TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-c7pp-g2v2-2766
Summary: DOM-based XSS in gmail-js
Aliases: CVE-2016-1000228
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T15:32:04Z

Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor.



## Recommendation

Update to version 0.6.5 or later.
Vulnerability: GHSA-65m9-m259-7jqw
Summary: Improper Authorization in react-oauth-flow
Severity: CRITICAL
CWE: CWE-285
Published: 2020-09-03T15:49:29Z

All versions of `react-oauth-flow` fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-3q9x-w53p-jg53
Summary: OS Command Injection in heroku-addonpool
Aliases: CVE-2020-7634
Severity: CRITICAL
CWE: CWE-78
Published: 2021-12-09T19:52:03Z

heroku-addonpool through 0.1.15 is vulnerable to Command Injection.
Vulnerability: GHSA-gr58-j5wh-m333
Summary: Prototype Pollution in nis-utils
Aliases: CVE-2020-7703
Severity: CRITICAL
CWE: CWE-915
Published: 2021-05-06T17:29:08Z

All versions of package nis-utils up to and including 0.6.10 are vulnerable to Prototype Pollution via the setValue function.
Vulnerability: GHSA-4cpg-3vgw-4877
Summary: Prototype pollution in Plist
Aliases: CVE-2022-22912
Severity: CRITICAL
CWE: CWE-1321
Published: 2022-02-18T00:00:33Z

Prototype pollution vulnerability via `.parse()` in Plist allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.
Vulnerability: GHSA-36r8-9qq7-mh43
Summary: Malicious Package in we3b
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:02:40Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-8w4h-3cm3-2pm2
Summary: Out-of-bounds Read in atob
Aliases: CVE-2018-3745
Severity: MODERATE
CWE: CWE-125
Published: 2018-10-09T00:56:26Z

Versions of `atob` before 2.1.0  uninitialized Buffers when number is passed in input on Node.js 4.x and below.


## Recommendation

Update to version 2.1.0 or later.
Vulnerability: GHSA-mg69-6j3m-jvgw
Summary: HTML Injection in marky-markdown
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T15:45:08Z

All versions of `marky-markdown` are vulnerable to HTML Injection. The package fails to sanitize `style` attributes in `img` tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.


## Recommendation

This package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`
Vulnerability: GHSA-c9g6-9335-x697
Summary: Improper Input Validation in SocksJS-Node
Aliases: CVE-2020-7693
Severity: MODERATE
CWE: CWE-20
Published: 2021-04-13T15:27:51Z

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Vulnerability: GHSA-pg53-56cg-4m8q
Summary: Token verification bug in next-auth
Aliases: CVE-2021-21310
Severity: LOW
CWE: CWE-290
Published: 2021-02-11T21:36:24Z

### Impact

Implementations using the **Prisma database adapter** with the **Email provider** **are impacted**.

Implementations using the Prisma database adapter that are not using the Email provider are not impacted.
Implementations using the default database adapter (TypeORM) with the Email provider are not impacted.
Implementations not using a database are not impacted.

### Patches

This issue is fixed in 3.3.0 and newer versions.

### Workarounds

Those not able to upgrade can alternatively disable the Email provider as a workaround.

### Description

The Prisma database adapter was checking the verification token but not the identifier (the email address associated with the token). This made it possible to use a valid token assigned to one user, to sign in as another user when using the Prima adapter in conjunction with the Email provider. The defect is specific to the community-supported Prisma database adapter in versions <3.3.0 and is not present in the default database adapter (TypeORM).

*Note:  The current community-supported adapter was not developed by Prisma.*

The defect was a problem in the implementation of verification function the adapter and is not directly related to Prisma.

The flaw may exist in other third party database adapters that do not check both the identifier and token values.

The design of the database adapter API may be revised in future to help reduce the likelyhood of similar defects.

### Timeline

On Monday (2021-02-08) we were notified via responsible disclosure by Alessandro Angelino (@AlessandroA) of a flaw in the implementation of the Prisma database adapter included with NextAuth.js. A detailed write up and proof of concept were provided.

The following day (2021-02-09) we published a fix in v3.3.0 and confirmed through internal testing, and with Alessandro, that the issue was resolved in the new release and prompted users to upgrade.

On 2021-02-10 we received a CVE ID and published this advisory within a few hours of notification.

We would like to thank Alessandro for using responsible disclose to allow us to address the issue promptly and publish this advisory once an update was available that resolved the issue and Balázs Orbán (@balazsorban44) for facilitating a timely release of the fix.
Vulnerability: GHSA-pwhf-39xg-4rxw
Summary: Script injection
Aliases: CVE-2021-32660
Severity: MODERATE
CWE: CWE-77, CWE-434
Published: 2021-06-04T19:09:35Z

### Impact

A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is hosted on the same origin as the Backstage app or other backend plugins, this may give access to sensitive data.

The ability to upload malicious content may be limited by internal code review processes, unless the chosen TechDocs deployment method is to use an object store and the actor has access to upload files directly to that store.

### Patches

The vulnerability is patched in the `0.6.4` release of `@backstage/techdocs-common`.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-766v-7gjx-55hf
Summary: Malicious Package in js-shq3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:08:34Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-p239-93f7-h6xf
Summary: Cross-Site Scripting in swagger-ui
Aliases: CVE-2016-5682
Severity: CRITICAL
CWE: CWE-79
Published: 2020-09-01T15:30:58Z

Affected versions of `swagger-ui` contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document.


## Proof of Concept
The vulnerable object structure is:
```
{
    "definitions": {
        "arbitraryVal": {
            "properties": {
                "<INJECTABLE_KEY_NAME>": "LoremIpsum"
                }
            }
        }
}
```
Malicious JSON documents can be loaded in by providing a URL to them in the `url` query string parameter.



## Recommendation

Update to version 2.2.1 or later.
Vulnerability: GHSA-w6v7-w58j-pg5r
Summary: Improper Verification of Communication Channel in @theia/plugin-ext
Aliases: CVE-2021-41038
Severity: MODERATE
CWE: CWE-940
Published: 2021-11-15T17:40:51Z

In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().
Vulnerability: GHSA-88g8-f5mf-f5rj
Summary: Improper Initialization in OpenZeppelin
Aliases: CVE-2021-46320
Severity: HIGH
CWE: CWE-665
Published: 2022-02-05T00:00:31Z

In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal proxies) may be reentered if they make an untrusted non-view external call. Once an initializer has finished running it can never be re-executed. However, an exception put in place to support multiple inheritance made reentrancy possible, breaking the expectation that there is a single execution.
Vulnerability: GHSA-rj44-gpjc-29r7
Summary: [thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values
Aliases: CVE-2021-21412
Severity: MODERATE
CWE: CWE-78
Published: 2021-04-06T17:22:41Z

### Impact

Potential for arbitrary code execution in `#gpg`-tagged property values (only if `decrypt: true` option is enabled)

### Patches

[A fix](https://github.com/thi-ng/umbrella/commit/3e14765d6bfd8006742c9e7860bc7d58ae94dfa5) has already been released as v0.4.0

### Workarounds

By default, EGF parse functions do NOT attempt to decrypt values (since GPG is only available in non-browser env).

However, if GPG encrypted values are used/required:

1. Perform a regex search for `#gpg`-tagged values in the EGF source file/string and check for backtick (\`) chars in the encrypted value string
2. Replace/remove them or skip parsing if present...

### References

https://github.com/thi-ng/umbrella/security/advisories/GHSA-rj44-gpjc-29r7#advisory-comment-65261

### For more information

If you have any questions or comments about this advisory, please open an issue in the [thi.ng/umbrella repo](https://github.com/thi-ng/umbrella/issues), of which this package is part of.
Vulnerability: GHSA-92px-q4w8-hrr5
Summary: Malicious Package in impala
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:56:52Z

Version 1.1.7 of `impala` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.1.7 of this module is found installed you will want to replace it with a version before or after 1.1.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-p4pj-mg4r-x6v4
Summary: Denial of Service in uap-core
Aliases: CVE-2021-21317
Severity: HIGH
CWE: CWE-400
Published: 2021-02-02T15:46:38Z

## Impact

Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings.

## Patches

Please update uap-core to >= v0.11.0

Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.
Vulnerability: GHSA-qfc9-x7gv-27jr
Summary: Malicious Package in deasyncp
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T18:12:36Z

All versions of `deasyncp ` contain malicious code. The package shuts down the machine upon installation as a preinstall script.


## Recommendation

Remove the package from your environment. There is no further compromise.
Vulnerability: GHSA-2fw4-mgq9-39cx
Summary: Code Injection in oauth2-server
Aliases: CVE-2017-18924
Severity: HIGH
CWE: CWE-94
Published: 2021-04-22T15:53:45Z

"oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.'"
Vulnerability: GHSA-426h-24vj-qwxf
Summary: Command Injection in npm-programmatic
Aliases: CVE-2020-7614
Severity: CRITICAL
CWE: CWE-20, CWE-78
Published: 2020-04-23T20:09:09Z

All versions of `npm-programmatic ` are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `exec` call on the `install`, `uninstall` and `list` functions . This may allow attackers to execute arbitrary code in the system if the package name passed to the function is user-controlled.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-pfj7-2qfw-vwgm
Summary: Path traversal in translator module in NodeBB
Aliases: CVE-2021-43788
Severity: MODERATE
CWE: CWE-22
Published: 2021-11-30T22:20:43Z

### Impact
Prior to v1.18.5, a path traversal vulnerability was present that allowed users to access JSON files outside of the expected `languages/` directory.

### Patches
The vulnerability has been patched as of v1.18.5.

### Workarounds
Cherry-pick commit hash `c8b2fc46dc698db687379106b3f01c71b80f495f` to receive this patch in lieu of a full upgrade.

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@nodebb.org](mailto:security@nodebb.org)
Vulnerability: GHSA-rc8h-3fv6-pxv8
Summary: Denial of Service in hapi
Aliases: CVE-2015-9241
Severity: HIGH
CWE: CWE-400
Published: 2018-06-07T19:43:15Z

Versions of `hapi` prior to 11.1.3 are affected by a denial of service vulnerability.

The vulnerability is triggered when certain input is passed into the If-Modified-Since or Last-Modified headers.

This causes an 'illegal access' exception to be raised, and instead of sending a HTTP 500 error back to the sender, hapi will continue to hold the socket open until timed out (default node timeout is 2 minutes).





## Recommendation

Update to v11.1.3 or later
Vulnerability: GHSA-fxwf-45c7-4ppr
Summary: Prototype pollution in object-hierarchy-access
Aliases: CVE-2020-28270
Severity: CRITICAL
CWE: CWE-915, CWE-1321
Published: 2021-10-12T16:40:58Z

Overview:Prototype pollution vulnerability in ‘object-hierarchy-access’ versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-c7pp-x73h-4m2v
Summary: Cross-Site Scripting in bootstrap-vue
Severity: HIGH
CWE: CWE-79
Published: 2020-09-02T15:53:46Z

Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.


## Recommendation

Upgrade to version 2.0.0-rc.12 or later.
Vulnerability: GHSA-pxq7-4ppw-qp7f
Summary: Directory Traversal in serverzyy
Aliases: CVE-2017-16135
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:19:36Z

Affected versions of `serverzyy` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-f7gc-6hcj-wc42
Summary: Malicious Package in path-to-regxep
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:05:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-h236-g5gh-vq6c
Summary: Cross-site scripting in Froala Editor
Aliases: CVE-2019-19935
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T23:32:51Z

Froala Editor before 3.0.6 allows XSS.
Vulnerability: GHSA-fqw7-8v6m-2f86
Summary: Malicious Package in hulp
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:37:39Z

All versions of `hulp` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fmf5-j5j9-99pp
Summary: OS Command Injection in pulverizr
Aliases: CVE-2020-7604
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-07T16:20:44Z

pulverizr through 0.7.0 allows execution of arbitrary commands. Within &quot;lib/job.js&quot;, the variable &quot;filename&quot; can be controlled by the attacker. This function uses the variable &quot;filename&quot; to construct the argument of the exec call without any sanitization. In order to successfully exploit this vulnerability, an attacker will need to create a new file with the same name as the attack command.
Vulnerability: GHSA-q43m-ffwr-rpcc
Summary: SSL Validation Defaults to False in electron-packager
Aliases: CVE-2016-10534
Severity: LOW
CWE: CWE-295
Published: 2019-02-18T23:58:24Z

Affected versions of `electron-packager` configure the generated application to disable SSL certificate verification by default. 

This could allow an attacker with a privileged network position to launch a Man In The Middle (MITM) attack on the install process, intercepting the step where electron-packager downloads Electron for supported target platforms and architectures, and replacing the valid download with a tampered malicious one.

This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.


## Recommendation

1. Update to version 7.0.0 or later.
2. Delete the `electron-download` cache folder, which is by default located at `~/.electron`.
Vulnerability: GHSA-57cf-349j-352g
Summary: Out-of-bounds Read in npmconf
Severity: MODERATE
CWE: CWE-125
Published: 2019-06-12T16:37:00Z

Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.


## Recommendation

Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.
Vulnerability: GHSA-vjvw-wcmw-pr26
Summary: Insufficient Entropy in parsel
Severity: CRITICAL
CWE: CWE-331
Published: 2020-09-04T17:37:08Z

All versions of `parsel` use an insecure key derivation function. The package runs keys of arbitrary lengths through one round of SHA256 hashing for key stretching. This allows for the use of keys of insufficient entropy with inappropriate key stretching.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.
Vulnerability: GHSA-rg3q-jxmp-pvjj
Summary: Low severity vulnerability that affects materialize-css
Aliases: CVE-2019-11004
Severity: MODERATE
CWE: CWE-79
Published: 2019-04-09T19:44:37Z

In Materialize through 1.0.0, XSS is possible via the Toast feature.
Vulnerability: GHSA-qv78-398w-cxp7
Summary: Malicious Package in shrugging-logging
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-11T21:08:19Z

All versions of `shrugging-logging` contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking,


## Recommendation

Remove the package from your system. If you own any packages that were compromised please contact npm security immediately at security@npmjs.com. Also enable 2FA for publishing to further secure packages you maintain.
Vulnerability: GHSA-87g3-x896-w798
Summary: Downloads Resources over HTTP in atom-node-module-installer
Aliases: CVE-2016-10620
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:56:53Z

Affected versions of `atom-node-module-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `atom-node-module-installer`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-wxj7-97fp-j53j
Summary: Exposure of Resource to Wrong Sphere in Zip-Local
Aliases: CVE-2021-23484
Severity: CRITICAL
CWE: CWE-668, CWE-29
Published: 2022-02-01T00:46:01Z

The package zip-local before 0.3.5 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) which can lead to an extraction of a crafted file outside the intended extraction directory.
Vulnerability: GHSA-wqr3-24xm-fxhq
Summary: Directory Traversal in wffserve
Aliases: CVE-2017-16168
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:31:22Z

Affected versions of `wffserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-j8qr-rvcv-crhv
Summary: Malicious Package in electron-native-notify
Severity: CRITICAL
Published: 2020-09-11T21:18:05Z

All versions of `electron-native-notify` contain malicious code. The package was part of a targeted attack to steal cryptocurrency wallet seeds and upload them to a remote server, effectively giving attackers access to users wallets.


## Recommendation

Remove the package from your environment and [follow the recommendations by Komodo](https://komodoplatform.com/vulnerability-discovered-in-komodos-agama-wallet-this-is-what-you-need-to-do/)
Vulnerability: GHSA-4jfq-q299-g4cr
Summary: Malicious Package in reqquest
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:28:57Z

All versions of `reqquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-cxwc-8pqp-2whw
Summary: Directory Traversal in qinserve
Aliases: CVE-2017-16197
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:20:40Z

Affected versions of `qinserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-rvj9-8cvx-3vq9
Summary: Invalid Curve Attack in node-jose
Aliases: CVE-2017-16007
Severity: HIGH
CWE: CWE-200
Published: 2018-07-20T21:10:14Z

Affected versions of `node-jose` are vulnerable to an invalid curve attack. This allows an attacker to recover the private secret key when JWE with Key Agreement with Elliptic Curve Diffie-Hellman Ephemeral Static (ECDH-ES) is used.

[Proof of Concept](https://gist.github.com/asanso/fa25685348051ef6a28d49aa0f27a4ae)


## Recommendation

Update to version 0.9.3 or later.
Vulnerability: GHSA-3hjg-vc7r-rcrw
Summary: Denial of Service vulnerability in @podium/layout and @podium/proxy
Aliases: CVE-2022-24822
Severity: HIGH
CWE: CWE-248
Published: 2022-04-07T15:20:23Z

### Impact
An attacker using the `Trailer` header as part of the request against proxy endpoints has the ability to take down the server.
All Podium layouts that include podlets with proxy endpoints are affected.

### Patches
`@podium/layout` which is the main way developers/users are vulnerable to this exploit, has been patched in version `4.6.110`. All earlier versions are vulnerable.
`@podium/proxy` which is the source of the vulnerability and is used by `@podium/layout` has been patched in version `4.2.74`. All earlier versions are vulnerable.

### Workarounds
It is not easily possible to work around this issue without upgrading. We recommend upgrading `@podium/layout` and/or `@podium/proxy` as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [podium-lib/issues](https://github.com/podium-lib/issues)

### Credits
The vulnerability was reported by [krynos](https://hackerone.com/krynos) from [Ercoli Consulting](https://www.ercoliconsulting.eu/) via FINN.no's private bug bounty program
Vulnerability: GHSA-6cpc-mj5c-m9rq
Summary: Arbitrary File Write in cli
Aliases: CVE-2016-10538
Severity: LOW
CWE: CWE-22
Published: 2019-02-18T23:40:03Z

Affected versions of `cli` use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the `cli` process has permission to write to.


## Proof of Concept

By creating Symbolic Links at the following locations, the target of the link can be written to.
```
lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';
```


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-crpm-fm48-chj7
Summary: SQL Injection in resquel
Severity: HIGH
CWE: CWE-89
Published: 2020-09-11T21:13:44Z

All versions of `resquel` are vulnerable to SQL Injection. Query parameters are not properly sanitized, allowing attackers to inject SQL statements and execute arbitrary SQL queries


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-fwvq-x4j9-hr5f
Summary: Malicious Package in bs58chekc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:43:09Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-x67x-98x7-wv26
Summary: OS Command Injection in gulp-tape
Aliases: CVE-2020-7605
Severity: CRITICAL
CWE: CWE-78
Published: 2021-05-07T16:14:56Z

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of &#39;gulp-tape&#39; options.
Vulnerability: GHSA-934w-hvj4-7fr6
Summary: Path Traversal in jsreport-chrome-pdf
Aliases: CVE-2020-7762
Severity: MODERATE
CWE: CWE-22
Published: 2021-04-13T15:25:15Z

This affects the package jsreport-chrome-pdf before 1.10.0.
Vulnerability: GHSA-vxfp-qmpq-6826
Summary: Malicious Package in hpmm
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:38:09Z

All versions of `hpmm` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m489-xr35-fjxr
Summary: Regular Expression Denial of Service in millisecond
Severity: MODERATE
CWE: CWE-400, CWE-1333
Published: 2021-09-22T20:35:08Z

Versions of `millisecond` prior to 0.1.2 are affected by a regular expression denial of service vulnerability when extremely long version strings are parsed.


## Proof of concept
```
var ms = require('millisecond');
var genstr = function (len, chr) {
   var result = "";
   for (i=0; i<=len; i++) {
       result = result + chr;
   }

   return result;
}

ms(genstr(process.argv[2], "5") + " minutea");
```


## Recommendation

Update to version 0.1.2 or later.
Vulnerability: GHSA-4vvg-x86p-mvqc
Summary: Leaking of user information on Cross-Domain communication in sysend
Aliases: CVE-2022-24762
Severity: MODERATE
CWE: CWE-200
Published: 2022-03-14T22:43:23Z

### Impact
Users that use Cross-Origin communication and send sensitive information make it possible for this data to be intercepted.
This is not a big impact because it happens only on the same browser.

### Patches
It has been patched in version 1.10.0

### Workarounds
The only workaround is to not send sensitive information with sysend messages.
Vulnerability: GHSA-3f95-w5h5-fq86
Summary: Prototype Pollution in mergify
Severity: MODERATE
CWE: CWE-1321
Published: 2020-09-11T21:22:24Z

All versions of `mergify` are vulnerable to Prototype Pollution. The `mergify()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative module as the package is deprecated.
Vulnerability: GHSA-926x-m6m5-3mmp
Summary: OS Command Injection
Aliases: CVE-2019-10803
Severity: HIGH
CWE: CWE-78
Published: 2022-02-09T22:50:06Z

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable &quot;opt.branch&quot; is not validated before being provided to the &quot;git&quot; command within &quot;index.js#L139&quot;. This could be abused by an attacker to inject arbitrary commands.
Vulnerability: GHSA-c497-v8pv-ch6x
Summary: Prototype pollution in nested-object-assign
Aliases: CVE-2021-23329
Severity: HIGH
CWE: CWE-400
Published: 2021-02-01T15:01:14Z

The package nested-object-assign before 1.0.4 is vulnerable to Prototype Pollution via the default function.
Vulnerability: GHSA-5g4r-87v2-jqvx
Summary: Downloads Resources over HTTP in apk-parser
Aliases: CVE-2016-10564
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:05:44Z

apk-parser is a tool to extract Android Manifest info from an APK file.

apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

Update to version 0.1.6 or later.
Vulnerability: GHSA-vp8g-53fw-r9f2
Summary: Malicious Package in dynamo-schema
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:54:44Z

Version 0.0.3 of `dynamo-schema` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.3 of this module is found installed you will want to replace it with a version before or after 0.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-xp4x-j9vh-c3wf
Summary: OS Command Injection and Command Injection in kill-port-process
Aliases: CVE-2019-15609
Severity: HIGH
CWE: CWE-77, CWE-78
Published: 2022-02-10T20:20:31Z

The kill-port-process package version &lt; 2.2.0 is vulnerable to a Command Injection vulnerability.
Vulnerability: GHSA-9gj3-hwp5-pmwc
Summary: XSS in the `altField` option of the Datepicker widget in jquery-ui
Aliases: CVE-2021-41182
Severity: MODERATE
CWE: CWE-79
Published: 2021-10-26T14:55:02Z

### Impact
Accepting the value of the `altField` option of the Datepicker widget from untrusted sources may execute untrusted code. For example, initializing the datepicker in the following way:
```js
$( "#datepicker" ).datepicker( {
	altField: "<img onerror='doEvilThing()' src='/404' />",
} );
```
will call the `doEvilThing` function.

### Patches
The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `altField` option is now treated as a CSS selector.

### Workarounds
A workaround is to not accept the value of the `altField` option from untrusted sources.

### For more information
If you have any questions or comments about this advisory, search for a relevant issue in [the jQuery UI repo](https://github.com/jquery/jquery-ui/issues). If you don't find an answer, open a new issue.
Vulnerability: GHSA-r2qc-w64x-6j54
Summary: XSS in Vega
Aliases: CVE-2020-26296
Severity: LOW
CWE: CWE-79
Published: 2020-12-30T23:09:21Z

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package.
In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could
execute arbitrary javascript on a victim's machine.

This is fixed in version 5.17.3
Vulnerability: GHSA-9qj9-36jm-prpv
Summary: Regular Expression Denial of Service in fresh
Aliases: CVE-2017-16119
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T20:16:57Z

Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.


## Recommendation

Update to version 0.5.2 or later.
Vulnerability: GHSA-cc2p-4jhr-xhhx
Summary: False-positive validity for NFT1 genesis transactions in SLPJS
Aliases: CVE-2020-15130
Severity: CRITICAL
CWE: CWE-697
Published: 2020-07-30T14:58:42Z

### Impact
In the npm package named "slpjs", versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.

### Patches
npm package "slpjs" has been patched and is published and tagged as version 0.27.4.

### Workarounds
Upgrade to slpjs 0.27.4.

### References
* Package location: https://www.npmjs.com/package/slpjs
* SLP NFT1 spec: https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements
* Git commit hash fixing this issue: https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c
* Unit tests have been added to assist validator implementations in avoiding this bug: https://github.com/simpleledger/slp-unit-test-data/commit/8c942eacfae12686dcf1f3366321445a4fba73e7

### For more information
If you have any questions or comments about this advisory please open an issue in the [slp-validate](https://github.com/simpleledger/slpjs/issues) repository.
Vulnerability: GHSA-7r2x-3qcm-8vfw
Summary: Downloads Resources over HTTP in herbivore
Aliases: CVE-2016-10665
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:36Z

Affected versions of `herbivore` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `herbivore`.


## Recommendation

The module author has rewritten much of the package, and in that process, patched the vulnerability, but has not published any of the new code to npm.  

In order to get an updated version, it is necessary to install the package from github. This can be done using the following command:
```
npm i samatt/herbivore
```
Vulnerability: GHSA-cph5-m8f7-6c5x
Summary: Incorrect Comparison in axios
Aliases: CVE-2021-3749
Severity: HIGH
CWE: CWE-400, CWE-697
Published: 2021-09-01T18:23:02Z

axios is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-q9wr-gcjc-hq52
Summary: Prototype Pollution in reggae
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-04T15:12:13Z

All versions of `reggae` are vulnerable to prototype pollution. The function `set` does not restrict the modification of an Object's prototype, which may allow a malicious to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-fx7m-j728-mjw3
Summary: Moderate severity vulnerability that affects uap-core
Aliases: CVE-2018-20164
Severity: MODERATE
CWE: CWE-185
Published: 2019-03-06T17:35:47Z

An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
Vulnerability: GHSA-jqjg-v355-hr9q
Summary: Malicious Package in buffer-xop
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:11:02Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-cv3v-7846-6pxm
Summary: Unauthorized File Access in node-git-server
Severity: HIGH
CWE: CWE-552
Published: 2020-09-03T21:15:19Z

Versions of `node-git-server` prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories.


## Recommendation

Upgrade to version 0.6.1 or later.
Vulnerability: GHSA-q324-q795-2q5p
Summary: Path traversal when using `preview-docs` when working dir contains files with question mark `?` in name
Severity: LOW
Published: 2021-10-12T16:05:11Z

### Impact
`preview-docs` command allows path traversal if current working dir contains files with question mark `?` in name and attacker knows the name.

### Patches
It was patched starting from 1.0.0-beta.59

### Workarounds
Do not run openapi-cli preview-docs command in the folder which contains files with question mark `?` in name.

### References
https://github.com/Redocly/openapi-cli/pull/347

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [@redocly/openapi-cli](https://github.com/Redocly/openapi-cli)
* Email us at [security@redocly.com](mailto:security@redocly.com)
Vulnerability: GHSA-j636-crp3-m584
Summary: Cross-site Scripting in tableexport.jquery.plugin
Aliases: CVE-2022-1291
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-11T00:00:22Z

There is a cross-site scripting vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. This can result in transmitting cookies to third-party servers and/or sending data from secure sessions to third-party servers.
Vulnerability: GHSA-j3wh-5m26-2pf7
Summary: Downloads Resources over HTTP in mystem-fix
Aliases: CVE-2016-10698
Severity: HIGH
CWE: CWE-311
Published: 2018-07-27T14:34:11Z

Affected versions of `mystem-fix` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem-fix`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-h4hr-7fg3-h35w
Summary: Denial of service in prismjs
Aliases: CVE-2021-23341
Severity: HIGH
CWE: CWE-400
Published: 2021-03-01T19:52:33Z

The package prismjs before 1.23.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the prism-asciidoc, prism-rest, prism-tap and prism-eiffel components.
Vulnerability: GHSA-p3hc-fv2j-rp68
Summary: Prototype Pollution in swiper
Aliases: CVE-2021-23370
Severity: CRITICAL
CWE: CWE-1321
Published: 2021-05-10T15:36:30Z

Versions of the package swiper before 6.5.1 are susceptible to prototype pollution.
Vulnerability: GHSA-r5fx-8r73-v86c
Summary: Cross-Site Scripting in angular
Aliases: CVE-2019-14863
Severity: MODERATE
CWE: CWE-79
Published: 2020-02-14T23:08:49Z

Versions of `angular` prior to 1.5.0-beta.1 are vulnerable to Cross-Site Scripting. The package fails to sanitize `xlink:href` attributes, which may allow attackers to execute arbitrary JavaScript in a victim's browser if the value is user-controlled.


## Recommendation

Upgrade to version 1.5.0-beta.1 or later.
Vulnerability: GHSA-468q-v4jj-485h
Summary: Inefficient Regular Expression Complexity in taro
Aliases: CVE-2021-3804
Severity: HIGH
CWE: CWE-1333
Published: 2021-09-20T20:09:59Z

taro is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-rjmf-p882-645m
Summary: Improper Certificate Validation
Aliases: CVE-2021-20327
Severity: MODERATE
CWE: CWE-295
Published: 2021-04-12T18:51:17Z

A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate. This vulnerability in combination with a privileged network position active MITM attack could result in interception of traffic between the Node.js driver and the KMS service rendering client-side field level encryption (CSFLE) ineffective. This issue was discovered during internal testing and affects mongodb-client-encryption module version 1.2.0, which was available from 2021-Jan-29 and deprecated in the NPM Registry on 2021-Feb-04. This vulnerability does not impact driver traffic payloads with CSFLE-supported key services from applications residing inside the AWS, GCP, and Azure nework fabrics due to compensating controls in these environments. This issue does not impact driver workloads that don’t use Field Level Encryption.
Vulnerability: GHSA-4cj8-g9cp-v5wr
Summary: High severity vulnerability that affects blueimp-file-upload
Aliases: CVE-2018-9206
Severity: CRITICAL
CWE: CWE-434
Published: 2018-10-22T18:53:56Z

Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
Vulnerability: GHSA-m7xv-7p93-g6q8
Summary: Malicious Package in libubx
Severity: CRITICAL
Published: 2020-09-03T00:35:35Z

Version 1.0.3 of `libubx` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-qj2g-642f-4jrv
Summary: Malicious Package in carloprojectlesang
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:17:30Z

All versions of `carloprojectlesang` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-xmmp-hrmx-x5g7
Summary: Malicious Package in bowe
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:32:22Z

Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-4gfq-6m28-m5mg
Summary: Improper neutralization of arguments in freediskspace
Aliases: CVE-2020-7775
Severity: CRITICAL
CWE: CWE-78
Published: 2021-04-13T15:16:11Z

This affects all versions of package freediskspace. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js.
Vulnerability: GHSA-j6v9-xgvh-f796
Summary: Command Injection in wxchangba
Severity: MODERATE
CWE: CWE-77
Published: 2020-09-11T21:11:34Z

All versions of `wxchangba` are vulnerable to Command Injection. The package does not validate user input on the `reqPostMaterial` function, passing contents of the `file` parameter to an exec call. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-jfx5-7mr2-g8hg
Summary: Malicious Package in alico
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:31:41Z

All versions of `alico` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.