TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-9qrh-qjmc-5w2p
Summary: Denial-of-Service when binding invalid parameters in sqlite3
Aliases: CVE-2022-21227
Severity: HIGH
CWE: CWE-248
Published: 2022-04-28T20:25:23Z

Affected versions of sqlite3 will experience a fatal error when supplying a specific object in the parameter array. This error causes the application to crash and could not be caught. Users of `sqlite3` v5.0.0, v5.0.1 and v5.0.2 are affected by this. This issue is fixed in v5.0.3. All users are recommended to upgrade to v5.0.3 or later. Ensure there is sufficient sanitization in the parent application to protect against invalid values being supplied to binding parameters as a workaround.
Vulnerability: GHSA-wqh4-27cc-j8f2
Summary: Hijacked Environment Variables in nodeffmpeg
Aliases: CVE-2017-16069
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-29T23:36:48Z

The `nodeffmpeg` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-7fm6-gxqg-2pwr
Summary: Code Injection in total.js
Aliases: CVE-2021-23389
Severity: CRITICAL
CWE: CWE-94
Published: 2021-12-10T17:26:06Z

The package total.js before 3.4.9 are vulnerable to Arbitrary Code Execution via the U.set() and U.get() functions.
Vulnerability: GHSA-qpqh-46qj-vwcw
Summary: Cross-site Scripting in docsify
Aliases: CVE-2020-7680
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-18T01:53:18Z

docsify prior to 4.11.4 is susceptible to Cross-site Scripting (XSS). Docsify.js uses fragment identifiers (parameters after # sign) to load resources from server-side .md files. Due to lack of validation here, it is possible to provide external URLs after the /#/ (domain.com/#//attacker.com) and render arbitrary JavaScript/HTML inside docsify page.
Vulnerability: GHSA-v7x3-7hw7-pcjg
Summary: Moderate severity vulnerability that affects renovate
Severity: MODERATE
CWE: CWE-200
Published: 2019-10-21T16:02:33Z

## Go Modules Vulnerability Disclosure

### Impact

Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.

### Patches

The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.

### Workarounds

Disable Go Modules support.

### References

Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Renovate](http://github.com/renovatebot/renovate)
* Email us at [support@renovatebot.com](mailto:support@renovatebot.com)
Vulnerability: GHSA-9c2p-jw8p-f84v
Summary: SQL Injection in sequelize
Aliases: CVE-2016-10556
Severity: CRITICAL
CWE: CWE-89
Published: 2019-02-18T23:54:24Z

Affected versions of `sequelize` cast arrays to strings and fail to properly escape the resulting SQL statement, resulting in a SQL injection vulnerability.


## Proof of Concept
In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped.

Example Query:
```
database.query('SELECT * FROM TestTable WHERE Name IN (:names)', {
  replacements: {
    names: directCopyOfUserInput
  }
});
```

If the user inputs the value of `:names` as:
```
["test", "'); DELETE TestTable WHERE Id = 1 --')"]
```

The resulting SQL statement will be:
```
SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')
```
As the backslash has no special meaning in PostgreSQL, MSSQL, or SQLite, the statement will delete the record in TestTable with an Id of 1.


## Recommendation

Update to version 3.20.0 or later.
Vulnerability: GHSA-h5mp-5q4p-ggf5
Summary: Prototype Pollution in lodash.defaultsdeep
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T18:07:05Z

Versions of `lodash.defaultsdeep` before 4.6.1 are vulnerable to prototype pollution. The function `mergeWith` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.
Vulnerability: GHSA-776r-w3v9-96mv
Summary: Directory Traversal in censorify.tanisjr
Aliases: CVE-2017-16157
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:46:16Z

Affected versions of `censorify.tanisjr` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-29fh-xcjr-p7rx
Summary: Malicious Package in web3-eht
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:02:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-c3m8-x3cg-qm2c
Summary: Configuration Override in helmet-csp
Severity: MODERATE
Published: 2020-09-03T20:39:53Z

Versions of `helmet-csp` before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the `default-src` CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.


## Recommendation

Upgrade to version 2.9.1 or later. Setting the `browserSniff` configuration to `false` in vulnerable versions also mitigates the issue.
Vulnerability: GHSA-m94c-37g6-cjhc
Summary: Fake objects feature vulnerability allowing to execute JavaScript code using malformed HTML.
Aliases: CVE-2021-37695
Severity: HIGH
CWE: CWE-79
Published: 2021-08-23T19:42:15Z

### Affected packages
The vulnerability has been discovered in [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin. All plugins with [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) plugin dependency are affected:

* [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects)
* [Link](https://ckeditor.com/cke4/addon/link)
* [Flash](https://ckeditor.com/cke4/addon/flash)
* [Iframe](https://ckeditor.com/cke4/addon/iframe)
* [Forms](https://ckeditor.com/cke4/addon/forms)
* [Page Break](https://ckeditor.com/cke4/addon/pagebreak)

### Impact
A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2.

### Patches
The problem has been recognized and patched. The fix will be available in version 4.16.2.

### For more information
Email us at security@cksource.com if you have any questions or comments about this advisory.

### Acknowledgements
The CKEditor 4 team would like to thank Mika Kulmala ([kulmik](https://github.com/kulmik)) for recognizing and reporting this vulnerability.
Vulnerability: GHSA-7f63-h6g3-7cwm
Summary: Cross Site Scripting (XSS) in @finastra/ssr-pages
Aliases: CVE-2022-24717
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-01T22:09:25Z

A cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function.

### References
- https://github.com/Finastra/ssr-pages/pull/2
- https://github.com/Finastra/ssr-pages/pull/2/commits/133606ffaec2edd9918d9fba5771ed21da7876a5
- https://github.com/Finastra/ssr-pages/commit/98abc59e28fec48246be0d59ac144675d6361073
Vulnerability: GHSA-v588-qcp3-jv46
Summary: Path Traversal in serve
Aliases: CVE-2019-5415
Severity: HIGH
CWE: CWE-548
Published: 2019-03-25T18:03:58Z

Versions of `serve` prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a `/./`, which allows attackers to access hidden folders and files.


## Recommendation

Upgrade to version 7.0.1 or later.
Vulnerability: GHSA-4x6v-rwh4-55jw
Summary: Pomelo allows external control of critical state data
Aliases: CVE-2019-18954
Severity: MODERATE
CWE: CWE-668
Published: 2019-12-02T18:16:34Z

Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious attacker can manipulate internal attributes by adding additional attributes to user input.
Vulnerability: GHSA-3hq6-rmv7-39vh
Summary: Injection in op-browser
Aliases: CVE-2020-7625
Severity: CRITICAL
CWE: CWE-78
Published: 2022-02-10T23:45:28Z

op-browser through 1.0.9 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.
Vulnerability: GHSA-qv2g-99x4-45x6
Summary: Malicious npm package: discord-fix
Severity: CRITICAL
CWE: CWE-506
Published: 2021-01-29T18:12:07Z

The npm `discord-fix` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-x56r-5r34-qg74
Summary: Downloads Resources over HTTP in dalek-browser-ie-canary
Aliases: CVE-2016-10612
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:47Z

Affected versions of `dalek-browser-ie-canary` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-ie-canary`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-hf66-r44g-p7j9
Summary: Inefficient Regular Expression Complexity in handsontable
Aliases: CVE-2021-23446
Severity: HIGH
CWE: CWE-1333
Published: 2021-09-30T17:10:46Z

The package handsontable before 10.0.0; the package handsontable from 0 and before 10.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) in Handsontable.helper.isNumeric function.
Vulnerability: GHSA-j38m-7q52-fgfh
Summary: Directory Traversal in node-server-forfront
Aliases: CVE-2017-16124
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T23:33:42Z

Affected versions of `node-server-forfront` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-94x5-94wf-m445
Summary: Directory Traversal in gomeplus-h5-proxy
Aliases: CVE-2017-16037
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T15:48:38Z

Affected versions of `gomeplus-h5-proxy` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-rh7p-9c79-gpp8
Summary: Downloads Resources over HTTP in wasdk
Aliases: CVE-2016-10587
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:34:44Z

Affected versions of `wasdk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `wasdk`.


## Recommendation

No fix is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit it are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-m639-9whg-fw97
Summary: Prototype Pollution in object-extend
Aliases: CVE-2021-23702
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-02-19T00:01:25Z

The package object-extend from 0.0.0 through 0.5.0 is vulnerable to Prototype Pollution via object-extend.
Vulnerability: GHSA-j9pj-hx76-92v6
Summary: Server-Side Request Forgery in phantomjs-seo
Aliases: CVE-2020-7739
Severity: HIGH
CWE: CWE-918, CWE-20
Published: 2021-05-10T18:38:21Z

This affects all versions of package phantomjs-seo. It is possible for an attacker to craft a url that will be passed to a PhantomJS instance allowing for an SSRF attack.
Vulnerability: GHSA-r2j6-p67h-q639
Summary: Secret disclosure when containing characters that become URI encoded
Aliases: CVE-2020-26226
Severity: HIGH
CWE: CWE-116
Published: 2020-11-18T21:19:14Z

### Impact

Secrets that would normally be masked by `semantic-release` can be accidentally disclosed if they contain characters that become encoded when included in a URL.

### Patches

Fixed in v17.2.3

### Workarounds

Secrets that do not contain characters that become encoded when included in a URL are already masked properly.
Vulnerability: GHSA-92xj-mqp7-vmcj
Summary: Prototype Pollution in node-forge
Aliases: CVE-2020-7720
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2020-09-14T21:42:09Z

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Vulnerability: GHSA-675m-85rw-j3w4
Summary: Prototype Pollution in just-extend
Aliases: CVE-2018-16489
Severity: MODERATE
CWE: CWE-400
Published: 2019-02-07T18:17:12Z

Versions of `just-extend` before 4.0.0 are vulnerable to prototype pollution. Provided certain input `just-extend` can add or modify properties of the `Object` prototype. These properties will be present on all objects.


## Recommendation

Update to version `4.0.0` or later.
Vulnerability: GHSA-vwjc-q9px-r9vq
Summary: Denial of Service in ecstatic
Aliases: CVE-2015-9242
Severity: HIGH
CWE: CWE-400
Published: 2018-06-07T19:43:11Z

Versions of `ecstatic` prior to 1.4.0 are affected by a denial of service vulnerability when certain input strings are sent via the `Last-Modified` or `If-Modified-Since` headers.

Parsing certain inputs with `new Date()` or `Date.parse()` cases v8 to crash. As ecstatic passes the value of the affected headers into one of these functions, sending certain inputs via one of the headers will cause the server to crash.



## Recommendation

Update to version 1.4.0 or later.
Vulnerability: GHSA-j7qv-pgf6-hvh4
Summary: XSS in `*Text` options of the Datepicker widget in jquery-ui
Aliases: CVE-2021-41183
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-26T14:55:21Z

### Impact
Accepting the value of various `*Text` options of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
```js
$( "#datepicker" ).datepicker( {
	showButtonPanel: true,
	showOn: "both",
	closeText: "<script>doEvilThing( 'closeText XSS' )</script>",
	currentText: "<script>doEvilThing( 'currentText XSS' )</script>",
	prevText: "<script>doEvilThing( 'prevText XSS' )</script>",
	nextText: "<script>doEvilThing( 'nextText XSS' )</script>",
	buttonText: "<script>doEvilThing( 'buttonText XSS' )</script>",
	appendText: "<script>doEvilThing( 'appendText XSS' )</script>",
} );
```
will call `doEvilThing` with 6 different parameters coming from all `*Text` options.

### Patches
The issue is fixed in jQuery UI 1.13.0. The values passed to various `*Text` options are now always treated as pure text, not HTML.

### Workarounds
A workaround is to not accept the value of the `*Text` options from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-4rq4-32rv-6wp6
Summary: Improper Privilege Management in shelljs
Aliases: CVE-2022-0144
Severity: HIGH
CWE: CWE-269
Published: 2022-01-21T23:37:28Z

shelljs is vulnerable to Improper Privilege Management
Vulnerability: GHSA-mj87-8xf8-fp4w
Summary: Cross-Site Scripting in yui
Aliases: CVE-2013-4939
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-01T16:42:51Z

Affected versions of `yui` are vulnerable to cross-site scripting in the `uploader.swf` and `io.swf` utilities, via script injection in the url.



## Recommendation

YUI has published their recommendation to fix this issue. 
Their recommendation is to:
 - Delete self-hosted copies of these files if you are not using them
 - Use the Yahoo! CDN hosted files
 - Use the patched files provided on the YUI Library [here](https://yuilibrary.com/support/20130515-vulnerability/#resolution).
Vulnerability: GHSA-jpjp-vxv6-59hm
Summary: Directory Traversal in open-device
Aliases: CVE-2017-16187
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:41:11Z

Affected versions of `open-device` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cch6-5x4h-6qc5
Summary: Directory Traversal in tiny-http
Aliases: CVE-2017-16097
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T16:46:04Z

Affected versions of `tiny-http` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-mpww-j7xj-cj35
Summary: Downloads Resources over HTTP in native-opencv
Aliases: CVE-2016-10658
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:45:07Z

Affected versions of `native-opencv` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `native-opencv`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-cmj2-m9m2-6726
Summary: Downloads Resources over HTTP in grunt-ccompiler
Aliases: CVE-2016-10636
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:11Z

Affected versions of `grunt-ccompiler` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `grunt-ccompiler`.


## Recommendation

No patch is currently available for this vulnerability, and the repository has been deleted from the owner's github account.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-6494-v9fq-fgq2
Summary: Keystone is vulnerable to CSV injection
Aliases: CVE-2017-15879
Severity: HIGH
CWE: CWE-20
Published: 2017-11-16T01:46:50Z

CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.
Vulnerability: GHSA-wv83-jrfh-rp33
Summary: Cross site scripting in kindeditor
Aliases: CVE-2021-42227
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-18T19:44:32Z

Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).
Vulnerability: GHSA-7xc4-793x-25jp
Summary: Malicious Package in bpi66
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:48:38Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-78cj-fxph-m83p
Summary: Regular Expression Denial of Service (ReDoS) in ua-parser-js
Aliases: CVE-2021-27292
Severity: HIGH
CWE: CWE-400
Published: 2021-05-06T16:11:13Z

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Vulnerability: GHSA-4jwp-vfvf-657p
Summary: Deserialization of Untrusted Data in bson
Aliases: CVE-2019-2391
Severity: MODERATE
CWE: CWE-502
Published: 2022-02-10T23:30:20Z

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure.
Vulnerability: GHSA-p5ch-w78f-xh44
Summary: Cross-site scripting in @atlaskit/editor-core
Aliases: CVE-2019-20903
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T20:34:24Z

The hyperlinks functionality in atlaskit/editor-core in before version 113.1.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability in link targets.
Vulnerability: GHSA-rp28-29ch-gh92
Summary: Directory Traversal in elding
Aliases: CVE-2017-16222
Severity: MODERATE
CWE: CWE-22
Published: 2018-08-06T21:30:15Z

Affected versions of `elding` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

This vulnerability only affects files that have file extensions - i.e. `/etc/passwd` will be treated as a directory, and a read attempt on `/etc/passwd/index.js` will be made and subsequently fail. 

Example request:
```
GET /../../../../../../../../../../some_app_dir/secrets.json HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-68cm-mgv7-vg5c
Summary: Directory Traversal in utahcityfinder
Aliases: CVE-2017-16173
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:45:11Z

Affected versions of `utahcityfinder` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-6jg8-7333-554w
Summary: Sandbox Breakout in realms-shim
Severity: CRITICAL
Published: 2019-10-04T17:56:12Z

Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-5m9c-634g-47vq
Summary: Downloads Resources over HTTP in steroids
Aliases: CVE-2016-10581
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:35:01Z

Affected versions of `steroids` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `steroids`.


## Recommendation

This vulnerability was discovered and reported in 2016, yet has not seen a patch issued as of 3/2018. 

The best path forward for mitigating this issue is to attempt to use an alternative module that is actively maintained and which provides similar functionality, such as the native PhoneGap API.
Vulnerability: GHSA-gjh4-fcv3-whpq
Summary: Cross-Site Scripting in webtorrent
Aliases: CVE-2019-15782
Severity: MODERATE
CWE: CWE-79
Published: 2019-09-04T10:02:50Z

Versions of `webtorrent` prior to 0.107.6 are vulnerable to Cross-Site Scripting. `webtorrent` servers started with `torrent.createServer()` lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing the malicious payload. The issue is mitigated due to the fact that the server only allows fetching data pieces from the torrent.


## Recommendation

Upgrade to version 0.107.6 or later.
Vulnerability: GHSA-rwvj-jgc4-fqq5
Summary: Downloads Resources over HTTP in cobalt-cli
Aliases: CVE-2016-10597
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:34:05Z

Affected versions of `cobalt-cli` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cobalt-cli`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-qrpm-p2h7-hrv2
Summary: Exposure of Sensitive Information to an Unauthorized Actor in nanoid
Aliases: CVE-2021-23566
Severity: MODERATE
CWE: CWE-200
Published: 2022-01-21T23:57:06Z

The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Vulnerability: GHSA-44c6-4v22-4mhx
Summary: Regular Expression Denial of Service (ReDOS)
Aliases: CVE-2021-3795
Severity: MODERATE
CWE: CWE-400
Published: 2021-09-20T20:42:25Z

npm `semver-regex` is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-mh5c-679w-hh4r
Summary: Denial of Service in mongodb
Severity: HIGH
Published: 2020-09-03T21:12:01Z

Versions of `mongodb` prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.


## Recommendation

Upgrade to version 3.1.13 or later.
Vulnerability: GHSA-wc9v-mj63-m9g5
Summary: Remote Code Execution in pg
Aliases: CVE-2017-16082
Severity: HIGH
CWE: CWE-94
Published: 2018-07-24T19:44:42Z

Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. 

There are two specific scenarios in which it is likely for an application to be vulnerable:
1. The application executes unsafe, user-supplied sql which contains malicious column names.
2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.

## Proof of Concept
```
const { Client } = require('pg')
const client = new Client()
client.connect()

const sql = `SELECT 1 AS "\\'/*", 2 AS "\\'*/\n + console.log(process.env)] = null;\n//"`

client.query(sql, (err, res) => {
  client.end()
})
```


## Recommendation

* Version 2.x.x: Update to version 2.11.2 or later.
* Version 3.x.x: Update to version 3.6.4 or later.
* Version 4.x.x: Update to version 4.5.7 or later.
* Version 5.x.x: Update to version 5.2.1 or later.
* Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )
* Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )
Vulnerability: GHSA-53xv-c2hx-5w6q
Summary: Command Injection in node-windows
Aliases: CVE-2021-45459
Severity: CRITICAL
CWE: CWE-77
Published: 2022-01-05T20:39:21Z

lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.
Vulnerability: GHSA-c9rj-pgxv-84jc
Summary: Exfiltrates data on installation in cofee-script
Aliases: CVE-2017-16206
Severity: HIGH
CWE: CWE-200
Published: 2018-08-06T20:12:46Z

The `cofee-script` package is a piece of malware that steals sensitive data such as a user's private SSH key and bash history, sending them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

If you have found `cofee-script` installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your SSH keys, registry credentials, tokens, and any other sensitive credentials that may have been present in your bash history.

Additionally, any service which may have been exposed via credentials in your bash history or accessible via your ssh keys, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-8gf4-pcj6-54rp
Summary: Downloads Resources over HTTP in strider-sauce
Aliases: CVE-2016-10611
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:53Z

Affected versions of `strider-sauce` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `strider-sauce`.



## Recommendation

While the package author has created a patch for this vulnerability, they have not yet published it to npm or bumped the version number.

In order to resolve the vulnerability, you will need to install the module manually from github:
```
npm install github:Strider-CD/strider-sauce#5ff6d65
```

As this vulnerability does not have a version bump included with the patch, it is possible that you have received a report for a vulnerable package, yet have installed the patched version and are no longer vulnerable. If that is the case, this advisory can be disregarded.
Vulnerability: GHSA-f3pp-32qc-36w4
Summary: Prototype Pollution in jointjs
Aliases: CVE-2021-23444
Severity: MODERATE
CWE: CWE-843, CWE-1321
Published: 2021-09-22T20:36:34Z

This affects the package jointjs before 3.4.2. A type confusion vulnerability can lead to a bypass of CVE-2020-28480 when the user-provided keys used in the path parameter are arrays in the setByPath function.
Vulnerability: GHSA-69rr-wvh9-6c4q
Summary: Directory Traversal in st
Aliases: CVE-2014-3744
Severity: HIGH
CWE: CWE-22
Published: 2020-08-31T22:58:04Z

Versions of `st` prior to 0.2.5 are affected by a directory traversal vulnerability. Vulnerable versions fail to properly handle URL encoded dots, which caused `%2e` to be interpreted as `.` by the filesystem, resulting the potential for an attacker to read sensitive files on the server.


## Recommendation

Update to version 0.2.5 or later.
Vulnerability: GHSA-2mvq-xp48-4c77
Summary: Denial of Service in subtext
Severity: HIGH
CWE: CWE-400
Published: 2020-09-03T20:35:29Z

All versions of `subtext` are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

This package is not actively maintained and has been moved to `@hapi/subtext` where version 6.1.2.
Vulnerability: GHSA-hpw4-m59j-9p52
Summary: Directory Traversal in dylmomo
Aliases: CVE-2017-16163
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:29:13Z

Affected versions of `dylmomo` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-j9cf-pr2x-5273
Summary: Prototype Pollution in dot-object
Aliases: CVE-2019-10793
Severity: MODERATE
CWE: CWE-74
Published: 2022-02-09T22:33:31Z

dot-object before 2.1.3 is vulnerable to Prototype Pollution. The set function could be tricked into adding or modifying properties of Object.prototype using a __proto__ payload.
Vulnerability: GHSA-5x5w-v4xq-p64r
Summary: Directory Traversal in ewgaddis.lab6
Aliases: CVE-2017-16175
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:44:52Z

Affected versions of `ewgaddis.lab6` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-8hw9-22v6-9jr9
Summary: Any logged in user could edit any other logged in user.
Aliases: CVE-2021-29452
Severity: HIGH
CWE: CWE-269
Published: 2021-04-19T15:14:33Z

### Impact
Everyone who is running a12n-server. 

A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change.

### Patches
Patched in v0.18.2
Vulnerability: GHSA-vc6r-4x6g-mmqc
Summary: Path Traversal in m-server
Severity: MODERATE
CWE: CWE-22
Published: 2019-06-11T16:16:23Z

Versions of `m-server` before 1.4.2 are vulnerable to path traversal allowing a remote attacker to display content of arbitrary files from the server.


## Recommendation

Update to version 1.4.2 or later.
Vulnerability: GHSA-wqhw-frpx-5mmp
Summary: Command Injection in tomato
Severity: HIGH
CWE: CWE-77
Published: 2020-09-02T16:01:33Z

All versions of `tomato` are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-6qh5-wx38-q92g
Summary: Directory Traversal in ltt.js
Severity: HIGH
CWE: CWE-22
Published: 2019-05-30T17:15:59Z

Affected versions of `ltt.js` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-vfp9-gwrh-wq9g
Summary: Path Traversal in crud-file-server
Aliases: CVE-2018-3733
Severity: HIGH
CWE: CWE-22
Published: 2018-07-18T21:20:19Z

Versions of `crud-file-server` prior to 0.9.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 0.9.0 or later.
Vulnerability: GHSA-r2rg-683g-ff96
Summary: Malicious Package in axios-http
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:40:12Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-v86x-f47q-f7f4
Summary: Unauthorized File Access in atompm
Severity: HIGH
CWE: CWE-200
Published: 2020-09-11T21:09:24Z

Versions of `atompm` prior to 0.8.2 are vulnerable to Unauthorized File Access. The package fails to sanitize relative paths in the URL for file downloads, allowing attackers to download arbitrary files from the system.


## Recommendation

Upgrade to version 0.8.2 or later.
Vulnerability: GHSA-3f97-rj68-2pjf
Summary: Malicious Package in buffe2-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:48:35Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-89gv-h8wf-cg8r
Summary: Hostname spoofing via backslashes in URL 
Aliases: CVE-2021-3647
Severity: MODERATE
CWE: CWE-601
Published: 2021-07-19T21:22:36Z

### Impact
If using affected versions to determine a URL's hostname, the hostname can be spoofed by using a combination of backslash (`\`) and slash (`/`) characters as part of the scheme delimiter, e.g. `scheme:/\/\/\hostname`. If the hostname is used in security decisions, the decision may be incorrect.

Depending on library usage and attacker intent, impacts may include allow/block list bypasses, SSRF attacks, open redirects, or other undesired behavior.

Example URL: `https:/\/\/\expected-example.com/path`
Escaped string: `https:/\\/\\/\\expected-example.com/path` (JavaScript strings must escape backslash)

Affected versions incorrectly return no hostname. Patched versions correctly return `expected-example.com`. Patched versions match the behavior of other parsers which implement the [WHATWG URL specification](https://url.spec.whatwg.org/), including web browsers and [Node's built-in URL class](https://nodejs.org/api/url.html).

### Patches
Version 1.19.7 is patched against all known payload variants.

### References
https://github.com/medialize/URI.js/releases/tag/v1.19.7 (fix for this particular bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.6 (fix for related bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.4 (fix for related bypass)
https://github.com/medialize/URI.js/releases/tag/v1.19.3 (fix for related bypass)
[PR #233](https://github.com/medialize/URI.js/pull/233) (initial fix for backslash handling)

### For more information
If you have any questions or comments about this advisory, open an issue in https://github.com/medialize/URI.js

### Reporter credit
[ready-research](https://github.com/ready-research) via https://huntr.dev/
Vulnerability: GHSA-pmgv-94f5-6w7w
Summary: Malicious Package in eact
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:21:30Z

All versions of `eact` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-r578-pj6f-r4ff
Summary: Auto-merging Person Records Compromised
Aliases: CVE-2021-32691
Severity: HIGH
CWE: CWE-287, CWE-303
Published: 2021-06-21T17:07:47Z

### Impact

New user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within the app, as well as any authenticated links to Rock-based webpages (such as giving and events).

### Patches

We have released a security patch on v2.20.0. The solution was to create a duplicate person and then patch the new person with their profile details.

### Workarounds

If you do not wish to upgrade your app to the new version, you can patch your server by overriding the `create` data source method on the `People` class.

```js
  create = async (profile) => {
    const rockUpdateFields = this.mapApollosFieldsToRock(profile);
    // auto-merge functionality is compromised
    // we are creating a new user and patching them with profile details
    const id = await this.post('/People', {
      Gender: 0, // required by Rock. Listed first so it can be overridden.
      IsSystem: false, // required by rock
    });
    await this.patch(`/People/${id}`, {
      ...rockUpdateFields,
    });
    return id;
  };
```

### For more information
If you have any questions or comments about this advisory:
* Email us at [support@apollos.app](mailto:support@apollos.app)
Vulnerability: GHSA-vf8q-pw7h-r2x2
Summary: Malicious Package in epress
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:15:54Z

Version 4.13.2 of `epress` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.
Vulnerability: GHSA-mhxg-pr3j-v9gr
Summary: Malicious Package in colne
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:41:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.