aswin1906/github-advisory-2019.csv huggingface dataset:
Moderate severity vulnerability that affects league/commonmark
Advisory: GHSA-3v43-877x-qgmq
Aliases: CVE-2019-10010
Published: 2019-09-17T22:47:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: league/commonmark
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.18.3
cwe_ids: CWE-79
severity: MODERATE

## CVE-2019-10010

### Impact

In `league/commonmark` 0.18.2 and below, malicious users can insert double-encoded HTML entities into their Markdown like this:

```md
[XSS](javascript&amp;colon;alert%28&#039;XSS&#039;%29)
```

This library would (correctly) unescape the `&amp;` entity to `&` during the parsing step.  However, **the renderer step would fail to properly re-escape the resulting `&colon;` string**, thus producing the following malicious HTML output:

```html
<p><a href="javascript&colon;alert('XSS')">XSS</a></p>
```

Browsers would interpret `&colon;` as a `:` character and allow the JS to be executed when the link is clicked.

This vulnerability was present in the upstream library this project was forked from and therefore exists in all prior versions of `league/commonmark`.

### Solution

The new [0.18.3](https://github.com/thephpleague/commonmark/releases/tag/0.18.3) release mirrors [the fix made upstream](https://github.com/commonmark/commonmark.js/commit/c89b35c5fc99bdf1d2181f7f0c9fcb8a1abc27c8) - we no longer attempt to preserve entities when rendering HTML attributes like `href`, `src`, `title`, etc.

The `$preserveEntities` parameter of `Xml::escape()` is therefore no longer used internally, so it has been deprecated and marked for removal in the next major release (0.19.0).

### Credits

 - Mohit Fawaz for identifying the issue
 - Sebastiaan Knijnenburg and Ross Tuck for responsibly disclosing/relaying the issue
 - John MacFarlane for investigating it and implementing the upstream fix we mirrored here

### References

 - https://nvd.nist.gov/vuln/detail/CVE-2019-10010
 - https://github.com/thephpleague/commonmark/releases/tag/0.18.3
 - https://github.com/thephpleague/commonmark/issues/353
- https://github.com/FriendsOfPHP/security-advisories/blob/master/league/commonmark/CVE-2019-10010.yaml
Low severity vulnerability that affects smartbanner.js
Advisory: GHSA-9mrq-cjgh-32g2
Published: 2019-09-13T13:22:33Z
Affected: package: ecosystem: npm
name: smartbanner.js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.14.1
severity: LOW

## rel noopener vulnerability

### Impact
Clicking on smartbanner _View_ link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile 3rd parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner.

### Patches
`rel="noopener"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability.

### Workarounds
If you can not upgrade to `v1.14.1`:
1. Ensure _View_ link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams
2. If _View_ link is going to a 3rd party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1,  `rel="noopener"` is imposed on all `target="_blank"` links.

    Following combination of smartbanner meta tags can be used to achieve the above:

    ```html
    <meta name="smartbanner:enabled-platforms" content="none">
    <meta name="smartbanner:include-user-agent-regex" content="Mobile.*Safari">
    ```

### References
* [About rel=noopener](https://mathiasbynens.github.io/rel-noopener/)
* [Safari 12.1 Release Notes](https://developer.apple.com/documentation/safari_release_notes/safari_12_1_release_notes#3130296)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [smartbanner.js](https://github.com/ain/smartbanner.js/issues/new)
Symlink Arbitrary File Overwrite in bower
Advisory: GHSA-p6mr-pxg4-68hx
Aliases: CVE-2019-5484
Published: 2019-09-17T23:21:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: bower
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.8.8
cwe_ids: CWE-22
severity: HIGH

Versions of `bower` prior to 1.8.8 are affected by an arbitrary file write vulnerability. The vulnerability occurs because `bower` does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory.



## Recommendation

Update to version 1.8.8 or later
Cross-Site Scripting in status-board
Advisory: GHSA-6m4r-cgm3-6q7q
Aliases: CVE-2019-15478
Published: 2019-09-23T18:32:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: status-board
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.82
cwe_ids: CWE-79
severity: MODERATE

All versions of `status-board` are vulnerable to Cross-Site Scripting. The `renderJsDashboard()` function concatenates the `safeDashboard` variable to the HTTP response message with insufficient sanitization. If this variable is controlled by user input it may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
High severity vulnerability that affects generator-jhipster
Advisory: GHSA-mc84-xr9p-938r
Published: 2019-09-23T18:31:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: generator-jhipster
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.3.1
cwe_ids: CWE-494
CWE-829
severity: HIGH

## Generated code uses repository configuration that downloads over HTTP instead of HTTPS

### Impact
Gradle users were using the http://repo.spring.io/plugins-release repositories in plain HTTP, and not HTTPS, so a man-in-the-middle attack was possible at build time.

### Patches

Maven users should at least upgrade to 6.3.0 while Gradle users should update to 6.3.1.
If you are not able to upgrade make sure not to use a Maven repository via `http` in your build file.

### Workarounds

Replace all custom repository definitions in `build.gradle` or `pom.xml` with their `https` version.

e.g.

```xml
 <repository>
            <id>oss.sonatype.org-snapshot</id>
            <url>https://oss.sonatype.org/content/repositories/snapshots</url> // <-- must be httpS
            <releases>
                <enabled>false</enabled>
            </releases>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
</repository>
```

```gradle
maven { url "https://repo.spring.io/plugins-release" } // <-- must be httpS
```

### References
* https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
* https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [https://github.com/jhipster/generator-jhipster/issues](https://github.com/jhipster/generator-jhipster/issues)
Status Board vulnerable to Cross-Site Scripting before v1.1.82
Advisory: GHSA-8864-rhmw-5m6f
Aliases: CVE-2019-15479
Published: 2019-09-23T18:32:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: status-board
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.82
cwe_ids: CWE-79
severity: MODERATE

Versions of `status-board` prior to 1.1.82 are vulnerable to Cross-Site Scripting. The `renderDashboard()` function concatenates the `safeDashboard` variable to the printed error message with insufficient sanitization. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.1.82 to receive a patch.
Improper Verification of Cryptographic Signature in keycloak
Advisory: GHSA-4fgq-gq9g-3rw7
Aliases: CVE-2019-10201
Published: 2019-09-23T18:32:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: package: ecosystem: Maven
name: org.keycloak:keycloak-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 7.0.0
database_specific: last_known_affected_version_range: <= 6.0.1
cwe_ids: CWE-347
severity: MODERATE

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.
Access of Resource Using Incompatible Type ('Type Confusion')  in yourls/yourls
Advisory: GHSA-vf23-f26f-mjj9
Aliases: CVE-2019-14537
Published: 2019-09-23T18:32:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: yourls/yourls
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.7.4
cwe_ids: CWE-843
severity: CRITICAL

## Type juggling vulnerability in the API

### Impact
YOURLS through 1.7.3 is affected by a type juggling vulnerability in the API component that can result in login bypass.

### Patches
https://github.com/YOURLS/YOURLS/releases/tag/1.7.4
https://github.com/YOURLS/YOURLS/pull/2542

### References
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14537
* https://github.com/Wocanilo/CVE-2019-14537

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [YOURLS repository](https://github.com/YOURLS/YOURLS)
Cross-Site Scripting in webtorrent
Advisory: GHSA-gjh4-fcv3-whpq
Aliases: CVE-2019-15782
Published: 2019-09-04T10:02:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: webtorrent
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.107.6
cwe_ids: CWE-79
severity: MODERATE

Versions of `webtorrent` prior to 0.107.6 are vulnerable to Cross-Site Scripting. `webtorrent` servers started with `torrent.createServer()` lists a torrent's title and files in the index page without sanitization. This allows attackers to execute arbitrary JavaScript in the victim's browser through files with names containing the malicious payload. The issue is mitigated due to the fact that the server only allows fetching data pieces from the torrent.


## Recommendation

Upgrade to version 0.107.6 or later.
Directory Traversal in SharpCompress
Advisory: GHSA-fxh6-w476-hgr4
Aliases: CVE-2018-1002206
Published: 2019-09-11T22:59:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected: package: ecosystem: NuGet
name: SharpCompress
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.21.0
cwe_ids: CWE-22
severity: MODERATE

SharpCompress prior to version 0.21 is vulnerable to path traversal issue in archive extraction.
Consul gem insufficient authentication check - Multiple powers in one controller are not always checked correctly
Advisory: GHSA-8jhx-9gf4-hhf5
Aliases: CVE-2019-16377
Published: 2019-09-27T20:01:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: consul
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.3
cwe_ids: CWE-284
severity: CRITICAL

With the consul ruby gem before 1.0.3, if a controller checks multiple powers  using `:if` or `:except` conditions, these conditions are erroneously applied to all power checks in that controller. This can lead to skipped power checks and hence unauthenticated access to certain controller actions.
Polymorphic Typing issue in FasterXML jackson-databind
Advisory: GHSA-85cw-hj65-qqv9
Aliases: CVE-2019-16335
Published: 2019-09-23T18:33:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.10
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.8.11.5
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.6.7.3
cwe_ids: CWE-502
severity: CRITICAL

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10, 2.8.11.5, and 2.6.7.3. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
Moderate severity vulnerability that affects org.apache.karaf:apache-karaf and org.apache.karaf:karaf
Advisory: GHSA-869j-5855-hjpm
Aliases: CVE-2019-0191
Published: 2019-03-25T16:16:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.karaf:karaf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.2.3
package: ecosystem: Maven
name: org.apache.karaf:apache-karaf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.2.3
cwe_ids: CWE-22
severity: MODERATE

Apache Karaf kar deployer reads .kar archives and extracts the paths from the "repository/" and "resources/" entries in the zip file. It then writes out the content of these paths to the Karaf repo and resources directories. However, it doesn't do any validation on the paths in the zip file. This means that a malicious user could craft a .kar file with ".." directory names and break out of the directories to write arbitrary content to the filesystem. This is the "Zip-slip" vulnerability - https://snyk.io/research/zip-slip-vulnerability. This vulnerability is low if the Karaf process user has limited permission on the filesystem. Any Apache Karaf releases prior 4.2.3 is impacted.
Directory Traversal in serve
Advisory: GHSA-xg75-3277-gvvj
Aliases: CVE-2019-5417
Published: 2019-03-25T18:04:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: serve
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 7.1.3
cwe_ids: CWE-22
severity: HIGH

Versions of `serve` before 7.1.3 are vulnerable to Directory Traversal. File paths are not sanitized leading to unauthorized access of system files.


## Recommendation

Upgrade to version 7.1.3 or later
Command Injection in kill-port
Advisory: GHSA-pmv6-gf98-p3r5
Aliases: CVE-2019-5414
Published: 2019-03-25T16:17:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: kill-port
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.2
cwe_ids: CWE-77
severity: HIGH

Versions of `kill-port` prior to 1.3.2 are vulnerable to Command Injection. The package does not validate user input on the `kill` function. This may allow attackers to run arbitrary commands in the system if user input (such as the port number) is passed directly to the function.


## Recommendation

Upgrade to version 1.3.2 or later.
Incomplete List of Disallowed Inputs in SOFA-Hessian
Advisory: GHSA-pfwp-8pq4-g7pv
Aliases: CVE-2019-9212
Published: 2019-03-06T17:36:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.alipay.sofa:hessian
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.0.2
package: ecosystem: Maven
name: com.alipay.sofa:hessian
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.3.6
cwe_ids: CWE-184
CWE-502
severity: CRITICAL

SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget.
Improper Certificate Validation in chloride
Advisory: GHSA-573x-jhqh-jg36
Aliases: CVE-2018-6517
Published: 2019-03-25T16:16:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: RubyGems
name: chloride
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.3.0
cwe_ids: CWE-295
severity: HIGH

Prior to version 0.3.0, chloride's use of net-ssh resulted in host fingerprints for previously unknown hosts getting added to the user's known_hosts file without confirmation. In version 0.3.0 this is updated so that the user's known_hosts file is not updated by chloride.
uap-core Regular Expression Denial of Service issue
Advisory: GHSA-fx7m-j728-mjw3
Aliases: CVE-2018-20164
Published: 2019-03-06T17:35:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: npm
name: uap-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.6.0
cwe_ids: CWE-185
severity: MODERATE

An issue was discovered in regex.yaml (aka regexes.yaml) in UA-Parser UAP-Core before 0.6.0. A Regular Expression Denial of Service (ReDoS) issue allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to a value containing a long digit string. (The UAP-Core project contains the vulnerability, propagating to all implementations.)
Path Traversal in Action View
Advisory: GHSA-86g5-2wh3-gc9j
Aliases: CVE-2019-5418
Published: 2019-03-13T17:26:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 5.2.0
fixed: 5.2.2.1
database_specific: last_known_affected_version_range: <= 5.2.2.0
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.2.11.1
database_specific: last_known_affected_version_range: <= 4.2.11.0
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 5.1.0
fixed: 5.1.6.2
database_specific: last_known_affected_version_range: <= 5.1.6.1
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.0.7.2
database_specific: last_known_affected_version_range: <= 5.0.7.1
cwe_ids: CWE-22
severity: HIGH

# File Content Disclosure in Action View

Impact 
------ 
There is a possible file content disclosure vulnerability in Action View.  Specially crafted accept headers in combination with calls to `render file:`  can cause arbitrary files on the target server to be rendered, disclosing the  file contents. 

The impact is limited to calls to `render` which render file contents without  a specified accept format.  Impacted code in a controller looks something like this: 

``` ruby
class UserController < ApplicationController 
  def index 
    render file: "#{Rails.root}/some/file" 
  end 
end 
``` 

Rendering templates as opposed to files is not impacted by this vulnerability. 

All users running an affected release should either upgrade or use one of the workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. 

Workarounds 
----------- 
This vulnerability can be mitigated by specifying a format for file rendering, like this: 

``` ruby
class UserController < ApplicationController 
  def index 
    render file: "#{Rails.root}/some/file", formats: [:html] 
  end 
end 
``` 

In summary, impacted calls to `render` look like this: 

``` 
render file: "#{Rails.root}/some/file" 
``` 

The vulnerability can be mitigated by changing to this: 

``` 
render file: "#{Rails.root}/some/file", formats: [:html] 
``` 

Other calls to `render` are not impacted. 

Alternatively, the following monkey patch can be applied in an initializer: 

``` ruby
$ cat config/initializers/formats_filter.rb 
# frozen_string_literal: true 

ActionDispatch::Request.prepend(Module.new do 
  def formats 
    super().select do |format| 
      format.symbol || format.ref == "*/*" 
    end 
  end 
end) 
``` 

Credits 
------- 
Thanks to John Hawthorn <john@hawthorn.email> of GitHub
Improper Input Validation in Apache Qpid Broker-J
Advisory: GHSA-c9h6-xhg9-xxrv
Aliases: CVE-2019-0200
Published: 2019-03-07T18:48:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.qpid:apache-qpid-broker-j
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 7.0.7
package: ecosystem: Maven
name: org.apache.qpid:apache-qpid-broker-j
ranges: type: ECOSYSTEM
events: introduced: 7.1.0
fixed: 7.1.1
versions: 7.1.0
cwe_ids: CWE-20
severity: HIGH

A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 which allows an unauthenticated attacker to crash the broker instance by sending specially crafted commands using AMQP protocol versions below 1.0 (AMQP 0-8, 0-9, 0-91 and 0-10). Users of Apache Qpid Broker-J versions 6.0.0-7.0.6 (inclusive) and 7.1.0 utilizing AMQP protocols 0-8, 0-9, 0-91, 0-10 must upgrade to Qpid Broker-J versions 7.0.7 or 7.1.1 or later.
Moderate severity vulnerability that affects splunk-sdk
Advisory: GHSA-f58w-649r-qjr9
Aliases: CVE-2019-5729
Published: 2019-03-25T16:18:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: splunk-sdk
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.6
cwe_ids: CWE-295
severity: HIGH

Splunk-SDK-Python before 1.6.6 does not properly verify untrusted TLS server certificates, which could result in man-in-the-middle attacks.
Doorkeeper-openid_connect contains Open Redirect
Advisory: GHSA-vv4c-g6q7-p3q7
Aliases: CVE-2019-9837
Published: 2019-03-25T16:15:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: RubyGems
name: doorkeeper-openid_connect
ranges: type: ECOSYSTEM
events: introduced: 1.4.0
fixed: 1.5.4
cwe_ids: CWE-601
severity: MODERATE

Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) 1.4.x and 1.5.x before 1.5.4 has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the 'openid' scope and a prompt=none value. This allows phishing attacks against the authorization flow.
Unauthenticated Remote Code Execution in Apache JMeter
Advisory: GHSA-wg37-7mrv-cfwm
Aliases: CVE-2019-0187
Published: 2019-03-07T18:47:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.jmeter:ApacheJMeter
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 5.1
cwe_ids: CWE-327
CWE-502
severity: CRITICAL

Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed mode. Note that versions before 4.0 are not able to encrypt traffic between the nodes, nor authenticate the participating nodes so upgrade to JMeter 5.1 is also advised.
ipycache is vulnerable to Code Injection
Advisory: GHSA-gcm4-q2pg-xw89
Aliases: CVE-2019-7539
Published: 2019-03-25T16:16:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: ipycache
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.4
cwe_ids: CWE-502
CWE-94
severity: CRITICAL

A code injection issue was discovered in ipycache versions up to 0.1.4.
Server-Side Request Forgery (SSRF) in org.apache.solr:solr-core
Advisory: GHSA-vrh8-27q8-fr8f
Aliases: CVE-2017-3164
Published: 2019-03-14T15:39:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.solr:solr-core
ranges: type: ECOSYSTEM
events: introduced: 1.30
fixed: 7.7.0
database_specific: last_known_affected_version_range: <= 7.6.0
cwe_ids: CWE-918
severity: HIGH

Server Side Request Forgery in Apache Solr, versions 1.3 until 7.6 (inclusive). Since the "shards" parameter does not have a corresponding whitelist mechanism, a remote attacker with access to the server could make Solr perform an HTTP GET request to any reachable URL.