TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-2q4g-w47c-4674
Summary: Unpreventable top-level navigation
Aliases: CVE-2020-15174
Severity: HIGH
CWE: CWE-20, CWE-693
Published: 2020-10-06T14:24:04Z

### Impact
The `will-navigate` event that apps use to prevent navigations to unexpected destinations [as per our security recommendations](https://www.electronjs.org/docs/tutorial/security) can be bypassed when a sub-frame performs a top-frame navigation across sites.

### Patches

* `11.0.0-beta.1`
* `10.0.1`
* `9.3.0`
* `8.5.1`

### Workarounds
Sandbox all your iframes using the [`sandbox` attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox).  This will prevent them creating top-frame navigations and is good practice anyway.

### For more information
If you have any questions or comments about this advisory:

* Email us at security@electronjs.org
Vulnerability: GHSA-gwg9-rgvj-4h5j
Summary: Code Injection in morgan
Aliases: CVE-2019-5413
Severity: MODERATE
CWE: CWE-94
Published: 2019-03-25T18:03:23Z

Verisons of `morgan` before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack.


## Recommendation

Update to version 1.9.1 or later.
Vulnerability: GHSA-3cqr-58rm-57f8
Summary: Arbitrary Code Execution in Handlebars
Aliases: CVE-2019-20920
Severity: HIGH
CWE: CWE-94
Published: 2022-02-10T20:38:19Z

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Vulnerability: GHSA-cg57-p69r-3m7p
Summary: Improper file handling in matrix-react-sdk
Aliases: CVE-2021-32622
Severity: MODERATE
CWE: CWE-74, CWE-434
Published: 2022-02-10T23:46:51Z

Matrix-React-SDK is a react-based SDK for inserting a Matrix chat/voip client into a web page. Before version 3.21.0, when uploading a file, the local file preview can lead to execution of scripts embedded in the uploaded file. This can only occur after several user interactions to open the preview in a separate tab. This only impacts the local user while in the process of uploading. It cannot be exploited remotely or by other users. This vulnerability is patched in version 3.21.0.
Vulnerability: GHSA-2xm2-xj2q-qgpj
Summary: receiving subscription objects with deleted session
Aliases: CVE-2020-15270
Severity: MODERATE
CWE: CWE-672
Published: 2020-10-27T19:15:19Z

Original Message:
Hi,

I create objects with one client with an ACL of all users with a specific column value. Thats working so far.

Then I deleted the session object from one user to look if he can receive subscription objects and he can receive them.
The client with the deleted session cant create new objects, which Parse restricts right.

The LiveQueryServer doesnt detect deleted sessions after the websocket connection was established.
There should be a mechanism that checks in an specific interval if the session exists.
I dont know if its true with expired sessions.

Any solutions?

Parse version: 4.3.0
Parse js SDK version: 2.17

Solution:
Hi guys.

I've found and fixed the problem. It happens because there are two caches in place for the session token:

- at Parse Server level, which, according with the docs, should be changed via cacheTTL option and defaults to 5 seconds;
- at Parse Live Query level, which, according with the docs, should be changed via liveQueryServerOptions.cacheTimeout and defaults to 30 days.

But there are three problems:

- cacheTTL has currently no effect over Live Query Server;
- cacheTimeout also has currently no effect over Live Query Server;
- cacheTimeout actually defaults to 1h.

So, currently, if you wait 1 hour after the session token was invalidated, the clients using the old session token are not able to receive the events.

What I did:

- Added a test case for the problem;
- Fixed cacheTTL for Live Query Server;
- Fixed cacheTimeout for Live Query Server;
- Changed the cacheTimeout to default 5s;
- Changed the docs to reflect the actual 5s default for cacheTimeout.
Vulnerability: GHSA-3mgp-fx93-9xv5
Summary: XSS vulnerability that affects bootstrap
Aliases: CVE-2018-20676
Severity: MODERATE
CWE: CWE-79
Published: 2019-01-17T13:57:34Z

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
Vulnerability: GHSA-77g4-36jp-5v3m
Summary: Remote Memory Disclosure in bittorrent-dht
Aliases: CVE-2016-10519
Severity: MODERATE
CWE: CWE-201
Published: 2020-09-01T15:22:12Z

Versions of `bittorrent-dht` prior to 5.1.3 are affected by a remote memory disclosure vulnerability. This vulnerability allows an attacker to send a specific series of of messages to a listening peer and get it to reveal internal memory.


There are two mitigating factors here, that slightly reduce the impact of this vulnerability:

1. Any modern kernel will zero out new memory pages before handing them off to a process. This means that only memory previously used and deallocated by the node process can be leaked.
1. Node.js manages Buffers by creating a few large internal SlowBuffers, and slicing them up into smaller Buffers which are made accessible in JS. They are not stored on V8's heap, because garbage collection would interfere. The result is that only memory that has been previously allocated as a Buffer can be leaked.


## Recommendation

Update to version 5.1.3 or later.
Vulnerability: GHSA-6jqp-j69q-pm62
Summary: AWS Lambda parser is vulnerable to Regular Expression Denial of Service
Aliases: CVE-2018-7560
Severity: HIGH
CWE: CWE-20
Published: 2018-03-05T19:16:56Z

index.js in the aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string.
Vulnerability: GHSA-7vm7-j8p7-h346
Summary: Code injection in blamer
Aliases: CVE-2020-8137
Severity: HIGH
CWE: CWE-94
Published: 2021-05-06T18:27:55Z

Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.
Vulnerability: GHSA-g8m7-qhv7-9h5x
Summary: Path Traversal in serve-here.js
Severity: HIGH
CWE: CWE-22
Published: 2019-07-05T21:07:14Z

Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-3h99-v4qw-p2h5
Summary: Malicious Package in coinpayment
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:41:56Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-f8rq-m28h-8hxj
Summary: Cross-Site Scripting in htmr
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T15:50:29Z

Versions of `htmr` prior to 0.8.7 are vulnerable to Cross-Site Scripting (XSS).  The package uses `innerHTML` to unescape HTML entities. This may lead to [DOM-based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS) through HTML-encoded XSS payloads. This may allow an attacker to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.8.7 or later.
Vulnerability: GHSA-76qm-4f93-fg6f
Summary: Improper Input Validation in xdLocalStorage
Aliases: CVE-2015-9545
Severity: MODERATE
CWE: CWE-20
Published: 2021-12-09T19:30:29Z

An issue was discovered in xdLocalStorage through 2.0.5. The receiveMessage() function in xdLocalStorage.js does not implement any validation of the origin of web messages. Remote attackers who can entice a user to load a malicious site can exploit this issue to impact the confidentiality and integrity of data in the local storage of the vulnerable site via malicious web messages.
Vulnerability: GHSA-vhx6-cp8w-295m
Summary: Directory Traversal in serverliujiayi1
Aliases: CVE-2017-16095
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:55:45Z

Affected versions of `serverliujiayi1` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-f523-2f5j-gfcg
Summary: Regular Expression Denial of Service in timespan
Aliases: CVE-2017-16115
Severity: LOW
CWE: CWE-400
Published: 2018-08-29T23:04:14Z

Affected versions of `timespan` are vulnerable to a regular expression denial of service when parsing dates.

The amplification for this vulnerability is significant, with 50,000 characters resulting in the event loop being blocked for around 10 seconds.


## Recommendation

No direct patch is available for this vulnerability.

Currently, the best available solution is to use a functionally equivalent alternative package.

It is also sufficient to ensure that user input is not being passed into `timespan`, or that the maximum length of such user input is drastically reduced. Limiting the input length to 150 characters should be sufficient in most cases.
Vulnerability: GHSA-j977-g5vj-j27g
Summary: Cross-Site Scripting in scratch-svg-renderer
Aliases: CVE-2020-7750
Severity: HIGH
CWE: CWE-79
Published: 2020-11-09T14:21:17Z

This affects the package scratch-svg-renderer before 0.2.0-prerelease.20201019174008. The loadString function does not escape SVG properly, which can be used to inject arbitrary elements into the DOM via the _transformMeasurements function.
Vulnerability: GHSA-pm9p-9926-w68m
Summary: Denial of Service in ecstatic
Aliases: CVE-2016-10703
Severity: HIGH
CWE: CWE-20
Published: 2017-12-28T22:52:47Z

`ecstatic`, a simple static file server middleware, is vulnerable to denial of service. If a payload with a large number of null bytes (`%00`) is provided by an attacker it can crash ecstatic by running it out of memory.


[Results from the original advisory](https://www.checkmarx.com/advisories/denial-of-service-dos-vulnerability-in-ecstatic-npm-package/)

```
A payload of 22kB caused a lag of 1 second,
A payload of 35kB caused a lag of 3 seconds,
A payload of 86kB caused the server to crash
```


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-2vqq-jgxx-fxjc
Summary: Malicious Package in motiv.scss
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:24:33Z

Version 0.4.20 of `motiv.scss` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-73jp-3c67-hjfv
Summary: Authentication Bypass in passport-azure-ad
Aliases: CVE-2016-7191
Severity: HIGH
CWE: CWE-287
Published: 2018-07-26T15:53:31Z

Affected versions of `passport-azure-ad` do not recognize the `validateIssuer` setting, which allows remote attackers to bypass authentication via a crafted token.


## Recommendation

Version 1.x: Update to version 1.4.6 or later.
Version 2.x: Update to version 2.0.1 or later.
Vulnerability: GHSA-vwrf-r5r4-7775
Summary: Incorrect handling of CORS preflight request headers in hapi
Aliases: CVE-2015-9236
Severity: MODERATE
CWE: CWE-284
Published: 2018-06-07T19:43:25Z

Versions of `hapi` prior to 11.0.0 implement CORS incorrectly, allowing for configurations that at best return inconsistent headers, and at worst allow cross-origin activities that are expected to be forbidden. 

If the connection has CORS enabled but one route has it off, and the route is not GET, the OPTIONS prefetch request will return the default CORS headers and then the actual request will go through and return no CORS headers. This defeats the purpose of turning CORS on the route.


## Recommendation

Update to version 11.0.0 or later.
Vulnerability: GHSA-xgh6-85xh-479p
Summary: Regular Expression Denial of Service in npm-user-validate
Severity: LOW
Published: 2020-10-16T18:56:26Z

`npm-user-validate` before version `1.0.1` is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with `@` characters.

### Impact
The issue affects the `email` function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service.

### Patches
The issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit.

### Workarounds
Restrict the character length to a reasonable degree before passing a value to `.emal()`; Also, consider doing a more rigorous sanitizing/validation beforehand.
Vulnerability: GHSA-38vq-cjh5-vw7x
Summary: Malicious Package in nodes.js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T18:13:41Z

All versions of `nodes.js ` contain malicious code. The package searches and installs globally thousands of packages based on keywords `node`, `react`, `react-native`, `vue`, `angular` and `babel` to fill the system's memory.


## Recommendation

Remove the package from your environment and validate what packages are installed.
Vulnerability: GHSA-gjhx-gxwx-jx9j
Summary: Cross-Site Scripting in jqtree
Aliases: CVE-2016-1000234
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T15:35:22Z

Affected versions of `jqtree` are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data. 

When a user attempts to drag a node to a different position in the hierarchy, script content existing within the node will be executed.


## Recommendation

Update to 1.3.4 or later.
Vulnerability: GHSA-jxwx-85vp-gvwm
Summary: Regular Expression Denial of Service in jquery-validation
Aliases: CVE-2021-21252
Severity: MODERATE
CWE: CWE-400
Published: 2021-01-13T18:21:54Z

The GitHub Security Lab team has identified potential security vulnerabilities in jquery.validation.

The project contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service)

This issue was discovered and reported by GitHub team member @erik-krogh (Erik Krogh Kristensen).
Vulnerability: GHSA-w2pf-g6r8-pg22
Summary: Placeholder property does not indicate HTML capable, could lead to inadvertent abuse
Aliases: CVE-2019-20174
Severity: MODERATE
CWE: CWE-79
Published: 2020-01-31T17:59:51Z

## Overview

Auth0 Lock version 11.20.4 and earlier did not properly sanitize the generated HTML code. Customers using the `additionalSignUpFields` customization option to add a checkbox to the sign-up dialog that are passing a `placeholder` property obtained from an untrusted source (e.g. a query parameter) could allow cross-site scripting (XSS) on their signup pages.

## Am I affected?

You are affected by this vulnerability if all of the following conditions apply:

- You are using Auth0 Lock version 11.20.4 or earlier.
- You pass `additionalSignUpFields` as options when initializing Lock which includes a field of type `checkbox` whose `placeholder` value is obtained from an untrusted source.

An example of a vulnerable snippet is the following where the `placeholder` value is partially user-controlled by the `name` query parameter:

```javascript
<script>
    var params = new URLSearchParams(window.location.search);
    var options = {
        auth: {
            redirectUrl: 'http://localhost:12345/callback',
            responseType: 'code',
            params: {
                scope: 'openid email',
            },
        },
        additionalSignUpFields: [{
            name: 'agree',
            type: 'checkbox',
            placeholder: "I agree to Terms and Conditions for " + params.get('name'),
        }],
    };
    var lock = new Auth0Lock('<CLIENT_ID>', '<TENANT_NAME>.auth0.com', options);
    lock.show({
        allowShowPassword: true,
        initialScreen: 'signUp',
    });
</script>
```

## How to fix that?

Developers using Auth0’s signin solution Lock need to upgrade to version 11.21.0 or later. Version 11.21.0 introduces two changes:

1. The existing `placeholder` property is now treated as plain text to mitigate the problem.
2. A new `placeholderHTML` property is introduced that indicates the level of control it provides and that it should be only supplied from trusted sources.

## Will this update impact my users?

This fix patches the Auth0 Lock widget and may require changes in application code, but it will not impact your users, their current state, or any existing sessions.

Developers using the `placeholder` property with HTML content from a trusted source should start using the `placeholderHTML` property to continue providing the same user experience.
Vulnerability: GHSA-cg48-9hh2-x6mx
Summary: HTML Injection in preact
Severity: MODERATE
CWE: CWE-74
Published: 2020-09-02T18:28:58Z

Versions of `preact` 10.x on prerelease tags alpha and beta prior to 10.0.0-beta.1 are vulnerable to HTML Injection. Due to insufficient input validation the package allows attackers to inject JavaScript objects as virtual-dom nodes, which may lead to Cross-Site Scripting. This requires user input parsed with `JSON.parse()` to be passed directly into JSX without sanitization.


## Recommendation

Upgrade to version 10.0.0-beta.1.
Vulnerability: GHSA-p72p-rjr2-r439
Summary: Server-Side Request Forgery in terriajs-server
Severity: HIGH
CWE: CWE-918
Published: 2019-05-29T20:24:02Z

Versions of `terriajs-server`prior to 2.7.4 are vulnerable to Server-Side Request Forgery (SSRF). If an attacker has access to a server whitelisted by the terriajs-server proxy or if the attacker is able to modify the DNS records of a domain whitelisted by the terriajs-server proxy, the attacker can use the terriajs-server proxy to access any HTTP-accessible resources that are accessible to the server, including private resources in the hosting environment.


## Recommendation

Upgrade to version 2.7.4 or later.
Vulnerability: GHSA-hwqf-gcqm-7353
Summary: Header injection in nodemailer
Aliases: CVE-2021-23400
Severity: MODERATE
CWE: CWE-74
Published: 2021-12-10T18:56:57Z

The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Vulnerability: GHSA-hx3r-jv9q-85jw
Summary: Bitcoin Inventory Out-of-Memory Denial-of-Service Attack (CVE-2018-17145)
Aliases: CVE-2018-17145
Severity: HIGH
CWE: CWE-400
Published: 2020-09-10T19:44:58Z

There was an easily exploitable uncontrolled memory resource consumption denial-of-service vulnerability that existed in the peer-to-peer network code of three implementations of Bitcoin and several alternative chains.

For more details please see:
https://invdos.net/

For the paper:
https://invdos.net/paper/CVE-2018-17145.pdf
Vulnerability: GHSA-6xwr-q98w-rvg7
Summary: Prototype Pollution in nconf
Aliases: CVE-2022-21803
Severity: HIGH
CWE: CWE-1321
Published: 2022-04-13T00:00:30Z

nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Vulnerability: GHSA-fvc6-qjp7-m4g4
Summary: Arbitrary file upload in Ghost
Aliases: CVE-2022-27139
Severity: CRITICAL
CWE: CWE-434
Published: 2022-04-13T00:00:24Z

An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted SVG file.
Vulnerability: GHSA-r3j7-x2g5-9gx6
Summary: Command injection in samba-client
Aliases: CVE-2021-27185
Severity: CRITICAL
CWE: CWE-74, CWE-77, CWE-78
Published: 2021-02-11T20:47:27Z

The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.
Vulnerability: GHSA-3hw5-q855-g6cw
Summary: Prototype Pollution in Dojox
Aliases: CVE-2020-5259
Severity: LOW
CWE: CWE-94
Published: 2020-03-10T18:03:32Z

The Dojox jQuery wrapper `jqMix` mixin method is vulnerable to Prototype Pollution. 

Affected Area:
```
//https://github.com/dojo/dojox/blob/master/jq.js#L442
		var tobj = {};
		for(var x in props){
			// the "tobj" condition avoid copying properties in "props"
			// inherited from Object.prototype.  For example, if obj has a custom
			// toString() method, don't overwrite it with the toString() method
			// that props inherited from Object.prototype
			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){
					if(dojo.isArray(props[x])){
						obj[x] = props[x];
					}else{
						obj[x] = jqMix(obj[x], props[x]);
					}
				}else{
					obj[x] = props[x];
				}
```
Vulnerability: GHSA-p2hm-8725-c8x8
Summary: Downloads Resources over HTTP in cue-sdk-node
Aliases: CVE-2016-10590
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:50:58Z

Affected versions of `cue-sdk-node` insecurely download an executable over an unencrypted HTTP connection. 
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cue-sdk-node`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-hgr5-82rc-p936
Summary: Cross-Site Scripting in md-data-table
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T21:24:41Z

All versions of `md-data-table` are vulnerable to cross-site scripting (XSS). This vulnerability is exploitable if an attacker has control over data that is rendered by `mdt-row`


## Recommendation

As there is no fix for this vulnerability at this time we recommend either selecting another package to perform this functionality or properly sanitizing all user data prior to rendering with `md-data-table`
Vulnerability: GHSA-4hpf-3wq7-5rpr
Summary: Regular expression deinal of service (ReDoS) in is-my-json-valid
Aliases: CVE-2018-1107
Severity: MODERATE
CWE: CWE-400
Published: 2022-01-06T20:44:07Z

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.
Vulnerability: GHSA-r8hx-3qx6-hxq9
Summary: Malicious Package in commandre
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:41:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qmv4-jgp7-mf68
Summary: Broken CORS in sails
Aliases: CVE-2016-10549
Severity: HIGH
CWE: CWE-284
Published: 2019-02-18T23:40:10Z

Affected versions of `sails` have an issue with the CORS configuration where the value of the origin header is reflected as the value for the `Access-Control-Allow-Origin` header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. 

## Mitigating Factors

This is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. 

The problem can be compounded when the cors `credentials` setting is not provided, because at that point authenticated cross domain requests are possible.


## Recommendation

Update to version 0.12.7 or later.

As this vulnerability is primarily a user error, the patch for the vulnerability will simply cause the application to write an error message to the console when a vulnerable configuration is used in a production environment.

Writing a proper CORS configuration is still the responsibility of the user, so it is necessary to check for the error message after installing the patch. Be sure you are not using `allRoutes: true` with `origin:'*'`, and that you uncomment `origin` and set it to a reasonable value. Ensure that if `origin` is set to `*` that you truly mean for all other websites to be able to make cross-domain requests to your API.

Likewise, ensure `credentials` is uncommented out and set to the appropriate value. Make sure to explicitly set which origins may request resources via CORS.
Vulnerability: GHSA-pq5x-rprq-8jrj
Summary: Directory Traversal in exxxxxxxxxxx
Aliases: CVE-2017-16130
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T22:06:14Z

Affected versions of `exxxxxxxxxxx` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

This vulnerability is only effective for files that have a file extension, which provides a partial mitigation. 

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-83pq-466j-fc6j
Summary: Prototype Pollution in sahmat
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:17:50Z

All versions of `sahmat ` are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-pjwm-rvh2-c87w
Summary: Embedded malware in ua-parser-js
Severity: CRITICAL
CWE: CWE-506
Published: 2021-10-22T20:38:14Z

The npm package `ua-parser-js` had three versions published with malicious code. Users of affected versions (0.7.29, 0.8.0, 1.0.0) should upgrade as soon as possible and check their systems for suspicious activity. See [this issue](https://github.com/faisalman/ua-parser-js/issues/536) for details as they unfold.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xm7f-x4wx-wmgv
Summary: Out-of-bounds Read in byte
Severity: MODERATE
CWE: CWE-125
Published: 2019-06-04T15:47:43Z

Versions of `byte` before 1.4.1 allocate uninitialized buffers and read data from them past the initialized length



## Recommendation

Update to version 1.4.1 or later.
Vulnerability: GHSA-957j-59c2-j692
Summary: Prototype pollution vulnerability in 'getobject'
Aliases: CVE-2020-28282
Severity: CRITICAL
Published: 2021-10-12T16:26:37Z

Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-9fg5-f5pj-rwcc
Summary: Hijacked Environment Variables in gruntcli
Aliases: CVE-2017-16058
Severity: MODERATE
CWE: CWE-506
Published: 2018-11-09T17:43:52Z

The `gruntcli` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation



As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-v99v-xgjx-7m7g
Summary: Malicious Package in asnyc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:40:47Z

All versions of `asnyc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-8xj3-7258-w4q2
Summary: Directory Traversal in dasafio
Aliases: CVE-2017-16179
Severity: MODERATE
CWE: CWE-22
Published: 2020-09-01T18:51:22Z

Affected versions of `dasafio` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-8c8c-4vfj-rrpc
Summary: Reflected Cross-Site Scripting in redis-commander
Severity: LOW
CWE: CWE-79
Published: 2020-09-01T19:05:11Z

Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander.

Mitigating factors:
Flash must be installed / enabled for this to work. The below proof of concept was verified to work using Firefox 57.0 on Windows 10 by manually installing the [Flash NPAPI Windows plugin](https://get.adobe.com/flashplayer/otherversions/)

## Proof of concept

```
http://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\%22))}%20catch(e)%20{alert(document.domain);}//
```


## Recommendation

No direct patch for this vulnerability is currently available.

At this time, the best mitigation is to use an alternative, functionally equivalent package, or to use extreme caution when using redis-commander, ensuring that redis-commmander is the only web page you have open, and avoiding clicking on any links.
Vulnerability: GHSA-4943-9vgg-gr5r
Summary: Cross-site Scripting in quill
Aliases: CVE-2021-3163
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-10T15:38:12Z

A vulnerability in the HTML editor of Slab Quill allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted `onloadstart` attribute of an IMG element) in a text field. No patch exists and no further releases are planned.

This CVE is disputed. Researchers have claimed that this issue is not within the product itself, but is intended behavior in a web browser. More information can be found [here](https://github.com/quilljs/quill/issues/3364).
Vulnerability: GHSA-j5qg-46p9-w2rp
Summary: Malicious Package in jekyll-for-github-projects
Severity: CRITICAL
Published: 2020-09-03T00:33:32Z

Version 0.2.12 of `jekyll-for-github-projects` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-35g4-qx3c-vjhx
Summary: Automatic room upgrade handling can be used maliciously to bridge a room non-consentually 
Aliases: CVE-2021-32659
Severity: MODERATE
CWE: CWE-306
Published: 2021-06-21T17:09:22Z

### Impact

If a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombstone` event it encounters will be used to unbridge the current room and bridge into the target room. However, the target room `m.room.create` event is not checked to verify if the `predecessor` field contains the previous room. This means that any mailcious admin of a bridged room can repoint the traffic to a different room without the new room being aware.


### Patches

Versions 2.6.1 and greater are patched.

### Workarounds

Disabling the automatic room upgrade handling can be done by removing the `roomUpgradeOpts` key from the `Bridge` class options. 

### References

The issue is patched by https://github.com/matrix-org/matrix-appservice-bridge/pull/330

### For more information]

If you have any questions or comments about this advisory, email us at security@matrix.org.
Vulnerability: GHSA-6vfc-qv3f-vr6c
Summary: Uncontrolled Resource Consumption in markdown-it
Aliases: CVE-2022-21670
Severity: MODERATE
CWE: CWE-400
Published: 2022-01-12T22:20:22Z

### Impact

Special patterns with length > 50K chars can slow down parser significantly.

```js
const md = require('markdown-it')();

md.render(`x ${' '.repeat(150000)} x  \nx`);
```


### Patches

Upgrade to v12.3.2+

### Workarounds

No.

### References

Fix + test sample: https://github.com/markdown-it/markdown-it/commit/ffc49ab46b5b751cd2be0aabb146f2ef84986101
Vulnerability: GHSA-j9xp-92vc-559j
Summary: SQL Injection in sequelize
Aliases: CVE-2019-10748
Severity: CRITICAL
CWE: CWE-89
Published: 2019-11-06T17:11:10Z

Affected versions of `sequelize` are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.8.11 or later.
If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.
If you are using `sequelize` 3.x, upgrade to version 3.35.1 or later.
Vulnerability: GHSA-45cp-hpc9-8347
Summary: Malicious Package in css_transform_support
Severity: CRITICAL
Published: 2020-09-01T19:52:35Z

Version 1.0.2 of `css_transform_support` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-g4hj-r7r3-9rwv
Summary: OS Command Injection in gulp-scss-lint
Aliases: CVE-2020-7601
Severity: CRITICAL
CWE: CWE-98
Published: 2021-05-07T16:15:37Z

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the &quot;exec&quot; function located in &quot;src/command.js&quot; via the provided options.
Vulnerability: GHSA-49r3-3h96-rwj6
Summary: Cross-Site Scripting in ids-enterprise
Severity: HIGH
CWE: CWE-79
Published: 2019-06-13T19:09:31Z

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
Vulnerability: GHSA-2563-83p7-f34p
Summary: Malicious Package in requestt
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:24:41Z

All versions of `requestt` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-p65h-233c-jxvm
Summary: Downloads Resources over HTTP in resourcehacker
Aliases: CVE-2016-10646
Severity: HIGH
CWE: CWE-311
Published: 2018-08-15T19:03:59Z

Affected versions of `resourcehacker` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `resourcehacker`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-gcm9-cc3r-c6vj
Summary: Cross-site Scripting (XSS) in Eclipse Theia
Aliases: CVE-2020-27224
Severity: CRITICAL
CWE: CWE-79
Published: 2021-04-13T15:18:09Z

In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code.
Vulnerability: GHSA-g7q5-pjjr-gqvp
Summary: Regular Expression Denial of Service in tough-cookie
Aliases: CVE-2017-15010
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:14:39Z

Affected versions of `tough-cookie` are susceptible to a regular expression denial of service.

The amplification on this vulnerability is relatively low - it takes around 2 seconds for the engine to execute on a malicious input which is 50,000 characters in length.

If node was compiled using the `-DHTTP_MAX_HEADER_SIZE` however, the impact of the vulnerability can be significant, as the primary limitation for the vulnerability is the default max HTTP header length in node.


## Recommendation

Update to version 2.3.3 or later.
Vulnerability: GHSA-5p28-63mc-cgr9
Summary: Cross-Site Scripting bypass in html-purify
Severity: HIGH
CWE: CWE-79
Published: 2020-12-04T20:04:37Z

All versions of html-purify are vulnerable to cross-site scripting. The data attribute inside of object tags is not properly sanitized and allows javascript URIs leading to code execution.

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-pwqj-h62h-q35c
Summary: Directory Traversal in goserv
Aliases: CVE-2017-16133
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:49:03Z

Affected versions of `goserv` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-q8pj-2vqx-8ggc
Summary: Denial of service in css-what
Aliases: CVE-2021-33587
Severity: HIGH
CWE: CWE-400
Published: 2021-06-07T22:11:39Z

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Vulnerability: GHSA-7pr3-p5fm-8r9x
Summary: LiveQuery publishes user session tokens in parse-server
Aliases: CVE-2021-41109
Severity: HIGH
CWE: CWE-200
Published: 2021-09-30T17:09:47Z

### Impact
For regular (non-LiveQuery) queries, the session token is removed from the response, but for LiveQuery payloads it is currently not. If a user has a LiveQuery subscription on the `Parse.User` class, all session tokens created during user sign-ups will be broadcast as part of the LiveQuery payload.

### Patches
Remove session token from LiveQuery payload.

### Workaround
Set `user.acl(new Parse.ACL())` in a beforeSave trigger to make the user private already on sign-up.
Vulnerability: GHSA-g74r-ffvr-5q9f
Summary: Memory Exposure in concat-stream
Severity: MODERATE
CWE: CWE-200
Published: 2019-06-03T17:26:44Z

Versions of `concat-stream` before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into `write()`

Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.



## Recommendation

Update to version 1.5.2, 1.4.11, 1.3.2 or later.

If you are unable to update make sure user provided input into the `write()` function is not a number.
Vulnerability: GHSA-qw96-mm2g-c8m7
Summary: Next.js has cross site scripting (XSS) vulnerability via the 404 or 500 /_error page
Aliases: CVE-2018-18282
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-15T21:43:12Z

Next.js 7.0.0 and 7.0.1 has XSS via the 404 or 500 /_error page.
Vulnerability: GHSA-5fg8-2547-mr8q
Summary: Misinterpretation of malicious XML input
Aliases: CVE-2021-32796
Severity: MODERATE
CWE: CWE-116
Published: 2021-08-03T16:57:05Z

### Impact
xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications.

### Patches
Update to one of the fixed versions of `@xmldom/xmldom` (`>=0.7.0`)

See issue #271 for the status of publishing `xmldom` to npm or join #270 for Q&A/discussion until it's resolved.

### Workarounds

Downstream applications can validate the input and reject the maliciously crafted documents.

### References

Similar to this one reported on the Go standard library:

- https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities/
- https://mattermost.com/blog/securing-xml-implementations-across-the-web/

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [`xmldom/xmldom`](https://github.com/xmldom/xmldom)
* Email us: send an email to **all** addresses that are shown by `npm owner ls @xmldom/xmldom`
Vulnerability: GHSA-f9cm-p3w6-xvr3
Summary: Denial-of-Service Extended Event Loop Blocking in qs
Aliases: CVE-2014-10064
Severity: HIGH
CWE: CWE-400
Published: 2018-10-09T00:38:48Z

Versions prior to 1.0.0 of `qs` are affected by a denial of service vulnerability that results from excessive recursion in parsing a deeply nested JSON string.




## Recommendation

Update to version 1.0.0 or later
Vulnerability: GHSA-fq6p-x6j3-cmmq
Summary: Denial of service in three
Aliases: CVE-2020-28496
Severity: HIGH
CWE: CWE-400
Published: 2021-03-01T19:57:16Z

This affects the package three before 0.125.0. This can happen when handling rgb or hsl colors. PoC: var three = require('three') function build_blank (n) { var ret = "rgb(" for (var i = 0; i < n; i++) { ret += " " } return ret + ""; } var Color = three.Color var time = Date.now(); new Color(build_blank(50000)) var time_cost = Date.now() - time; console.log(time_cost+" ms")
Vulnerability: GHSA-8948-ffc6-jg52
Summary: Insecure Default Configuration in redbird
Severity: MODERATE
CWE: CWE-20
Published: 2019-06-06T15:32:21Z

Versions of `redbird` prior to 0.9.1 have a vulnerable default configuration of allowing TLS 1.0 connections on `lib/proxy.js`. The package does not provide an option to disable TLS 1.0 which is deprecated and vulnerable.


## Recommendation

Upgrade to version 0.9.1 or later.
Vulnerability: GHSA-gc94-6w89-hpqr
Summary: Command Injection in fs-path
Severity: HIGH
CWE: CWE-77, CWE-62
Published: 2019-06-12T16:37:07Z

All versions of `fs-path` are vulnerable to command injection is unsanitized user input is passed in.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Vulnerability: GHSA-w7wg-24g3-2c78
Summary: Malicious Package in requset
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:14:17Z

All versions of `requset` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-mpgr-2cx9-327h
Summary: Information disclosure in SSB-DB
Aliases: CVE-2020-4045
Severity: HIGH
CWE: CWE-200
Published: 2020-06-11T21:09:04Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Servers running SSB-DB 20.0.0 (which is packaged with SSB-Server 16.0.0) must upgrade immediately.

**There is no evidence that other SSB apps are vulnerable or that this problem has been exploited in the wild.**

The `get()` method is supposed to only decrypt messages when you explicitly ask it to, but there's a bug where it's decrypting any message that it can. This means that it's returning the decrypted content of private messages, which a malicious peer could use to get access to private data. This only affects peers running SSB-DB@20.0.0 who also have private messages, and is only known to be exploitable if you're also running SSB-OOO (default in SSB-Server), which exposes a thin wrapper around `get()` to anonymous peers.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes, please upgrade to SSB-DB 20.0.1 (or SSB-Server 16.0.1) immediately.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

You may be able to disable the most obvious attack vector, SSB-OOO, by disabling the plugin, but you should upgrade immediately anyway.

### For more information

If you have any questions or comments about this advisory, open an issue in [SSB-DB](https://github.com/ssbc/ssb-db/)
Vulnerability: GHSA-vx5w-cxch-wwc9
Summary: Path Traversal in f-serv
Severity: CRITICAL
CWE: CWE-22
Published: 2020-09-03T19:02:27Z

All versions of `f-serv` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.