TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-f3vw-587g-r29g
Summary: Path Traversal in sapper
Severity: CRITICAL
CWE: CWE-22
Published: 2020-09-03T15:50:38Z

Versions of `sapper` prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded `../`.  

You may test a `sapper` application running in prod mode with `curl -vvv http://localhost:3000/client/750af05c3a69ddc6073a/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd`.


## Recommendation

Upgrade to version 0.27.11 or later.
Vulnerability: GHSA-984p-xq9m-4rjw
Summary: Rate Limiting Bypass in express-brute
Severity: MODERATE
CWE: CWE-77
Published: 2019-06-07T21:01:53Z

All versions of `express-brute` are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-hg79-j56m-fxgv
Summary: Cross-Site Scripting in react
Severity: HIGH
CWE: CWE-79
Published: 2020-09-04T15:26:04Z

Versions of `react` prior to 0.14.0 are vulnerable to Cross-Site Scripting (XSS). The package's `createElement` function fails to properly validate its input object, allowing attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.14.0 or later.
Vulnerability: GHSA-27wq-qx3q-fxm9
Summary: Improper Handling of Unexpected Data Type in ced
Aliases: CVE-2021-39131
Severity: HIGH
CWE: CWE-241
Published: 2021-08-23T19:42:28Z

### Impact

In ced v0.1.0, passing data types other than `Buffer` causes the Node.js process to crash.

### Patches

The problem has been patched in [ced v1.0.0](https://github.com/sonicdoe/ced/releases/tag/v1.0.0). You can upgrade from v0.1.0 without any breaking changes.

### Workarounds

Before passing an argument to ced, verify it’s a `Buffer` using [`Buffer.isBuffer(obj)`](https://nodejs.org/api/buffer.html#buffer_static_method_buffer_isbuffer_obj).

### CVSS score

[CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/RL:O/RC:C)

Base Score: 7.5 (High)
Temporal Score: 7.2 (High)

Since ced is a library, the scoring is based on the “[reasonable worst-case implementation scenario](https://www.first.org/cvss/v3.1/user-guide#3-7-Scoring-Vulnerabilities-in-Software-Libraries-and-Similar)”, namely, accepting data from untrusted sources over a network and passing it directly to ced. Depending on your specific implementation, the vulnerability’s severity in your program may be different.

### Proof of concept

```js
const express = require("express");
const bodyParser = require("body-parser");
const ced = require("ced");

const app = express();

app.use(bodyParser.raw());

app.post("/", (req, res) => {
  const encoding = ced(req.body);

  res.end(encoding);
});

app.listen(3000);
```

`curl --request POST --header "Content-Type: text/plain" --data foo http://localhost:3000` crashes the server.

### References

- https://github.com/sonicdoe/ced/commit/a4d9f10b6bf1cd468d1a5b9a283cdf437f8bb7b3
Vulnerability: GHSA-rwxp-hwwf-653v
Summary: Insecure template handling in express-hbs
Aliases: CVE-2021-32817
Severity: MODERATE
CWE: CWE-200
Published: 2021-05-17T20:58:51Z

express-hbs is an Express handlebars template engine. express-hbs mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .hbs appended to them. For complete details refer to the referenced GHSL-2021-019 report. Notes in documentation have been added to help users of express-hbs avoid this potential information exposure vulnerability.
Vulnerability: GHSA-8v9x-9xqg-r8mr
Summary: Prototype pollution in json8-merge-patch
Aliases: CVE-2020-8268
Severity: HIGH
CWE: CWE-471, CWE-20, CWE-1321
Published: 2021-05-10T19:17:15Z

Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties of the global object constructor.
Vulnerability: GHSA-2j5v-fc74-j9q2
Summary: Cross-Site Scripting in editor.md
Aliases: CVE-2019-9737
Severity: MODERATE
CWE: CWE-79
Published: 2019-03-14T15:38:56Z

All versions of `editor.md` are vulnerable to Cross-Site Scripting. User input is insufficiently sanitized, allowing attackers to inject malicious code in payloads containing  base64-encoded content.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-c3px-v9c7-m734
Summary: Prototype Pollution in mithril
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T19:04:39Z

Affected versions of `mithril`are vulnerable to prototype pollution. The function `parseQueryString` may allow a malicious user to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. A payload such as `__proto__%5BtoString%5D=123` in the query string would change the `toString()` function to `123`.



## Recommendation

If you are using mithril 2.x, upgrade to version 2.0.2 or later.
If you are using mithril 1.x, upgrade to version 1.1.7 or later.
Vulnerability: GHSA-v6c5-hwqg-3x5q
Summary: Improper Authorization in passport-cognito
Aliases: CVE-2019-19723
Severity: CRITICAL
CWE: CWE-285
Published: 2020-09-04T17:23:03Z

All versions of `passport-cognito` are vulnerable to Improper Authorization. The package fails to properly scope the variables containing authorization information, such as access token, refresh token and ID token. This causes a race condition where simultaneous authenticated users may receive authorization tokens for a different user. This would allow a user to take actions on another user's behalf.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-44g9-w23c-5rw7
Summary: Directory Traversal in nhouston
Aliases: CVE-2014-8883
Severity: MODERATE
CWE: CWE-23
Published: 2020-08-31T22:53:54Z

All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.


## Recommendation

It is recommended that a different module be used, as we have been unable to reacher the maintainer of this module. We will continue to reach out to them, and if an update becomes available that fixes the issue, we will update this advisory accordingly.
Vulnerability: GHSA-8wg9-92fr-6j7v
Summary: Downloads Resources over HTTP in marionette-socket-host
Aliases: CVE-2016-10648
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2018-08-15T18:50:31Z

Affected versions of `marionette-socket-host` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `marionette-socket-host`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has removed the package from their Github account.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-4ccc-jm2p-vg3p
Summary: Downloads Resources over HTTP in windows-latestchromedriver
Aliases: CVE-2016-10696
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:14:22Z

Affected versions of `windows-latestchromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-latestchromedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-x8m7-cv39-xmg9
Summary: Malicious Package in jq-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:56:10Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-whgm-jr23-g3j9
Summary: Uncontrolled Resource Consumption in ansi-html
Aliases: CVE-2021-23424
Severity: HIGH
CWE: CWE-400
Published: 2021-09-02T17:15:24Z

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
Vulnerability: GHSA-7qcx-jmrc-h2rr
Summary: Cross-Site Scripting in keystone
Aliases: CVE-2017-15878
Severity: MODERATE
CWE: CWE-79
Published: 2017-11-15T19:44:16Z

Versions of `keystone` prior to 4.0.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize user input on the `Contact Us` page,  allowing attackers to submit contact forms with malicious JavaScript in the message field. The output is not properly encoded leading an admin that opens new inquiry to execute the arbitrary JavaScript supplied in their browser.


## Recommendation

Update to version 4.0.0 or later.
Vulnerability: GHSA-wv67-9jq7-8r69
Summary: Improper Input Validation and Buffer Over-read in mqtt-packet
Aliases: CVE-2019-5432
Severity: HIGH
CWE: CWE-126, CWE-125
Published: 2019-05-14T04:02:45Z

A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.
Vulnerability: GHSA-689x-x68p-fph3
Summary: Cross-site Scripting in vditor
Aliases: CVE-2022-0350
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-01T00:00:41Z

Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
Vulnerability: GHSA-4jj4-m52p-8rx3
Summary: Prototype pollution in set-object-value
Aliases: CVE-2020-28281
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-04-13T15:24:08Z

Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-j87c-cj65-vmh5
Summary: High severity vulnerability that affects rendertron
Aliases: CVE-2017-18354
Severity: HIGH
CWE: CWE-22
Published: 2019-01-04T17:41:51Z

Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote attacker.
Vulnerability: GHSA-78p3-96hc-3j47
Summary: Malicious Package in jquery-airload
Severity: CRITICAL
Published: 2020-09-03T19:11:17Z

Version 0.2.5 of `jquery-airload` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-vx5c-87qx-cv6c
Summary: Arbitrary Code Execution in mathjs
Aliases: CVE-2017-1001002
Severity: CRITICAL
CWE: CWE-94
Published: 2017-12-18T22:27:45Z

math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution.


## Recommendation

Update to version 3.17.0 or later.
Vulnerability: GHSA-xw5p-hw6r-2j98
Summary: Denial of service in fastify
Aliases: CVE-2020-8192
Severity: MODERATE
CWE: CWE-400
Published: 2020-08-05T14:53:22Z

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.
Vulnerability: GHSA-x3j8-g4v9-67jq
Summary: Downloads Resources over HTTP in pennyworth
Aliases: CVE-2016-10619
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:56:51Z

Affected versions of `pennyworth` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-5888-ffcr-r425
Summary: Prototype Pollution leading to Remote Code Execution in superjson
Aliases: CVE-2022-23631
Severity: CRITICAL
CWE: CWE-94, CWE-1321
Published: 2022-02-09T22:20:49Z

### Impact

This is critical vulnerability, as it allows to run arbitrary code on any server using superjson input, including a Blitz.js server, without prior authentication or knowledge. Attackers gain full control over the server so they could steal and manipulate data or attack further systems. The only requirement is that the server implements at least one endpoint which uses superjson during request processing. In the case of Blitz.js, it would be at least one RPC call. 

### Patches
This has been patched in superjson 1.8.1 and Blitz.js 0.45.3. 

If you are unable to upgrade to Blitz.js 0.45.3 in a timely manner, you can instead upgrade only superjson to version 1.8.1 using yarn resolutions are similar. Blitz versions < 0.45.3 are only affected because they used superjson versions < 1.8.1.

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/blitz-js/superjson
* Email us at b@bayer.ws
Vulnerability: GHSA-v45m-2wcp-gg98
Summary: Global node_modules Binary Overwrite in bin-links
Severity: LOW
Published: 2020-09-04T17:18:44Z

Versions of  `bin-links` prior to 1.1.6 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent globally-installed binaries to be overwritten by other package installs. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This behavior is still allowed in local installations.


## Recommendation

Upgrade to version 1.1.6 or later.
Vulnerability: GHSA-42xw-2xvc-qx8m
Summary: Denial of Service in axios
Aliases: CVE-2019-10742
Severity: HIGH
CWE: CWE-20, CWE-755
Published: 2019-05-29T18:04:45Z

Versions of `axios` prior to 0.18.1 are vulnerable to Denial of Service. If a request exceeds the `maxContentLength` property, the package prints an error but does not stop the request. This may cause high CPU usage and lead to Denial of Service.


## Recommendation

Upgrade to 0.18.1 or later.
Vulnerability: GHSA-7j93-5m2h-rvjx
Summary: Malicious Package in bconi
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:32:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-r587-7jh2-4qr3
Summary: Server secret was included in static assets and served to clients
Severity: CRITICAL
Published: 2020-08-26T19:32:50Z

### Impact
Server JWT signing secret was included in static assets and served to clients.

This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface (which is unprotected and ALLOWS arbitrary code execution) and usually wide-ranging privileges to files, along with Flood's lack of security controls against authenticated users, the severity of this vulnerability is **CRITICAL**. 

### Background
Commit 8d11640b imported `config.js` to client (frontend) components to get `disableUsersAndAuth` configuration variable. Subsequently contents of `config.js` are compiled into static assets and served to users. Unfortunately `config.js` also includes `secret`.

Intruders can use `secret` to sign authentication tokens themselves to bypass builtin access control of Flood.

### Patches
Commit 042cb4ce removed imports of `config.js` from client (frontend) components. Additionally an eslint rule was added to prevent config.js from being imported to client (frontend) components.

Commit 103f53c8 provided a general mitigation to this kind of problem by searching static assets to ensure `secret` is not included before starting server (backend). 

### Workarounds
Users shall upgrade if they use Flood's builtin authentication system.

While maintainers will do their best to support it, Flood cannot guarantee its in-house access control system can stand against determined attackers in high-stake environments. 

> Use `HTTP Basic Auth` or other battle-hardened authentication methods instead of Flood's in-house one. You can use `disableUsersAndAuth` to avoid duplicate authentication.

Users are advised to check out the [wiki](https://github.com/jesec/flood/wiki) for more information on security precautions.

### References
[Wiki - Security precautions](https://github.com/jesec/flood/wiki/Security-precautions)

[Introduction to JSON Web Tokens](https://jwt.io/introduction/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [issue tracker](https://github.com/jesec/flood/issues)
* Email us at [jc@linux.com](mailto:jc@linux.com)
Vulnerability: GHSA-4r5x-qjqc-p579
Summary: Tracking Module in botbait
Aliases: CVE-2017-16126
Severity: MODERATE
CWE: CWE-200
Published: 2020-09-01T18:57:44Z

The module `botbait` is a tool to be used to track bot and automated tools usage with-in the npm ecosystem.

`botbait` is known to record and track user information.

The module tracks the following information.
- Source IP
- process.versions
- process.platform
- How the module was invoked (test, require, pre-install)


## Recommendation

This package has no functional value, and should be removed from your environment if discovered.
Vulnerability: GHSA-q75g-2496-mxpp
Summary: Regular Expression Denial of Service in parsejson
Aliases: CVE-2017-16113
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:11:13Z

Affected versions of `parsejson` are vulnerable to a regular expression denial of service when parsing untrusted user input.


## Recommendation

The `parsejson` package has not been functionally updated since it was initially released.

Additionally, it provides functionality which is natively included in Node.js, and therefore the native `JSON.parse()` should be used, for both performance and security reasons.
Vulnerability: GHSA-652h-xwhf-q4h6
Summary: OS Command Injection in ssh2
Aliases: CVE-2020-26301
Severity: HIGH
CWE: CWE-78
Published: 2021-09-21T16:50:46Z

ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
Vulnerability: GHSA-273r-mgr4-v34f
Summary: Uncaught Exception in engine.io
Aliases: CVE-2022-21676
Severity: HIGH
CWE: CWE-754
Published: 2022-01-13T16:14:17Z

### Impact

A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.

> RangeError: Invalid WebSocket frame: RSV2 and RSV3 must be clear
>   at Receiver.getInfo (/.../node_modules/ws/lib/receiver.js:176:14)
>   at Receiver.startLoop (/.../node_modules/ws/lib/receiver.js:136:22)
>   at Receiver._write (/.../node_modules/ws/lib/receiver.js:83:10)
>   at writeOrBuffer (internal/streams/writable.js:358:12)

This impacts all the users of the [`engine.io`](https://www.npmjs.com/package/engine.io) package starting from version `4.0.0`, including those who uses depending packages like [`socket.io`](https://www.npmjs.com/package/socket.io).

### Patches

A fix has been released for each major branch:

| Version range | Fixed version |
| --- | --- |
| `engine.io@4.x.x` | `4.1.2` |
| `engine.io@5.x.x` | `5.2.1` |
| `engine.io@6.x.x` | `6.1.1` |

Previous versions (`< 4.0.0`) are not impacted.

For `socket.io` users:

| Version range | `engine.io` version | Needs minor update? |
| --- | --- | --- |
| `socket.io@4.4.x` | `~6.1.0` | -
| `socket.io@4.3.x` | `~6.0.0` | Please upgrade to `socket.io@4.4.x`
| `socket.io@4.2.x` | `~5.2.0` | -
| `socket.io@4.1.x` | `~5.1.1` | Please upgrade to `socket.io@4.4.x`
| `socket.io@4.0.x` | `~5.0.0` | Please upgrade to `socket.io@4.4.x`
| `socket.io@3.1.x` | `~4.1.0` | -
| `socket.io@3.0.x` | `~4.0.0` | Please upgrade to `socket.io@3.1.x` or `socket.io@4.4.x` (see [here](https://socket.io/docs/v4/migrating-from-3-x-to-4-0/))

In most cases, running `npm audit fix` should be sufficient. You can also use  `npm update engine.io --depth=9999`.

### Workarounds

There is no known workaround except upgrading to a safe version.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [`engine.io`](https://github.com/socketio/engine.io)

Thanks to Marcus Wejderot from Mevisio for the responsible disclosure.
Vulnerability: GHSA-v9wp-8r97-v6xg
Summary: Cross-Site Scripting in jquery.json-viewer
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T17:17:00Z

Versions of `jquery.json-viewer` prior to 1.3.0 are vulnerable to Cross-Site Scripting (XSS). The package insufficiently sanitizes user input when creating links, and concatenates the user input in an `<a>` tag. This allows attackers to create malicious links with JSON payloads such as: 
```
{
  "foo": "https://bar.com\" onmouseover=alert('xss') \""
}
```

This may lead to arbitrary JavaScript execution in a victim's browser.


## Recommendation

Upgrade to version 1.3.0 or later.
Vulnerability: GHSA-xgp2-cc4r-7vf6
Summary: Denial of Service in http-live-simulator
Severity: MODERATE
Published: 2020-09-03T20:44:21Z

Versions of `http-live-simulator` prior to 1.0.8 are vulnerable to Denial of Service. The package fails to catch an exception that causes the Node process to crash, effectively shutting down the server. This allows an attacker to send an HTTP request that crashes the server.


## Recommendation

Upgrade to version 1.0.8 or later.
Vulnerability: GHSA-cxm3-284p-qc4v
Summary: Prototype Pollution in sds
Aliases: CVE-2020-7618
Severity: MODERATE
CWE: CWE-915
Published: 2020-09-03T15:53:12Z

Affected versions of `sds` are vulnerable to prototype pollution. The `set` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

## Recommendation

Upgrade to version 4.0.0 or later
Vulnerability: GHSA-qj3g-wfr7-3cv7
Summary: Malicious Package in require-ports
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:41:53Z

Version 10.4.0 of `require-ports` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-wxgw-qj99-44c2
Summary: Prototype Pollution in node-forge util.setPath API
Severity: LOW
Published: 2022-01-08T00:22:40Z

### Impact
`forge.util.setPath` had a potential prototype pollution issue if called with untrusted keys. This API was not used by forge itself.

### Patches
The `forge.util.setPath` API and related functions were removed in 0.10.0.

### Workarounds
Don't call `forge.util.setPath` directly or indirectly with untrusted keys.

### References
- https://security.snyk.io/vuln/SNYK-JS-NODEFORGE-598677
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge).
* Email us at support@digitalbazaar.com.
Vulnerability: GHSA-jhgp-hvj6-x2p2
Summary: Stored Cross-Site Scripting in tianma-static
Aliases: CVE-2018-16474
Severity: CRITICAL
CWE: CWE-79
Published: 2018-11-06T23:12:01Z

All versions of `tianma-static` are vulnerable to stored cross-site scripting (XSS). The vulnerability is exploitable if a user can control the name of a file that is served by `tianma-static`


## Recommendation

As no fix is available for this vulnerability at this time it is our recommendation to use another static file server.
Vulnerability: GHSA-vj72-mwrj-m2xq
Summary: Prototype Pollution in deepmergefn
Aliases: CVE-2021-23417
Severity: MODERATE
CWE: CWE-915, CWE-1321
Published: 2021-08-10T16:09:25Z

All versions of package deepmergefn are vulnerable to Prototype Pollution via deepMerge function.
Vulnerability: GHSA-9p49-cwh3-4qhf
Summary: Malicious Package in grunt-radic
Severity: CRITICAL
Published: 2020-09-11T21:21:19Z

Version 0.1.1 of `grunt-radic` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-jp6r-xcjj-5h7r
Summary: Cross-Site Scripting in cyberchef
Aliases: CVE-2019-15532
Severity: MODERATE
CWE: CWE-79
Published: 2019-08-27T17:36:32Z

Versions of `cyberchef` prior to 8.31.3 are vulnerable to Cross-Site Scripting. In `Text Encoding Brute Force` the table rows are created by concatenating the `value` variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 8.31.3 or later.
Vulnerability: GHSA-wmcq-3wfx-qjx5
Summary: Directory Traversal in nodeload-nmickuli
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:33:30Z

Affected versions of `nodeload-nmickuli` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cx8m-8xmx-q8v3
Summary: Denial of Service in memjs
Aliases: CVE-2018-3767
Severity: MODERATE
CWE: CWE-400
Published: 2018-10-10T17:25:12Z

Versions of `memjs` prior to 1.2.2 are vulnerable to Denial of Service (DoS).  The package fails to sanitize the `value` option passed to the Buffer constructor, which may allow attackers to pass large values exhausting system resources.


## Recommendation

Upgrade to version 1.2.2 or later.
Vulnerability: GHSA-xr3g-4gg5-w3wq
Summary: Malicious Package in degbu
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:06:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-5f7m-mmpc-qhh4
Summary: Remote Memory Exposure in mysql
Severity: MODERATE
CWE: CWE-201
Published: 2019-05-23T09:27:00Z

Versions of `mysql` before 2.14.0 are vulnerable to remove memory exposure.

Affected versions of `mysql` package allocate and send an uninitialized memory over the network when a number is provided as a password.

Only `mysql` running on Node.js versions below 6.0.0 is affected due to a throw added in newer node.js versions.

Proof of Concept:

```
require('mysql').createConnection({
  host: 'localhost',
  user: 'user',
  password : USERPROVIDEDINPUT,  // number
  database : 'my_db'
}).connect();
```



## Recommendation

Update to version 2.14.0 or later.
Vulnerability: GHSA-rrfc-g2gh-xvjm
Summary: Directory Traversal in 22lixian
Aliases: CVE-2017-16162
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:46:07Z

Affected versions of `22lixian` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jv35-xqg7-f92r
Summary: Prototype Pollution
Aliases: CVE-2021-25949
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-06-21T17:16:09Z

Prototype pollution vulnerability in ‘set-getter’ version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-8j4w-5fw4-rm27
Summary: Prototype Pollution in deeply
Aliases: CVE-2019-10750
Severity: CRITICAL
CWE: CWE-400
Published: 2019-08-27T17:45:33Z

Versions of `deeply` prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

Upgrade to version 3.1.0 or later.
Vulnerability: GHSA-mq6c-fh97-4gwv
Summary: Denial of Service vulnerability with large JSON payloads in fastify
Aliases: CVE-2018-3711
Severity: HIGH
CWE: CWE-770
Published: 2018-07-18T21:20:34Z

Affected versions of `fastify` are vulnerable to a denial of service when processing a request with `Content-Type` set to `application/json` and a very large payload.


## Recommendation

Update to version 0.38.0 or later.
Vulnerability: GHSA-vpj4-89q8-rh38
Summary: Cross-Site Scripting in bpmn-js-properties-panel
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T18:16:59Z

Versions of `bpmn-js-properties-panel` prior to 0.31.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.31.0 or later.
Vulnerability: GHSA-74fj-2j2h-c42q
Summary: Exposure of sensitive information in follow-redirects
Aliases: CVE-2022-0155
Severity: HIGH
CWE: CWE-359
Published: 2022-01-12T22:46:26Z

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
Vulnerability: GHSA-p8fm-w787-x6x3
Summary: Malicious Package in portionfatty12
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T15:50:28Z

All versions of `portionfatty12` are considered malicious. The package is malware designed to steal user's data. When installed it uploads the user's public SSH keys to a remote server.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.
Vulnerability: GHSA-fgxq-p49f-qw99
Summary: Directory Traversal in isomorphic-git
Aliases: CVE-2021-30483
Severity: MODERATE
CWE: CWE-22
Published: 2021-09-02T22:00:20Z

isomorphic-git before 1.8.2 allows Directory Traversal via a crafted repository.
Vulnerability: GHSA-43m5-c88r-cjvv
Summary: XSS due to lack of CSRF validation for replying/publishing
Aliases: CVE-2020-15156
Severity: MODERATE
CWE: CWE-352
Published: 2020-08-26T18:55:38Z

### Impact
Due to lack of CSRF validation, a logged in user is potentially vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum.

### Patches
Upgrade to the latest version v0.7.0

### Workarounds
You can cherry-pick the following commit: [https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618](https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618)

### References
Visit https://community.nodebb.org if you have any questions about this issue or on how to patch / upgrade your instance.
Vulnerability: GHSA-96r7-mrqf-jhcc
Summary: Prototype Pollution in ini-parser
Aliases: CVE-2020-7617
Severity: CRITICAL
CWE: CWE-915
Published: 2020-06-10T20:27:53Z

All versions of `ini-parser` are vulnerable to prototype pollution. The `parse` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-qcg2-h349-vwm3
Summary: Cross-site Scripting in React Draft Wysiwyg
Aliases: CVE-2021-31712
Severity: HIGH
CWE: CWE-79
Published: 2021-05-06T15:52:35Z

react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users, leading to XSS.
Vulnerability: GHSA-f2jv-r9rf-7988
Summary: Remote code execution in handlebars when compiling templates
Aliases: CVE-2021-23369
Severity: CRITICAL
CWE: CWE-94
Published: 2021-05-06T15:57:44Z

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Vulnerability: GHSA-5rc6-2r3r-fv79
Summary: Downloads Resources over HTTP in slimerjs-edge
Aliases: CVE-2016-10644
Severity: HIGH
CWE: CWE-311
Published: 2018-08-15T19:25:47Z

Affected versions of `slimerjs-edge` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `slimerjs-edge`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-36j3-xxf7-4pqg
Summary: Universal XSS in Android WebView
Aliases: CVE-2020-6506
Severity: MODERATE
CWE: CWE-79, CWE-863
Published: 2020-10-02T16:22:41Z

A universal cross-site scripting (UXSS) vulnerability, CVE-2020-6506 (https://crbug.com/1083819), has been identified in the Android WebView system component, which allows cross-origin iframes to execute arbitrary JavaScript in the top-level document. This vulnerability affects React Native apps which use a `react-native-webview` that allows navigation to arbitrary URLs, and when that app runs on systems with an Android WebView version prior to 83.0.4103.106.

## Pending mitigation

Ensure users update their Android WebView system component via the Google Play Store to 83.0.4103.106 or higher to avoid this UXSS. 'react-native-webview' is working on a mitigation but it could take some time.

### References

https://alesandroortiz.com/articles/uxss-android-webview-cve-2020-6506/
Vulnerability: GHSA-23wc-v4mf-x7v4
Summary: Directory Traversal in intsol-package
Aliases: CVE-2017-16178
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:44:45Z

`intsol-package` is a file server.

`intsol-package` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Example Request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost
```
and the server's Response
```
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-pwm7-qr6j-3vjg
Summary: Prototype Pollution in realms-shim
Aliases: CVE-2021-23594
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-01-12T22:56:13Z

All versions of package realms-shim are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector.
Vulnerability: GHSA-cqjg-whmm-8gv6
Summary: Denial of Service via malformed accept-encoding header in hapi
Aliases: CVE-2017-16013
Severity: MODERATE
CWE: CWE-400
Published: 2018-10-09T00:57:28Z

Affected versions of `hapi` will crash or lock the event loop when a malformed `accept-encoding` header is recieved.


## Recommendation

Update to version 16.1.1 or later.
Vulnerability: GHSA-j7wp-vjj6-cp5m
Summary: Cross-Site Scripting in @progress/kendo-angular-editor
Severity: HIGH
CWE: CWE-79
Published: 2020-08-11T19:40:10Z

Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed.
Adding the following content to the Editor value demonstrates the issue: `<img src="" onerror=alert(document.domain)>`.
Vulnerability: GHSA-4m6q-rxhm-675w
Summary:  OS Command Injection in adb-driver
Aliases: CVE-2020-7636
Severity: CRITICAL
CWE: CWE-78
Published: 2021-12-09T19:54:29Z

adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.
Vulnerability: GHSA-mg85-8mv5-ffjr
Summary: Denial of Service in ammo
Severity: HIGH
Published: 2020-09-03T15:45:40Z

All versions of `ammo` are vulnerable to Denial of Service. The Range HTTP header parser has a vulnerability which will cause the function to throw a system error if the header is set to an invalid value. Because hapi is not expecting the function to ever throw, the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/ammo`. Please update your dependencies to use `@hapi/ammo`.
Vulnerability: GHSA-425c-ccf3-3jrr
Summary: Critical severity vulnerability that affects slpjs
Aliases: CVE-2019-16762
Severity: CRITICAL
CWE: CWE-20
Published: 2019-11-15T23:10:35Z

## Validator parsing discrepancy due to string encoding

### Impact
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus.

### Patches
All versions > 0.21.3 are patched.

### Workarounds
Upgrade to any version >= 0.21.4.

### References
The bug was located and fixed [here](https://github.com/simpleledger/slpjs/commit/ac8809b42e47790a6f0205991b36f2699ed10c84#diff-fe58606994c412ba56a65141a7aa4a62L701).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [slpjs repo](https://github.com/simpleledger/slpjs/issues)
* Email us at [info@slp.cash](mailto:info@slp.cash)
Vulnerability: GHSA-pfv6-prqm-85q8
Summary: Prototype Pollution in madlib-object-utils
Aliases: CVE-2022-24279
Severity: HIGH
CWE: CWE-1321
Published: 2022-04-16T00:00:26Z

The package madlib-object-utils before version 0.1.8 is vulnerable to Prototype Pollution via the `setValue` method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)
Vulnerability: GHSA-j32x-j8pj-pg2h
Summary: Prototype Pollution in decal
Aliases: CVE-2020-28450
Severity: HIGH
CWE: CWE-94, CWE-400, CWE-1321
Published: 2021-04-13T15:20:34Z

This affects all versions of package decal. The vulnerability is in the extend function.
Vulnerability: GHSA-xvch-5gv4-984h
Summary: Prototype Pollution in minimist
Aliases: CVE-2021-44906
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-03-18T00:01:09Z

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Vulnerability: GHSA-vm7j-4rj6-mw2p
Summary: Malicious Package in ember_cli_babe
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:08:42Z

Version 6.16.0 of `ember_cli_babe` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hr2v-3952-633q
Summary: Prototype Pollution in deep-extend
Aliases: CVE-2018-3750
Severity: CRITICAL
CWE: CWE-20
Published: 2018-10-09T00:44:59Z

Versions of `deep-extend` before 0.5.1 are vulnerable to prototype pollution.


## Recommendation

Update to version 0.5.1 or later.
Vulnerability: GHSA-vvwp-3f54-xc39
Summary: Downloads Resources over HTTP in broccoli-closure
Aliases: CVE-2016-10635
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:57:05Z

Affected versions of `broccoli-closure` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `broccoli-closure`.


## Recommendation

Update to version 1.3.1 or later.
Vulnerability: GHSA-j657-59rv-qwm6
Summary: Cross-Site Scripting in min-http-server
Aliases: CVE-2019-5457
Severity: HIGH
CWE: CWE-79
Published: 2019-07-31T04:22:27Z

All versions of `min-http-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-gxr4-xjj5-5px2
Summary: Potential XSS vulnerability in jQuery
Aliases: CVE-2020-11022
Severity: MODERATE
CWE: CWE-79
Published: 2020-04-29T22:18:55Z

### Impact
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. `.html()`, `.append()`, and others) may execute untrusted code.

### Patches
This problem is patched in jQuery 3.5.0.

### Workarounds
To workaround the issue without upgrading, adding the following to your code:

```js
jQuery.htmlPrefilter = function( html ) {
	return html;
};
```

You need to use at least jQuery 1.12/2.2 or newer to be able to apply this workaround.

### References
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://jquery.com/upgrade-guide/3.5/

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery repo](https://github.com/jquery/jquery/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-g3xp-v2ff-x5c3
Summary: Downloads Resources over HTTP in go-ipfs-dep
Aliases: CVE-2016-10563
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:18Z

Affected versions of `go-ipfs-deps` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 0.4.4 or later.
Vulnerability: GHSA-2hhw-p8mg-jrm6
Summary: Path Traversal in http-live-simulator
Aliases: CVE-2019-5423
Severity: HIGH
CWE: CWE-22
Published: 2019-04-08T15:18:40Z

Versions of `http-live-simulator` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 1.0.6