
Published: 2018-03-13T20:42:00Z

brianleroux tiny-json-http version all versions since commit 9b8e74a232bba4701844e07bcba794173b0238a8 (Oct 29 2016) contains a Missing SSL certificate validation vulnerability in The libraries core functionality is affected. that can result in Exposes the user to man-in-the-middle attacks.
Vulnerability: GHSA-jv7g-9g6q-cxvw
Summary: Path Traversal in convert-svg packages
Aliases: CVE-2021-23631
Severity: HIGH
CWE: CWE-22
Published: 2022-01-27T14:04:28Z

This affects all versions of package convert-svg-core; all versions of package convert-svg-to-png; all versions of package convert-svg-to-jpeg. Using a specially crafted SVG file, an attacker could read arbitrary files from the file system and then show the file content as a converted PNG file.
Vulnerability: GHSA-hv96-xxx2-5v7w
Summary: Downloads Resources over HTTP in nw
Aliases: CVE-2016-10588
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:51:04Z

Affected versions of `nw` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nw`.


## Recommendation

Update to version 0.23.6-1 or later.
Vulnerability: GHSA-82rf-q3pr-4f6p
Summary: Sensitive data exposure in NATS
Aliases: CVE-2020-26149
Severity: HIGH
CWE: CWE-522
Published: 2020-10-08T22:11:32Z

Preview versions of two NPM packages and one Deno package from the NATS
project contain an information disclosure flaw, leaking options to the
NATS server; for one package, this includes TLS private credentials.

The _connection_ configuration options in these JavaScript-based
implementations were fully serialized and sent to the server in the
client's CONNECT message, immediately after TLS establishment.

The nats.js client supports Mutual TLS and the credentials for the TLS
client key are included in the connection configuration options;
disclosure of the client's TLS private key to the server has been
observed.

Most authentication mechanisms are handled after connection, instead of
as part of connection, so other authentication mechanisms are
unaffected.
For clarity: NATS account NKey authentication is NOT affected.

Neither the nats.ws nor the nats.deno clients support Mutual TLS: the
affected versions listed below are those where the logic flaw is
present. We are including the nats.ws and nats.deno versions out of an
abundance of caution, as library maintainers, but rate as minimal the
likelihood of applications leaking sensitive data.

Affected versions:

Security impact:

* NPM package nats.js:
+ mainline is unaffected
+ beta branch is vulnerable from 2.0.0-201, fixed in 2.0.0-209

Logic flaw:

* NPM package nats.ws:
+ status: preview
+ flawed from 1.0.0-85, fixed in 1.0.0-111
* Deno repository https://github.com/nats-io/nats.deno
+ status: preview
+ flawed in all git tags prior to fix
+ fixed with git tag v1.0.0-9

Impact:

For deployments using TLS client certificates (for mutual TLS), private
key material for TLS is leaked from the client application to the
server. If the server is untrusted (run by a third party), or if the
client application also disables TLS verification (and so the true
identity of the server is unverifiable) then authentication credentials
are leaked.
Vulnerability: GHSA-w7rc-rwvf-8q5r
Summary: The `size` option isn't honored after following a redirect in node-fetch
Aliases: CVE-2020-15168
Severity: LOW
CWE: CWE-20, CWE-770
Published: 2020-09-10T17:46:21Z

### Impact
Node Fetch did not honor the `size` option after following a redirect, which means that when a content size was over the limit, a `FetchError` would never get thrown and the process would end without failure.

For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after `fetch()` has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

### Patches
We released patched versions for both stable and beta channels:

- For `v2`: 2.6.1
- For `v3`: 3.0.0-beta.9

### Workarounds
None, it is strongly recommended to update as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [node-fetch](https://github.com/node-fetch/node-fetch/issues/new?assignees=&labels=question&template=support-or-usage.md&title=Question%3A+)
* Contact one of the core maintainers.
Vulnerability: GHSA-28f8-hqmc-7ph8
Summary: Malicious Package in ember-power-timepicker
Severity: CRITICAL
Published: 2020-09-11T21:19:09Z

Version 1.0.8 of `ember-power-timepicker` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-8g64-9cm2-838j
Summary: Malicious Package in bugfer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:29:26Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-vw7g-jq9m-3q9v
Summary: Unauthorized File Access in glance
Severity: MODERATE
Published: 2020-09-02T18:23:35Z

Versions of `glance` prior to 3.0.7 are vulnerable to Unauthorized File Access. The package provides a `--nodot` option meant to hide files and directories with names that begin with a `.`, such as `.git` but fails to hide files inside a folder that begins with `.`. 


## Recommendation

Upgrade to version 3.0.7 or later.
Vulnerability: GHSA-v82v-rq72-phq9
Summary: Server side request forgery in @isomorphic-git/cors-proxy
Aliases: CVE-2021-23664
Severity: HIGH
CWE: CWE-918
Published: 2022-01-26T22:13:05Z

The package @isomorphic-git/cors-proxy before 2.7.1 is vulnerable to Server-side Request Forgery (SSRF) due to missing sanitization and validation of the redirection action in middleware.js.
Vulnerability: GHSA-w36g-q975-37rg
Summary: Improper Input Validation (RCE)
Aliases: CVE-2021-26814
Severity: HIGH
CWE: CWE-20
Published: 2021-03-18T19:30:20Z

Wazuh API in Wazuh from 4.0.0 to 4.0.3 allows authenticated users to execute arbitrary code with administrative privileges via /manager/files URI. An authenticated user to the service may exploit incomplete input validation on the /manager/files API to inject arbitrary code within the API service script.
Vulnerability: GHSA-g7h8-p22m-2rvx
Summary: Prototype Pollution in flat-wrap
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:08:46Z

All versions of `flat-wrap` are vulnerable to prototype pollution. The function `unflatten` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-mfcp-34xw-p57x
Summary: Authentication Bypass in saml2-js
Severity: MODERATE
CWE: CWE-287
Published: 2020-09-03T21:20:52Z

Versions of `saml2-js` prior to 2.0.5 are vulnerable to an Authentication Bypass. The package fails to enforce the assertion conditions for encrypted assertions, which may allow an attacker to reuse encrypted assertion tokens indefinitely.


## Recommendation

Upgrade to version 2.0.5 or later.
Vulnerability: GHSA-4964-cjrr-jg97
Summary: Malicious Package in jqeury
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:38:43Z

Version 3.3.1 of `jqeury` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-ch52-vgq2-943f
Summary: Regular Expression Denial of Service in marked
Severity: LOW
Published: 2020-09-03T18:15:53Z

Affected versions of `marked` are vulnerable to Regular Expression Denial of Service (ReDoS). The `_label` subrule may significantly degrade parsing performance of malformed input.


## Recommendation

Upgrade to version 0.7.0 or later.
Vulnerability: GHSA-2hpj-g53m-9gj6
Summary: Downloads Resources over HTTP in closure-util
Aliases: CVE-2016-10583
Severity: HIGH
Published: 2019-02-18T23:58:03Z

Affected versions of `closure-util` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `closure-util`.


## Recommendation

To mitigate this issue:
1. Install the package using npm's `--ignore-scripts` flag.
2. Navigate to the package directory, and open `default-config.json` in a text editor
3. Change the download URLs in the `compiler_url` and `library_url` to `https` equivalents
4. run `npm i` in the package directory.
Vulnerability: GHSA-2mj8-pj3j-h362
Summary: Symlink reference outside of node_modules in bin-links
Severity: LOW
Published: 2020-09-04T17:17:39Z

Versions of `bin-links` prior to 1.1.5 are vulnerable to a Symlink reference outside of node_modules. It is possible to create symlinks to files outside of the`node_modules` folder through the `bin` field. This may allow attackers to access unauthorized files.


## Recommendation

Upgrade to version 1.1.5 or later.
Vulnerability: GHSA-q4j7-v27r-fgcx
Summary: Prototype Pollution in realms-shim
Aliases: CVE-2021-23543
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-01-13T15:00:36Z

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
Vulnerability: GHSA-8cc8-8vvx-fhgw
Summary: Downloads Resources over HTTP in jdf-sass
Aliases: CVE-2016-10595
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:34:11Z

Affected versions of `jdf-sass` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `jdf-sass`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-wqgx-4q47-j2w5
Summary: Insecure Cryptography Algorithm in parsel
Severity: CRITICAL
CWE: CWE-327
Published: 2020-09-04T17:36:04Z

All versions of `parsel` use an insecure cryptography algorithm. The package uses `aes-256-cbc` without integrity checks, which renders the ciphertext vulnerable to bit-flipping attacks.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.
Vulnerability: GHSA-7pgq-hhq9-9r27
Summary: Directory Traversal in lab6drewfusbyu
Aliases: CVE-2017-16141
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:48:38Z

Affected versions of `lab6drewfusbyu` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-pfxf-wh96-fvjc
Summary: Log Forging in generator-jhipster-kotlin
Aliases: CVE-2020-4072
Severity: MODERATE
CWE: CWE-117
Published: 2020-06-25T20:02:51Z

### Impact

We log the mail for invalid password reset attempts. 
As the email is provided by a user and the api is public this can be used by an attacker to forge log entries.
This is vulnerable to https://cwe.mitre.org/data/definitions/117.html

This problem affects only application generated with jwt or session authentication. Applications using oauth are not vulnerable.

### Patches

version 1.7.0.

### Workarounds

In `AccountResource.kt` you should change the line

```kotlin
 log.warn("Password reset requested for non existing mail '$mail'");
```

to 

```kotlin
 log.warn("Password reset requested for non existing mail");
```

### References

* https://cwe.mitre.org/data/definitions/117.html
* https://owasp.org/www-community/attacks/Log_Injection
* https://www.baeldung.com/jvm-log-forging

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [jhipster kotlin](https://github.com/jhipster/jhipster-kotlin)
Vulnerability: GHSA-m79w-4mqv-r39f
Summary: Downloads Resources over HTTP in windows-seleniumjar
Aliases: CVE-2016-10691
Severity: HIGH
CWE: CWE-311
Published: 2018-07-31T22:06:33Z

Affected versions of `windows-seleniumjar` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-seleniumjar`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-m3j9-p4x2-97q6
Summary: Directory Traversal in liyujing
Aliases: CVE-2017-16120
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:22:49Z

Affected versions of `liyujing` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-qp6m-jqfr-2f7v
Summary: Malicious Package in babel-laoder
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:27:11Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-6m85-wvcr-pgw3
Summary: Prototype Pollution in safetydance
Aliases: CVE-2020-7737
Severity: HIGH
CWE: CWE-1321
Published: 2022-02-10T20:33:49Z

All versions of package safetydance are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-2pr6-76vf-7546
Summary: Denial of Service in js-yaml
Severity: MODERATE
CWE: CWE-400
Published: 2019-06-05T14:35:29Z

Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.


## Recommendation

Upgrade to version 3.13.0.
Vulnerability: GHSA-x3g3-334f-q6h4
Summary: Moderate severity vulnerability that affects editor.md
Aliases: CVE-2018-19056
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:41:15Z

pandao Editor.md 1.5.0 has DOM XSS via input starting with a "<<" substring, which is mishandled during construction of an A element.
Vulnerability: GHSA-mrmf-qwxg-7c3h
Summary: XSS in Data URI in remarkable
Aliases: CVE-2017-16006
Severity: HIGH
CWE: CWE-79
Published: 2018-11-09T17:48:20Z

Affected versions of `remarkable` are vulnerable to cross-site scripting. Vulnerable versions of the package allow the use of `data:` URIs in links, and can therefore execute javascript. 


## Proof of Concept

```
[link](data:text/html,<script>alert('0')</script>)
```


## Recommendation

Update to v1.7.0 or later
Vulnerability: GHSA-6394-6h9h-cfjg
Summary: Regular Expression Denial of Service
Severity: MODERATE
CWE: CWE-400
Published: 2019-06-07T21:12:35Z

A Regular Expression vulnerability was found in nwmatcher before 1.4.4. The fix replacing multiple repeated instances of the "\s*" pattern.
Vulnerability: GHSA-cr4x-w2v7-4mmf
Summary: Malicious Package in bufver-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:26:13Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-2j5x-56p6-hj6x
Summary: Path Traversal in statichttpserver
Aliases: CVE-2019-5480
Severity: CRITICAL
CWE: CWE-22
Published: 2019-09-04T10:02:14Z

All versions of `statichttpserver` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.