TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-pmw4-jgxx-pcq9
Summary: File System Bounds Escape
Aliases: CVE-2020-26299
Severity: MODERATE
CWE: CWE-22
Published: 2021-02-10T18:11:34Z

### Impact

Clients of FTP servers utilizing `ftp-srv` hosted on Windows machines can escape the  FTP user's defined root folder using the expected FTP commands, for example, `CWD` and `UPDR`.

### Background

When windows separators exist within the path (`\`), `path.resolve` leaves the upper pointers intact and allows the user to move beyond the root folder defined for that user. We did not take that into account when creating the path resolve function.

![Screen Shot 2020-12-15 at 6 42 52 PM](https://user-images.githubusercontent.com/3375444/102293941-5a75fb80-3f05-11eb-9d71-0c190a8dcc75.png)

### Patches
None at the moment.

### Workarounds
There are no workarounds for windows servers. Hosting the server on a different OS mitigates the issue.

### References

Issues: 
https://github.com/autovance/ftp-srv/issues/167
https://github.com/autovance/ftp-srv/issues/225

### For more information
If you have any questions or comments about this advisory:
Open an issue at https://github.com/autovance/ftp-srv.
Please email us directly; security@autovance.com.
Vulnerability: GHSA-6xg2-cf6h-x4v8
Summary: Malicious Package in buffer-por
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:53:05Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-8pww-pp5r-rff8
Summary: Path Traversal in marscode
Aliases: CVE-2020-7681
Severity: HIGH
CWE: CWE-22
Published: 2021-05-07T16:06:03Z

This affects all versionsup to and including version 1.0.1-0 of package marscode. There is no path sanitization in the path provided at fs.readFile in index.js.
Vulnerability: GHSA-4hm7-73ch-vm59
Summary: Malicious Package in buffer-8or
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:49:43Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-gg2g-m5wc-vccq
Summary: Rebuild-bot workflow may allow unauthorised repository modifications
Aliases: CVE-2021-21423
Severity: HIGH
CWE: CWE-527
Published: 2021-04-06T18:36:40Z

### Impact

`projen` is a project generation tool that synthesizes project configuration files such as `package.json`, `tsconfig.json`, `.gitignore`, GitHub Workflows, `eslint`, `jest`, and more, from a well-typed definition written in JavaScript. Users of projen's `NodeProject` project type (including any project type derived from it) include a `.github/workflows/rebuild-bot.yml` workflow that may allow any GitHub user to trigger execution of un-trusted code in the context of the "main" repository (as opposed to that of a fork). In some situations, such untrusted code may potentially be able to commit to the "main" repository.

The rebuild-bot workflow is triggered by comments including `@projen rebuild` on pull-request to trigger a re-build of the projen project, and updating the pull request with the updated files. This workflow is triggered by an `issue_comment` event, and thus always executes with a `GITHUB_TOKEN` belonging to the repository into which the pull-request is made (this is in contrast with workflows triggered by `pull_request` events, which always execute with a `GITHUB_TOKEN` belonging to the repository from which the pull-request is made).

Repositories that do not have branch protection configured on their default branch (typically `main` or `master`) could possibly allow an untrusted user to gain access to secrets configured on the repository (such as NPM tokens, etc). Branch protection prohibits this escalation, as the managed `GITHUB_TOKEN` would not be able to modify the contents of a protected branch and affected workflows must be defined on the default branch. 

### Patches

The issue was mitigated in version `0.16.41` of the `projen` tool, which removes the `issue_comment` trigger from this workflow. Version `0.17.0` of projen completely removes the `rebuild-bot.yml` workflow.

### Workarounds

The recommended way to address the vulnerability is to upgrade `projen`. Users who cannot upgrade `projen` may also remove the `.github/workflows/rebuild-bot.yml` file and add it to their `.gitignore` file (via `projenrc.js`) to mitigate the issue.

### References

The `rebuild-bot.yml` workflow managed by `projen` is only one occurrence of a GitHub Workflows mis-configuration, but it may also be present in other workflows not managed by `projen` (either hand-written, or managed by other tools). For more information on this class of issues, the [Keeping your GitHub Actions and workflows secure: Preventing pwn requests][1] article provides a great overview of the problem.
 

[1]: https://securitylab.github.com/research/github-actions-preventing-pwn-requests
Vulnerability: GHSA-c4w7-xm78-47vh
Summary: Prototype Pollution in y18n
Aliases: CVE-2020-7774
Severity: HIGH
CWE: CWE-915, CWE-20
Published: 2021-03-29T16:05:12Z

### Overview

The npm package `y18n` before versions 3.2.2, 4.0.1, and 5.0.5 is vulnerable to Prototype Pollution. 

### POC

```
const y18n = require('y18n')();

y18n.setLocale('__proto__');
y18n.updateLocale({polluted: true});

console.log(polluted); // true
```

### Recommendation

Upgrade to version 3.2.2, 4.0.1, 5.0.5 or later.
Vulnerability: GHSA-8wgc-jjvv-cv6v
Summary: Improper Authorization in loopback
Severity: HIGH
CWE: CWE-285
Published: 2020-09-02T15:54:52Z

Vulnerable versions of `loopback` may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's `userId`. This will allow the attacker to access the user's data and their privileges.


## Recommendation

For loopback 2.x, upgrade to version 2.40.0 or later
For loopback 3.x, upgrade to version 3.22.0 or later
Vulnerability: GHSA-79qm-h35f-hr77
Summary: OS Command Injection in compile-sass
Aliases: CVE-2019-10799
Severity: HIGH
CWE: CWE-78
Published: 2021-04-13T15:23:13Z

compile-sass prior to 1.0.5 allows execution of arbritary commands. The function &quot;setupCleanupOnExit(cssPath)&quot; within &quot;dist/index.js&quot; is executed as part of the &quot;rm&quot; command without any sanitization.
Vulnerability: GHSA-588m-9qg5-35pq
Summary: Reverse Tabnabbing in quill
Severity: MODERATE
CWE: CWE-1022
Published: 2020-09-03T17:19:09Z

Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-h232-fpqx-mqgr
Summary: Malicious Package in log-symboles
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:03:15Z

Version 2.1.0 of `log-symboles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m57p-p67h-mq74
Summary: Command Injection Vulnerability in systeminformation
Aliases: CVE-2020-26274
Severity: MODERATE
CWE: CWE-78
Published: 2020-12-16T19:25:00Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a shell string sanitation fix. Please upgrade to version >= 4.31.1

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetLatency()

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [systeminformation](https://github.com/sebhildebrandt/systeminformation/issues/new?template=bug_report.md)
Vulnerability: GHSA-6fcr-9h9g-23fq
Summary: Denial of Service in ipfs-bitswap
Severity: MODERATE
CWE: CWE-400
Published: 2020-09-02T21:50:51Z

Versions of `ipfs-bitswap` prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions.


## Recommendation

Upgrade to version 0.24.1 or later.
Vulnerability: GHSA-j4mr-9xw3-c9jx
Summary: Out-of-bounds Read in base64-url
Severity: HIGH
CWE: CWE-125
Published: 2019-05-31T23:47:01Z

Versions of `base64-url` before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.


## Recommendation

Update to version 2.0.0 or later.
Vulnerability: GHSA-rp65-9cf3-cjxr
Summary: Inefficient Regular Expression Complexity in nth-check
Aliases: CVE-2021-3803
Severity: MODERATE
CWE: CWE-1333
Published: 2021-09-20T20:47:31Z

nth-check is vulnerable to Inefficient Regular Expression Complexity
Vulnerability: GHSA-q3gh-5r98-j4h3
Summary: RSA-PSS signature validation vulnerability by prepending zeros in jsrsasign
Aliases: CVE-2020-14968
Severity: CRITICAL
CWE: CWE-119
Published: 2020-06-26T16:26:50Z

### Impact
Jsrsasign can verify RSA-PSS signature which value can expressed as BigInteger. When there is a valid RSA-PSS signature value, this vulnerability is also accept value with prepending zeros as a valid signature.

- If you are not use RSA-PSS signature validation, this vulnerability is not affected. 
- Risk to accept a forged or crafted message to be signed is low.
- Risk to raise memory corruption is low since jsrsasign uses BigInteger class.

### Patches
Users using RSA-PSS signature validation should upgrade to 8.0.17.

### Workarounds
Reject RSA-PSS signatures with unnecessary prepending zeros.

### References
https://github.com/kjur/jsrsasign/security/advisories/GHSA-q3gh-5r98-j4h3
[https://github.com/kjur/jsrsasign/issues/438](https://github.com/kjur/jsrsasign/issues/438)
https://nvd.nist.gov/vuln/detail/CVE-2020-14968
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14968
https://vuldb.com/?id.157125
https://kjur.github.io/jsrsasign/api/symbols/RSAKey.html#.verifyWithMessageHashPSS
Vulnerability: GHSA-59x8-7wx6-4hj9
Summary: Malicious Package in secure_identity_login_module
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:47:52Z

All versions of `secure_identity_login_module` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-f7f4-hqp2-7prc
Summary: Improper Input Validation in sails-hook-sockets
Aliases: CVE-2018-21036
Severity: HIGH
CWE: CWE-20
Published: 2020-07-24T20:10:21Z

Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.
Vulnerability: GHSA-9q9m-m2f6-jr5q
Summary: Malicious Package in chak
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T20:22:34Z

All versions of `chak` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-25jw-gcfj-283j
Summary: Directory Traversal in 360class.jansenhm
Aliases: CVE-2017-16186
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:27:04Z

Affected versions of `360class.jansenhm` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-jp4x-w63m-7wgm
Summary: Prototype Pollution in hoek
Aliases: CVE-2018-3728
Severity: MODERATE
CWE: CWE-471
Published: 2018-04-26T15:25:17Z

Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.

The `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.

This can be demonstrated like so:

```javascript
var Hoek = require('hoek');
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {};
console.log("Before : " + a.oops);
Hoek.merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
```

This type of attack can be used to overwrite existing properties causing a potential denial of service.


## Recommendation

Update to version 4.2.1, 5.0.3 or later.
Vulnerability: GHSA-9gr3-7897-pp7m
Summary: XSS in Image Optimization API for Next.js
Aliases: CVE-2021-39178
Severity: HIGH
CWE: CWE-79
Published: 2021-09-01T18:24:22Z

### Impact
- **Affected:** All of the following must be true to be affected
    - Next.js between version 10.0.0 and 11.1.0
    - The `next.config.js` file has [`images.domains`](https://nextjs.org/docs/basic-features/image-optimization#domains) array assigned
    - The image host assigned in [`images.domains`](https://nextjs.org/docs/basic-features/image-optimization#domains) allows user-provided SVG
- **Not affected**: The `next.config.js` file has [`images.loader`](https://nextjs.org/docs/basic-features/image-optimization#loader) assigned to something other than default
- **Not affected**: Deployments on [Vercel](https://vercel.com) are not affected

### Patches
[Next.js v11.1.1](https://github.com/vercel/next.js/releases/tag/v11.1.1)
Vulnerability: GHSA-v85c-hgq5-7pfw
Summary: Arbitrary Command Injection
Aliases: CVE-2021-23399
Severity: CRITICAL
CWE: CWE-20
Published: 2021-06-29T18:26:05Z

This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-c3hq-7mxh-mqxf
Summary: Sandbox Breakout / Arbitrary Code Execution in lighter-vm
Severity: CRITICAL
Published: 2020-09-04T14:59:50Z

All versions of `lighter-vm` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-26q7-g57v-mxcp
Summary: HTML Injection in shout
Aliases: CVE-2017-16043
Severity: MODERATE
CWE: CWE-80
Published: 2018-11-07T00:28:11Z

Affected versions of `shout` do not escape the `/topic` command in messages, and are therefore vulnerable to cross-site scripting.


## Recommendation

Update to version 0.50.0 or later.
Vulnerability: GHSA-hhrp-qm88-xjr3
Summary: Moderate severity vulnerability that affects valine
Aliases: CVE-2018-19289
Severity: MODERATE
CWE: CWE-79
Published: 2018-11-21T22:19:41Z

An issue was discovered in Valine v1.3.3. It allows HTML injection, which can be exploited for JavaScript execution via an EMBED element in conjunction with a .pdf file.
Vulnerability: GHSA-36vc-cw62-fqvr
Summary: Hijacked Environment Variables in shadowsock
Aliases: CVE-2017-16078
Severity: MODERATE
CWE: CWE-506
Published: 2018-08-27T19:07:23Z

The `shadowsock` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-gvpx-9459-w3mj
Summary: Cross-Site Scripting in @ckeditor/ckeditor5-link
Aliases: CVE-2018-11093
Severity: MODERATE
CWE: CWE-79
Published: 2018-05-23T20:37:46Z

Versions of `status-board` prior to 10.0.1 are vulnerable to Cross-Site Scripting. The `_createPreviewButton()` function fails to sanitize the `href` attribute of a created `<a>` tag. This may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 10.0.1 or later.
Vulnerability: GHSA-6cf8-qhqj-vjqm
Summary: Prototype pollution in total.js
Aliases: CVE-2020-28495
Severity: HIGH
CWE: CWE-400
Published: 2021-02-05T20:43:19Z

There is a prototype pollution vulnerability in the package total.js before version 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized, leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS), Remote Code Execution or Property Injection.
Vulnerability: GHSA-crf7-fvjx-863q
Summary: Path Traversal in zero
Severity: HIGH
CWE: CWE-22
Published: 2020-09-03T17:09:26Z

Versions of `zero` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

Upgrade to version 1.0.6 or later.
Vulnerability: GHSA-hjxc-462x-x77j
Summary: TOCTOU Race Condition in Yarn
Aliases: CVE-2019-15608
Severity: MODERATE
CWE: CWE-367
Published: 2022-02-09T22:49:38Z

The package integrity validation in yarn &lt; 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It&#39;s not computed again when reading from the cache. This may lead to a cache pollution attack. This issue is fixed in 1.19.0.
Vulnerability: GHSA-2p69-gxpm-5469
Summary: Downloads Resources over HTTP in alto-saxophone
Aliases: CVE-2016-10694
Severity: HIGH
CWE: CWE-311
Published: 2018-07-31T22:34:45Z

Affected versions of `alto-saxophone` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `alto-saxophone`.


## Recommendation

Update to version 2.25.1 or later.
Vulnerability: GHSA-5x7p-gm79-383m
Summary: Malicious Package in regenraotr
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T21:11:57Z

All versions of `regenraotr` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-2cf5-4w76-r9qv
Summary: Arbitrary Code Execution in handlebars
Severity: HIGH
Published: 2020-09-04T14:57:38Z

Versions of `handlebars` prior to 3.0.8 or 4.5.2 are vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system. It can be used to run arbitrary code in a server processing Handlebars templates or on a victim's browser (effectively serving as Cross-Site Scripting).

The following template can be used to demonstrate the vulnerability:  
```{{#with "constructor"}}
	{{#with split as |a|}}
		{{pop (push "alert('Vulnerable Handlebars JS');")}}
		{{#with (concat (lookup join (slice 0 1)))}}
			{{#each (slice 2 3)}}
				{{#with (apply 0 a)}}
					{{.}}
				{{/with}}
			{{/each}}
		{{/with}}
	{{/with}}
{{/with}}```


## Recommendation

Upgrade to version 3.0.8, 4.5.2 or later.
Vulnerability: GHSA-649c-x44h-4q7v
Summary: Low severity vulnerability that affects public
Aliases: CVE-2018-16480
Severity: LOW
CWE: CWE-79
Published: 2019-02-07T18:14:37Z

A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering.
Vulnerability: GHSA-gpvj-q7fp-jcch
Summary: Moderate severity vulnerability that affects simplehttpserver
Aliases: CVE-2018-3787
Severity: MODERATE
CWE: CWE-22
Published: 2018-09-06T03:22:59Z

Path traversal in simplehttpserver <v0.2.1 allows listing any file on the server.
Vulnerability: GHSA-wcm2-9c89-wmfm
Summary: Cross-site Scripting in jquery-ui
Aliases: CVE-2010-5312
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:38Z

Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
Vulnerability: GHSA-jvf5-q4h5-2jmj
Summary: Prototype Pollution in madlib-object-utils
Aliases: CVE-2020-7701
Severity: CRITICAL
CWE: CWE-915
Published: 2021-05-06T17:28:57Z

madlib-object-utils before 0.1.7 is vulnerable to Prototype Pollution via setValue.
Vulnerability: GHSA-5v72-xg48-5rpm
Summary: Denial of Service in ws
Severity: HIGH
CWE: CWE-400
Published: 2019-06-04T19:37:52Z

Affected versions of `ws` can crash when a specially crafted `Sec-WebSocket-Extensions` header containing `Object.prototype` property names as extension or parameter names is sent.

## Proof of concept

```
const WebSocket = require('ws');
const net = require('net');

const wss = new WebSocket.Server({ port: 3000 }, function () {
  const payload = 'constructor';  // or ',;constructor'

  const request = [
    'GET / HTTP/1.1',
    'Connection: Upgrade',
    'Sec-WebSocket-Key: test',
    'Sec-WebSocket-Version: 8',
    `Sec-WebSocket-Extensions: ${payload}`,
    'Upgrade: websocket',
    '\r\n'
  ].join('\r\n');

  const socket = net.connect(3000, function () {
    socket.resume();
    socket.write(request);
  });
});
```


## Recommendation

Update to version 3.3.1 or later.
Vulnerability: GHSA-fwcw-5qw2-87mp
Summary: Cross-Site Scripting in fuelux
Aliases: CVE-2016-1000235
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T15:55:56Z

Affected versions of `fuelux` contain a cross-site scripting vulnerability in the Pillbox feature. By supplying a script as a value for a new pillbox, it is possible to cause arbitrary script execution.  



## Recommendation

Update to version 3.15.7 or later.
Vulnerability: GHSA-2p62-c4rm-mr72
Summary: Malicious Package in another-date-picker
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T19:44:57Z

Version 2.0.43 of `another-date-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 2.0.43 of this module is found installed you will want to replace it with a version before or after 2.0.43. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-36c4-4r89-6whg
Summary: Prototype Pollution in @commercial/subtext
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T15:49:02Z

Versions of `@commercial/subtext` prior to 5.1.2 are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

Upgrade to version 5.1.2 or later.
Vulnerability: GHSA-7mpx-vg3c-cmr4
Summary: Improper Authentication in react-adal
Aliases: CVE-2020-7787
Severity: HIGH
CWE: CWE-287
Published: 2021-04-13T15:22:37Z

This affects versions of react-adal < 0.5.1. It is possible for a specially crafted JWT token and request URL can cause the nonce, session and refresh values to be incorrectly validated, causing the application to treat an attacker-generated JWT token as authentic. The logical defect is caused by how the nonce, session and refresh values are stored in the browser local storage or session storage. Each key is automatically appended by ||. When the received nonce and session keys are generated, the list of values is stored in the browser storage, separated by ||, with || always appended to the end of the list. Since || will always be the last 2 characters of the stored values, an empty string ("") will always be in the list of the valid values. Therefore, if an empty session parameter is provided in the callback URL, and a specially-crafted JWT token contains an nonce value of "" (empty string), then adal.js will consider the JWT token as authentic.
Vulnerability: GHSA-6qqj-rx4w-r3cj
Summary: CSRF Vulnerability in jquery-ujs
Severity: MODERATE
CWE: CWE-352
Published: 2020-08-31T22:48:44Z

Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains.

When an attacker controls the href attribute of an anchor tag, or
the action attribute of a form tag triggering a POST action, the attacker can set the
href or action to " https://attacker.com". By prepending a space to the external domain, it causes jQuery to consider it a same origin request, resulting in the user's CSRF token being sent to the external domain.


## Recommendation

Upgrade jquery-ujs to version 1.0.4 or later.
Vulnerability: GHSA-qgfr-5hqp-vrw9
Summary: Path Traversal in decompress
Aliases: CVE-2020-12265
Severity: CRITICAL
CWE: CWE-59, CWE-22
Published: 2020-09-03T21:16:27Z

Versions of `decompress` prior to 4.2.1 are vulnerable to Arbitrary File Write. The package fails to prevent extraction of files with relative paths, allowing attackers to write to any folder in the system by including filenames containing`../`.


## Recommendation

Upgrade to version 4.2.1 or later.
Vulnerability: GHSA-5q5w-mf87-57x4
Summary: Downloads Resources over HTTP in sfml
Aliases: CVE-2016-10654
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:45:18Z

Affected versions of `sfml` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-g336-c7wv-8hp3
Summary: Cross-Site Scripting in swagger-ui
Severity: CRITICAL
CWE: CWE-79
Published: 2020-09-01T15:58:06Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting via the `url` query string parameter.


## Recommendation

Update to 2.2.1 or later.
Vulnerability: GHSA-w3cg-6577-wx9f
Summary: Directory Traversal in cuciuci
Aliases: CVE-2017-16122
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T17:20:41Z

Affected versions of `cuciuci` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-5x8q-gj67-rhf2
Summary: Malicious Package in discord_debug_log
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:18:33Z

All versions of `discord_debug_log` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.
Vulnerability: GHSA-qx9m-27wh-7fjg
Summary: Downloads Resources over HTTP in jvminstall
Aliases: CVE-2016-10631
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:57:03Z

Affected versions of `jvminstall` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `jvminstall`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-pjxw-22xf-6pwc
Summary: Prototype Pollution in defaults-deep
Aliases: CVE-2018-16486
Severity: MODERATE
CWE: CWE-345, CWE-400
Published: 2019-02-07T18:16:38Z

All versions of `defaults-deep` are vulnerable to prototype pollution. Provided certain input `defaults-deep` can add or modify properties of the `Object` prototype. These properties will be present on all objects.


## Recommendation

As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.
Vulnerability: GHSA-mxr5-p36v-479m
Summary: Moderate severity vulnerability that affects jquery-file-upload
Aliases: CVE-2018-9207
Severity: CRITICAL
CWE: CWE-434
Published: 2018-12-19T19:24:03Z

Arbitrary file upload in jQuery Upload File <= 4.0.2
Vulnerability: GHSA-2r8f-2665-3gxq
Summary: Malicious Package in froever
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:36:36Z

All versions of `froever` contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-fhv8-fx5f-7fxf
Summary: Prototype Pollution in the merge and clone helper methods
Aliases: CVE-2021-39227
Severity: MODERATE
CWE: CWE-915, CWE-1321
Published: 2021-09-20T19:53:15Z

### Impact
Using `merge` and `clone` helper methods in the `src/core/util.ts` module will have prototype pollution. It will affect the popular data visualization library Apache ECharts, which is using and exported these two methods directly.

### Patches
 
It has been patched in https://github.com/ecomfe/zrender/pull/826. 
Users should update zrender to `5.2.1`.  and update echarts to `5.2.1` if project is using echarts.

### References
NA

### For more information
NA
Vulnerability: GHSA-6pw2-5hjv-9pf7
Summary: Sandbox bypass in vm2
Aliases: CVE-2021-23555
Severity: CRITICAL
CWE: CWE-1265, CWE-1321
Published: 2022-02-12T00:00:38Z

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
Vulnerability: GHSA-8w3j-g983-8jh5
Summary: Sensitive Data Exposure in parse-server
Aliases: CVE-2019-1020013
Severity: MODERATE
CWE: CWE-209
Published: 2019-07-11T14:23:09Z

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking.
`ParseError.ACCOUNT_ALREADY_LINKED(208)` was thrown BEFORE the AuthController checks the password and throws a `ParseError.SESSION_MISSING(206)` for Insufficient auth.  An attacker can guess ids and get information about linked accounts/email addresses.

### For more information
If you have any questions or comments about this advisory,
Open an issue in the [parse-server](https://github.com/parse-community/parse-server)
[Parse Community Vulnerability Disclosure Program](https://github.com/parse-community/parse-server/blob/master/SECURITY.md)
Vulnerability: GHSA-9mrv-456v-pf22
Summary: Cross-site Scripting in vis-timeline
Aliases: CVE-2020-28487
Severity: MODERATE
CWE: CWE-79
Published: 2021-04-13T15:19:50Z

This affects the package vis-timeline before 7.4.4.
 An attacker with the ability to control the items of a Timeline element can inject additional script code into the generated application.
Vulnerability: GHSA-g95f-p29q-9xw4
Summary: Regular Expression Denial of Service in braces
Severity: LOW
CWE: CWE-400, CWE-185
Published: 2019-06-06T15:30:30Z

Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 2.3.1 or higher.
Vulnerability: GHSA-4fqg-89cc-5pv5
Summary: Malicious Package in sj-labc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T14:58:44Z

All versions of `sj-labc` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-w9q5-mvc6-5cw3
Summary: Malicious Package in bufder-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:45:13Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-mm4f-47ch-f7hx
Summary: Arbitrary code execution in kill-by-port
Aliases: CVE-2021-23363
Severity: MODERATE
CWE: CWE-77
Published: 2021-04-13T15:32:43Z

This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-4p7j-5ppx-rfhm
Summary: Downloads Resources over HTTP in apk-parser3
Aliases: CVE-2016-10574
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:06:49Z

Affected versions of `apk-parser3` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `apk-parser3`.


## Recommendation

Update to version 0.1.3 or greater.
Vulnerability: GHSA-6h7f-qwqm-35pp
Summary: Arbitrary File Read in phantom-html-to-pdf
Aliases: CVE-2020-7763
Severity: HIGH
CWE: CWE-22, CWE-200
Published: 2020-11-06T18:06:16Z

This affects the package phantom-html-to-pdf before 0.6.1.
Vulnerability: GHSA-25v4-mcx4-hh35
Summary: Cross-Site Scripting in atlasboard-atlassian-package
Severity: HIGH
CWE: CWE-79
Published: 2020-09-04T17:28:28Z

All versions of `atlasboard-atlassian-package` prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS).  The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers being able to change issue summaries in Jira tickets.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-6qgx-f452-7699
Summary: Malicious Package in superhappyfuntime
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T23:28:39Z

All versions of `superhappyfuntime` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-wqg7-vrj7-v82h
Summary: High severity vulnerability that affects mosca
Aliases: CVE-2018-11615
Severity: HIGH
CWE: CWE-20
Published: 2018-08-31T06:22:50Z

This vulnerability allows remote attackers to deny service on vulnerable installations of npm mosca 2.8.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of topics. A crafted regular expression can cause the broker to crash. An attacker can leverage this vulnerability to deny access to the target system.
Vulnerability: GHSA-hrgx-7j6v-xj82
Summary: Reflected cross-site scripting (XSS) vulnerability
Aliases: CVE-2022-0087
Severity: HIGH
CWE: CWE-79
Published: 2022-01-12T21:55:40Z

This security advisory relates to a capability for an attacker to exploit a reflected cross-site scripting vulnerability when using the `@keystone-6/auth` package.

#### Impact
The vulnerability can impact users of the administration user interface when following an untrusted link to the `signin` or `init` page.
This is a targeted attack and may present itself in the form of phishing and or chained in conjunction with some other vulnerability.

## Vulnerability mitigation
Please upgrade to `@keystone-6/auth >= 1.0.2`, where this vulnerability has been closed.
If you are using `@keystone-next/auth`,  we **strongly** recommend you upgrade to `@keystone-6`.

### Workarounds
If for some reason you cannot upgrade the dependencies in software, you could alternatively

- disable the administration user interface, or 
- if using a reverse-proxy, strip query parameters when accessing the administration interface

### References
https://owasp.org/www-community/attacks/xss/

Thanks to Shivansh Khari (@Shivansh-Khari) for discovering and reporting this vulnerability
Vulnerability: GHSA-gmv4-r438-p67f
Summary: Leading white space bypasses protocol validation
Aliases: CVE-2022-24723
Severity: MODERATE
CWE: CWE-20
Published: 2022-03-03T19:23:36Z

### Impact
Whitespace characters are not removed from the beginning of the protocol, so URLs are not parsed properly and protocol validation mechanisms may fail.

### Patches
Patched in 1.19.9

### Workarounds
Remove leading whitespace from values before passing them to URI.parse (e.g. via `.href(value)` or `new URI(value)`), e.g. by using

```js
function remove_whitespace(url){
     const whitespace = /^[\x00-\x20\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000\ufeff]+/;
     url = url.replace(whitespace, '')
     return url
}
```

### References
* https://huntr.dev/bounties/82ef23b8-7025-49c9-b5fc-1bb9885788e5/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [medialize/URI.js](https://github.com/medialize/URI.js/)
Vulnerability: GHSA-ph8p-2g97-9654
Summary: Downloads Resources over HTTP in jstestdriver
Aliases: CVE-2016-10643
Severity: HIGH
CWE: CWE-311
Published: 2018-08-15T19:27:25Z

Affected versions of `jstestdriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `jstestdriver`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2011.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-38f9-m297-6q9g
Summary: DoS via malicious record IDs in WatermelonDB
Aliases: CVE-2020-4035
Severity: MODERATE
CWE: CWE-89
Published: 2020-06-03T21:57:53Z

## Impact

Medium severity 5.9 https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H

A maliciously crafted record ID can exploit a SQL Injection vulnerability in iOS adapter implementation and cause the app to delete all or selected records from the database, generally causing the app to become unusable.

This may happen in apps that don't validate IDs (valid IDs are `/^[a-zA-Z0-9_-.]+$/`) and use Watermelon Sync or low-level `database.adapter.destroyDeletedRecords` method.

The integrity risk is low due to the fact that maliciously deleted records won't synchronize, so logout-login will restore all data, although some local changes may be lost if the malicious deletion causes the sync process to fail to proceed to push stage.

No way to breach confidentiality with this vulnerability is known. Full exploitation of SQL Injection is mitigated, because it's not possible to nest an insert/update query inside a delete query in SQLite, and it's not possible to pass a semicolon-separated second query. There's also no known practicable way to breach confidentiality by selectively deleting records, because those records will not be synchronized.

It's theoretically possible that selective record deletion could cause an app to behave insecurely if lack of a record is used to make security decisions by the app. 

## Patches

Patched versions include:

- 0.15.1
- 0.16.2
- 0.16.1-fix
	- this is actually the same as 0.16.0, but with the patch applied - as 0.16.1 is causing issues for some users
- `924c7ae2a8d` commit id contains the patch

## Workarounds

1. Ensure that your backend service sanitizes record IDs sent in the `pull sync` endpoint, such that only IDs matching `/^[a-zA-Z0-9_-.]+$/` are returned. This could also be done in JavaScript `pullChanges` function passed to `synchronize()`
2. If you use `destroyDeletedRecords` directly, validate all IDs passed the same way

## For more information

If you have any questions about this advisory, contact @radex.
Vulnerability: GHSA-6xhf-x49c-m5m6
Summary: Github Token Leak in aegir
Aliases: CVE-2017-16225
Severity: HIGH
CWE: CWE-200
Published: 2018-07-24T20:04:11Z

Affected versions of `aegir` bundle and publish the current users github token to npm when `aegir-release` is executed.


## Recommendation

Update to version 12.0.8 or later.

If you used this module to do a release for your project you should invalidate the GitHub tokens that were leaked.
Vulnerability: GHSA-fvwr-h9xh-m6wc
Summary: Denial of Service in @commercial/subtext
Severity: HIGH
Published: 2020-09-03T20:33:17Z

Versions of `@commercial/subtext` prior to 5.1.1 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 5.1.1 or later.
Vulnerability: GHSA-gmxv-xf2q-6j8m
Summary: Cross-Site Scripting in m-server
Aliases: CVE-2018-16484
Severity: MODERATE
CWE: CWE-79
Published: 2019-02-07T18:16:16Z

Versions of `m-server` before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that `m-server` is serving.


## Recommendation

Update to version 1.4.2 or later.
Vulnerability: GHSA-r8f7-9pfq-mjmv
Summary: Improper Certificate Validation in node-sass
Aliases: CVE-2020-24025
Severity: MODERATE
CWE: CWE-295
Published: 2022-02-09T22:22:24Z

Certificate validation in node-sass 2.0.0 to 6.0.1 is disabled when requesting binaries even if the user is not specifying an alternative download path.