aswin1906/github-advisory-2019.csv huggingface dataset:
mistune Cross-site scripting (XSS) vulnerability
Advisory: GHSA-98gj-wwxm-cj3h
Aliases: CVE-2017-16876
Published: 2019-01-04T17:47:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: mistune
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.8.1
cwe_ids: CWE-79
severity: MODERATE

Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument.
Apache Thrift Node.js static web server sandbox escape
Advisory: GHSA-vx85-mj8c-4qm6
Aliases: CVE-2018-11798
Published: 2019-01-17T13:56:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.thrift:libthrift
ranges: type: ECOSYSTEM
events: introduced: 0.9.2
fixed: 0.12.0
cwe_ids: CWE-538
severity: MODERATE

The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.
Django Open redirect and possible XSS attack via user-supplied numeric redirect URLs
Advisory: GHSA-37hp-765x-j95x
Aliases: CVE-2017-7233
Published: 2019-01-04T17:50:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.10
fixed: 1.10.7
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.9
fixed: 1.9.13
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.8
fixed: 1.8.18
cwe_ids: CWE-601
severity: MODERATE

Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.
High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind
Advisory: GHSA-c8hm-7hpq-7jhg
Aliases: CVE-2018-19362
Published: 2019-01-04T19:07:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.8
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.3
database_specific: last_known_affected_version_range: <= 2.8.11.2
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.9.5
database_specific: last_known_affected_version_range: <= 2.7.9.4
cwe_ids: CWE-502
severity: HIGH

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
Arbitrary Code Execution in jackson-databind
Advisory: GHSA-4gq5-ch57-c2mg
Aliases: CVE-2018-14719
Published: 2019-01-04T19:09:49Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.7
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.3
database_specific: last_known_affected_version_range: <= 2.8.11.2
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.7.9.5
database_specific: last_known_affected_version_range: <= 2.7.9.4
cwe_ids: CWE-502
severity: CRITICAL

FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
Improper Authentication in Apache Karaf
Advisory: GHSA-cq9c-55r7-455x
Aliases: CVE-2018-11787
Published: 2019-01-07T19:14:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.karaf:apache-karaf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.9
package: ecosystem: Maven
name: org.apache.karaf:apache-karaf
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.0.9
package: ecosystem: Maven
name: org.apache.karaf:apache-karaf
ranges: type: ECOSYSTEM
events: introduced: 4.1.0
fixed: 4.1.1
versions: 4.1.0
cwe_ids: CWE-287
severity: HIGH

In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised.
react-dev-utils on Windows vulnerable to Remote Code Execution
Advisory: GHSA-29gp-92wp-94q8
Aliases: CVE-2018-6342
Published: 2019-01-04T17:41:20Z
Affected: package: ecosystem: npm
name: react-dev-utils
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.0.4
package: ecosystem: npm
name: react-dev-utils
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.2
package: ecosystem: npm
name: react-dev-utils
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.1.2
package: ecosystem: npm
name: react-dev-utils
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.2.2
package: ecosystem: npm
name: react-dev-utils
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.0.2
cwe_ids: CWE-78
severity: HIGH

`react-dev-utils` on Windows is vulnerable to remote code execution.


## Recommendation

Update to one of the following versions, depending on the release line that you are using.
- 1.0.4
- 2.0.2
- 3.1.2
- 4.2.2
- 5.0.2
- 6.0.0-next.a671462c
Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters
Advisory: GHSA-2f9x-5v75-3qv4
Aliases: CVE-2018-7537
Published: 2019-01-04T17:50:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.0
fixed: 2.0.3
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11
fixed: 1.11.11
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.8
fixed: 1.8.19
cwe_ids: CWE-185
severity: MODERATE

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Django open redirect
Advisory: GHSA-h4hv-m4h4-mhwg
Aliases: CVE-2017-7234
Published: 2019-01-04T17:50:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.10
fixed: 1.10.7
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.9
fixed: 1.9.13
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.8
fixed: 1.8.18
cwe_ids: CWE-601
severity: MODERATE

A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the `django.views.static.serve()` view could redirect to any other domain, aka an open redirect vulnerability.
rendertron XSS vulnerability
Advisory: GHSA-j88m-953w-8r2c
Aliases: CVE-2017-18352
Published: 2019-01-07T19:14:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: rendertron
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0
cwe_ids: CWE-79
severity: MODERATE

Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.
XML External Entity Reference in mchange:c3p0
Advisory: GHSA-q485-j897-qc27
Aliases: CVE-2018-20433
Published: 2019-01-07T19:14:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.mchange:c3p0
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.9.5.3
database_specific: last_known_affected_version_range: <= 0.9.5.2
cwe_ids: CWE-611
severity: CRITICAL

c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream in com/mchange/v2/c3p0/cfg/C3P0ConfigXmlUtils.java during initialization.
XML External Entity Reference in Apache Karaf
Advisory: GHSA-92wj-x78c-m4fx
Aliases: CVE-2018-11788
Published: 2019-01-07T19:14:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.karaf.specs:org.apache.karaf.specs.java.xml
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.2
package: ecosystem: Maven
name: org.apache.karaf.specs:org.apache.karaf.specs.java.xml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.1.7
cwe_ids: CWE-611
severity: CRITICAL

Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
Django vulnerable to XSS on 500 pages
Advisory: GHSA-9r8w-6x8c-6jr9
Aliases: CVE-2017-12794
Published: 2019-01-04T17:50:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.10.0
fixed: 1.10.8
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11.0
fixed: 1.11.5
cwe_ids: CWE-79
severity: MODERATE

In Django 1.10.x before 1.10.8 and 1.11.x before 1.11.5, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with `DEBUG = True` (which makes this page accessible) in your production settings.
modulemd uses an unsafe function for processing externally provided data
Advisory: GHSA-jhjh-ghwx-6h7r
Aliases: CVE-2017-1002157
Published: 2019-01-17T13:56:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: modulemd
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.2
cwe_ids: CWE-20
CWE-242
severity: CRITICAL

modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution.
XML External Entity Reference (XXE) in jackson-databind
Advisory: GHSA-x2w5-5m2g-7h5m
Aliases: CVE-2018-14720
Published: 2019-01-04T19:09:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.7
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.3
database_specific: last_known_affected_version_range: <= 2.8.11.2
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.9.5
database_specific: last_known_affected_version_range: <= 2.7.9.2
cwe_ids: CWE-502
CWE-611
severity: CRITICAL

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
PyYAML insecurely deserializes YAML strings leading to arbitrary code execution
Advisory: GHSA-rprw-h62v-c2w7
Aliases: CVE-2017-18342
Published: 2019-01-04T17:45:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: PyYAML
ecosystem_specific: affected_functions: yaml.load
yaml.dump
safe_dump_all
safe_dump
yaml.CSafeLoader
yaml.CLoader
yaml.CSafeDumper
yaml.CDumper
yaml.SafeDumper
yaml.Dumper
yaml.SafeLoader
yaml.Loader
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.1
cwe_ids: CWE-502
severity: CRITICAL

In PyYAML before 4.1, the `yaml.load()` API could execute arbitrary code. In other words, `yaml.safe_load` is not used.
Improper Input Validation in Apache Thrift
Advisory: GHSA-wjxj-f8rg-99wx
Aliases: CVE-2018-1320
Published: 2019-01-17T13:56:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.thrift:libthrift
ranges: type: ECOSYSTEM
events: introduced: 0.5.0
fixed: 0.9.3-1
package: ecosystem: Maven
name: org.apache.thrift:libthrift
ranges: type: ECOSYSTEM
events: introduced: 0.10.0
fixed: 0.12.0
cwe_ids: CWE-20
CWE-295
severity: HIGH

Apache Thrift Java client library versions 0.5.0 prior to 0.9.3-1 and 0.10.0 prior to 0.12.0 can bypass SASL negotiation isComplete validation in the org.apache.thrift.transport.TSaslTransport class. An assert used to determine if the SASL handshake had successfully completed could be disabled in production settings making the validation incomplete.
Missing Origin Validation in webpack-dev-server
Advisory: GHSA-cf66-xwfp-gvc4
Aliases: CVE-2018-14732
Published: 2019-01-04T17:40:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: webpack-dev-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.1.11
cwe_ids: CWE-20
severity: HIGH

Versions of `webpack-dev-server` before 3.1.10 are missing origin validation on the websocket server. This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation
For `webpack-dev-server` update to version 3.1.11 or later.
Moderate severity vulnerability that affects org.hswebframework.web:hsweb-commons
Advisory: GHSA-qqv6-5w6p-3pgr
Aliases: CVE-2018-20594
Published: 2019-01-04T17:43:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.hswebframework.web:hsweb-commons
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.0.4
cwe_ids: CWE-79
severity: MODERATE

An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.
Improper Input Validation in Apache Airflow resulting in Remote Code Execution
Advisory: GHSA-8fg4-j562-mjrc
Aliases: CVE-2017-15720
Published: 2019-01-25T16:19:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: apache-airflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.9.0
database_specific: last_known_affected_version_range: <= 1.8.2
cwe_ids: CWE-20
severity: HIGH

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
Server-Side Request Forgery (SSRF) in jackson-databind
Advisory: GHSA-9mxf-g3x6-wv74
Aliases: CVE-2018-14721
Published: 2019-01-04T19:07:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.7
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.3
database_specific: last_known_affected_version_range: <= 2.8.11.2
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.9.5
database_specific: last_known_affected_version_range: <= 2.7.9.4
cwe_ids: CWE-918
severity: CRITICAL

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
Improper Input Validation in Django
Advisory: GHSA-337x-4q8g-prc5
Aliases: CVE-2019-3498
Published: 2019-01-14T16:20:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.18
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.10
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.5
cwe_ids: CWE-20
severity: MODERATE

In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in `django.views.defaults.page_not_found()`, leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.
Arbitrary Code Execution in jackson-databind
Advisory: GHSA-645p-88qh-w398
Aliases: CVE-2018-14718
Published: 2019-01-04T19:06:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.7
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.3
database_specific: last_known_affected_version_range: <= 2.8.11.2
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.9.5
database_specific: last_known_affected_version_range: <= 2.7.9.4
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.6.7.3
cwe_ids: CWE-502
severity: CRITICAL

FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, 2.7.9.5, and 2.6.7.3 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CRLF Injection in pypiserver
Advisory: GHSA-mh24-7wvg-v88g
Aliases: CVE-2019-6802
Published: 2019-01-30T20:56:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: pypiserver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.6
database_specific: last_known_affected_version_range: <= 1.2.5
cwe_ids: CWE-74
CWE-79
severity: MODERATE

CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a `%0d%0a` in a URI.
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Ratpack
Advisory: GHSA-54mg-vgrp-mwx9
Aliases: CVE-2019-11808
Published: 2019-05-14T04:01:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: io.ratpack:ratpack-session
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.1
package: ecosystem: Maven
name: io.ratpack:ratpack-java
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.1
package: ecosystem: Maven
name: io.ratpack:ratpack-groovy
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.1
cwe_ids: CWE-338
severity: LOW

Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
Exposure of Sensitive Information to an Unauthorized Actor and SQL Injection in Spring Data JPA
Advisory: GHSA-jgmr-wrwx-mgfj
Aliases: CVE-2019-3797
Published: 2019-05-14T04:02:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: org.springframework.data:spring-data-jpa
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.20
package: ecosystem: Maven
name: org.springframework.data:spring-data-jpa
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.14
package: ecosystem: Maven
name: org.springframework.data:spring-data-jpa
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.6
cwe_ids: CWE-200
CWE-89
severity: MODERATE

This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ?startingWith?, ?endingWith? or ?containing? could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
Improper Input Validation and Buffer Over-read in mqtt-packet
Advisory: GHSA-wv67-9jq7-8r69
Aliases: CVE-2019-5432
Published: 2019-05-14T04:02:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: mqtt-packet
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.5.1
package: ecosystem: npm
name: mqtt-packet
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.3
package: ecosystem: npm
name: mqtt-packet
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.6.1
package: ecosystem: npm
name: mqtt-packet
ranges: type: ECOSYSTEM
events: introduced: 6.0.0
fixed: 6.1.2
cwe_ids: CWE-125
CWE-126
severity: HIGH

A specifically malformed MQTT Subscribe packet crashes MQTT Brokers using the mqtt-packet module versions < 3.5.1, 4.0.0 - 4.1.3, 5.0.0 - 5.6.1, 6.0.0 - 6.1.2 for decoding.
Out-of-bounds Read in concat-with-sourcemaps
Advisory: GHSA-2xv3-h762-ccxv
Published: 2019-05-29T19:18:02Z
Affected: package: ecosystem: npm
name: concat-with-sourcemaps
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.0.6
cwe_ids: CWE-125
severity: MODERATE

Versions of `concat-with-sourcemaps` before 1.0.6 allocates uninitialized Buffers when a number is passed as a separator.


## Recommendation

Update to version 1.0.6 or later.