TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-xg68-chx2-253g
Summary: Prototype Pollution in jquery-deparam
Aliases: CVE-2021-20087
Severity: HIGH
CWE: CWE-1321
Published: 2021-05-24T19:53:01Z

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam allows a malicious user to inject properties into Object.prototype.
Vulnerability: GHSA-pm44-7gw9-6g8p
Summary: Directory Traversal in uekw1511server
Aliases: CVE-2017-16185
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:28:08Z

Affected versions of `uekw1511server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-w6xj-45gv-fw35
Summary: Malicious Package in stream-combine
Severity: CRITICAL
Published: 2020-09-02T15:57:06Z

Version 2.0.2 of `stream-combine` has malicious code design to steal credentials and credit card information. The code searches all form elements for passwords, credit card numbers and CVC codes. It then uploads the information to a remote server using HTML links embedded in the page or form actions. If your application has Content Security Policy set you are not affected by this issue.


## Recommendation

This package is not available on the npm Registry anymore. If you used this module and your application processed credentials or credit card information, it is possible that information was stolen.
Vulnerability: GHSA-xwg4-93c6-3h42
Summary: Directory Traversal in send
Aliases: CVE-2014-6394
Severity: LOW
CWE: CWE-22
Published: 2017-10-24T18:33:36Z

Versions 0.8.3 and earlier of `send` are affected by a directory traversal vulnerability. When relying on the root option to restrict file access it may be possible for an application consumer to escape out of the restricted directory and access files in a similarly named directory. 

For example, `static(_dirname + '/public')` would allow access to `_dirname + '/public-restricted'`.


## Recommendation

Update to version 0.8.4 or later.
Vulnerability: GHSA-v5vg-g7rq-363w
Summary: Prototype Pollution in json-pointer
Aliases: CVE-2021-23820
Severity: MODERATE
CWE: CWE-843, CWE-1321
Published: 2021-11-08T17:40:49Z

This affects all versions of package `json-pointer`, up to and including `0.6.1`. A type confusion vulnerability can lead to a bypass of CVE-2020-7709 when the pointer components are arrays.
Vulnerability: GHSA-r5cq-9537-9rpf
Summary: Prototype Pollution in mixme
Aliases: CVE-2021-28860
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-02-10T23:52:01Z

Node.js mixme 0.5.0, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS).
Vulnerability: GHSA-7r9x-hr76-jr96
Summary: Command Injection in giting
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-04T17:26:18Z

All versions of `gitting` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `pull` function is vulnerable through the `branch` variable.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-gm29-35c7-8cfw
Summary: Cross-Site Scripting in buttle
Aliases: CVE-2019-5422
Severity: HIGH
CWE: CWE-79
Published: 2019-04-08T15:18:38Z

All versions of `buttle` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-7c7g-72q7-4xhm
Summary: Prototype pollution vulnerability in 'deepref'
Aliases: CVE-2020-28274
Severity: CRITICAL
Published: 2021-10-12T16:27:35Z

Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-9534-h433-2rjf
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in utilitify
Aliases: CVE-2019-10808
Severity: HIGH
CWE: CWE-915
Published: 2021-05-07T16:28:47Z

utilitify prior to 1.0.3 allows modification of object properties. The merge method could be tricked into adding or modifying properties of the Object.prototype.
Vulnerability: GHSA-w8fh-pvq2-x8c4
Summary: Malicious npm package: sonatype
Severity: CRITICAL
CWE: CWE-506
Published: 2021-01-29T18:11:20Z

The npm `sonatype` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3329-pjwv-fjpg
Summary: Hostname spoofing via backslashes in URL
Aliases: CVE-2020-26291
Severity: MODERATE
CWE: CWE-20
Published: 2020-12-30T23:40:48Z

### Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a backslash (`\`) character followed by an at (`@`) character. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https://expected-example.com\@observed-example.com`
Escaped string: `https://expected-example.com\\@observed-example.com` (JavaScript strings must escape backslash)

Affected versions incorrectly return `observed-example.com`. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).

### Patches
Version 1.19.4 is patched against all known payload variants. Version 1.19.3 has a partial patch but is still vulnerable to a payload variant.

### References
https://github.com/medialize/URI.js/releases/tag/v1.19.4 (complete fix for this bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.3 (partial fix for this bypass)
[PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)

### For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js

### Reporter credit
[Alesandro Ortiz](https://AlesandroOrtiz.com)
Vulnerability: GHSA-vgrx-w6rg-8fqf
Summary: Forgeable Public/Private Tokens in jwt-simple
Aliases: CVE-2016-10555
Severity: CRITICAL
CWE: CWE-20
Published: 2018-11-06T23:12:07Z

Affected versions of the `jwt-simple` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT, the end result is a complete authentication bypass with minimal effort.



## Recommendation

Update to version 0.3.1 or later.

Additionally, be sure to always specify an algorithm in calls to `.decode()`.
Vulnerability: GHSA-v6vv-hhqc-6hh2
Summary: Malicious Package in pyramid-proportion
Severity: CRITICAL
Published: 2020-09-03T19:15:37Z

Version 1.0.5 of `pyramid-proportion` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qjvf-rmwg-64fr
Summary: Downloads Resources over HTTP in install-g-test
Aliases: CVE-2016-10630
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:20Z

Affected versions of `install-g-test` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-76xq-58hj-vwm2
Summary: Malicious Package in test-module-a
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:16:59Z

All versions of `test-module-a` contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking,


## Recommendation

Remove the package from your system. If you own any packages that were compromised please contact npm security immediately at security@npmjs.com. Also enable 2FA for publishing to further secure packages you maintain.
Vulnerability: GHSA-7x7c-qm48-pq9c
Summary: Cross-site Scripting in karma
Aliases: CVE-2022-0437
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-06T00:00:54Z

karma prior to version 6.3.14 contains a cross-site scripting vulnerability.
Vulnerability: GHSA-8hj4-w233-g35q
Summary: Downloads Resources over HTTP in react-native-baidu-voice-synthesizer
Aliases: CVE-2016-10697
Severity: HIGH
CWE: CWE-311
Published: 2018-07-31T22:47:16Z

Affected versions of `react-native-baidu-voice-synthesizer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `react-native-baidu-voice-synthesizer`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-chqj-j4fh-rw7m
Summary: Cross-Site Scripting in dompurify
Aliases: CVE-2019-16728
Severity: CRITICAL
CWE: CWE-79
Published: 2020-08-28T21:25:11Z

Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of `<svg>`/`<math>` elements and `</p>`/`</br>`. An example payload is: `<svg></p><style><a id="</style><img src=1 onerror=alert(1)>">`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.0.3 or later. You may also disallow `<svg>` and `<math>` through `dompurify` configurations:
```DOMPurify.sanitize(input, {
     FORBID_TAGS: ['svg', 'math']
 });```
Vulnerability: GHSA-c3x7-gjmx-r2ff
Summary: Open Redirect in serve-static
Aliases: CVE-2015-1164
Severity: LOW
CWE: CWE-601
Published: 2020-08-31T22:57:02Z

Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.


## Proof of Concept

A link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e`

Some browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect.


## Recommendation

Version 1.7.x: Update to version 1.7.2 or later.
Version 1.6.x: Update to version 1.6.5 or later.
Vulnerability: GHSA-g27j-74fp-xfpr
Summary: Insecure default value for CORS configuration
Aliases: CVE-2022-26969
Severity: HIGH
Published: 2022-04-05T18:31:22Z

### Impact

The default value for the `CORS_ENABLED` and `CORS_ORIGIN` configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed.

### Patches

The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0

### Workarounds

Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [directus/directus](https://github.com/directus/directus)
* Email us at [security@directus.io](mailto:security@directus.io)
Vulnerability: GHSA-c2m4-w5hm-vqjw
Summary: Hijacked Environment Variables in crossenv
Aliases: CVE-2017-16074
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:05:46Z

The `crossenv` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-c722-pv5w-cfg2
Summary: Malicious Package in github-jquery-widgets
Severity: CRITICAL
Published: 2020-09-11T21:20:14Z

Version 0.1.2 of `github-jquery-widgets` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qm28-7hqv-wg5j
Summary: OS Command Injection in ng-packagr
Aliases: CVE-2020-7735
Severity: MODERATE
CWE: CWE-78
Published: 2021-05-07T16:47:32Z

The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.
Vulnerability: GHSA-r496-7hgp-53wf
Summary: Vulnerability in dump function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36377
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2021-11-02T15:42:24Z

aaptjs is a node wraper for aapt. An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-2r4h-2ghh-5hpx
Summary: Directory Traversal in weather.swlyons
Aliases: CVE-2017-16110
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:18:33Z

Affected versions of `weather.swlyons` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-vwjj-2852-3765
Summary: Cross-Site Scripting in forms
Aliases: CVE-2017-16015
Severity: MODERATE
CWE: CWE-80
Published: 2018-11-09T17:46:27Z

Affected versions of `forms` do not properly escape HTML in generated forms, which may result in cross-site scripting.


## Recommendation

Update to version 1.3.0 or later.
Vulnerability: GHSA-v633-x5vv-hqwc
Summary: Cross-Site Scripting in serve-index
Aliases: CVE-2015-8856
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

Versions 1.6.2 and earlier of `serve-index` are affected by a cross-site scripting vulnerability. Because file and directory names are not escaped in the module's HTML output, a remote attacker that can influence file or directory names can launch a persistent cross-site scripting attack on the application.


## Recommendation

Update to version 1.6.3 or later.
Vulnerability: GHSA-53mj-mc38-q894
Summary: Remote Memory Exposure in openwhisk
Severity: MODERATE
Published: 2020-09-01T19:40:41Z

Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure.

When a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded).

Proof of concept:

```js
var openwhisk = require('openwhisk');
var options = {
  apihost: '127.0.0.1:1433', 
  api_key: USERSUPPLIEDINPUT // number
};
var ow = openwhisk(options);
ow.actions.invoke({actionName: 'sample'}).then(result => console.log(result))
```


## Recommendation

Update to version 3.3.1 or later.
Vulnerability: GHSA-gpqq-952q-5327
Summary: XSS in the `of` option of the `.position()` util in jquery-ui
Aliases: CVE-2021-41184
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-26T14:55:12Z

### Impact
Accepting the value of the `of` option of the [`.position()`](https://api.jqueryui.com/position/) util from untrusted sources may execute untrusted code. For example, invoking the following code:
```js
$( "#element" ).position( {
	my: "left top",
	at: "right bottom",
	of: "<img onerror='window.globalOf=true' src='/404' />",
	collision: "none"
} );
```
will call the `doEvilThing()` function.

### Patches
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector.

### Workarounds
A workaround is to not accept the value of the `of` option from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-ff6g-gm92-rf32
Summary: Malicious Package in coinstirng
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:42:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xfxf-qw26-hr33
Summary: Arbitrary command execution in roar-pidusage
Aliases: CVE-2021-23380
Severity: MODERATE
CWE: CWE-77
Published: 2021-05-06T15:55:43Z

This affects all current versions of package roar-pidusage. If attacker-controlled user input is given to the stat function of this package on certain operating systems, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-h3c2-x77c-7pvr
Summary: High severity vulnerability that affects git-dummy-commit
Aliases: CVE-2018-3785
Severity: HIGH
CWE: CWE-78
Published: 2018-08-21T17:03:33Z

A command injection in git-dummy-commit v1.3.0 allows os level commands to be executed due to an unescaped parameter.
Vulnerability: GHSA-qmm9-x5gr-4gfm
Summary: Open Redirect in hekto
Aliases: CVE-2018-3743
Severity: LOW
CWE: CWE-601
Published: 2018-07-18T21:20:12Z

Versions of `hekto` before 0.2.4 are vulnerable to open redirect when a domain name is used as part of the `.html` filename.


## Recommendation

Update to version 0.2.4 or later.
Vulnerability: GHSA-2pqj-h3vj-pqgw
Summary: Cross-Site Scripting in jquery
Aliases: CVE-2012-6708
Severity: HIGH
CWE: CWE-79, CWE-64
Published: 2020-09-01T16:41:46Z

Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that `jquery` may interpret HTML as selectors when given certain inputs, allowing for client side code execution.

## Proof of Concept
```
$("#log").html(
    $("element[attribute='<img src=\"x\" onerror=\"alert(1)\" />']").html()
);
```




## Recommendation

Update to version 1.9.0 or later.
Vulnerability: GHSA-r92x-f52r-x54g
Summary: regular expression denial of service (ReDoS)
Aliases: CVE-2020-26289
Severity: HIGH
CWE: CWE-400
Published: 2020-12-24T20:49:02Z

date-and-time is an npm package for manipulating date and time. In date-and-time before version 0.14.2, there a regular expression involved in parsing which can be exploited to to cause a denial of service. This is fixed in version 0.14.2.
Vulnerability: GHSA-jp9g-5x75-ccp8
Summary: Malicious Package in colro-name
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:34:30Z

Version 9.0.0 of `colro-name` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m2w9-rm58-mhm9
Summary: Downloads Resources over HTTP in node-thulac
Aliases: CVE-2016-10640
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:06Z

Affected versions of `node-thulac` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `node-thulac`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-j68r-23hj-xf9c
Summary: Hijacked Environment Variables in node-openssl
Aliases: CVE-2017-16064
Severity: MODERATE
CWE: CWE-506
Published: 2018-10-10T17:28:14Z

The `node-openssl` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-4cmx-hrq9-c23p
Summary: Improper Authorization in aedes
Aliases: CVE-2018-3778
Severity: MODERATE
CWE: CWE-285
Published: 2018-08-15T20:03:22Z

Versions of `aedes` before 0.35.1 does not respect its own authorization rules when a client sets a `Last Will`.


## Recommendation

Update to version 0.35.1 or later.
Vulnerability: GHSA-wg96-3933-j2w5
Summary: Cross-Site Scripting in sanitize-html
Aliases: CVE-2017-16017
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:45:55Z

Affected versions of `sanitize-html` are vulnerable to cross-site scripting.

## Proof of Concept:

`<IMG SRC= onmouseover="alert('XSS');">`
produces the following:

`<img src="onmouseover="alert('XSS');"" />`
This is definitely invalid HTML, but would suggest that it's being interpreted incorrectly by the parser.


## Recommendation

Update to version 1.2.3 or later.
Vulnerability: GHSA-rp2c-jrgp-cvr8
Summary: Code injection in plupload
Aliases: CVE-2021-23562
Severity: MODERATE
CWE: CWE-434, CWE-75
Published: 2021-12-16T15:32:31Z

This affects the package plupload before 2.3.9. A file name containing JavaScript code could be uploaded and run. An attacker would need to trick a user to upload this kind of file.
Vulnerability: GHSA-j438-45hc-vjhm
Summary: CSRF and DNS Rebinding in Oasis
Aliases: CVE-2020-11003
Severity: MODERATE
CWE: CWE-352
Published: 2020-04-16T03:14:39Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

If you're running a vulnerable application on your computer and an attacker can trick you into visiting a malicious website, they could use [DNS rebinding](https://en.wikipedia.org/wiki/DNS_rebinding) and [CSRF](https://en.wikipedia.org/wiki/Cross-site_request_forgery) attacks to read/write to vulnerable applications. 

**There is no evidence that suggests that this has been used in the wild.**

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, 2.15.0.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

No.

### References
_Are there any links users can visit to find out more?_

No.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [fraction/oasis](http://github.com/fraction/oasis)
* Email me at [christianbundy@fraction.io](mailto:christianbundy@fraction.io)
Vulnerability: GHSA-f8rj-4v7g-p5rj
Summary: Directory Traversal in jansenstuffpleasework
Aliases: CVE-2017-16176
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:53:29Z

Affected versions of `jansenstuffpleasework` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hfj4-96f7-6r5g
Summary: Cross-Site Scripting in html-janitor
Aliases: CVE-2017-0931
Severity: HIGH
CWE: CWE-79
Published: 2018-11-09T17:49:11Z

Versions of `html-janitor` prior to 2.0.2 (all current versions) are vulnerable to cross-site scripting (XSS).

This is exploitable if user-controlled data is passed into the modules `clean()` function.


## Recommendation

No fix is currently available for this vulnerability. It is recommended to use an alternative module for HTML sanitization.
Vulnerability: GHSA-9vp3-7qwq-83r9
Summary: Server-Side Request Forgery in FUXA
Aliases: CVE-2021-45851
Severity: HIGH
CWE: CWE-918
Published: 2022-03-17T00:00:48Z

A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
Vulnerability: GHSA-r9cj-xj33-4q42
Summary: Malicious Package in buffgr-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:21:54Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-4xrw-wvmq-8jmh
Summary: OS Command Injection in node-key-sender
Aliases: CVE-2020-7627
Severity: CRITICAL
CWE: CWE-78
Published: 2022-02-10T23:46:11Z

node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function.
Vulnerability: GHSA-x2w5-725j-gf2g
Summary: Prototype Pollution in convict
Aliases: CVE-2022-22143
Severity: HIGH
CWE: CWE-1321
Published: 2022-04-20T16:21:03Z

An attacker can inject attributes that are used in other components and override existing attributes with ones that have incompatible type, which may lead to a crash.

The main use case of Convict is for handling server-side configurations written by the admins owning the servers, and not random users. So it's unlikely that an admin would deliberately sabotage their own server. Still a situation can happen where an admin not knowledgeable about JavaScript could be tricked by an attacker into writing the malicious JavaScript code into some config files.

The problem is patched in `convict@6.2.2`. Users should upgrade to `convict@6.2.2`. There is no way for users to fix or remediate the vulnerability without upgrading.
Vulnerability: GHSA-hcq6-h8v2-r5wm
Summary: Server-Side Request Forgery in node-pdf-generator
Aliases: CVE-2020-7740
Severity: HIGH
CWE: CWE-918, CWE-20
Published: 2021-05-10T18:38:34Z

This affects all versions of package node-pdf-generator up to and including 0.0.6. Due to lack of user input validation and sanitization done to the content given to node-pdf-generator, it is possible for an attacker to craft a url that will be passed to an external server allowing an SSRF attack.
Vulnerability: GHSA-fwvp-x5gj-773j
Summary: Malicious Package in react-server-native
Severity: CRITICAL
Published: 2020-09-01T20:33:10Z

Version 0.0.7 of `react-server-native` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.7 of this module is found installed you will want to replace it with a version before or after 0.0.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-xj6q-9hx8-mm7f
Summary: Directory Traversal in liuyaserver
Aliases: CVE-2017-16170
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:34:34Z

Affected versions of `liuyaserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hf2m-j98r-4fqw
Summary: API token verification can be bypassed in NodeBB 
Aliases: CVE-2021-43786
Severity: CRITICAL
CWE: CWE-287
Published: 2021-11-30T22:21:05Z

### Impact
Incorrect logic present in the token verification step unintentionally allowed master token access to the API.

### Patches
The vulnerability has been patch as of v1.18.5.

### Workarounds
Cherry-pick commit hash 04dab1d550cdebf4c1567bca9a51f8b9ca48a500 to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Vulnerability: GHSA-v88g-cgmw-v5xw
Summary: Prototype Pollution in Ajv
Aliases: CVE-2020-15366
Severity: MODERATE
CWE: CWE-915
Published: 2022-02-10T23:30:59Z

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Vulnerability: GHSA-xf27-jqwv-gf3r
Summary: Unintended Require in larvitbase-api
Aliases: CVE-2019-5479
Severity: MODERATE
CWE: CWE-98
Published: 2019-09-11T23:03:57Z

Versions of `larvitbase-api` prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running.


## Recommendation

Upgrade to version 0.5.4 or later.
Vulnerability: GHSA-xr9h-9m79-x29g
Summary: SSRF in Rendertron
Aliases: CVE-2020-8902
Severity: MODERATE
CWE: CWE-918
Published: 2021-03-01T19:38:23Z

Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are to upgrade your rendertron to version 3.0.0, or, if you cannot update, to secure the infrastructure to limit the headless chrome's access to your internal domain.
Vulnerability: GHSA-p9g3-vpvp-hcj5
Summary: Malicious Package in bufber-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:41:55Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-322m-p39j-r5m2
Summary: Malicious Package in npm-script-demo
Aliases: CVE-2017-16128
Severity: MODERATE
CWE: CWE-506
Published: 2020-09-01T18:55:37Z

The `npm-script-demo` package is a piece of malware that opens a connection to a command and control server and executed the instructions it is given.

It has been removed from the npm registry.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer has been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-3fxp-vwxm-2r5p
Summary: Command injection in gitlogplus
Aliases: CVE-2021-23412
Severity: CRITICAL
CWE: CWE-77
Published: 2021-07-26T21:23:35Z

All versions of package gitlogplus are vulnerable to Command Injection via the main functionality, as options attributes are appended to the command to be executed without sanitization.
Vulnerability: GHSA-8hmr-w35f-3qgj
Summary: Malicious Package in harmlesspackage
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:07:37Z

Version 0.0.1 of `harmlesspackage` contains malicious code as a postinstall script. The package printed a message to the console and performed a GET request to a remote server.


## Recommendation

Remove the package from your environment. There is no evidence of further compromise.
Vulnerability: GHSA-m6cx-g6qm-p2cx
Summary: Arbitrary File Write in npm
Aliases: CVE-2019-16775
Severity: HIGH
CWE: CWE-61, CWE-59
Published: 2019-12-13T15:39:19Z

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to create files on a user's system when the package is installed. It is only possible to affect files that the user running `npm install` has access to and it is not possible to over write files that already exist on disk.

This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.


## Recommendation

Upgrade to version 6.13.3 or later.
Vulnerability: GHSA-jxg6-fhwc-9v9c
Summary: Regular Expression Denial of Service (ReDoS) in es6-crawler-detect
Aliases: CVE-2020-28501
Severity: MODERATE
CWE: CWE-400
Published: 2021-04-13T15:19:39Z

This affects the package es6-crawler-detect before 3.1.3. No limitation of user agent string length supplied to regex operators.
Vulnerability: GHSA-7mg4-w3w5-x5pc
Summary: Prototype pollution in json-pointer
Aliases: CVE-2020-7709
Severity: MODERATE
CWE: CWE-1321
Published: 2021-05-10T18:37:47Z

This affects the package json-pointer before 0.6.1. Multiple reference of object using slash is supported.
Vulnerability: GHSA-jxfh-8wgv-vfr2
Summary: Prototype pollution in dojo
Aliases: CVE-2020-5258
Severity: HIGH
CWE: CWE-74, CWE-94, CWE-1321
Published: 2020-03-10T18:03:14Z

In affected versions of dojo (NPM package), the deepCopy method is vulnerable to Prototype Pollution.

Prototype Pollution refers to the ability to inject properties into existing JavaScript language construct prototypes, such as objects.
An attacker manipulates these attributes to overwrite, or pollute, a JavaScript application object prototype of the base object by injecting other values. 

This has been patched in versions 1.12.8, 1.13.7, 1.14.6, 1.15.3 and 1.16.2
Vulnerability: GHSA-832h-xg76-4gv6
Summary: ReDoS in brace-expansion
Aliases: CVE-2017-18077
Severity: HIGH
CWE: CWE-20
Published: 2018-01-29T15:50:46Z

Affected versions of `brace-expansion` are vulnerable to a regular expression denial of service condition.

## Proof of Concept

```
var expand = require('brace-expansion');
expand('{,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,\n}');
```


## Recommendation

Update to version 1.1.7 or later.
Vulnerability: GHSA-3vv5-42wr-m32g
Summary: Downloads Resources over HTTP in scala-bin
Aliases: CVE-2016-10627
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:57:00Z

Affected versions of `scala-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `scala-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-g68x-vvqq-pvw3
Summary: Moderate severity vulnerability that affects ckeditor
Aliases: CVE-2018-17960
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-21T22:19:50Z

CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
Vulnerability: GHSA-5jpf-pj32-xx53
Summary: Authorization header is not sanitized in an error object in auth0
Aliases: CVE-2020-15125
Severity: HIGH
CWE: CWE-209
Published: 2020-07-29T16:26:22Z

### Overview
Versions before and including `2.27.0` use a block list of specific keys that should be sanitized from the request object contained in the error object.  When a request to Auth0 management API fails, the key for `Authorization` header is not sanitized and the `Authorization` header value can be logged exposing a bearer token.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using `auth0` npm package
- You are using a Machine to Machine application authorized to use Auth0's management API https://auth0.com/docs/flows/concepts/client-credentials

### How to fix that?
Upgrade to version `2.27.1`

### Will this update impact my users?
The fix provided in patch will not affect your users.

### Credit
http://github.com/osdiab
Vulnerability: GHSA-m36m-x4c5-rjxj
Summary: Silently Runs Cryptocoin Miner in hooka-tools
Severity: LOW
Published: 2020-09-01T19:01:58Z

Affected versions of `hooka-tools` were compromised and modified to silently run a cryptocoin miner in the background.

All affected versions have been unpublished from the npm registry.


## Recommendation

While this module has been unpublished, some versions may exist in mirrors or caches. Do not install this module, and remove it if found.
Vulnerability: GHSA-xcgx-27q5-7634
Summary: Malicious Package in commanedr
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:41:05Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-43ch-2h55-2vj7
Summary: Server-Side Request Forgery in private-ip
Aliases: CVE-2020-28360
Severity: CRITICAL
CWE: CWE-918
Published: 2021-04-13T15:18:17Z

Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges, resulting in an indeterminable number of critical attack vectors, allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.
Vulnerability: GHSA-j8hw-49gg-vq3w
Summary: Malicious Package in retcodelog
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:45:41Z

All versions of `retcodelog` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fwx5-5fqj-jv98
Summary: Cross-Site Scripting in morris.js
Aliases: CVE-2017-16022
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-09T17:46:30Z

Affected versions of `morris.js` are vulnerable to cross-site scripting attacks in labels that appear when hovering over a particular point on a generated graph. The text content of these labels is not escaped, so if control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.


## Recommendation

A patch for this vulnerability was created in 2014, but has still not been published to npm. In order to mitigate this issue effectively, install the library from github via:
```
npm i morrisjs/morris.js -s
```
Vulnerability: GHSA-xf7w-r453-m56c
Summary: Arbitrary File Overwrite in fstream
Aliases: CVE-2019-13173
Severity: HIGH
CWE: CWE-59
Published: 2019-05-30T17:19:34Z

Versions of `fstream` prior to 1.0.12 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file. The `fstream.DirWriter()` function is vulnerable.


## Recommendation

Upgrade to version 1.0.12 or later.
Vulnerability: GHSA-4w88-rjj3-x7wp
Summary: Chromium Remote Code Execution in electron
Aliases: CVE-2017-16151
Severity: HIGH
CWE: CWE-94
Published: 2018-07-24T20:04:23Z

Affected versions of `ElectronJS` are susceptible to a remote code execution vulnerability that occurs when an affected application access remote content, even if the [sandbox option](https://electron.atom.io/docs/api/sandbox-option) is enabled.



## Recommendation

Update to electron version 1.7.8 or later.
Vulnerability: GHSA-jqvv-r4w3-8f7w
Summary: Malicious Package in bictoind-rpc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:35:00Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hg5q-rj62-c43g
Summary: Malicious Package in reqest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:29:08Z

All versions of `reqest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-5fjj-cfh2-ghc5
Summary: Server-Side Request Forgery and Inclusion of Functionality from Untrusted Control Sphere in jsreport
Aliases: CVE-2020-8128
Severity: HIGH
CWE: CWE-829, CWE-918
Published: 2021-04-13T15:25:24Z

An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code.