TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-xfrc-7mj2-5xh9
Summary: Undefined Behavior in zencashjs
Severity: CRITICAL
Published: 2020-09-03T17:14:51Z

Versions of `zencashjs` prior to 1.2.0 may cause loss of funds when used with cryptocurrency wallets. The package relies on a string comparison of the first two characters of a Horizen address to determine the destination address type of a transaction (P2PKH or P2SH). Due to the base58 address prefixes chosen in Horizen there exists the possibility of a clash of address prefixes for testnet P2PKH and mainnet P2SH addresses, testnet P2PKH addresses start with “zt” while a subset of mainnet P2SH addresses can also start with “zt”. The package interprets transactions sent to a “zt” P2SH address on mainnet as P2PKH transactions erroneously. Any funds sent to a mainnet P2SH multisignature address starting with “zt” will be sent to the wrong address and be lost.


## Recommendation

Upgrade to version 1.2.0 or later.
Vulnerability: GHSA-wgvj-6v57-wjh3
Summary: Malicious Package in bowee
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T21:30:14Z

Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-mw35-24gh-f82w
Summary: High severity vulnerability that affects keycloak-connect and keycloak-js
Aliases: CVE-2017-7474
Severity: HIGH
CWE: CWE-253
Published: 2017-11-15T20:41:51Z

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly.  An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
Vulnerability: GHSA-5p98-wpc9-g498
Summary: Server-Side Request Forgery in html-pdf-chrome
Severity: HIGH
CWE: CWE-918
Published: 2020-09-04T15:21:32Z

All versions of `html-pdf-chrome` are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as `<iframe src="http://localhost" height="800px" width="800px"></iframe>`. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-m2r3-8492-vx59
Summary: Denial of Service (DoS) in mongo-express
Aliases: CVE-2021-23372
Severity: MODERATE
CWE: CWE-754
Published: 2021-10-06T17:47:46Z

All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash.
Vulnerability: GHSA-fxwf-4rqh-v8g3
Summary: Insecure defaults due to CORS misconfiguration in socket.io
Aliases: CVE-2020-28481
Severity: MODERATE
CWE: CWE-453, CWE-346
Published: 2021-01-20T21:22:37Z

The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Vulnerability: GHSA-jff2-qjw8-5476
Summary: Command Injection Vulnerability in systeminformation
Aliases: CVE-2021-21388
Severity: HIGH
CWE: CWE-77, CWE-78
Published: 2021-04-06T17:30:14Z

### Impact
command injection vulnerability

### Patches
Problem was fixed with a parameter check. Please upgrade to version >= 5.6.4

### Workarounds
If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Vulnerability: GHSA-5955-9wpr-37jh
Summary: Arbitrary File Creation/Overwrite on Windows via insufficient relative path sanitization
Aliases: CVE-2021-37713
Severity: HIGH
CWE: CWE-22
Published: 2021-08-31T16:05:05Z

### Impact

Arbitrary File Creation, Arbitrary File Overwrite, Arbitrary Code Execution

node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain `..` path portions, and resolving the sanitized paths against the extraction target directory.

This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as `C:some\path`.  If the drive letter does not match the extraction target, for example `D:\extraction\dir`, then the result of `path.resolve(extractionDirectory, entryPath)` would resolve against the current working directory on the `C:` drive, rather than the extraction target directory.

Additionally, a `..` portion of the path could occur immediately after the drive letter, such as `C:../foo`, and was not properly sanitized by the logic that checked for `..` within the normalized and split portions of the path.

This only affects users of `node-tar` on Windows systems.

### Patches

4.4.18 || 5.0.10 || 6.1.9

### Workarounds

There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does.

Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

### Fix

The fixed versions strip path roots from all paths prior to being resolved against the extraction target folder, even if such paths are not "absolute".

Additionally, a path starting with a drive letter and then two dots, like `c:../`, would bypass the check for `..` path portions.  This is checked properly in the patched versions.

Finally, a defense in depth check is added, such that if the `entry.absolute` is outside of the extraction taret, and we are not in preservePaths:true mode, a warning is raised on that entry, and it is skipped.  Currently, it is believed that this check is redundant, but it did catch some oversights in development.
Vulnerability: GHSA-98f7-p5rc-jx67
Summary: Cross-Site Scripting in materialize-css
Aliases: CVE-2019-11002
Severity: MODERATE
CWE: CWE-79
Published: 2019-04-09T19:44:40Z

All versions of `materialize-css` are vulnerable to Cross-Site Scripting. The `tooltip` component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Vulnerability: GHSA-cr6c-85fh-cqpg
Summary: Downloads Resources over HTTP in haxeshim
Aliases: CVE-2016-10692
Severity: HIGH
Published: 2018-07-31T22:27:04Z

Affected versions of `haxeshim` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxeshim`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-qh2h-chj9-jffq
Summary: Command Injection in growl
Aliases: CVE-2017-16042
Severity: CRITICAL
CWE: CWE-94
Published: 2018-06-08T12:43:43Z

Affected versions of `growl` do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.


## Recommendation

Update to version 1.10.2 or later.
Vulnerability: GHSA-446w-rrm4-r47f
Summary: Exposure of home directory through shescape on Unix with Bash
Aliases: CVE-2022-24725
Severity: MODERATE
CWE: CWE-200
Published: 2022-03-03T19:26:11Z

### Impact

The issue allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected.

```javascript
const cp = require("child_process");
const shescape = require("shescape");

const payload = "home_directory=~";
const options = { interpolation: true };
console.log(cp.execSync(`echo ${shescape.escape(payload, options)}`));
// home_directory=/home/user
```

Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_.

### Patches

The issue was patched in `v1.5.1`.

### Workarounds

Manually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, "\\~")`.

### References

See GitHub issue https://github.com/ericcornelissen/shescape/issues/169.
Vulnerability: GHSA-jrj9-5qp6-2v8q
Summary: Machine-In-The-Middle in airtable
Severity: HIGH
Published: 2020-09-03T23:22:19Z

Affected versions of `airtable` are vulnerable to Machine-In-The-Middle. The package has SSL certificate validation disabled by default unintentionally. This may allow attackers in a privileged network position to decrypt intercepted traffic.


## Recommendation

Upgrade to version 0.7.2 or later.
Vulnerability: GHSA-552w-rqg8-gxxm
Summary: Moderate severity vulnerability that affects validator
Aliases: CVE-2013-7453
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:36Z

The validator module before 1.1.0 for Node.js allows remote attackers to bypass the cross-site scripting (XSS) filter via vectors related to UI redressing.
Vulnerability: GHSA-5726-g6r9-5f22
Summary: Potential for Script Injection in syntax-error
Aliases: CVE-2014-7192
Severity: HIGH
CWE: CWE-94
Published: 2017-10-24T18:33:36Z

Versions of `syntax-error` prior to 1.1.1 are affected by a cross-site scripting vulnerability which may allow a malicious file to execute code when browserified. 

## Recommendation

Update to version 1.1.1 or later.
Vulnerability: GHSA-9298-m7jf-55h2
Summary: Malicious Package in bitconid-rpc
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-04T16:42:08Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-pxqp-mv67-g528
Summary: Malicious Package in bqffer-xor
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:38:34Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-5jg5-w395-9684
Summary: Directory Traversal in ltt
Aliases: CVE-2017-16212
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:39:59Z

Affected versions of `ltt` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-x5r6-x823-9848
Summary: Arbitrary Code Execution in json-ptr
Aliases: CVE-2020-7766
Severity: HIGH
CWE: CWE-74, CWE-400
Published: 2021-05-10T19:15:43Z

npm `json-ptr` before 2.0.0 has an arbitrary code execution vulnerability. The issue occurs in the set operation (https://flitbit.github.io/json-ptr/classes/_src_pointer_.jsonpointer.htmlset) when the force flag is set to true. The function recursively set the property in the target object, however it does not properly check the key being set, leading to a prototype pollution.
Vulnerability: GHSA-h6ch-v84p-w6p9
Summary: Regular Expression Denial of Service (ReDoS)
Severity: HIGH
CWE: CWE-400
Published: 2019-06-13T18:58:54Z

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.
Vulnerability: GHSA-fwr7-v2mv-hh25
Summary: Prototype Pollution in async
Aliases: CVE-2021-43138
Severity: HIGH
CWE: CWE-1321
Published: 2022-04-07T00:00:17Z

A vulnerability exists in Async through 3.2.1 for 3.x and through 2.6.3 for 2.x (fixed in 3.2.2 and 2.6.4), which could let a malicious user obtain privileges via the `mapValues()` method.
Vulnerability: GHSA-4vfj-c2xf-8r48
Summary: Directory Traversal in looppake
Aliases: CVE-2017-16169
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T20:45:20Z

Affected versions of `looppake` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-f7vx-j8mp-3h2x
Summary: Insufficient Verification of Data Authenticity in Eclipse Theia
Aliases: CVE-2019-17636
Severity: HIGH
CWE: CWE-345
Published: 2021-04-13T15:18:01Z

In Eclipse Theia versions 0.3.9 through 0.15.0, one of the default pre-packaged Theia extensions is "Mini-Browser", published as "@theia/mini-browser" on npmjs.com. This extension, for its own needs, exposes a HTTP endpoint that allows to read the content of files on the hosts filesystem, given their path, without restrictions on the requesters origin. This design is vulnerable to being exploited remotely through a DNS rebinding attack or a drive-by download of a carefully crafted exploit.
Vulnerability: GHSA-cfhh-xgwq-5r67
Summary: Sudden swap of user auth tokens in Volto
Aliases: CVE-2022-24740
Severity: MODERATE
CWE: CWE-287
Published: 2022-03-14T22:15:19Z

### Impact
Due to the usage of an outdated version of the react-cookie library, under the circumstances of given a server high load, it is possible that a user could get his/her auth cookie replaced with the auth cookie from another user, effectively giving him full access to the other users account and privileges. A proven exploit for this vulnerability does not exist, since the exact requisites for it to happen have not been fully clarified, and the attempts to reproduce it under testing conditions have been unsuccessful, but it still can happen randomly and unintentionally in the wild. 

### Patches
The patch and fix is present in Volto 15.0.0-alpha.0 (or later). See PR: https://github.com/plone/volto/pull/3051.
We recommend upgrading to the final release of Volto 15 as soon as possible if running an affected version.
See the upgrade guide https://6-dev-docs.plone.org/volto/upgrade-guide/index.html#upgrading-to-volto-15-x-x

### Workarounds
It is possible to create a fix by manually upgrading the react-cookie package to 4.1.1 and then overriding all Volto components that use this library as in https://github.com/plone/volto/pull/3051. As this is substantial work, an update to the Volto 15 is recommended. The upgrade steps for going from Volto 14 to Volto 15 are quite easy and do not involve any complexity. Please take a look at the upgrade guide: https://6-dev-docs.plone.org/volto/upgrade-guide/index.html#upgrading-to-volto-15-x-x


### For more information
If you have any questions or comments about this advisory:
* Open an issue in [volto](https://github.com/plone/volto/issues)
* Email us at [security@plone.org](mailto:security@plone.org)
Vulnerability: GHSA-w7jx-j77m-wp65
Summary: Cross-site scripting vulnerability in TinyMCE
Severity: MODERATE
CWE: CWE-79
Published: 2021-01-06T19:27:54Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the URL sanitization logic of the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor using the clipboard or APIs. This impacts all users who are using TinyMCE 5.5.1 or lower.

### Patches
This vulnerability has been patched in TinyMCE 5.6.0 by improved URL sanitization logic.

### Workarounds
To work around this vulnerability, either:
- Upgrade to TinyMCE 5.6.0 or higher
- Manually sanitize `iframe`, `object` and `embed` URL attributes using a [TinyMCE node filter](https://www.tiny.cloud/docs/api/tinymce.html/tinymce.html.domparser/#addnodefilter).
- Disable `iframe`, `object`, and `embed` elements in your content using the [invalid_elements](https://www.tiny.cloud/docs/configure/content-filtering/#invalid_elements) setting.

#### Example: Sanitizing using a node filter
```js
editor.parser.addNodeFilter('iframe,object,embed', function(nodes) {
  nodes.forEach(function(node) {
    if (node.attributes) {
      node.attributes.forEach(function(attr) {
        var name = attr.name;
        var value = attr.value;
        // Sanitize the attribute value here or remove it entirely
        var sanitizedValue = ...;
        node.attr(name, santizedValue);
      });
    }
  });
});
```

#### Example: Using invalid_elements
```js
invalid_elements: 'iframe,object,embed'
```

### Acknowledgements
Tiny Technologies would like to thank Aaron Bishop at SecurityMetrics for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes56/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)
Vulnerability: GHSA-rrqm-p222-8ph2
Summary: Prototype Pollution in Dynamoose
Aliases: CVE-2021-21304
Severity: MODERATE
CWE: CWE-915, CWE-1321
Published: 2021-02-08T17:44:01Z

### Impact

In Dynamoose versions 2.0.0-2.6.0 there was a prototype pollution vulnerability in the internal utility method [`lib/utils/object/set.ts`](https://github.com/dynamoose/dynamoose/blob/master/lib/utils/object/set.ts). This method is used throughout the codebase for various operations throughout Dynamoose.

We have not seen any evidence of this vulnerability being exploited.

We do not believe this issue impacts v1.x.x since this method was added as part of the v2 rewrite. This vulnerability also impacts v2.x.x beta/alpha versions.

### Patches

v2.7.0 includes a patch for this vulnerability.

### Workarounds

We are unaware of any workarounds to patch this vulnerability other than upgrading to v2.7.0 or greater.

### References

- Patch commit hash: 324c62b4709204955931a187362f8999805b1d8e

### For more information

If you have any questions or comments about this advisory:

* [Contact me](https://charlie.fish/contact)
* [Read our Security Policy](https://github.com/dynamoose/dynamoose/blob/master/SECURITY.md)

### Credit

- GitHub CodeQL Code Scanning
Vulnerability: GHSA-vv7g-pjw9-4qj9
Summary: Malicious Package in scrytsy
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T17:03:56Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Vulnerability: GHSA-rmmc-8cqj-hfp3
Summary: Authentication Bypass in otpauth
Severity: HIGH
CWE: CWE-287
Published: 2020-09-03T18:24:43Z

Versions of `otpauth` prior to 3.2.8 are vulnerable to Authentication Bypass. The package's `totp.validate()` function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens.


## Recommendation

Upgrade to version 3.2.8 or later.
Vulnerability: GHSA-w7fj-336r-vw49
Summary: Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend
Aliases: CVE-2021-43776
Severity: HIGH
CWE: CWE-79
Published: 2021-12-01T18:29:21Z

### Impact
This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but it is expected that some deployments have these policies disabled due to incompatibilities.

### Patches
This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.

### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-jqh7-w5pr-cr56
Summary: Cross-site scripting in koa-shopify-auth
Aliases: CVE-2020-8176
Severity: MODERATE
CWE: CWE-79
Published: 2021-05-17T21:01:22Z

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.
Vulnerability: GHSA-m7p2-ghfh-pjvx
Summary: Vulnerability in crunch function leads to arbitrary code execution via filePath parameters
Aliases: CVE-2020-36380
Severity: CRITICAL
CWE: CWE-77, CWE-78
Published: 2021-11-01T19:18:51Z

aaptjs is a node wraper for aapt. An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameters.
Vulnerability: GHSA-5mrr-rgp6-x4gr
Summary: Command Injection in marsdb
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-03T19:39:05Z

All versions of `marsdb` are vulnerable to Command Injection. In the `DocumentMatcher` class, selectors on `$where` clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Vulnerability: GHSA-f9mq-jph6-9mhm
Summary: Arbitrary file read via window-open IPC in Electron
Aliases: CVE-2020-4075
Severity: MODERATE
CWE: CWE-552
Published: 2020-07-07T00:01:13Z

### Impact
The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.

### Workarounds
Ensure you are calling `event.preventDefault()` on all [`new-window`](https://electronjs.org/docs/api/web-contents#event-new-window) events where the `url` or `options` is not something you expect.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)
Vulnerability: GHSA-2fqv-h3r5-m4vf
Summary: Cross Site Scripting (XSS) in plotly.js
Aliases: CVE-2017-1000006
Severity: MODERATE
CWE: CWE-79
Published: 2017-10-24T18:33:35Z

Affected versions of `plotly.js` are vulnerable to cross-site scripting if an attacker can convince a user to visit a malicious plot on a site using this package.


## Recommendation

Update to 1.16.0 or later.
Vulnerability: GHSA-jpg7-6c9f-7q54
Summary: Directory Traversal in datachannel-client
Aliases: CVE-2017-16121
Severity: HIGH
CWE: CWE-22
Published: 2018-07-23T23:15:21Z

Affected versions of `datachannel-client` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation


No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-5j3g-jfq3-7jwx
Summary: Arbitrary JavaScript Execution in bassmaster
Aliases: CVE-2014-7205
Severity: CRITICAL
CWE: CWE-94
Published: 2017-10-24T18:33:36Z

A vulnerability exists in bassmaster <= 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval.


## Recommendation

Update to bassmaster version 1.5.2 or greater.
Vulnerability: GHSA-gjm5-83cw-p3p2
Summary: Prototype Pollution in extend2
Aliases: CVE-2021-23568
Severity: HIGH
CWE: CWE-1321
Published: 2022-01-12T22:59:13Z

The package extend2 before 1.0.1 are vulnerable to Prototype Pollution via the extend function due to unsafe recursive merge.
Vulnerability: GHSA-mg3m-f475-28hv
Summary: Path Traversal in @backstage/plugin-scaffolder-backend
Aliases: CVE-2021-43783
Severity: HIGH
CWE: CWE-22
Published: 2021-12-01T18:28:51Z

### Impact
A malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance.

This vulnerability can in some situation also be exploited through user input when executing a template, meaning you do not need write access to the templates. This method will not allow the attacker to control the contents of the injected file however, unless the template is also crafted in a specific way that gives control of the file contents.

### Patches
This vulnerability is fixed in version `0.15.14` of the `@backstage/plugin-scaffolder-backend`.

### Workarounds
This attack is mitigated by restricting access and requiring reviews when registering or modifying scaffolder templates.

### For more information
If you have any questions or comments about this advisory:

* Open an issue in the [Backstage repository](https://github.com/backstage/backstage)
* Visit our chat, linked to in [Backstage README](https://github.com/backstage/backstage)
Vulnerability: GHSA-hfq9-rfpv-j8r8
Summary: Command Injection in pidusage
Aliases: CVE-2017-16034
Severity: CRITICAL
CWE: CWE-77
Published: 2020-09-01T16:49:19Z

Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.
 
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable. 

## Proof of Concept
```
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
```


## Recommendation

Update to version 1.1.5 or later.
Vulnerability: GHSA-7j52-6fjp-58gr
Summary: Inconsistent storage layout for ERC2771ContextUpgradeable
Severity: LOW
Published: 2022-03-14T23:22:27Z

### Impact

The storage layout of the ERC2771ContextUpgradeable is not constant between versions. 
- versions `4.0.0`, `4.1.0` and `4.2.0`, the contract has a length of 51 slots. 
- since `4.3.0`, the contract has a length of 50 slots
- future versions will continue using 50 slots. 

This difference in layout could result in breaking upgrades if someone upgrades from an affected version to a non-affected version. It is thus recommended to be extremely careful when upgrading from a contract that uses ERC2771ContextUpgradeable `<4.3.0` to a newer version that uses `>=4.3.0`.

We've assessed the instances of this contract found on chain (with publicly verified source code) and notified the corresponding teams of the risk that an upgrade could cause.

### Workarounds

Potentially breaking upgrades would be caught by the OpenZeppelin Upgrades Plugins for Hardhat and Truffle. It is recommended to use this tooling for all your upgrades.

If you need to upgrade to a newer version of the Upgradeable Contracts library, we recommend copying the previous implementation ERC2771ContextUpgradeable (available in the `release-4.2` branch) and packaging it with your code.

### Reference

https://github.com/OpenZeppelin/openzeppelin-transpiler/pull/86

### For more information

If you have any questions, comments, or need assistance regarding this advisory, email us at [security@openzeppelin.com](mailto:security@openzeppelin.com).

To submit security reports please use [our bug bounty on Immunefi](https://immunefi.com/bounty/openzeppelin/).
Vulnerability: GHSA-vxwf-pprx-wc25
Summary: Directory Traversal in citypredict.whauwiller
Aliases: CVE-2017-16104
Severity: HIGH
CWE: CWE-22
Published: 2018-07-24T00:10:03Z

Affected versions of `citypredict.whauwiller` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.
Vulnerability: GHSA-339j-hqgx-qrrx
Summary: Prototype Pollution
Aliases: CVE-2021-23395
Severity: HIGH
CWE: CWE-1321
Published: 2021-06-21T17:13:06Z

This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a __proto__ or constructor.prototype payload.
Vulnerability: GHSA-7hvm-29rf-2gf2
Summary: Downloads Resources over HTTP in node-air-sdk
Aliases: CVE-2016-10647
Severity: HIGH
CWE: CWE-311
Published: 2020-09-01T16:08:58Z

Affected versions of `node-air-sdk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `node-air-sdk`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-2hqf-qqmq-pgpp
Summary: Malicious Package in commander-js
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-02T15:48:16Z

All versions of `commander-js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads an arbitrary file and executes its contents as a post-install script.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.
Vulnerability: GHSA-cvxm-f295-x957
Summary: Prototype Pollution in merge-recursive
Aliases: CVE-2018-3751
Severity: CRITICAL
CWE: CWE-20
Published: 2018-09-18T13:46:06Z

All versions of `merge-recursive` are vulnerable to Prototype Pollution. When malicious user input is merged with another object it allows the attacker to modify the prototype of Object via `__proto__` causing the addition or modification of an existing property.

Proof of concept:

```
var merge = require('merge-recursive').recursive;
var malicious_payload = '{"__proto__":{"oops":"It works !"}}';

var a = {};
console.log("Before : " + a.oops);
merge({}, JSON.parse(malicious_payload));
console.log("After : " + a.oops);
```


## Recommendation

There is currently no fix available.
Vulnerability: GHSA-v5hp-35hw-cw5x
Summary: XSS in client rendered block templates in rendr
Aliases: CVE-2016-1000230
Severity: HIGH
CWE: CWE-79
Published: 2020-09-01T15:33:10Z

Affected versions of `rendr` are vulnerable to cross-site scripting when client side rendering is done inside a `_block`.

Server side rendering is not affected and is properly escaped.


## Recommendation

Update to version 1.1.4 or later.
Vulnerability: GHSA-6v7p-j23v-4xmw
Summary: Downloads Resources over HTTP in robot-js
Aliases: CVE-2016-10608
Severity: HIGH
CWE: CWE-311
Published: 2019-02-18T23:48:03Z

Affected versions of `robot-js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `robot-js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Vulnerability: GHSA-q5wr-fvpq-p67g
Summary: Integer Overflow in png-img
Aliases: CVE-2020-28248
Severity: HIGH
CWE: CWE-190, CWE-787
Published: 2021-12-10T17:23:30Z

An integer overflow in the PngImg::InitStorage_() function of png-img before 3.1.0 leads to an under-allocation of heap memory and subsequently an exploitable heap-based buffer overflow when loading a crafted PNG file.
Vulnerability: GHSA-vhhw-xjvf-wprr
Summary: Command Injection in @graphql-tools/git-loader
Aliases: CVE-2021-23326
Severity: MODERATE
CWE: CWE-77
Published: 2021-01-29T18:13:14Z

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.
Vulnerability: GHSA-6gp3-h3jj-prx4
Summary: Prototype pollution in class-transformer
Aliases: CVE-2020-7637
Severity: MODERATE
CWE: CWE-915
Published: 2020-04-07T15:47:40Z

class-transformer through 0.2.3 is vulnerable to Prototype Pollution. The 'classToPlainFromExist' function could be tricked into adding or modifying properties of 'Object.prototype' using a '__proto__' payload.
Vulnerability: GHSA-mp55-2274-4pj8
Summary: Malicious Package in buffer-xgr
Severity: CRITICAL
CWE: CWE-506
Published: 2020-09-03T21:54:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.
Vulnerability: GHSA-7f59-x49p-v8mq
Summary: Cross-Site Scripting in swagger-ui
Aliases: CVE-2016-1000226
Severity: CRITICAL
CWE: CWE-79
Published: 2020-09-01T15:28:45Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.

Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.

## Proof of Concept

```
http://<USER_HOSTNAME>/swagger-ui/index.html?url=http://<MALICIOUS_HOSTNAME>/malicious-swagger-file.json
````



## Recommendation

Update to version 2.2.1 or later.
Vulnerability: GHSA-j5c2-hm46-wp5c
Summary: Privilege escalation: all users can access Admin-level API keys
Aliases: CVE-2021-39192
Severity: MODERATE
CWE: CWE-269, CWE-200
Published: 2021-07-22T19:43:16Z

### Impact
An error in the implementation of the limits service in 4.0.0 allows all authenticated users (including contributors) to view admin-level API keys via the integrations API endpoint, leading to a privilege escalation vulnerability.

Ghost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.9.4. Immediate action should be taken to secure your site - see patches & workarounds below.

It is highly recommended to regenerate all API keys after patching or applying the workaround below.

### Patches
Fixed in 4.10.0, all 4.x sites should upgrade as soon as possible.

### Workarounds
- Disable all non-Administrator accounts to prevent API access.

### For more information
If you have any questions or comments about this advisory:
* email us at security@ghost.org

---
Credits: Aden Yap Chuen Zhen, BAE Systems Applied Intelligence (Malaysia)
Vulnerability: GHSA-89q5-mj78-pw5w
Summary: Cross-site Scripting in pekeupload
Aliases: CVE-2021-23673
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-02T17:52:26Z

This affects all versions of package pekeupload. If an attacker induces a user to upload a file whose name contains javascript code, the javascript code will be executed.
Vulnerability: GHSA-vg44-fw64-cpjx
Summary: Incorrect Account Used for Signing
Severity: HIGH
CWE: CWE-287
Published: 2020-03-24T15:08:59Z

### Impact

Anybody using this library to sign with a BIP44 account other than the first account may be affected. If a user is signing with the first account (i.e. the account at index `0`), or with the legacy MEW/MyCrypto HD path, they are not affected.

The vulnerability impacts cases where the user signs a personal message or transaction without first adding the account. This includes cases where the user has already added the account in a previous session (i.e. they added the account, reset the application, then signed something). The serialization/deserialization process does restore a previously added account, but it doesn&#39;t restore the index instructing the keyring to use that account for signing. As a result, after serializing then deserializing the keyring state, the account at index `0` is always used for signing even if it isn&#39;t the current account.

### Patches

This has been patched ([#14](https://github.com/MetaMask/eth-ledger-bridge-keyring/pull/14)) in version &gt;=0.2.1 of [`eth-ledger-bridge-keyring`](https://www.npmjs.com/package/eth-ledger-bridge-keyring), and in version &gt;=0.2.2 of [`@metamask/eth-ledger-bridge-keyring`](https://www.npmjs.com/package/@metamask/eth-ledger-bridge-keyring). Users are encouraged to migrate to the new package name.

### Workarounds

To work around this problem without updating, you should remove then re-add the account before use. As long as the account was added during the lifetime of that process, signing with that account should work correctly.

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [MetaMask/eth-ledger-bridge-keyring on GitHub](https://github.com/MetaMask/eth-ledger-bridge-keyring)
* Email the MetaMask team at [hello@metamask.io](mailto:hello@metamask.io)
Vulnerability: GHSA-v7cp-5326-54fh
Summary: Path Traversal in bruteser
Severity: HIGH
CWE: CWE-22
Published: 2020-09-03T16:45:15Z

Versions of `bruteser` prior to 0.1.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 0.1.0 or later.
Vulnerability: GHSA-prfq-f66g-43mp
Summary: Information disclosure through error object in auth0.js
Aliases: CVE-2020-5263
Severity: HIGH
CWE: CWE-522
Published: 2020-04-10T18:19:10Z

## Overview
Between versions 8.0.0 and  9.13.1(inclusive), in the case of an (authentication) error, the error object returned by the library contains the original request of the user, which may include the plaintext password the user entered. 

If the error object is exposed or logged without modification, the application risks password exposure.

## Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using Auth0.js version between 8.0.0 and 9.13.1(inclusive).
- You store or display error objects without filtering. 

## How to fix that?
Developers should upgrade auth0.js to version 9.13.2 or later where user inputted passwords are masked in errors. If upgrading is not possible, a temporary fix may include not storing the error object or displaying it publicly without modification.

## Will this update impact my users?

This fix patches the Auth0.js and may require changes in application code due to password no longer available in error object, but it will not impact your users, their current state, or any existing sessions.
Vulnerability: GHSA-6663-c963-2gqg
Summary: DoS due to excessively large websocket message in ws
Aliases: CVE-2016-10542
Severity: HIGH
CWE: CWE-400
Published: 2019-02-18T23:58:35Z

Affected versions of `ws` do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.



## Recommendation

Update to version 1.1.1 or later. 
Alternatively, set the `maxpayload` option for the `ws` server to a value smaller than 256MB.
Vulnerability: GHSA-v756-4whv-48vc
Summary: Code Injection in cd-messenger
Aliases: CVE-2020-7675
Severity: CRITICAL
CWE: CWE-94
Published: 2021-05-17T21:00:24Z

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the `color` argument executed by the `eval` function resulting in code execution.
Vulnerability: GHSA-x4jg-mjrx-434g
Summary: Improper Verification of Cryptographic Signature in node-forge
Aliases: CVE-2022-24772
Severity: HIGH
CWE: CWE-347
Published: 2022-03-18T23:10:28Z

### Impact

RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used.

### Patches

The issue has been addressed in `node-forge` `1.3.0`.

### References

For more information, please see
["Bleichenbacher's RSA signature forgery based on implementation error"](https://mailarchive.ietf.org/arch/msg/openpgp/5rnE9ZRN1AokBVj3VqblGlP63QE/)
by Hal Finney.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [forge](https://github.com/digitalbazaar/forge)
* Email us at [example email address](mailto:security@digitalbazaar.com)
Vulnerability: GHSA-rrc9-gqf8-8rwg
Summary: Prototype Pollution via file load in aws-sdk and @aws-sdk/shared-ini-file-loader
Aliases: CVE-2020-28472
Severity: HIGH
CWE: CWE-400
Published: 2021-11-16T21:26:43Z

This affects the package @aws-sdk/shared-ini-file-loader before 1.0.0-rc.9; the package aws-sdk before 2.814.0. If an attacker submits a malicious INI file to an application that parses it with loadSharedConfigFiles , they will pollute the prototype on the application. This can be exploited further depending on the context.
Vulnerability: GHSA-22j5-38qv-pxx7
Summary: Hijacked Environment Variables in sqliter
Aliases: CVE-2017-16051
Severity: MODERATE
CWE: CWE-506
Published: 2018-07-23T20:50:04Z

The `sqliter` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.
Vulnerability: GHSA-884w-698f-927f
Summary: Arbitrary File Write via Archive Extraction in unzipper
Aliases: CVE-2018-1002203
Severity: HIGH
CWE: CWE-22
Published: 2018-07-27T17:06:50Z

Versions of `unzipper` before 0.8.13 are vulnerable to arbitrary file write when used to extract a specifically crafted archive that contains path traversal filenames (`../../file.txt` for example).


## Recommendation

Update to version 0.3.18 or later.
Vulnerability: GHSA-9cq4-mhmr-84gm
Summary: Malicious Package in jasmin
Severity: CRITICAL
Published: 2020-09-01T20:26:49Z

Version 0.0.3 of `jasmin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.3 of this module is found installed you will want to replace it with a version before or after 0.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.
Vulnerability: GHSA-hgch-jjmr-gp7w
Summary: Sandbox Breakout / Arbitrary Code Execution in safer-eval
Aliases: CVE-2019-10760
Severity: CRITICAL
CWE: CWE-94
Published: 2019-10-17T18:27:30Z

Versions of `safer-eval` before 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.


## Recommendation

Upgrade to version 1.3.2.
Vulnerability: GHSA-v26w-gcxh-v4r7
Summary: Prototype polluation in just-safe-set
Aliases: CVE-2021-25952
Severity: CRITICAL
CWE: CWE-915, CWE-1321
Published: 2021-12-10T18:50:40Z

Prototype pollution vulnerability in ‘just-safe-set’ versions 1.0.0 through 2.2.1 allows an attacker to cause a denial of service and may lead to remote code execution.
Vulnerability: GHSA-5cv7-r488-wc5x
Summary: Hijacked Environment Variables in noderequest
Aliases: CVE-2017-16073
Severity: MODERATE
CWE: CWE-506
Published: 2018-09-17T20:39:17Z

The `noderequest` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.