aswin1906/github-advisory-2019.csv huggingface dataset:
Webargs mishandles concurrent JSON parsing
Advisory: GHSA-8554-jxcw-454q
Aliases: CVE-2019-9710
Published: 2019-03-12T15:16:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: webargs
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 5.1.3
cwe_ids: CWE-362
severity: HIGH

An issue was discovered in webargs before 5.1.3, as used with marshmallow and other products. JSON parsing uses a short-lived cache to store the parsed JSON body. This cache is not thread-safe, meaning that incorrect JSON payloads could have been parsed for concurrent requests.
Moderate severity vulnerability that affects org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Advisory: GHSA-2g9q-chq2-w8qw
Aliases: CVE-2017-12625
Published: 2019-03-14T15:40:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.hive:hive
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: Maven
name: org.apache.hive:hive
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.1
versions: 2.2.0
package: ecosystem: Maven
name: org.apache.hive:hive
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.1
versions: 2.3.0
package: ecosystem: Maven
name: org.apache.hive:hive-exec
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: Maven
name: org.apache.hive:hive-exec
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.1
versions: 2.2.0
package: ecosystem: Maven
name: org.apache.hive:hive-exec
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.1
versions: 2.3.0
package: ecosystem: Maven
name: org.apache.hive:hive-service
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: Maven
name: org.apache.hive:hive-service
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.1
versions: 2.2.0
package: ecosystem: Maven
name: org.apache.hive:hive-service
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.1
versions: 2.3.0
cwe_ids: CWE-200
severity: MODERATE

Apache Hive 2.1.x before 2.1.2, 2.2.x before 2.2.1, and 2.3.x before 2.3.1 expose an interface through which masking policies can be defined on tables or views, e.g., using Apache Ranger. When a view is created over a given table, the policy enforcement does not happen correctly on the table for masked columns.
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark
Advisory: GHSA-6mqq-8r44-vmjc
Aliases: CVE-2018-1334
Published: 2019-03-14T15:41:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.spark:spark-core_2.10
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 2.1.3
package: ecosystem: Maven
name: org.apache.spark:spark-core_2.10
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.2
package: ecosystem: Maven
name: org.apache.spark:spark-core_2.11
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 2.1.3
package: ecosystem: Maven
name: org.apache.spark:spark-core_2.11
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.2
package: ecosystem: Maven
name: org.apache.spark:spark-core_2.11
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.1
versions: 2.3.0
cwe_ids: CWE-200
severity: MODERATE

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
jackson-databind Deserialization of Untrusted Data vulnerability
Advisory: GHSA-cjjf-94ff-43w7
Aliases: CVE-2018-12022
Published: 2019-03-25T18:03:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.7.9.4
database_specific: last_known_affected_version_range: <= 2.7.9.3
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.2
database_specific: last_known_affected_version_range: <= 2.8.11.1
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.6
cwe_ids: CWE-502
severity: HIGH

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db jar (for database access for the Jodd framework) in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.
devise Time-of-check Time-of-use Race Condition vulnerability
Advisory: GHSA-73rf-6mrf-759q
Aliases: CVE-2019-5421
Published: 2019-03-19T18:03:25Z
Affected: package: ecosystem: RubyGems
name: devise
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.6.0
cwe_ids: CWE-367
severity: MODERATE

Devise ruby gem before 4.6.0 when the `lockable` module is used is vulnerable to a time-of-check time-of-use (TOCTOU) race condition due to `increment_failed_attempts` within the `Devise::Models::Lockable` class not being concurrency safe.
Path Traversal in serve
Advisory: GHSA-v588-qcp3-jv46
Aliases: CVE-2019-5415
Published: 2019-03-25T18:03:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: serve
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 7.1.3
cwe_ids: CWE-548
severity: HIGH

Versions of `serve` prior to 7.0.1 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through if the path contains a `/./`, which allows attackers to access hidden folders and files.


## Recommendation

Upgrade to version 7.0.1 or later.
Code Injection in morgan
Advisory: GHSA-gwg9-rgvj-4h5j
Aliases: CVE-2019-5413
Published: 2019-03-25T18:03:23Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: morgan
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.9.1
cwe_ids: CWE-94
severity: CRITICAL

Verisons of `morgan` before 1.9.1 are vulnerable to code injection when user input is allowed into the filter or combined with a prototype pollution attack.


## Recommendation

Update to version 1.9.1 or later.
Critical severity vulnerability that affects org.apache.solr:solr-core
Advisory: GHSA-xhcq-fv7x-grr2
Aliases: CVE-2019-0192
Published: 2019-03-14T15:39:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.solr:solr-core
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 7.0.0
database_specific: last_known_affected_version_range: <= 5.5.5
package: ecosystem: Maven
name: org.apache.solr:solr-core
ranges: type: ECOSYSTEM
events: introduced: 6.0.0
fixed: 7.0.0
database_specific: last_known_affected_version_range: <= 6.6.5
cwe_ids: CWE-502
severity: CRITICAL

In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.
Improper Input Validation python-gnupg
Advisory: GHSA-2fch-jvg5-crf6
Aliases: CVE-2019-6690
Published: 2019-03-25T16:17:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: PyPI
name: python-gnupg
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.4.4
cwe_ids: CWE-20
severity: HIGH

python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a "CWE-20: Improper Input Validation" issue affecting the affect functionality component.
Improper Privilege Management in org.apache.hadoop:hadoop-main
Advisory: GHSA-5cf4-jqwp-584g
Aliases: CVE-2018-11767
Published: 2019-03-25T16:17:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.7.5
fixed: 2.7.7
package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.8.3
fixed: 2.8.5
package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.2
cwe_ids: CWE-269
severity: HIGH

In Apache Hadoop 2.9.0 to 2.9.1, 2.8.3 to 2.8.4, 2.7.5 to 2.7.6, KMS blocking users or granting access to users incorrectly, if the system uses non-default groups mapping mechanisms.
Infinite loop in org.apache.commons:commons-compress
Advisory: GHSA-h436-432x-8fvx
Aliases: CVE-2018-1324
Published: 2019-03-14T15:41:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.commons:commons-compress
ranges: type: ECOSYSTEM
events: introduced: 1.11
fixed: 1.16
database_specific: last_known_affected_version_range: <= 1.15
cwe_ids: CWE-835
severity: MODERATE

A specially crafted ZIP archive can be used to cause an infinite loop inside of Apache Commons Compress' extra field parser used by the ZipFile and ZipArchiveInputStream classes in versions 1.11 to 1.15. This can be used to mount a denial of service attack against services that use Compress' zip package.
org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service vulnerable to Improper Certificate Validation 
Advisory: GHSA-gf2v-9hp6-44qg
Aliases: CVE-2016-3083
Published: 2019-03-14T15:40:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.hive:hive
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.2
package: ecosystem: Maven
name: org.apache.hive:hive
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.1
versions: 2.0.0
package: ecosystem: Maven
name: org.apache.hive:hive-service
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.2
package: ecosystem: Maven
name: org.apache.hive:hive-service
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.1
versions: 2.0.0
package: ecosystem: Maven
name: org.apache.hive:hive-exec
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.2
package: ecosystem: Maven
name: org.apache.hive:hive-exec
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.1
versions: 2.0.0
cwe_ids: CWE-295
severity: HIGH

Apache Hive (JDBC + HiveServer2) implements SSL for plain TCP and HTTP connections (it supports both transport modes). While validating the server's certificate during the connection setup, the client in Apache Hive before 1.2.2 and 2.0.x before 2.0.1 doesn't seem to be verifying the common name attribute of the certificate. In this way, if a JDBC client sends an SSL request to server abc.com, and the server responds with a valid certificate (certified by CA) but issued to xyz.com, the client will accept that as a valid certificate and the SSL handshake will go through.
Denial of Service Vulnerability in Action View
Advisory: GHSA-m63j-wh5w-c252
Aliases: CVE-2019-5419
Published: 2019-03-13T17:25:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.2.11.1
database_specific: last_known_affected_version_range: <= 4.2.11.0
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 5.2.0
fixed: 5.2.2.1
database_specific: last_known_affected_version_range: <= 5.2.2.0
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 5.1.0
fixed: 5.1.6.2
database_specific: last_known_affected_version_range: <= 5.1.6.1
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.0.7.2
database_specific: last_known_affected_version_range: <= 5.0.7.1
package: ecosystem: RubyGems
name: actionview
ranges: type: ECOSYSTEM
events: introduced: 6.0.0.beta1
fixed: 6.0.0.beta3
cwe_ids: CWE-400
CWE-770
severity: HIGH

# Denial of Service Vulnerability in Action View

Impact 
------ 
Specially crafted accept headers can cause the Action View template location code to consume 100% CPU, causing the server unable to process requests.  This impacts all Rails applications that render views. 

All users running an affected release should either upgrade or use one of the workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. 

Workarounds 
----------- 
This vulnerability can be mitigated by wrapping `render` calls with `respond_to` blocks.  For example, the following example is vulnerable: 

``` ruby
class UserController < ApplicationController 
  def index 
    render "index" 
  end 
end 
``` 

But the following code is not vulnerable: 

```ruby 
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
``` 

Implicit rendering is impacted, so this code is vulnerable: 

```ruby 
class UserController < ApplicationController 
  def index 
  end 
end 
``` 

But can be changed this this: 

```ruby 
class UserController < ApplicationController 
  def index 
    respond_to |format| 
      format.html { render "index" } 
    end 
  end 
end 
``` 

Alternatively to specifying the format, the following monkey patch can be applied in an initializer: 

``` 
$ cat config/initializers/formats_filter.rb 
# frozen_string_literal: true 

ActionDispatch::Request.prepend(Module.new do 
  def formats 
    super().select do |format| 
      format.symbol || format.ref == "*/*" 
    end 
  end 
end) 
``` 

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. 

Also note that the patches for this vulnerability are the same as CVE-2019-5418. 

Credits 
------- 
Thanks to John Hawthorn <john@hawthorn.email> of GitHub
Apache Airflow vulnerable to Stored XSS
Advisory: GHSA-99cv-8cvv-666c
Aliases: CVE-2018-20244
Published: 2019-03-06T17:35:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: apache-airflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.10.2
cwe_ids: CWE-79
severity: MODERATE

In Apache Airflow before 1.10.2, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Use of Insufficiently Random Values in Railties Allows Remote Code Execution
Advisory: GHSA-m42h-mh85-4qgc
Aliases: CVE-2019-5420
Published: 2019-03-13T17:28:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: railties
ranges: type: ECOSYSTEM
events: introduced: 5.2.0
fixed: 5.2.2.1
database_specific: last_known_affected_version_range: <= 5.2.2.0
cwe_ids: CWE-330
CWE-77
severity: CRITICAL

# Possible Remote Code Execution Exploit in Rails Development Mode

Impact 
------ 
With some knowledge of a target application it is possible for an attacker to  guess the automatically generated development mode secret token.  This secret  token can be used in combination with other Rails internals to escalate to a remote code execution exploit. 

All users running an affected release should either upgrade or use one of the workarounds immediately. 

Releases 
-------- 
The 6.0.0.beta3 and 5.2.2.1 releases are available at the normal locations. 

Workarounds 
----------- 
This issue can be mitigated by specifying a secret key in development mode. 
In "config/environments/development.rb" add this: 

```
  config.secret_key_base = SecureRandom.hex(64) 
```

Please note that only the 5.2.x, 5.1.x, 5.0.x, and 4.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. 

Credits 
------- 
Thanks to ooooooo_q
Stack Overflow in Apache Mesos
Advisory: GHSA-p2xq-vcm7-xjj6
Aliases: CVE-2018-11793
Published: 2019-03-06T17:36:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.mesos:mesos
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.3
package: ecosystem: Maven
name: org.apache.mesos:mesos
ranges: type: ECOSYSTEM
events: introduced: 1.5.0
fixed: 1.5.2
package: ecosystem: Maven
name: org.apache.mesos:mesos
ranges: type: ECOSYSTEM
events: introduced: 1.6.0
fixed: 1.6.2
package: ecosystem: Maven
name: org.apache.mesos:mesos
ranges: type: ECOSYSTEM
events: introduced: 1.7.0
fixed: 1.7.1
versions: 1.7.0
cwe_ids: CWE-119
severity: HIGH

When parsing a JSON payload with deeply nested JSON structures, the parser in Apache Mesos versions pre-1.4.x, 1.4.0 to 1.4.2, 1.5.0 to 1.5.1, 1.6.0 to 1.6.1, and 1.7.0 might overflow the stack due to unbounded recursion. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability
Advisory: GHSA-77rv-6vfw-x4gc
Aliases: CVE-2019-3778
Published: 2019-03-14T15:39:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.17.RELEASE
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth2
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.17.RELEASE
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth
ranges: type: ECOSYSTEM
events: introduced: 2.1.0.RELEASE
fixed: 2.1.4.RELEASE
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth2
ranges: type: ECOSYSTEM
events: introduced: 2.1.0.RELEASE
fixed: 2.1.4.RELEASE
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth
ranges: type: ECOSYSTEM
events: introduced: 2.2.0.RELEASE
fixed: 2.2.4.RELEASE
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth2
ranges: type: ECOSYSTEM
events: introduced: 2.2.0.RELEASE
fixed: 2.2.4.RELEASE
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth
ranges: type: ECOSYSTEM
events: introduced: 2.3.0.RELEASE
fixed: 2.3.5.RELEASE
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth2
ranges: type: ECOSYSTEM
events: introduced: 2.3.0.RELEASE
fixed: 2.3.5.RELEASE
cwe_ids: CWE-601
severity: MODERATE

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code.

A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.

This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. 

This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).
Moderate severity vulnerability that affects org.b3log:symphony
Advisory: GHSA-xgjc-49cw-529m
Aliases: CVE-2019-9142
Published: 2019-03-06T17:35:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.b3log:symphony
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.7
cwe_ids: CWE-79
severity: MODERATE

An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.
Path Traversal in localhost-now
Advisory: GHSA-qwj8-p662-3m7x
Aliases: CVE-2019-5416
Published: 2019-03-25T16:17:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: localhost-now
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.2
cwe_ids: CWE-22
severity: HIGH

All versions of `localhost-now` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Moderate severity vulnerability that affects com.puppycrawl.tools:checkstyle
Advisory: GHSA-gp32-7h29-rpxm
Aliases: CVE-2019-9658
Published: 2019-03-14T15:39:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: com.puppycrawl.tools:checkstyle
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 8.18
cwe_ids: CWE-611
severity: MODERATE

Checkstyle prior to 8.18 loads external DTDs by default, which can potentially lead to denial of service attacks or the leaking of confidential information.
Regular Expression Denial of Service in highcharts
Advisory: GHSA-xmc8-cjfr-phx3
Aliases: CVE-2018-20801
Published: 2019-03-18T15:59:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: highcharts
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.1.0
cwe_ids: CWE-1333
severity: HIGH

Versions of `highcharts` prior to 6.1.0 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 6.1.0 or higher.
Cross-Site Scripting in editor.md
Advisory: GHSA-2j5v-fc74-j9q2
Aliases: CVE-2019-9737
Published: 2019-03-14T15:38:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: editor.md
versions: 1.5.0
cwe_ids: CWE-79
severity: MODERATE

All versions of `editor.md` are vulnerable to Cross-Site Scripting. User input is insufficiently sanitized, allowing attackers to inject malicious code in payloads containing  base64-encoded content.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.