TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-jw37-5gqr-cf9j
Summary: Server-Side Request Forgery in ftp-srv
Aliases: CVE-2020-15152
Severity: CRITICAL
CWE: CWE-918
Published: 2020-08-17T21:44:54Z

### Background

The FTP protocol creates two connections, one for commands and one for transferring data.
This second data connection can be created in two ways, on the server by sending the PASV command, or on the client by sending the PORT command.

The PORT command sends the IP and port for the server to connect to the client with.

### Issue
Since the client can send an arbitrary IP with the PORT command, this can be used to cause the server to make a connection elsewhere.

### Patches

* _fix: disallow PORT connections to alternate hosts_: e449e75219d918c400dec65b4b0759f60476abca

Deprecation notices have been published for older versions.

### Workarounds

Blacklisting the FTP Command `PORT` will prevent the server from exposing this behaviour through active connections until a fix is applied.
```js
const ftp = new FtpSrv({
  blacklist: ['PORT']
});
```

### References
https://www.npmjs.com/advisories/1445

### Credits

Thank you to;
@trs for fixing it
@andreeleuterio for reporting it to us for an anonymous user (Vincent) through the NPM platform
@quiquelhappy for bringing it to our attention after it slipped through the cracks during Christmas

### For more information
If you have any questions or comments about this advisory:
* Open an issue at [https://github.com/autovance/ftp-srv](https://github.com/autovance/ftp-srv)
* Email us directly; security@autovance.com
Vulnerability: GHSA-4fc4-chg7-h8gh
Summary: Unprotected dynamically loaded chunks
Aliases: CVE-2020-15262
Severity: LOW
CWE: CWE-345
Published: 2020-10-19T20:02:44Z

### Impact

All dynamically loaded chunks receive an invalid integrity hash that is ignored by the browser, and therefore the browser cannot validate their integrity. This removes the additional level of protection offered by SRI for such chunks. Top-level chunks are unaffected.

### Patches

This issue is patched in version 1.5.1.

### Workarounds

N/A

### References

https://github.com/waysact/webpack-subresource-integrity/issues/131

### For more information
If you have any questions or comments about this advisory:
* Comment on [webpack-subresource-integrity issue #131](https://github.com/waysact/webpack-subresource-integrity/issues/131)
* Or email us at [security@waysact.com](mailto:security@waysact.com)
Vulnerability: GHSA-8225-6cvr-8pqp
Summary: Large gzip Denial of Service in superagent
Aliases: CVE-2017-16129
Severity: LOW
CWE: CWE-409
Published: 2018-08-09T20:13:01Z

Affected versions of `superagent` do not check the post-decompression size of ZIP compressed HTTP responses prior to decompressing. This results in the package being vulnerable to a [ZIP bomb](https://en.wikipedia.org/wiki/Zip_bomb) attack, where an extremely small ZIP file becomes many orders of magnitude larger when decompressed. 

This may result in unrestrained CPU/Memory/Disk consumption, causing a denial of service condition.


## Recommendation

Update to version 3.7.0 or later.
Vulnerability: GHSA-5rc4-8qqh-vq7f
Summary: Handling of URL Encoding permitting access to ignored
Aliases: CVE-2018-3718
Severity: MODERATE
CWE: CWE-177
Published: 2021-08-09T22:24:26Z

serve node module suffers from Improper Handling of URL Encoding by permitting access to ignored files if a filename is URL encoded.
Vulnerability: GHSA-jrhj-2j3q-xf3v
Summary: Stored Cross-Site Scripting in simplehttpserver
Aliases: CVE-2018-3716
Severity: HIGH
CWE: CWE-79
Published: 2018-07-26T15:03:30Z

All versions of simplehttpserver are vulnerable to stored cross-site scripting (XSS). To be exploited an attacker needs to control the filename of a file that is used in the directory listing output.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not use this module if the exploitable conditions are met.
Vulnerability: GHSA-v4x8-gw49-7hv4
Summary: Path Traversal in swagger-injector
Severity: CRITICAL
CWE: CWE-22
Published: 2020-09-03T20:37:42Z

All versions of `swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-257v-vj4p-3w2h
Summary: Regular Expression Denial of Service (ReDOS)
Aliases: CVE-2021-29060
Severity: MODERATE
CWE: CWE-770
Published: 2021-06-22T01:14:09Z

In the npm package `color-string`, there is a  ReDos (Regular Expression Denial of Service) vulnerability regarding an exponential time complexity for
linearly increasing input lengths for `hwb()` color strings.

Strings reaching more than 5000 characters would see several
milliseconds of processing time; strings reaching more than
50,000 characters began seeing 1500ms (1.5s) of processing time.

The cause was due to a the regular expression that parses
hwb() strings - specifically, the hue value - where
the integer portion of the hue value used a 0-or-more quantifier
shortly thereafter followed by a 1-or-more quantifier.

This caused excessive backtracking and a cartesian scan,
resulting in exponential time complexity given a linear
increase in input length.
Vulnerability: GHSA-8px5-63x9-5c7p
Summary: Command Injection in pullit
Severity: HIGH
CWE: CWE-77
Published: 2020-09-03T16:47:30Z

Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names  and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 1.4.0 or later.

## Credits

   This vulnerability was discovered by @lirantal
Vulnerability: GHSA-r9w3-g83q-m6hq
Summary: Prototype Pollution in deepmerge-ts
Aliases: CVE-2022-24802
Severity: HIGH
CWE: CWE-915, CWE-1321
Published: 2022-04-01T17:26:03Z

deepmerge-ts is used to merge 2 or more objects respecting type information. deepmerge-ts is vulnerable to Prototype Pollution via file deepmerge.ts, function defaultMergeRecords(). A fix was released in version 4.0.2. Currently, there is no known workaround.
Vulnerability: GHSA-55xv-f85c-248q
Summary: Regular Expression Denial of Service (ReDoS) in jsx-slack
Aliases: CVE-2021-43838
Severity: LOW
CWE: CWE-400
Published: 2021-12-17T19:59:02Z

jsx-slack v4.5.1 and earlier versions are vulnerable to a regular expression denial-of-service (ReDoS) attack. 

### Impact

If attacker can put a lot of JSX elements into `<blockquote>` tag, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

```javascript
/** @jsxImportSource jsx-slack */
import { Section } from 'jsx-slack'

console.log(
  <Section>
    <blockquote>
      {[...Array(40)].map((_, i) => (
        <p>{i + 1}</p>
      ))}
    </blockquote>
  </Section>
)
```

### Patches

_See also: https://github.com/yhatt/jsx-slack/security/advisories/GHSA-hp68-xhvj-x6j6_

jsx-slack v4.5.2 has updated regular expressions to prevent catastrophic backtracking.

jsx-slack v4.5.1 also had patched a workaround. It has no problems to contents with ASCII characters, but _still vulnerable to contents with multibyte characters_. (https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d)

### References

- https://nvd.nist.gov/vuln/detail/CVE-2021-43838
- https://github.com/yhatt/jsx-slack/commit/36e4a10405e4c7745333e245fcc5029c02c7065d

### Credits

Thanks to @hieki for finding out this vulnerability.
Vulnerability: GHSA-4wm5-q7wv-6jx3
Summary: Downloads Resources over HTTP in bkjs-wand
Aliases: CVE-2016-10571
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:52:20Z

Affected versions of `bkjs-wand` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `bkjs-wand`.


## Recommendation

Update to version 0.3.2 or later.
Vulnerability: GHSA-phph-xpj4-wvcv
Summary: Cross-Site Scripting in hexo-admin
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T21:13:07Z

All versions of `hexo-admin` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-mgh5-4h95-qj4p
Summary: Information Exposure in Snyk Broker
Aliases: CVE-2020-7654
Severity: HIGH
CWE: CWE-532
Published: 2020-06-03T22:02:14Z

All versions of snyk-broker before 4.73.1 are vulnerable to Information Exposure. It logs private keys if logging level is set to DEBUG.
Vulnerability: GHSA-43vf-2x6g-p2m5
Summary: Malicious Package in browserift
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:33:26Z

Version 16.3.3 of `browserift` contained malicious code as a preinstall script. The package was a backdoor that opened a connection to a remote server and executed incoming commands on both Unix and Windows machines


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-j6px-jwvv-vpwq
Summary: Angular Expressions - Remote Code Execution
Aliases: CVE-2021-21277
Severity: LOW
CWE: CWE-74
Published: 2021-02-01T15:01:26Z

### Impact

The vulnerability, reported by GoSecure Inc, allows Remote Code Execution, if you call `expressions.compile(userControlledInput)` where `userControlledInput` is text that comes from user input.

This time, the security of the package could be bypassed by using a more complex payload, using a `.constructor.constructor` technique.

* If running angular-expressions in the browser, an attacker could run any browser script when the application code calls expressions.compile(userControlledInput).
* If running angular-expressions on the server, an attacker could run any Javascript expression, thus gaining Remote Code Execution.

### Patches

Users should upgrade to version 1.1.2 of angular-expressions

### Workarounds

A temporary workaround might be either to : 

* disable user-controlled input that will be fed into angular-expressions in your application

OR

* allow only following characters in the userControlledInput : 

```js
if (/^[|a-zA-Z.0-9 :"'+-?]+$/.test(userControlledInput)) {
      var result = expressions.compile(userControlledInput);
}
else {
     result = undefined;
}
```

### References

[Removal of angular-expression sandbox](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html)

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [angular-expressions](https://github.com/peerigon/angular-expressions/issues)
* [Email us](mailto:contact@javascript-ninja.fr)

### Credits 

The issue was reported by Maxime Nadeau from GoSecure, Inc.
Vulnerability: GHSA-v8g7-9qv2-j865
Summary: Malicious Package in bitcoin-osp
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:38:55Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-v6gv-fg46-h89j
Summary: Sensitive Data Exposure in put
Severity: LOW
CWE: CWE-200
Published: 2020-09-03T16:48:36Z

All versions of `put` are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of Node.js <=6.x.


## Recommendation

Upgrade your Node.js version or consider using an alternative package.
Vulnerability: GHSA-7x92-2j68-h32c
Summary: Directory Traversal in featurebook
Severity: MODERATE
CWE: CWE-22
Published: 2020-09-01T19:03:02Z

Affected versions of `featurebook` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

The `featurebook` package is not intended to be run in production code nor to be exposed to an untrusted network.


## Proof of Concept
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No direct patch is currently available.

At this time, the best mitigation is to ensure that `featurebook` is not running in production or exposed to an untrusted network.
Vulnerability: GHSA-72fg-jqhx-c68p
Summary: Open Redirect in st
Aliases: CVE-2017-16224
Severity: MODERATE
CWE: CWE-601
Published: 2018-08-06T21:33:31Z

st is a module for serving static files.

An attacker is able to craft a request that results in an `HTTP 301` (redirect) to an entirely different domain. 

A request for: `http://some.server.com//nodesecurity.org/%2e%2e` would result in a 301 to `//nodesecurity.org/%2e%2e` which most browsers treat as a proper redirect as `//` is translated into the current schema being used.

Mitigating factor: 

In order for this to work, `st` must be serving from the root of a server (`/`) rather than the typical sub directory (`/static/`) and the redirect URL will end with some form of URL encoded `..` ("%2e%2e", "%2e.", ".%2e"). 

Code example (provided by Xin Gao): 

[example.js]

```
var st = require('st') 
var http = require('http') 
http.createServer(st(process.cwd())).listen(1337)
```

```
$ curl -v http://localhost:1337//cve.mitre.com/%2e%2e
*   Trying ::1...
* TCP_NODELAY set
* Connected to localhost (::1) port 1337 (#0)
> GET //cve.mitre.com/%2e%2e HTTP/1.1
> Host: localhost:1337
> User-Agent: curl/7.54.0
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< cache-control: public, max-age=600
< last-modified: Fri, 13 Oct 2017 22:56:33 GMT
< etag: "16777220-46488904-1507935393000"
< location: //cve.mitre.com/%2e%2e/
< Date: Fri, 13 Oct 2017 22:56:41 GMT
< Connection: keep-alive
< Content-Length: 30
<
* Connection #0 to host localhost left intact
```


## Recommendation

Update to version 1.2.2 or later.
Vulnerability: GHSA-xmjj-3c76-5w84
Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in directus
Aliases: CVE-2022-24814
Severity: HIGH
CWE: CWE-79
Published: 2022-04-05T18:30:15Z

### Impact

Unauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS.

### Patches

This was resolved in https://github.com/directus/directus/pull/12020 which is released in 9.7.0

### Workarounds

You can disable the live embed in the WYSIWYG by adding `{ "media_live_embeds": false }` to the _Options Overrides_ option of the Rich Text HTML interface.

### References

https://github.com/directus/directus/pull/12020

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [directus/directus](https://github.com/directus/directus)
* Email us at [security@directus.io](mailto:security@directus.io)
Vulnerability: GHSA-6mrq-7r7m-hh4p
Summary: Malicious Package in hs-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:52:58Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-9cq3-fj2h-ggj5
Summary: Vulnerability in remove function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36379
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2021-11-02T15:42:31Z

Aaptjs is a node wraper for aapt. An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-9w6v-m7wp-jwg4
Summary: Http request which redirect to another hostname do not strip authorization header in @actions/http-client
Aliases: CVE-2020-11021
Severity: MODERATE
CWE: CWE-200
Published: 2020-04-29T17:58:53Z

### Impact
If consumers of the http-client:
  1. make an http request with an authorization header
  2. that request leads to a redirect (302) and
  3. the redirect url redirects to another domain or hostname 

The authorization header will get passed to the other domain.

Note that since this library is for actions, the GITHUB_TOKEN that is available in actions is generated and scoped per job with [these permissions](https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token#permissions-for-the-github_token).

### Patches
The problem is fixed in 1.0.8 at [npm here](https://www.npmjs.com/package/@actions/http-client).  In 1.0.8, the authorization header is stripped before making the redirected request if the hostname is different.

### Workarounds
None.

### References
https://github.com/actions/http-client/pull/27

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/actions/http-client/issues
Vulnerability: GHSA-77xq-cpvg-7xm2
Summary: Prototype pollution in @tsed/core
Aliases: CVE-2020-7748
Severity: MODERATE
CWE: CWE-915
Published: 2021-05-10T19:07:56Z

"This affects the package @tsed/core before 5.65.7. This vulnerability relates to the deepExtend function which is used as part of the utils directory. Depending on if user input is provided, an attacker can overwrite and pollute the object prototype of a program."
Vulnerability: GHSA-gff7-g5r8-mg8m
Summary: Prototype Pollution in simple-plist
Aliases: CVE-2022-26260
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-03-23T00:00:22Z

simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().
Vulnerability: GHSA-2w8q-69fh-9gq6
Summary: Malicious Package in bufger-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:25:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-qwp9-52h8-xgg8
Summary: Prototype pollution in JointJS
Aliases: CVE-2020-28480
Severity: HIGH
CWE: CWE-400
Published: 2021-01-20T21:21:16Z

The package jointjs before 3.3.0 are vulnerable to Prototype Pollution via util.setByPath (https://resources.jointjs.com/docs/jointjs/v3.2/joint.htmlutil.setByPath). The path used the access the object's key and set the value is not properly sanitized, leading to a Prototype Pollution.
Vulnerability: GHSA-gfjr-xqhm-qvv3
Summary: Malicious Package in aysnc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:16:09Z

All versions of `aysnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-cgc7-mwp4-3ccx
Summary: Cross-site Scripting in Joplin
Aliases: CVE-2020-15930
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-07T16:29:05Z

An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
Vulnerability: GHSA-x55w-vjjp-222r
Summary: Inefficient Regular Expression in inflect
Aliases: CVE-2021-3820
Severity: MODERATE
CWE: CWE-400, CWE-697, CWE-1333
Published: 2021-09-29T17:12:19Z

inflect is customizable inflections for nodejs. inflect is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-5vj8-3v2h-h38v
Summary: Remote Code Execution in next
Severity: HIGH
CWE: CWE-20
Published: 2020-09-04T18:04:08Z

Versions of `next` prior to 5.1.0 are vulnerable to Remote Code Execution. The `/path:` route fails to properly sanitize input and passes it to a `require()` call. This allows attackers to execute JavaScript code on the server. Note that prior version 0.9.9 package `next` npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

## Recommendation

Upgrade to version 5.1.0.
Vulnerability: GHSA-g694-m8vq-gv9h
Summary: URL Confusion When Scheme Not Supplied in medialize/uri.js
Aliases: CVE-2022-1233
Severity: MODERATE
CWE: CWE-115, CWE-601
Published: 2022-04-05T00:00:17Z

Medialize is a Javascript URL mutation library. When parsing a URL without a scheme and with excessive slashes, like ///www.example.com, URI.js will parse the hostname as null and the path as /www.example.com. Such behaviour is different from that exhibited by browsers, which will parse ///www.example.com as http://www.example.com instead. For example, the following will cause a redirect to http://www.example.com: A fix was released in version 1.19.11.
Vulnerability: GHSA-9r7h-6639-v5mw
Summary: Cross-Site Scripting in bootstrap-select
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T15:54:00Z

Versions of `bootstrap-select` prior to 1.13.6 are vulnerable to Cross-Site Scripting (XSS).  The package does not escape `title` values on `<option>` tags. This may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.13.6 or later.
Vulnerability: GHSA-h3m2-h22h-695r
Summary: Malicious Package in ali-contributor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:29:31Z

All versions of `ali-contributor` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hj48-42vr-x3v9
Summary: Regular Expression Denial of Service in path-parse
Aliases: CVE-2021-23343
Severity: MODERATE
CWE: CWE-400
Published: 2021-08-10T15:33:47Z

Affected versions of npm package `path-parse` are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Vulnerability: GHSA-7xcv-wvr7-4h6p
Summary: Malicious npm package: an0n-chat-lib
Severity: CRITICAL
CWE: CWE-506
Published: 2021-01-29T18:12:19Z

The npm `an0n-chat-lib` package has been identified as malicious and removed from the npm package registry.

## Remediation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-h26f-j4mv-84g7
Summary: Malicious Package in asycn
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:39:43Z

All versions of `asycn` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-fx46-whrj-73v5
Summary: Bypassing Sanitization using DOM clobbering in html-janitor
Aliases: CVE-2017-0928
Severity: HIGH
CWE: CWE-547, CWE-642
Published: 2018-07-24T20:06:17Z

All versions of `html-janitor` are vulnerable to cross-site scripting (XSS).

Arbitrary HTML can pass the sanitization process, which can be unexpected and dangerous (XSS) in case user-controlled input is passed to the clean function."


## Recommendation

Upgrade to version 2.0.4 or later.
Vulnerability: GHSA-h5q8-5697-9p9h
Summary: Cross-Site Request Forgery in express-cart
Aliases: CVE-2020-22403
Severity: HIGH
CWE: CWE-352
Published: 2021-08-30T17:22:15Z

The express-cart package through 1.1.10 for Node.js allows CSRF.
Vulnerability: GHSA-2r5h-gh4x-8hp9
Summary: Resources Downloaded over Insecure Protocol in igniteui
Aliases: CVE-2016-10552
Severity: LOW
CWE: CWE-311
Published: 2019-02-18T23:40:14Z

Affected versions of `igniteui` download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection.




## Recommendation

The `igniteui` package has been deprecated by the package author and now exists under [`ignite-ui`](https://preview.npmjs.com/package/ignite-ui), which should be used in place of this package.
Vulnerability: GHSA-p7qp-3fh7-pv4p
Summary: Malicious Package in buffur-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:24:04Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-2xw5-3767-qxvm
Summary: Malicious Package in ng-ui-library
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:21:20Z

Version 1.0.987 of `ng-ui-library` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-8cpw-73f2-w58m
Summary: Cross-Site Scripting in selectize-plugin-a11y
Aliases: CVE-2019-15482
Severity: MODERATE
CWE: CWE-79
Published: 2019-08-27T17:38:33Z

Versions of `selectize-plugin-a11y ` prior to 1.1.0 are vulnerable to Cross-Site Scripting. The `accessibility.liveRegion.speak` function does not sanitize the `msg` variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.1.0 or later.
Vulnerability: GHSA-w973-2qcc-p78x
Summary: User Impersonation in converse.js
Aliases: CVE-2017-5858
Severity: MODERATE
CWE: CWE-20, CWE-346
Published: 2020-09-11T21:19:09Z

Versions of `converse.js` prior to 1.0.7 for 1.x or 2.0.5 for 2.x are vulnerable to User Impersonation. The package provides an incorrect implementation of [XEP-0280: Message Carbons](https://xmpp.org/extensions/xep-0280.html) that allows a remote attacker to impersonate any user, including contacts, in the vulnerable application's display. This allows for various kinds of social engineering attacks.


## Recommendation

If you're using `converse.js` 1.x, upgrade to 1.0.7 or later.
If you're using `converse.js` 2.x, upgrade to 2.0.5 or later.
Vulnerability: GHSA-hxmg-hm46-cf62
Summary: Remote code execution in mongo-express
Aliases: CVE-2020-24391
Severity: HIGH
CWE: CWE-20
Published: 2021-04-13T15:41:01Z

mongo-express before 1.0.0 offers support for certain advanced syntax but implements this in an unsafe way. NOTE: this may overlap CVE-2019-10769.
Vulnerability: GHSA-w4wq-rvmq-77x7
Summary: Cross-site scripting in anchorme
Aliases: CVE-2021-23411
Severity: MODERATE
CWE: CWE-79
Published: 2021-07-26T21:23:58Z

All versions of package anchorme are vulnerable to Cross-site Scripting (XSS) via the main functionality.
Vulnerability: GHSA-j5mg-fpq8-vvxv
Summary: Directory Traversal in commentapp.stetsonwood
Aliases: CVE-2017-16143
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:48:14Z

Affected versions of `commentapp.stetsonwood` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-m6q2-9pfm-2wvr
Summary: Malicious Package in wallet-address-vaildator
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:02:49Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-q22g-8fr4-qpj4
Summary: Regular Expression Denial of Service in remarkable
Aliases: CVE-2019-12041
Severity: HIGH
CWE: CWE-400
Published: 2019-06-06T15:32:15Z

lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
Vulnerability: GHSA-pmg9-p9r2-6q87
Summary: ReDoS via long UserAgent header in ua-parser
Aliases: CVE-2017-16086
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T19:46:37Z

Affected versions of `ua-parser` are vulnerable to regular expression denial of service when given a specially crafted `User-Agent` header.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different, functionally equivalent package such as [useragent](https://www.npmjs.com/package/useragent).
Vulnerability: GHSA-g5m5-v5cp-5p7m
Summary: Directory Traversal in wintiwebdev
Aliases: CVE-2017-16181
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:50:16Z

Affected versions of `wintiwebdev` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-cf2x-rqc8-grfq
Summary: Regular expression deinal of service in express-validators
Aliases: CVE-2020-7767
Severity: MODERATE
CWE: CWE-400
Published: 2021-05-10T19:16:27Z

All versions of package express-validators are vulnerable to Regular Expression Denial of Service (ReDoS) when validating specifically-crafted invalid urls.
Vulnerability: GHSA-j27j-4w6m-8fc4
Summary: Path Traversal in statics-server
Aliases: CVE-2019-15596
Severity: MODERATE
CWE: CWE-22
Published: 2020-03-31T17:02:12Z

All versions of `statics-server` are vulnerable to Path Traversal. The package fails to limit access to files outside of the served folder through symlinks.


## Recommendation

No fix is currently available. Do not use `statics-server` in production or consider using an alternative module until a fix is made available.
Vulnerability: GHSA-gcfc-mgg3-8j2c
Summary: Malicious Package in sdfjghlkfjdshlkjdhsfg
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T18:11:29Z

All versions of `sdfjghlkfjdshlkjdhsfg` contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version.


## Recommendation

Remove the package from your environment and ensure all packages owned were not impacted.
Vulnerability: GHSA-4449-hg37-77v8
Summary: Command injection in total.js
Aliases: CVE-2020-28494
Severity: HIGH
CWE: CWE-78
Published: 2021-02-05T20:43:27Z

There is a command injection vulnerability that affects the package total.js before version 3.4.7. The issue occurs in the image.pipe and image.stream functions. The type parameter is used to build the command that is then executed using child_process.spawn. The issue occurs because child_process.spawn is called with the option shell set to true and because the type parameter is not properly sanitized.
Vulnerability: GHSA-qffw-8wg7-h665
Summary: Command injection in git-interface
Aliases: CVE-2022-1440
Severity: CRITICAL
CWE: CWE-78
Published: 2022-04-23T00:03:01Z

A command injection vulnerability exists in git-interface in the GitHub repository yarkeev/git-interface prior to 2.1.2. If both the git remote and destination directory are provided by user input, then the use of an `--upload-pack` command-line argument feature of git is also supported for `git clone`, which would then allow for any operating system command to be spawned by the attacker.
Vulnerability: GHSA-686g-3xr3-x4x6
Summary: Information Exposure on Case Insensitive File Systems in serve
Aliases: CVE-2018-3809
Severity: MODERATE
CWE: CWE-200
Published: 2018-07-18T18:33:15Z

Versions of `serve` before 7.0.0 are vulnerable to information exposure, bypassing the ignore security control, but only on case insensitive file systems.



## Recommendation

Update to version 7.0.0 or later.
Vulnerability: GHSA-h3rx-g5c9-8q4x
Summary: Prototype Pollution in bmoor
Aliases: CVE-2020-7736
Severity: HIGH
CWE: CWE-1321
Published: 2021-05-10T18:37:26Z

The package bmoor before 0.8.12 are vulnerable to Prototype Pollution via the set function.
Vulnerability: GHSA-v2jv-33gh-xx29
Summary: Command Injection in ps-visitor
Aliases: CVE-2021-23374
Severity: CRITICAL
CWE: CWE-77
Published: 2021-05-07T16:06:23Z

This affects all versions up to and including version 0.0.2 of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-vpgc-7h78-gx8f
Summary: Validation bypass vulnerability
Severity: LOW
Published: 2020-09-04T18:05:14Z

Back in min June a security vulnerability was reported to the team, the reason for the slow response was due to ownership of some packages
was locked and we wanted to be sure to update all packages before any disclosure was released.

The issue is deemed being a Low severity vulnerability.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

C# 3.0.2  
D 3.0.1  
Dart 3.0.3  
Elixir 3.0.0  
Go 3.0.1  
Java 3.3.0  
JavaScript 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
PHP 3.0.2  
Perl 3.0.0  
Python 3.0.2  
Ruby 3.0.1  
Rust 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

### Credits

Niklas Sköldmark (Medborgarskolan)
Vulnerability: GHSA-722q-3g9x-vp8q
Summary: Downloads Resources over HTTP in tomita-parser
Aliases: CVE-2016-10666
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:54:41Z

Affected versions of `tomita-parser` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `tomita-parser`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-m2fp-c79h-rr79
Summary: Malicious Package in tensorplow
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:42:56Z

All versions of `tensorplow` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-qwqc-28w3-fww6
Summary: Message Signature Bypass in openpgp
Aliases: CVE-2019-9153
Severity: HIGH
CWE: CWE-347
Published: 2019-08-23T21:42:20Z

Versions of `openpgp` prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type `text`. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as `standalone` or `timestamp`). For example, an attacker that captures a `standalone` signature packet from a victim can construct arbitrary signed messages that would be verified correctly.


## Recommendation

Upgrade to version 4.2.0 or later.
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Vulnerability: GHSA-g8jc-mm3c-cwhj
Summary: Malicious Package in reques
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:31:06Z

All versions of `reques` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-r32x-jhw5-g48p
Summary: Cross-Site Scripting in eco
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T17:08:20Z

All versions of  `eco` are vulnerable to Cross-Site Scripting (XSS). The package's default `__escape` implementation fails to escape single quotes, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-mm7r-265w-jv6f
Summary: Server-Side Request Forgery in @uppy/companion
Aliases: CVE-2020-8135
Severity: HIGH
CWE: CWE-918
Published: 2020-09-03T15:51:19Z

Versions of `@uppy/companion` prior to 1.9.3 are vulnerable to Server-Side Request Forgery (SSRF). The `get` route passes the user-controlled variable `req.body.url` to a GET request without sanitizing the value. This allows attackers to inject arbitrary URLs and make GET requests on behalf of the server. 


## Recommendation

Upgrade to version 1.9.3 or later.
Vulnerability: GHSA-mfwh-5m23-j46w
Summary: Environment Variable Injection in GitHub Actions
Aliases: CVE-2020-15228
Severity: LOW
CWE: CWE-77, CWE-20
Published: 2020-10-01T17:16:20Z

### Impact
The `@actions/core` npm module `addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment variables being modified without the intention of the workflow or action author. 

### Patches
The runner will release an update that disables the `set-env` and `add-path` workflow commands in the near future. For now, users should upgrade to `@actions/core v1.2.6` or later, and replace any instance of the `set-env` or `add-path` commands in their workflows with the new [Environment File Syntax](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files). Workflows and actions using the old commands or older versions of the toolkit will start to warn, then error out during workflow execution.

### Workarounds
None, it is strongly suggested that you upgrade as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Actions Toolkit](https://github.com/actions/toolkit/issues)
Vulnerability: GHSA-vvfh-mvjv-w38q
Summary: Malicious Package in babel-loadre
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:28:19Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-xrrg-wfwc-c7r3
Summary: Malicious Package in bictoin-ops
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:33:52Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-vh59-v9r5-4mh4
Summary: Cross-site scripting in jspdf
Aliases: CVE-2020-7690
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-17T21:01:32Z

It's possible to inject JavaScript code via the html method.
Vulnerability: GHSA-jf8x-wg7f-p3w8
Summary: Malicious Package in cage-js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T18:22:33Z

All versions of `cage-js`  contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-84fq-6626-w5fg
Summary: CORS Token Disclosure in crumb
Aliases: CVE-2014-7193
Severity: MODERATE
CWE: CWE-284
Published: 2017-10-24T18:33:36Z

When CORS is enabled on a hapi route handler, it is possible to set a crumb token for a different domain. An attacker would need to have an application consumer visit a site they control, request a route supporting CORS, and then retrieve the token. With this token, they could possibly make requests to non CORS routes as this user.

A configuration and scenario where this would occur is unlikely, as most configurations will set CORS globally (where crumb is not used), or not at all.


## Recommendation

Update to version 3.0.0 or greater.
Vulnerability: GHSA-rqf8-8c89-mw29
Summary: Cross-site Scripting in curly-bracket-parser
Aliases: CVE-2021-23416
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-10T16:08:16Z

This affects all versions of package curly-bracket-parser.
 When used as a template library, it does not properly sanitize the user input.
Vulnerability: GHSA-9frq-f867-hgqc
Summary: Directory Traversal in fast-http-cli
Aliases: CVE-2017-16155
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:46:25Z

`fast-http-cli` is the command line interface for `fast-http`, a simple web server.

`fast-http-cli` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the url.

Example Request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host: localhost
```
 and server Response:
```
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-xcvv-84j5-jw9h
Summary: Prototype Pollution in assign-deep
Aliases: CVE-2018-3720
Severity: LOW
CWE: CWE-471
Published: 2018-07-26T15:12:31Z

Versions of `assign-deep` before 0.4.7 are vulnerable to prototype pollution via merging functions.


## Recommendation

Update to version 0.4.7 or later.
Vulnerability: GHSA-c94v-8fff-73ph
Summary: Command Injection in @theia/messages
Aliases: CVE-2021-28162
Severity: MODERATE
CWE: CWE-829
Published: 2021-05-10T15:36:55Z

In Eclipse Theia versions up to and including 0.16.0, in the notification messages there is no HTML escaping, so Javascript code can run.
Vulnerability: GHSA-49vv-6q7q-w5cf
Summary: OS Command Injection in Strapi
Aliases: CVE-2019-19609
Severity: HIGH
CWE: CWE-20, CWE-78
Published: 2021-12-10T17:22:12Z

The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.