aswin1906/github-advisory-2019.csv huggingface dataset:
Slanger Arbitrary command execution
Advisory: GHSA-rg32-m3hf-772v
Aliases: CVE-2019-1010306
Published: 2019-07-16T00:41:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: slanger
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.6.1
cwe_ids: CWE-502
severity: CRITICAL

Slanger 0.6.0 is affected by Remote Code Execution (RCE). The impact is A remote attacker can execute arbitrary commands by sending a crafted request to the server. The component is Message handler & request validator. The attack vector is Remote unauthenticated. The fixed version is after commit 5267b455caeb2e055cccf0d2b6a22727c111f5c3.
Exposure of Sensitive Information to an Unauthorized Actor in ansible
Advisory: GHSA-grgm-pph5-j5h7
Aliases: CVE-2019-10156
Published: 2019-07-31T04:22:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: ansible
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.6.18
package: ecosystem: PyPI
name: ansible
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.12
package: ecosystem: PyPI
name: ansible
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.2
cwe_ids: CWE-200
severity: MODERATE

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
Regular Expression Denial of Service (ReDoS) in lodash
Advisory: GHSA-x5rq-j2xg-h7qm
Aliases: CVE-2019-1010266
Published: 2019-07-19T16:13:07Z
Affected: package: ecosystem: npm
name: lodash
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.17.11
package: ecosystem: npm
name: lodash-es
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.17.11
package: ecosystem: npm
name: lodash-amd
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.17.11
cwe_ids: CWE-400
severity: MODERATE

lodash prior to 4.7.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.7.11.
MadsKristensen.AspNetCore.Miniblog subject to Improper Input Validation
Advisory: GHSA-958r-g534-ccmr
Aliases: CVE-2019-9845
Published: 2019-07-05T21:11:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: MadsKristensen.AspNetCore.Miniblog
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.3
cwe_ids: CWE-20
severity: CRITICAL

madskristensen Miniblog.Core through 2019-01-16 allows remote attackers to execute arbitrary ASPX code via an IMG element with a data: URL, because SaveFilesToDisk in Controllers/BlogController.cs writes a decoded base64 string to a file without validating the extension.
Insufficient Entropy in DotNetNuke
Advisory: GHSA-pf46-gqg9-j3v3
Aliases: CVE-2018-15812
Published: 2019-07-05T21:08:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: NuGet
name: DotNetNuke.Core
ranges: type: ECOSYSTEM
events: introduced: 9.2.0
fixed: 9.2.2
cwe_ids: CWE-331
severity: HIGH

DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy.
Python-saml allows manipulation of SAML data without invalidation of cryptographic signature
Advisory: GHSA-j8j8-348v-wfm3
Aliases: CVE-2017-11427
Published: 2019-07-05T21:11:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: package: ecosystem: PyPI
name: python-saml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.0
cwe_ids: CWE-287
severity: HIGH

OneLogin PythonSAML 2.3.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Path Traversal vulnerability that affects yard
Advisory: GHSA-xfhh-rx56-rxcr
Aliases: CVE-2019-1020001
Published: 2019-07-02T15:28:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: RubyGems
name: yard
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.9.20
cwe_ids: CWE-22
severity: HIGH

## Possible arbitrary path traversal and file access via `yard server`

### Impact

A path traversal vulnerability was discovered in YARD <= 0.9.19 when using `yard server` to serve documentation. This bug would allow unsanitized HTTP requests to access arbitrary files on the machine of a yard server host under certain conditions.

Thanks to CuongMX from Viettel Cyber Security for discovering this vulnerability.

### Patches

Please upgrade to YARD v0.9.20 immediately if you are relying on yard server to host documentation in any untrusted environments.

### Workarounds

For users who cannot upgrade, it is possible to perform path sanitization of HTTP requests at your webserver level. WEBrick, for example, can perform such sanitization by default (which you can use via `yard server -s webrick`), as can certain rules in your webserver configuration.
Path Traversal in http-file-server
Advisory: GHSA-2mp5-m968-gwr2
Aliases: CVE-2019-5447
Published: 2019-07-16T00:41:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: npm
name: http-file-server
ranges: type: ECOSYSTEM
events: 0
database_specific: last_known_affected_version_range: < 0.2.6
cwe_ids: CWE-22
severity: MODERATE

All versions of `http-file-server` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Improper Input Validation and Cross-Site Request Forgery in Keycloak
Advisory: GHSA-p5xp-6vpf-jwvh
Aliases: CVE-2019-10199
Published: 2019-09-23T18:32:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.keycloak:keycloak-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 7.0.0
database_specific: last_known_affected_version_range: <= 6.0.1
cwe_ids: CWE-20
CWE-352
severity: HIGH

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.
Cross-site scripting in padrino-contrib
Advisory: GHSA-rwpr-83g3-96g7
Aliases: CVE-2019-16145
Published: 2019-09-23T18:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: RubyGems
name: padrino-contrib
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.0
cwe_ids: CWE-79
severity: MODERATE

The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.
OS Command Injection in Nexus Yum Repository Plugin
Advisory: GHSA-g5m7-57ph-j6p8
Aliases: CVE-2019-5475
Published: 2019-09-11T23:04:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.sonatype.nexus.plugins:nexus-yum-repository-plugin
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.14.14
cwe_ids: CWE-78
severity: HIGH

The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data, such as the Yum Configuration Capability.
Path Traversal in algo-httpserv
Advisory: GHSA-cgjv-rghq-qhgp
Published: 2019-09-11T23:00:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Affected: package: ecosystem: npm
name: algo-httpserv
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.2
cwe_ids: CWE-22
severity: HIGH

Versions of `algo-httpserv` prior to 1.1.2 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 1.1.2 or later.
Polymorphic Typing issue in FasterXML jackson-databind
Advisory: GHSA-h822-r4r5-v8jg
Aliases: CVE-2019-14540
Published: 2019-09-23T18:33:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.10
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.8.11.5
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.6.7.3
cwe_ids: CWE-502
severity: CRITICAL

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. It is related to `com.zaxxer.hikari.HikariConfig`.
Incorrect Resource Transfer Between Spheres in eclipse-wtp
Advisory: GHSA-gvxv-5fp2-358q
Aliases: CVE-2019-10753
Published: 2019-09-11T23:08:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: com.diffplug.spotless:spotless-eclipse-wtp
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.9.6
package: ecosystem: Maven
name: com.diffplug.spotless:spotless-eclipse-cdt
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 9.4.4
package: ecosystem: Maven
name: com.diffplug.spotless:spotless-eclipse-groovy
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.1
cwe_ids: CWE-669
severity: MODERATE

In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
Cross-site scripting in Sakai
Advisory: GHSA-q8wc-9xvp-g3c3
Aliases: CVE-2019-16148
Published: 2019-09-23T18:33:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.sakaiproject:chat-base
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 12.6
cwe_ids: CWE-79
severity: MODERATE

Sakai through 12.6 allows XSS via a chat user name.
Authentication Bypass in Devise
Advisory: GHSA-fcjw-8rhj-gwwc
Aliases: CVE-2019-16109
Published: 2019-09-11T23:06:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: RubyGems
name: devise
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.7.1
cwe_ids: CWE-284
severity: MODERATE

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
Cross-Site Request Forgery in MicroPyramid Django CRM
Advisory: GHSA-pg2f-r7pc-6fxx
Aliases: CVE-2019-11457
Published: 2019-09-11T22:57:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: django-crm
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.1
cwe_ids: CWE-352
severity: HIGH

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/.
Undefined Behavior in sailsjs-cacheman
Advisory: GHSA-5w65-6875-rhq8
Published: 2019-09-11T23:01:57Z
Affected: package: ecosystem: npm
name: sailsjs-cacheman
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.0
severity: LOW

All versions of `sailsjs-cacheman` have a vulnerability that may lead to Undefined Behavior. The config variable is exposing to the global scope which may overwrite other variables and cause the application to misbehave.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Improper Input Validation in simple_form
Advisory: GHSA-r74q-gxcg-73hx
Aliases: CVE-2019-16676
Published: 2019-09-30T19:41:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: simple_form
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 5.0.0
cwe_ids: CWE-20
severity: CRITICAL

## Incorrect Access Control in `file_method?` in `lib/simple_form/form_builder.rb`; a user-supplied string is invoked as a method call

### Impact
For pages that build a form using user input, it is possible for an attacker to manipulate the input and send any method present in the form object. For example:

```erb
<%= simple_form_for @user do |f| %>
  <%= f.label @user_supplied_string %>
  ...
<% end %>
```

The string provided in the variable `@user_supplied_string` would be invoked as a method call inside the `@user` object (unless the string contains any of the following: `password`, `time_zone`, `country`, `email`, `phone` and `url`).

By manipulation that input, an attacker could do any of the following:

- Code execution (call actions like `#destroy`)
- Denial of Service (by executing a computation intensive method)
- Information Disclosure (check the presence of methods, leak user information)

### Patches
The problem was fixed in version `5.0`. Although it's a major version, there should be no issues with upgrading for `4.x`. The reason it was released in a major version is that the configuration `SimpleForm.file_methods` was deprecated in order to fix the problem.

### Workarounds
The issue only happens with pages that build forms based on user-provided input. If your application doesn't do that, you're not affected.
A workaround is to explicitly pass which type you want for an input since the issue lies on Simple Form's automatically discovery of input types. This can be done using the `as` option, like the following:
```erb
<%= form.input :avatar, as: :file %>
```

### References
[TDB]

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/plataformatec/simple_form](https://github.com/plataformatec/simple_form)
* Email us at [opensource@plataformatec.com.br](mailto:opensource@plataformatec.com.br)
Path Traversal in statichttpserver
Advisory: GHSA-2j5x-56p6-hj6x
Aliases: CVE-2019-5480
Published: 2019-09-04T10:02:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: npm
name: statichttpserver
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.9.7
cwe_ids: CWE-22
severity: MODERATE

All versions of `statichttpserver` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Sensitive Data Exposure in seneca
Advisory: GHSA-2xwv-3cc9-fp7c
Aliases: CVE-2019-5483
Published: 2019-09-11T23:07:57Z
Affected: package: ecosystem: npm
name: seneca
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.9.0
cwe_ids: CWE-209
severity: LOW

Versions of `seneca` prior to 3.9.0 are vulnerable to Sensitive Data Exposure. When a process using the package crashes all environment variables are printed. This may leak sensitive data such as access keys, especially given scenarios when log-monitoring systems store the error output.


## Recommendation

Upgrade to version 3.9.0 or later.
Command Injection in gitlabhook
Advisory: GHSA-549f-73hh-mj38
Aliases: CVE-2019-5485
Published: 2019-09-16T22:24:02Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: gitlabhook
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.17
cwe_ids: CWE-78
severity: CRITICAL

All versions of `gitlabhook` are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Timing attack on HMAC signature comparison in Apache Tapestry
Advisory: GHSA-fgmr-vx7c-5wj6
Aliases: CVE-2019-10071
Published: 2019-09-26T21:30:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.tapestry:tapestry-core
ranges: type: ECOSYSTEM
events: introduced: 5.4
fixed: 5.4.5
cwe_ids: CWE-203
CWE-697
severity: CRITICAL

The code which checks HMAC in form submissions used String.equals() for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.
Rubyzip denial of service 
Advisory: GHSA-5m2v-hc64-56h6
Aliases: CVE-2019-16892
Published: 2019-09-30T16:05:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: package: ecosystem: RubyGems
name: rubyzip
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.0
cwe_ids: CWE-400
severity: MODERATE

In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).
Unintended Require in larvitbase-api
Advisory: GHSA-xf27-jqwv-gf3r
Aliases: CVE-2019-5479
Published: 2019-09-11T23:03:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: larvitbase-api
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.5.5
cwe_ids: CWE-829
severity: HIGH

Versions of `larvitbase-api` prior to 0.5.4 are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is running.


## Recommendation

Upgrade to version 0.5.4 or later.
Critical severity vulnerability that affects generator-jhipster
Advisory: GHSA-mwp6-j9wf-968c
Published: 2019-09-13T21:33:25Z
Withdrawn: 2020-06-26T16:40:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: generator-jhipster
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.3.0
cwe_ids: CWE-338
severity: CRITICAL

Account takeover and privilege escalation is possible in applications generated by generator-jhipster before 6.3.0. This is due to a vulnerability in the generated java classes: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Generated applications must be manually patched, following instructions in the release notes: https://www.jhipster.tech/2019/09/13/jhipster-release-6.3.0.html
Buffer Overflow in centra
Advisory: GHSA-v6cj-r88p-92rm
Published: 2019-09-30T19:31:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: centra
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.0
cwe_ids: CWE-119
severity: HIGH

## Denial of Service

### Impact

Affected Centra versions will, when not in stream mode, buffer responses to requests into memory with no size limit. This issue affects anyone requesting content from untrusted sources.

### Patches

Version 2.4.0 resolves the issue by limiting the size of buffered response body.

### Workarounds

Attempting workarounds isn't recommended. Updating is preferred.

### For more information

If you have any questions or comments about this advisory, open an issue in [ethanent/centra](https://github.com/ethanent/centra).
Airbrake keys not being filtered
Advisory: GHSA-2p82-v77v-mppr
Aliases: CVE-2019-16060
Published: 2019-09-11T23:05:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: airbrake-ruby
ranges: type: ECOSYSTEM
events: introduced: 4.2.3
fixed: 4.2.4
versions: 4.2.3
cwe_ids: CWE-200
severity: CRITICAL

The Airbrake Ruby notifier 4.2.3 for Airbrake mishandles the blacklist_keys configuration option and consequently may disclose passwords to unauthorized actors. This is fixed in 4.2.4 (also, 4.2.2 and earlier are unaffected).
Improper Handling of Exceptional Conditions and Origin Validation Error in Eclipse Paho Java client library
Advisory: GHSA-63qc-p2x4-9fgf
Aliases: CVE-2019-11777
Published: 2019-09-17T22:47:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.eclipse.paho:org.eclipse.paho.client.mqttv3
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.1
cwe_ids: CWE-346
CWE-755
severity: MODERATE

In the Eclipse Paho Java client library version 1.2.0, when connecting to an MQTT server using TLS and setting a host name verifier, the result of that verification is not checked. This could allow one MQTT server to impersonate another and provide the client library with incorrect information.
Cross-Site Scripting in dojo
Advisory: GHSA-536q-8gxx-m782
Aliases: CVE-2010-2273
Published: 2019-09-11T23:02:57Z
Affected: package: ecosystem: npm
name: dojo
ranges: type: ECOSYSTEM
events: introduced: 1.13.0
fixed: 1.13.1
versions: 1.13.0
package: ecosystem: npm
name: dojo
ranges: type: ECOSYSTEM
events: introduced: 1.12.0
fixed: 1.12.4
package: ecosystem: npm
name: dojo
ranges: type: ECOSYSTEM
events: introduced: 1.11.0
fixed: 1.11.6
package: ecosystem: npm
name: dojo
ranges: type: ECOSYSTEM
events: introduced: 1.10.0
fixed: 1.10.10
cwe_ids: CWE-79
severity: MODERATE

Versions of `dojo` prior to 1.4.2 are vulnerable to DOM-based Cross-Site Scripting (XSS). The package does not sanitize URL parameters in the `_testCommon.js` and `runner.html` test files, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.4.2 or later.