aswin1906/github-advisory-2019.csv huggingface dataset:
Potential SQL Injection in sequelize
Advisory: GHSA-2v7q-2xqx-f4q5
Aliases: CVE-2016-10553
Published: 2019-02-18T23:54:32Z
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.0
database_specific: last_known_affected_version_range: <= 2.1.3
cwe_ids: CWE-89
severity: HIGH

Affected versions of `sequelize` are vulnerable to SQL Injection when user input is passed into `findOne` or into a statement such as `where: "user input"`.



## Recommendation

Update to version 3.0.0 or later.

Version 3.0.0 will introduce a number of breaking changes.
Thankfully, the project authors have provided a 2.x -> 3.x [upgrade guide](https://github.com/sequelize/sequelize/wiki/Upgrade-from-2.0-to-3.0) to ease this transition.

If upgrading is not an option, it is also possible to mitigate this by ensuring that all uses of `where: "input"` and `findOne("input")` are properly sanitized, such as by the use of a wrapper function.
Downloads Resources over HTTP in air-sdk
Advisory: GHSA-6jx3-rqcx-g3ww
Aliases: CVE-2016-10603
Published: 2019-02-18T23:33:48Z
Affected: package: ecosystem: npm
name: air-sdk
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 16.0.0-272-9
cwe_ids: CWE-311
severity: HIGH

Affected versions of `air-sdk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `air-sdk`.


## Recommendation

No patch is currently available for this vulnerability, and the package hasn't seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Exposure of Sensitive Information to an Unauthorized Actor in Hadoop
Advisory: GHSA-v569-g72v-q434
Aliases: CVE-2018-1296
Published: 2019-02-12T17:26:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.7.6
package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.4
package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.1
versions: 2.9.0
cwe_ids: CWE-200
severity: HIGH

In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, HDFS exposes extended attribute key/value pairs during listXAttrs, verifying only path-level search access to the directory rather than path-level read permission to the referent.
Downloads Resources over HTTP in ntfserver
Advisory: GHSA-476p-r2wx-2wch
Aliases: CVE-2016-10650
Published: 2019-02-18T23:47:05Z
Affected: package: ecosystem: npm
name: ntfserver
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.6
cwe_ids: CWE-311
severity: HIGH

Affected versions of `ntfserver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `ntfserver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in arcanist
Advisory: GHSA-g7w9-vm5m-48q8
Aliases: CVE-2016-10683
Published: 2019-02-18T23:42:09Z
Affected: package: ecosystem: npm
name: arcanist
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.1
cwe_ids: CWE-311
severity: MODERATE

Affected versions of `arcanist` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `arcanist`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
ipip-coffee downloads Resources over HTTP
Advisory: GHSA-m8pw-h8qj-rgj9
Aliases: CVE-2016-10673
Published: 2019-02-18T23:44:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: ipip-coffee
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.9
cwe_ids: CWE-311
severity: HIGH

Affected versions of `ipip-coffee` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This could impact the integrity and availability of the data being used to make geolocation decisions by an application.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Prototype Pollution in extend
Advisory: GHSA-qrmc-fj45-qfc2
Aliases: CVE-2018-16492
Published: 2019-02-07T18:03:28Z
Affected: package: ecosystem: npm
name: extend
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.2
package: ecosystem: npm
name: extend
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.2
cwe_ids: CWE-400
severity: MODERATE

Versions of `extend` prior to 3.0.2 (for 3.x) and 2.0.2 (for 2.x) are vulnerable to Prototype Pollution. The `extend()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

If you're using `extend` 3.x upgrade to 3.0.2 or later.
If you're using `extend` 2.x upgrade to 2.0.2 or later.
Authentication Bypass in console-io
Advisory: GHSA-q52j-4q2q-hcj6
Aliases: CVE-2016-10532
Published: 2019-02-18T23:39:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: console-io
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.0
cwe_ids: CWE-287
severity: CRITICAL

Affected versions of the `console-io` package do not configure the underlying websocket library to require authentication, resulting in an authentication bypass vulnerability. As `console-io` allows terminal access on the server via a web page, an authentication bypass is essentially remote code execution.



## Recommendation

Update to version 2.3.0 or later.
Downloads Resources over HTTP in phantomjs-cheniu
Advisory: GHSA-w364-8vfv-gvf5
Aliases: CVE-2016-10661
Published: 2019-02-18T23:44:52Z
Affected: package: ecosystem: npm
name: phantomjs-cheniu
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.0.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `phantomjs-cheniu` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `phantomjs-cheniu`.


## Recommendation

No patch is currently available for this vulnerability.

As this package is just a fork of Medium's [`phantomjs-prebuilt`](https://github.com/Medium/phantomjs) package, the best mitigation is currently to install the `Medium` version of [`phantomjs-prebuilt`](https://github.com/Medium/phantomjs). This can be done via the following command:
```
npm i phantomjs-prebuilt
```
SQL Injection in waterline-sequel
Advisory: GHSA-cgpp-wm2h-6hqx
Aliases: CVE-2016-10551
Published: 2019-02-18T23:54:28Z
Affected: package: ecosystem: npm
name: waterline-sequel
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.5.1
cwe_ids: CWE-89
severity: HIGH

Affected versions of `waterline-sequel` are vulnerable to SQL injection in cases where user input is passed into the `like`, `contains`, `startsWith`, or `endsWith` methods.



## Recommendation

Upgrade to at least version 0.5.1
Downloads Resources over HTTP in imageoptim
Advisory: GHSA-mm7h-323r-9p4g
Aliases: CVE-2016-10596
Published: 2019-02-18T23:50:33Z
Affected: package: ecosystem: npm
name: imageoptim
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.5.0
cwe_ids: CWE-311
severity: HIGH

imageoptim is a Node.js wrapper for some images compression algorithms.

imageoptim downloads zipped resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

No fix is currently available for this vulnerability.

It is our recommendation to not install or use this module at this time.
Downloads Resources over HTTP in fibjs
Advisory: GHSA-6p48-xfj3-jw67
Aliases: CVE-2016-10621
Published: 2019-02-18T23:56:54Z
Affected: package: ecosystem: npm
name: fibjs
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.8
cwe_ids: CWE-311
severity: HIGH

Affected versions of `fibjs` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fibjs`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in rs-brightcove
Advisory: GHSA-3w76-x94r-pw44
Aliases: CVE-2016-10676
Published: 2019-02-18T23:42:16Z
Affected: package: ecosystem: npm
name: rs-brightcove
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `rs-brightcove` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `rs-brightcove`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Pyspark User Impersonation Vulnerability
Advisory: GHSA-fvxv-9xxr-h7wj
Aliases: CVE-2018-11760
Published: 2019-02-07T18:02:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: PyPI
name: pyspark
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.2
package: ecosystem: PyPI
name: pyspark
ranges: type: ECOSYSTEM
events: introduced: 1.0.2
fixed: 2.2.3
severity: MODERATE

When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
Downloads Resources over HTTP in broccoli-closure
Advisory: GHSA-vvwp-3f54-xc39
Aliases: CVE-2016-10635
Published: 2019-02-18T23:57:05Z
Affected: package: ecosystem: npm
name: broccoli-closure
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `broccoli-closure` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `broccoli-closure`.


## Recommendation

Update to version 1.3.1 or later.
Downloads Resources over HTTP in grunt-webdriver-qunit
Advisory: GHSA-4q79-fch7-g78q
Aliases: CVE-2016-10606
Published: 2019-02-18T23:48:11Z
Affected: package: ecosystem: npm
name: grunt-webdriver-qunit
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.6
cwe_ids: CWE-311
severity: HIGH

Affected versions of `grunt-webdriver-qunit` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `grunt-webdriver-qunit`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in curses
Advisory: GHSA-8p52-7cxv-6c95
Aliases: CVE-2016-10615
Published: 2019-02-18T23:56:47Z
Affected: package: ecosystem: npm
name: curses
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.10
cwe_ids: CWE-311
severity: HIGH

Affected versions of `curses` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `curses`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
headless-browser-lite downloads Resources over HTTP
Advisory: GHSA-g95j-p8f6-pwh4
Aliases: CVE-2016-10625
Published: 2019-02-18T23:56:58Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: headless-browser-lite
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2015.4.18-a
database_specific: last_known_affected_version_range: <= 2015.4.3-10
cwe_ids: CWE-311
severity: HIGH

Affected versions of `headless-browser-lite` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `headless-browser-lite`.


## Recommendation

Update to version 2015.4.18-a or later.
steroids downloads resources over HTTP
Advisory: GHSA-5m9c-634g-47vq
Aliases: CVE-2016-10581
Published: 2019-02-18T23:35:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: steroids
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 4.1.27
cwe_ids: CWE-311
severity: HIGH

Affected versions of `steroids` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `steroids`.


## Recommendation

This vulnerability was discovered and reported in 2016, yet has not seen a patch issued as of 03/2018. As of 08/2022, [the package is marked as deprecated](https://www.npmjs.com/package/steroids) and the GitHub repository is no longer publicly available.

The best path forward for mitigating this issue is to attempt to use an alternative module that is actively maintained and which provides similar functionality, such as the native PhoneGap API.
Downloads Resources over HTTP in cue-sdk-node
Advisory: GHSA-p2hm-8725-c8x8
Aliases: CVE-2016-10590
Published: 2019-02-18T23:50:58Z
Affected: package: ecosystem: npm
name: cue-sdk-node
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.2.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `cue-sdk-node` insecurely download an executable over an unencrypted HTTP connection. 
In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cue-sdk-node`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in install-g-test
Advisory: GHSA-qjvf-rmwg-64fr
Aliases: CVE-2016-10630
Published: 2019-02-18T23:47:20Z
Affected: package: ecosystem: npm
name: install-g-test
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.0.12
cwe_ids: CWE-311
severity: HIGH

Affected versions of `install-g-test` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Cross-site Scripting in jspwiki-war
Advisory: GHSA-5q75-cxcq-wr26
Aliases: CVE-2018-20242
Published: 2019-02-12T17:26:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.11.0.M1
database_specific: last_known_affected_version_range: <= 2.10.5
cwe_ids: CWE-79
severity: MODERATE

A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki, from versions up to 2.10.5, which could lead to session hijacking.
Insecure Default Configuration in airbrake
Advisory: GHSA-856x-cp3q-47vg
Aliases: CVE-2016-10530
Published: 2019-02-18T23:58:13Z
Affected: package: ecosystem: npm
name: airbrake
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.4.0
cwe_ids: CWE-200
severity: MODERATE

Affected versions of `airbrake` default to sending environment variables over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible for them to capture and read these environment variables, which may result in leaking sensitive information.


## Recommendation

Update to version 0.4.0 or later, or upgrade from the now-deprecated `airbrake` module to its replacement, [`airbrake-js`](https://www.npmjs.com/package/airbrake-js).
No CSRF Validation in droppy
Advisory: GHSA-rhvc-x32h-5526
Aliases: CVE-2016-10529
Published: 2019-02-18T23:39:32Z
Affected: package: ecosystem: npm
name: droppy
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.5.0
cwe_ids: CWE-352
severity: HIGH

Affected versions of `droppy`  are vulnerable to cross-site socket forgery. The package does not perform verification for cross-domain websocket requests, and as a result, an attacker can create a web page that opens up a websocket connection on behalf of the user visiting the page. The attacker can then perform any action that the target user could, including adding a new admin account under their control, or deleting others.


## Recommendation

Update to version 3.5.0 or later.