TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-4mvj-rq4v-2fxw
Summary: Prototype Pollution in x-assign
Aliases: CVE-2021-23452
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-10-21T17:50:44Z

This affects all versions of package x-assign. The global proto object can be polluted using the __proto__ object.
Vulnerability: GHSA-mf22-92pm-m8p8
Summary: Cross site scripting in @awsui/components-react
Aliases: CVE-2022-24709
Severity: HIGH
CWE: CWE-79
Published: 2022-02-25T15:36:47Z

### Impact
Components could potentially allow cross-site scripting (XSS) in certain circumstances. These components could render content without adequate neutralization.

### Patches
Fixed in 3.0.367.
Vulnerability: GHSA-4x5j-v9v9-w8gw
Summary: Downloads Resources over HTTP in httpsync
Aliases: CVE-2016-10614
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:40Z

Affected versions of `httpsync` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `httpsync`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-36rh-ggpr-j3gj
Summary: Azure DevOps token leakage in logs
Severity: MODERATE
Published: 2020-09-14T16:38:40Z

### Impact

Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the `http.extraheader=AUTHORIZATION` parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.

### Patches

Fixed in 23.25.1

### Workarounds

Do not share Renovate logs with anyone who cannot be trusted with access to the token.

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@renovatebot.com](mailto:security@renovatebot.com)
Vulnerability: GHSA-gqf6-75v8-vr26
Summary: Arbitrary File Write in bin-links
Severity: LOW
Published: 2020-09-04T16:56:11Z

Versions of `bin-links` prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended `node_modules` folder through the `bin` field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite files that already exist.


## Recommendation

Upgrade to version 1.1.5 or later.
Vulnerability: GHSA-jhq3-57xh-6643
Summary: Privilege Escalation due to Blind NoSQL Injection in flintcms
Aliases: CVE-2018-3783
Severity: CRITICAL
CWE: CWE-89
Published: 2018-08-21T17:03:59Z

Versions of `flintcms` before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset.


## Recommendation

Update to version 1.1.10 or later.
Vulnerability: GHSA-r4m5-47cq-6qg8
Summary: Server-Side Request Forgery in ftp-srv
Severity: HIGH
CWE: CWE-918
Published: 2020-09-04T17:25:13Z

All versions of `ftp-srv` are vulnerable to Server-Side Request Forgery (SSRF). The package fails to prevent remote clients to access other resources in the network, for example when connecting to the server through telnet. This allows attackers to access any network resources available to the server, including private resources in the hosting environment.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-q6pj-jh94-5fpr
Summary: OS Command Injection in docker-compose-remote-api
Aliases: CVE-2020-7606
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-07T16:14:39Z

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within &#39;index.js&#39; of the package, the function &#39;exec(serviceName, cmd, fnStdout, fnStderr, fnExit)&#39; uses the variable &#39;serviceName&#39; which can be controlled by users without any sanitization.
Vulnerability: GHSA-5c8j-xr24-2665
Summary: Potential Command Injection in printer
Aliases: CVE-2014-3741
Severity: CRITICAL
CWE: CWE-77
Published: 2017-11-28T22:44:52Z

Versions 0.0.1 and earlier of `printer` are affected by a command injection vulnerability resulting from a failure to sanitize command arguments properly in the `printDirect()` function. 



## Recommendation

Update to version 0.0.2 or later.
Vulnerability: GHSA-5xf4-f2fq-f69j
Summary: Improper link resolution before file access (Link Following)
Aliases: CVE-2019-10773
Severity: HIGH
CWE: CWE-78
Published: 2020-02-14T23:10:16Z

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.
Vulnerability: GHSA-4363-x42f-xph6
Summary: Malicious Package in hw-trnasport-u2f
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:05:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hf8c-xr89-vfm5
Summary: Command Injection in ungit
Aliases: CVE-2022-25766
Severity: HIGH
CWE: CWE-77
Published: 2022-03-22T00:00:41Z

The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.
Vulnerability: GHSA-c3hr-wwh3-qm54
Summary: Directory Traversal in fsk-server
Aliases: CVE-2017-16090
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:47:09Z

Affected versions of `fsk-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-g78m-2chm-r7qv
Summary: Regular Expression Denial of Service in websocket-extensions (NPM package)
Aliases: CVE-2020-7662
Severity: HIGH
CWE: CWE-400
Published: 2020-06-05T16:16:12Z

### Impact

The ReDoS flaw allows an attacker to exhaust the server's capacity to process
incoming requests by sending a WebSocket handshake request containing a header
of the following form:

    Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...

That is, a header containing an unclosed string parameter value whose content is
a repeating two-byte sequence of a backslash and some other character. The
parser takes exponential time to reject this header as invalid, and this will
block the processing of any other work on the same thread. Thus if you are
running a single-threaded server, such a request can render your service
completely unavailable.

### Patches

Users should upgrade to version 0.1.4.

### Workarounds

There are no known work-arounds other than disabling any public-facing
WebSocket functionality you are operating.

### References

- https://blog.jcoglan.com/2020/06/02/redos-vulnerability-in-websocket-extensions/
Vulnerability: GHSA-xw22-wv29-3299
Summary: ApiKey secret could be revelated on network issue
Aliases: CVE-2021-21421
Severity: HIGH
CWE: CWE-200
Published: 2021-04-06T17:29:52Z

### Impact
_What kind of vulnerability is it? Who is impacted?_
Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too

### Patches
_Has the problem been patched? What versions should users upgrade to?_

creharmony/node-etsy-client#18 fixes this issue. This is fixed in [node-etsy-client v0.3.0](https://github.com/creharmony/node-etsy-client/tree/v0.3.0) and later.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Do not report or log etsy client error if you are using version <= v0.2.0

Update your version of node-etsy-client

### References
_Are there any links users can visit to find out more?_

- https://github.com/creharmony/node-etsy-client/issues/17 : On connect error secret appears in error #17

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/creharmony/node-etsy-client/issues](https://github.com/creharmony/node-etsy-client/issues/)
Vulnerability: GHSA-5fw9-fq32-wv5p
Summary: OS Command Injection in node-notifier
Aliases: CVE-2020-7789
Severity: MODERATE
CWE: CWE-78
Published: 2020-12-21T16:04:07Z

This affects the package node-notifier before 8.0.1. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.
Vulnerability: GHSA-754x-4jwp-cqp6
Summary: Cross-Site Scripting in http_server
Aliases: CVE-2019-15600
Severity: HIGH
CWE: CWE-22
Published: 2020-03-31T17:02:26Z

All versions of `http_server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-8r98-rqg5-4vm3
Summary: Downloads Resources over HTTP in node-browser
Aliases: CVE-2016-10618
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:56:50Z

Affected versions of `node-browser` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-rvww-x6m4-4vc2
Summary: Malicious Package in blubird
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:12:39Z

Version 3.5.0 of `blubird` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.
Vulnerability: GHSA-fm93-fhh2-cg2c
Summary: Prototype Pollution in min-dash
Aliases: CVE-2021-23460
Severity: HIGH
CWE: CWE-1321
Published: 2022-01-27T14:21:53Z

The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement of key types.
Vulnerability: GHSA-2xwv-3cc9-fp7c
Summary: Sensitive Data Exposure in seneca
Aliases: CVE-2019-5483
Severity: LOW
CWE: CWE-209
Published: 2019-09-11T23:07:57Z

Versions of `seneca` prior to 3.9.0 are vulnerable to Sensitive Data Exposure. When a process using the package crashes all environment variables are printed. This may leak sensitive data such as access keys, especially given scenarios when log-monitoring systems store the error output.


## Recommendation

Upgrade to version 3.9.0 or later.
Vulnerability: GHSA-5w25-hxp5-h8c9
Summary: Improper Verification of Cryptographic Signature
Aliases: CVE-2021-32685
Severity: CRITICAL
CWE: CWE-347
Published: 2021-06-21T17:12:13Z

tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-512 hash matching the SHA-512 hash of the message even if the signature was invalid. This issue is patched in version 7.0.3. As a workaround: In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`.
Vulnerability: GHSA-65p8-3hm4-h9h8
Summary: Denial of Service in rgb2hex
Severity: MODERATE
CWE: CWE-400
Published: 2019-08-23T00:04:48Z

All versions of `rgb2hex` are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value.


## Recommendation

Update to version 0.1.6 or later.
Vulnerability: GHSA-6q48-vjq2-mwcj
Summary: Command Injection in umount
Aliases: CVE-2020-7628
Severity: CRITICAL
CWE: CWE-78
Published: 2020-06-10T20:28:03Z

All versions of `umount ` are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `umount` function . This may allow attackers to execute arbitrary code in the system if the `device` value passed to the function is user-controlled.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-23cm-x6j7-6hq3
Summary: matrix-js-sdk can be tricked into disclosing E2EE room keys to a participating homeserver
Aliases: CVE-2021-40823
Severity: MODERATE
CWE: CWE-200
Published: 2021-09-14T20:24:18Z

### Impact

A logic error in the room key sharing functionality of matrix-js-sdk before 12.4.1 allows a malicious Matrix homeserver† participating in an encrypted room to steal room encryption keys from affected Matrix clients participating in that room. This allows the homeserver to decrypt end-to-end encrypted messages sent by affected clients.

† Or anyone with access to the account of the original recipient of an encrypted message.

Known clients affected (via their use of vulnerable versions of matrix-js-sdk):

- Element Web (1.8.2 and earlier)
- Element Desktop (1.8.2 and earlier)
- SchildiChat Web (1.7.32-sc1 and earlier)
- SchildiChat Desktop (1.7.32-sc1 and earlier)
- Cinny (1.2.0 and earlier)

### Patch

This was fixed in https://github.com/matrix-org/matrix-js-sdk/commit/894c24880da0e1cc81818f51c0db80e3c9fb2be9.

### Workarounds
To prevent a homeserver from being able to steal the room keys, vulnerable clients can be taken offline or signed out. If signing out, care should be taken to either set up Secure Backup or export E2E room keys in order to preserve access to past messages.
Vulnerability: GHSA-mvjj-gqq2-p4hw
Summary: Cross-Site Scripting in react-dom
Aliases: CVE-2018-6341
Severity: LOW
CWE: CWE-79
Published: 2019-01-04T19:05:35Z

Affected versions of `react-dom` are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
- be a server-side React app
- be rendered to HTML using `ReactDOMServer`
- include an attribute name from user input in an HTML tag


## Recommendation

If you are using `react-dom` 16.0.x, upgrade to 16.0.1 or later.  
If you are using `react-dom` 16.1.x, upgrade to 16.1.2 or later.  
If you are using `react-dom` 16.2.x, upgrade to 16.2.1 or later.  
If you are using `react-dom` 16.3.x, upgrade to 16.3.3 or later.  
If you are using `react-dom` 16.4.x, upgrade to 16.4.2 or later.
Vulnerability: GHSA-432j-4fw9-2g6f
Summary: Downloads Resources over HTTP in libsbml
Aliases: CVE-2016-10668
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:33Z

Affected versions of `libsbml` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libsbml`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-g7mq-rfj2-25wq
Summary: Code Injection in total4
Aliases: CVE-2021-23390
Severity: CRITICAL
CWE: CWE-94
Published: 2021-12-10T17:26:33Z

The package total4 before 0.0.43 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Vulnerability: GHSA-h9x2-5rm7-x4gm
Summary: Insecure Comparison in secure-compare
Aliases: CVE-2015-9238
Severity: HIGH
CWE: CWE-697
Published: 2019-06-03T17:28:23Z

Versions of `secure-compare` prior to 3.0.1 are affected by a vulnerability that results in the package always returning true when comparing two strings of the same length, despite differences in the contents of those strings.


## Recommendation

Upgrade to version 3.0.1 or later.
Vulnerability: GHSA-rc3x-jf5g-xvc5
Summary: Open redirect in karma
Aliases: CVE-2021-23495
Severity: MODERATE
CWE: CWE-601
Published: 2022-02-26T00:00:38Z

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.
Vulnerability: GHSA-qq89-hq3f-393p
Summary: Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links
Aliases: CVE-2021-37712
Severity: HIGH
CWE: CWE-59, CWE-22
Published: 2021-08-31T16:05:17Z

### Impact
Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created.

This logic was insufficient when extracting tar files that contained two directories and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include directories with two forms of the path that resolve to the same file system entity, followed by a symbolic link with a name in the first form, lastly followed by a file using the second form. It led to bypassing node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite.

The v3 branch of `node-tar` has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of `node-tar`. If this is not possible, a workaround is available below.

### Patches

6.1.9 || 5.0.10 || 4.4.18

### Workarounds

Users may work around this vulnerability without upgrading by creating a custom filter method which prevents the extraction of symbolic links.

```js
const tar = require('tar')

tar.x({
  file: 'archive.tgz',
  filter: (file, entry) => {
    if (entry.type === 'SymbolicLink') {
      return false
    } else {
      return true
    }
  }
})
```

Users are encouraged to upgrade to the latest patched versions, rather than attempt to sanitize tar input themselves.

#### Fix

The problem is addressed in the following ways, when comparing paths in the directory cache and path reservation systems:

1. The `String.normalize('NFKD')` method is used to first normalize all unicode to its maximally compatible and multi-code-point form.
2. All slashes are normalized to `/` on Windows systems (on posix systems, `\` is a valid filename character, and thus left intact).
3. When a symbolic link is encountered on Windows systems, the entire directory cache is cleared.  Collisions related to use of 8.3 short names to replace directories with other (non-symlink) types of entries may make archives fail to extract properly, but will not result in arbitrary file writes.
Vulnerability: GHSA-xg59-m7wx-853q
Summary: Cross-site Scripting in node-red-dashboard
Aliases: CVE-2019-10756
Severity: MODERATE
CWE: CWE-79
Published: 2019-10-25T19:41:24Z

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
Vulnerability: GHSA-hgjh-723h-mx2j
Summary: Authorization Bypass Through User-Controlled Key in url-parse
Aliases: CVE-2022-0686
Severity: CRITICAL
CWE: CWE-639
Published: 2022-02-21T00:00:21Z

url-parse prior to version 1.5.8 is vulnerable to Authorization Bypass Through User-Controlled Key.
Vulnerability: GHSA-frcq-4ffq-v4mw
Summary: Directory Traversal in lessindex
Aliases: CVE-2017-16211
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:12:07Z

Affected versions of `lessindex` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-4vvp-x9h2-x2vf
Summary: Path Traversal in public
Severity: MODERATE
CWE: CWE-22
Published: 2020-09-03T20:26:39Z

All versions of `public` are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.


## Recommendation

No fix is currently available. Do not use `public` in production or consider using an alternative module until a fix is made available.
Vulnerability: GHSA-9m4x-8w29-r78g
Summary: Server-Side Request Forgery in @uppy/companion
Aliases: CVE-2020-8205
Severity: MODERATE
CWE: CWE-918
Published: 2020-08-13T18:54:19Z

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.
Vulnerability: GHSA-hm82-qr45-h7mw
Summary: Improperly Controlled Modification of Dynamically-Determined Object Attributes in field
Aliases: CVE-2020-28269
Severity: CRITICAL
CWE: CWE-915
Published: 2021-12-10T17:22:58Z

Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-4g46-5grc-wq49
Summary: Cross-Site Scripting in seeftl
Aliases: CVE-2019-15603
Severity: HIGH
CWE: CWE-79
Published: 2020-04-01T16:36:31Z

All versions of `seeftl` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-f78f-353m-cf4j
Summary: Code Injection in node-rules
Aliases: CVE-2020-7609
Severity: CRITICAL
CWE: CWE-94
Published: 2021-12-10T20:05:37Z

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON()" can be controlled by users without any sanitization.
Vulnerability: GHSA-5379-r78w-42h2
Summary: Unlimited transforms allowed for signed nodes
Aliases: CVE-2021-39171
Severity: MODERATE
CWE: CWE-400
Published: 2021-08-30T16:11:57Z

### Impact
A malicious SAML payload can require transforms that consume significant system resources to process, thereby resulting in reduced or denied service. This would be an effective way to perform a denial-of-service attack.

### Patches
This has been resolved in version 3.1.0. The resolution is to limit the number of allowable transforms to 2.

### References
https://github.com/node-saml/passport-saml/pull/595
Vulnerability: GHSA-hpcf-8vf9-q4gj
Summary: XSS in dialog closeText in jquery-ui
Aliases: CVE-2016-7103
Severity: HIGH
CWE: CWE-79
Published: 2017-10-24T18:33:35Z

Affected versions of `jquery-ui` are vulnerable to a cross-site scripting vulnerability when arbitrary user input is supplied as the value of the `closeText` parameter in the `dialog` function. 

jQuery-UI is a library for manipulating UI elements via jQuery.

Version 1.11.4 has a cross site scripting (XSS) vulnerability in the `closeText` parameter of the `dialog`  function.  If your application passes user input to this parameter, it may be vulnerable to XSS via this attack vector.


## Recommendation

Upgrade to jQuery-UI 1.12.0 or later.
Vulnerability: GHSA-q24h-5rq3-63j9
Summary: Incorrect Authorization in @uppy/companion
Aliases: CVE-2022-0528
Severity: HIGH
CWE: CWE-863, CWE-200
Published: 2022-03-04T00:00:19Z

@uppy/companion prior to version 3.3.1 is vulnerable to incorrect authorization. A user with URL upload access could enumerate internal companion server networks, send local webservers files to the destination server, and finally download them If each of these files had a guessable and regular name.
Vulnerability: GHSA-hxm2-r34f-qmc5
Summary: Regular Expression Denial of Service in minimatch
Aliases: CVE-2016-10540
Severity: HIGH
CWE: CWE-400
Published: 2018-10-09T00:40:41Z

Affected versions of `minimatch` are vulnerable to regular expression denial of service attacks when user input is passed into the `pattern` argument of `minimatch(path, pattern)`.


## Proof of Concept
```
var minimatch = require(“minimatch”);

// utility function for generating long strings
var genstr = function (len, chr) {
  var result = “”;
  for (i=0; i<=len; i++) {
    result = result + chr;
  }
  return result;
}

var exploit = “[!” + genstr(1000000, “\\”) + “A”;

// minimatch exploit.
console.log(“starting minimatch”);
minimatch(“foo”, exploit);
console.log(“finishing minimatch”);
```


## Recommendation

Update to version 3.0.2 or later.
Vulnerability: GHSA-m93v-9qjc-3g79
Summary: Context isolation bypass via leaked cross-context objects in Electron
Aliases: CVE-2020-4076
Severity: HIGH
CWE: CWE-501
Published: 2020-07-07T00:01:07Z

### Impact
Apps using `contextIsolation` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### Non-Impacted Versions
* `9.0.0-beta.*`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-wv26-rj8c-4r33
Summary: Moderate severity vulnerability that affects auth0-js
Aliases: CVE-2018-6874
Severity: HIGH
CWE: CWE-352
Published: 2018-11-06T23:15:13Z

CSRF exists in the Auth0 authentication service through 14591 if the Legacy Lock API flag is enabled.
Vulnerability: GHSA-8w65-xjc5-9w79
Summary: Cross-Site Scripting in node-red
Aliases: CVE-2019-15607
Severity: MODERATE
CWE: CWE-79
Published: 2020-01-30T21:00:21Z

Versions of `node-red` prior to 0.20.8are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new Flows, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 0.18.6 or later.
Vulnerability: GHSA-vh95-rmgr-6w4m
Summary: Prototype Pollution in minimist
Aliases: CVE-2020-7598
Severity: MODERATE
CWE: CWE-1321
Published: 2020-04-03T21:48:32Z

Affected versions of `minimist` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  
Parsing the argument `--__proto__.y=Polluted` adds a `y` property with value `Polluted` to all objects. The argument `--__proto__=Polluted` raises and uncaught error and crashes the application.  
This is exploitable if attackers have control over the arguments being passed to `minimist`.



## Recommendation

Upgrade to versions 0.2.1, 1.2.3 or later.
Vulnerability: GHSA-h698-r4hm-w94p
Summary: Validation Bypass in paypal-ipn
Aliases: CVE-2014-10067
Severity: MODERATE
CWE: CWE-287
Published: 2020-08-31T22:54:56Z

Versions 2.x.x and earlier of `paypal-ipn` are affected by a validation bypass vulnerability. 

paypal-ipn uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox.

A motivated attacker could craft a request string using the simulator to fool the application into entering the sandbox mode, potentially allowing purchases without valid payment.


## Recommendation

Upgrade to version 3.0.0 or later.
Vulnerability: GHSA-j67m-jg9p-ppg4
Summary: Malicious Package in ns-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:18:05Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-2gjg-5x33-mmp2
Summary: Path Traversal in localhost-now
Aliases: CVE-2018-3729
Severity: HIGH
CWE: CWE-22
Published: 2018-07-25T22:44:05Z

Versions of `localhost-now` before 1.0.2 are vulnerable to path traversal. This allows a remote attacker to read the content of an arbitrary file.


## Recommendation

Update to version 1.0.2 or later.
Vulnerability: GHSA-x5pg-88wf-qq4p
Summary: Regular Expression Denial of Service in marked
Aliases: CVE-2017-16114
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:10:52Z

Affected versions of `marked` are vulnerable to a regular expression denial of service. 

The amplification in this vulnerability is significant, with 1,000 characters resulting in the event loop being blocked for around 6 seconds.


## Recommendation

Update to version 0.3.9 or later.
Vulnerability: GHSA-m69q-pmxg-vqch
Summary: Directory Traversal in cypserver
Aliases: CVE-2017-16191
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:26:00Z

Affected versions of `cypserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-7xf6-cpxm-5mx9
Summary: Malicious Package in bufner-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:27:18Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-jh2m-j8pp-55rc
Summary: Prototype Pollution in gedi
Aliases: CVE-2020-7727
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:12:47Z

All versions of package gedi up to and including version 1.6.3 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-c36v-fmgq-m8hx
Summary: Prototype Pollution in immer
Aliases: CVE-2021-3757
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2021-09-07T22:57:14Z

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Vulnerability: GHSA-vwhc-pww7-72x6
Summary: Code Injection in total.js
Aliases: CVE-2021-32831
Severity: HIGH
CWE: CWE-94
Published: 2021-09-01T18:24:05Z

Total.js framework (npm package total.js) is a framework for Node.js platfrom written in pure JavaScript similar to PHP's Laravel or Python's Django or ASP.NET MVC. In total.js framework before version 3.4.9, calling the utils.set function with user-controlled values leads to code-injection. This can cause a variety of impacts that include arbitrary code execution. This is fixed in version 3.4.9.
Vulnerability: GHSA-7xfp-9c55-5vqj
Summary: Remote Memory Exposure in request
Aliases: CVE-2017-16026
Severity: MODERATE
CWE: CWE-201
Published: 2018-11-09T17:44:01Z

Affected versions of `request` will disclose local system memory to remote systems in certain circumstances. When a multipart request is made, and the type of `body` is `number`, then a buffer of that size will be allocated and sent to the remote server as the body.

## Proof of Concept

```
var request = require('request');
var http = require('http');

var serveFunction = function (req, res){
	req.on('data', function (data) {
            console.log(data)
        });
	res.end();
};
var server = http.createServer(serveFunction);
server.listen(8000);

request({
	method: "POST",
	uri: 'http://localhost:8000',
	multipart: [{body:500}]
},function(err,res,body){});
```


## Recommendation

Update to version 2.68.0 or later
Vulnerability: GHSA-m6w8-fq7v-ph4m
Summary: GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
Severity: MODERATE
Published: 2022-01-13T16:09:36Z

### Impact

The `GovernorCompatibilityBravo` module may lead to the creation of governance proposals that execute function calls with incorrect arguments due to bad ABI encoding. This happens if the proposal is created using explicit function signatures, e.g. a proposal to invoke the function `foo(uint256)` is created as `propose([target], [0], ["foo(uint256)"], ["0x00..01"])`. If the function selector is provided as part of the encoded proposal data the issue is not present, e.g. the same proposal is created as `propose([target], [0], ["0x2fbebd3800..01"])`, where `2fbebd38` is the function selector.

We've assessed the instances of this contract found on chain, and did not find any occurrence of this bug in the past. Proposal creation through Tally or OpenZeppelin Defender is not affected. The core `Governor` contract on its own is not affected.

### Patches

A fix is included in version v4.4.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Do not create proposals using explicit function signatures. Instead, use the `propose` function without the `signatures` argument, and create the proposal using the fully ABI-encoded function call including the function selector in the `calldatas` argument as explained above.

### References

https://github.com/OpenZeppelin/openzeppelin-contracts/issues/3099

### Credits

This issue was identified and reported by @GeraldHost.

### For more information

If you have any questions, comments, or need assistance regarding this advisory, email us at security@openzeppelin.com.

To submit security reports please use [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).
Vulnerability: GHSA-vcg5-9xw6-r56c
Summary: Malicious Package in logsymbles
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:40:49Z

Version 2.2.0 of `logsymbles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fc42-h7q4-qp8h
Summary: Command Injection in killport
Aliases: CVE-2021-23360
Severity: HIGH
CWE: CWE-77
Published: 2021-04-13T15:16:20Z

This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success.
Vulnerability: GHSA-v3jv-wrf4-5845
Summary: Local Privilege Escalation in npm
Aliases: CVE-2013-4116
Severity: LOW
CWE: CWE-59
Published: 2020-09-01T16:03:34Z

Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation.



## Recommendation

Update to version 1.3.3 or later.
Vulnerability: GHSA-5pg7-v24c-9rp9
Summary: Prototype pollution in controlled-merge
Aliases: CVE-2020-28268
Severity: HIGH
CWE: CWE-1321
Published: 2021-05-18T01:53:46Z

Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-hq8g-qq57-5275
Summary: SQL Injection in untitled-model
Severity: HIGH
CWE: CWE-89
Published: 2020-09-11T21:24:33Z

All versions of `untitled-model` re vulnerable to SQL Injection. Query parameters are not properly sanitized allowing attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-mq7g-6rv4-pj95
Summary: Downloads Resources over HTTP in embedza
Aliases: CVE-2016-10569
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:35:23Z

Affected versions of `embedza` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `embedza`.


## Recommendation

Update to version 1.2.4 or later.
Vulnerability: GHSA-crr2-ph72-c52g
Summary: Malicious Package in my-very-own-package
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:27:22Z

All versions of `my-very-own-package` contain malicious code. The package sends the output of `process.versions`, `process.arch` and `process.platform` to a remote server in a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.
Vulnerability: GHSA-277p-xwpp-3jf7
Summary: Malicious Package in rrgod
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T15:49:22Z

All versions of `rrgod` are considered malicious. The package is malware designed to run arbitrary scripts. When installed, the package downloads an arbitrary file and executes its contents as a pre, post and install scripts.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.
Vulnerability: GHSA-74hh-4rcv-pp27
Summary: Malicious Package in bitconijs-lib
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:44:19Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-q52j-4q2q-hcj6
Summary: Authentication Bypass in console-io
Aliases: CVE-2016-10532
Severity: CRITICAL
CWE: CWE-287
Published: 2019-02-18T23:39:39Z

Affected versions of the `console-io` package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As `console-io` allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution.



## Recommendation

Update to version 2.3.0 or later.
Vulnerability: GHSA-52qp-gwwh-qrg4
Summary: Missing Handler in @scandipwa/magento-scripts
Aliases: CVE-2021-32684
Severity: MODERATE
CWE: CWE-670
Published: 2021-06-21T17:10:02Z

### Impact
After changing the function from synchronous to asynchronous there wasn't implemented handler in the [start](https://docs.create-magento-app.com/getting-started/available-commands/start), [stop](https://docs.create-magento-app.com/getting-started/available-commands/stop), [exec](https://docs.create-magento-app.com/getting-started/available-commands/exec) and [logs](https://docs.create-magento-app.com/getting-started/available-commands/logs) commands, effectively making them unusable.

### Patches
[Version 1.5.3](https://github.com/scandipwa/create-magento-app/releases/tag/%40scandipwa%2Fmagento-scripts%401.5.3) contains patches for the problems described above.

### Workarounds
Upgrade to patched or latest (recommended) version `npm i @scandipwa/magento-scripts@1.5.3` or `npm i @scandipwa/magento-scripts@latest`.

### References
New releases always available here: https://github.com/scandipwa/create-magento-app/releases

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [create-magento-app](https://github.com/scandipwa/create-magento-app/issues)
Vulnerability: GHSA-j6w4-pg6p-5mrv
Summary: Directory Traversal in tmock
Aliases: CVE-2017-16106
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T23:51:04Z

`tmock` is a static file server.

`tmock` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Example Request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host: localhost
```
 and server Response:
```
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6584-gfwm-3vc3
Summary: Malicious Package in budfer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:43:01Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-g4xp-36c3-f7mr
Summary: Hidden Directories Always Served in inert
Aliases: CVE-2014-10068
Severity: MODERATE
CWE: CWE-22
Published: 2020-08-31T22:47:41Z

Versions 1.1.1 and earlier of `inert` are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.

The inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false.


## Recommendation

Update to version >= 1.1.1.
Vulnerability: GHSA-mpjm-v997-c4h4
Summary: Sandboxed renderers can obtain thumbnails of arbitrary files through the nativeImage API
Aliases: CVE-2021-39184
Severity: MODERATE
CWE: CWE-668
Published: 2021-10-12T21:59:13Z

### Impact
This vulnerability allows a sandboxed renderer to request a "thumbnail" image of an arbitrary file on the user's system. The thumbnail can potentially include significant parts of the original file, including textual data in many cases.

All current stable versions of Electron are affected.

### Patches
This was fixed with #30728, and the following Electron versions contain the fix:

- 15.0.0-alpha.10
- 14.0.0
- 13.3.0
- 12.1.0
- 11.5.0

### Workarounds
If your app enables `contextIsolation`, this vulnerability is significantly more difficult for an attacker to exploit.

Further, if your app does not depend on the `createThumbnailFromPath` API, then you can simply disable the functionality. In the main process, before the 'ready' event:
```js
delete require('electron').nativeImage.createThumbnailFromPath
```

### For more information
If you have any questions or comments about this advisory, email us at [security@electronjs.org](mailto:security@electronjs.org).
Vulnerability: GHSA-c6pw-q7f2-97hv
Summary: Privilege Escalation in cordova-plugin-inappbrowser
Aliases: CVE-2019-0219
Severity: CRITICAL
CWE: CWE-79
Published: 2020-09-04T17:57:43Z

Versions of `cordova-plugin-inappbrowser` prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android applications using the package.


## Recommendation

Upgrade to version 3.1.0 or later.
Vulnerability: GHSA-pc5p-h8pf-mvwp
Summary: Machine-In-The-Middle in https-proxy-agent
Severity: MODERATE
CWE: CWE-300
Published: 2020-04-16T03:14:56Z

Versions of `https-proxy-agent` prior to 2.2.3 are vulnerable to Machine-In-The-Middle. The package fails to enforce TLS on the socket if the proxy server responds the to the request with a HTTP status different than 200. This allows an attacker with access to the proxy server to intercept unencrypted communications, which may include sensitive information such as credentials.


## Recommendation

Upgrade to version 3.0.0 or 2.2.3.