aswin1906/github-advisory-2019.csv huggingface dataset:
Cross-site scripting in Apache JSPWiki
Advisory: GHSA-g6ww-2x43-h963
Aliases: CVE-2019-10090
Published: 2019-10-11T18:41:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M5
database_specific: last_known_affected_version_range: <= 2.11.0.M4
cwe_ids: CWE-79
severity: MODERATE

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the plain editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
graphite.composer.views.send_email vulnerable to SSRF
Advisory: GHSA-vfj6-275q-4pvm
Aliases: CVE-2017-18638
Published: 2019-10-25T13:55:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: PyPI
name: graphite-web
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.6
cwe_ids: CWE-918
severity: HIGH

### Impact
send_email in graphite-web/webapp/graphite/composer/views.py in Graphite through 1.1.5 is vulnerable to SSRF. The vulnerable SSRF endpoint can be used by an attacker to have the Graphite web server request any resource. The response to this SSRF request is encoded into an image file and then sent to an e-mail address that can be supplied by the attacker. Thus, an attacker can exfiltrate any information. Email will be send through SMTP server configured in Graphite, by default it's 'localhost'

### Patches
Problem was patched in Graphite-web 1.1.6. Also patches was released for graphite-web [1.0.x](https://github.com/graphite-project/graphite-web/pull/2501) and [0.9.x](https://github.com/graphite-project/graphite-web/pull/2500), and we'll discuss releases of non-supported branches later.

### Workarounds
You can manually remove function `send_email` from file `webapp/graphite/composer/views.py`. This function are not in use and will not affect your Graphite installation.

### References
For more information check this graphite-web Github issue #2008 

### For more information
If you have any questions or comments about this advisory:
* Add comment in [issue #2008](https://github.com/graphite-project/graphite-web/issues/2008)
Denial of Service in Apache Commons Compress
Advisory: GHSA-53x6-4x5p-rrvv
Aliases: CVE-2019-12402
Published: 2019-10-11T18:41:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.commons:commons-compress
ranges: type: ECOSYSTEM
events: introduced: 1.15
fixed: 1.19
cwe_ids: CWE-835
severity: HIGH

The file name encoding algorithm used internally in Apache Commons Compress 1.15 to 1.18 can get into an infinite loop when faced with specially crafted inputs. This can lead to a denial of service attack if an attacker can choose the file names inside of an archive created by Compress.
Improper Authentication in Auth0.AuthenticationApi
Advisory: GHSA-c9cg-q8r2-xvjq
Aliases: CVE-2019-16929
Published: 2019-10-24T20:56:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: NuGet
name: Auth0.AuthenticationApi
ranges: type: ECOSYSTEM
events: introduced: 5.8.0
fixed: 6.5.4
cwe_ids: CWE-287
severity: HIGH

Auth0 auth0.net before 6.5.4 has Incorrect Access Control because IdentityTokenValidator can be accidentally used to validate untrusted ID tokens.
Sandbox Breakout in realms-shim
Advisory: GHSA-7cg8-pq9v-x98q
Published: 2019-10-21T21:58:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: realms-shim
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.1
severity: CRITICAL

Versions of `realms-shim` prior to 1.2.1 are vulnerable to a Sandbox Breakout. The Realms evaluation function has an option to apply Babel-like transformations to the source code before it reaches the evaluator. One portion of this transform pipeline exposed a primal-Realm object to the rewriting function. Confined code which used the evaluator itself could provide a malicious rewriter function that captured this object, and use it to breach the sandbox.


## Recommendation

Upgrade to version 1.2.1 or later.
HTTP Request Smuggling in Netty
Advisory: GHSA-p979-4mfw-53vg
Aliases: CVE-2019-16869
Published: 2019-10-11T18:41:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: io.netty:netty-all
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.1.42.Final
package: ecosystem: Maven
name: org.jboss.netty:netty
ranges: type: ECOSYSTEM
events: 0
database_specific: last_known_affected_version_range: < 4.0.0
cwe_ids: CWE-444
severity: HIGH

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.
Path Traversal in LibreNMS
Advisory: GHSA-r336-jxfr-4c3c
Aliases: CVE-2019-12464
Published: 2019-10-11T18:43:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: librenms/librenms
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.53
cwe_ids: CWE-22
severity: HIGH

An issue was discovered in LibreNMS 1.50.1. An authenticated user can perform a directory traversal attack against the /pdf.php file with a partial filename in the report parameter, to cause local file inclusion resulting in code execution.
ecdsa Denial of Service vulnerability in signature verification and signature malleability
Advisory: GHSA-pwfw-mgfj-7g3g
Aliases: CVE-2019-14853
Published: 2019-10-08T16:30:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: ecdsa
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.13.3
cwe_ids: CWE-391
CWE-755
severity: HIGH

## possible DoS in signature verification and signature malleability 

### Impact
Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` may receive exceptions other than the documented `BadSignatureError` when signatures are malformed. If those other exceptions are not caught, they may lead to program termination and thus Denial of Service

Code using `VerifyingKey.verify()` and `VerifyingKey.verify_digest()` with `sigdecode` option using `ecdsa.util.sigdecode_der` will accept signatures even if they are not properly formatted DER. This makes the signatures malleable. It impacts only applications that later sign the signatures or verify signatures of signatures, e.g. Bitcoin.

All versions between 0.5 and 0.13.2 (inclusive) are thought to be vulnerable. Code before 0.5 may be vulnerable but didn't receive extended analysis to rule this issue out.

### Patches
The patches have been merged to `master` branch in https://github.com/warner/python-ecdsa/pull/115.
The backported patches for a release in the 0.13 branch are in https://github.com/warner/python-ecdsa/pull/124

They are part of the 0.13.3 release.

There are no plans to backport them to earlier releases.

### Workarounds
It may be possible to prevent the Denial of Service by catching also `UnexpectedDER`, `IndexError` and `AssertionError` exceptions. That list hasn't been verified to be complete though. If those exceptions are raised, the signature verification process should consider the signature to be invalid.

To remediate signature malleability and the Denial of Service vulnerability, it may be possible to first verify that the signature is properly DER formatted ECDSA-Sig-Value, as defined in [RFC3279](https://tools.ietf.org/html/rfc3279), before passing it to `verify()` or `verify_digest()` methods. If the signature is determined to not follow the DER or encode a different structure, the signature verification process should consider the signature to be invalid.

### References
https://en.bitcoinwiki.org/wiki/Transaction_Malleability

### For more information
If you have any questions or comments about this advisory please open an issue in [python-ecdsa](https://github.com/warner/python-ecdsa/issues) project.
Cross-site scripting in Apache JSPWiki
Advisory: GHSA-gwfq-qwmp-x9xg
Aliases: CVE-2019-10087
Published: 2019-10-11T18:41:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M5
database_specific: last_known_affected_version_range: <= 2.11.0.M4
cwe_ids: CWE-79
severity: MODERATE

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
Advisory: GHSA-f6vf-pq8c-69m4
Aliases: CVE-2019-17195
Published: 2019-10-16T18:31:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.nimbusds:nimbus-jose-jwt
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 7.9
cwe_ids: CWE-754
CWE-755
severity: CRITICAL

Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Regular Expression Denial of Service in csv-parse
Advisory: GHSA-582f-p4pg-xc74
Aliases: CVE-2019-17592
Published: 2019-10-15T20:06:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: csv-parse
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.4.6
cwe_ids: CWE-20
CWE-400
severity: HIGH

Versions of `csv-parse` prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The `__isInt()` function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the `cast` option.


## Recommendation

Upgrade to version 4.4.6 or later.
SQL Injection in LibreNMS
Advisory: GHSA-g9xh-3w5g-229r
Aliases: CVE-2019-10671
Published: 2019-10-11T18:43:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: librenms/librenms
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.50.1
cwe_ids: CWE-89
severity: HIGH

An issue was discovered in LibreNMS through 1.47. It does not parameterize all user supplied input within database queries, resulting in SQL injection. An authenticated attacker can subvert these database queries to extract or manipulate data, as demonstrated by the graph.php sort parameter.
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Advisory: GHSA-r3x4-wr4h-pw33
Aliases: CVE-2019-10759
Published: 2019-10-21T21:58:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: safer-eval
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.4
cwe_ids: CWE-94
severity: CRITICAL

Versions of `safer-eval` prior to 1.3.4 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code. For example, evaluating he string `console.constructor.constructor('return process')().env` prints `process.env` to the console.


## Recommendation

Upgrade to version 1.3.4 or later.
Arbitrary File Read in html-pdf
Advisory: GHSA-x4w5-r546-x9qh
Aliases: CVE-2019-15138
Published: 2019-10-11T18:40:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: html-pdf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.1
cwe_ids: CWE-200
CWE-668
CWE-73
CWE-79
severity: HIGH

All versions of `html-pdf` are vulnerable to Arbitrary File Read. The package fails to sanitize the HTML input, allowing attackers to exfiltrate server files by supplying malicious HTML code. XHR requests in the HTML code are executed by the server. Input with an XHR request such as `request.open("GET","file:///etc/passwd")` will result in a PDF document with the contents of `/etc/passwd`.


## Recommendation

No fix is currently available. There is a mitigation available in the provided reference.
Improper Encoding or Escaping of Output and Injection in LibreNMS
Advisory: GHSA-w5r2-gvgf-mpm8
Aliases: CVE-2019-12463
Published: 2019-10-11T18:43:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: librenms/librenms
ranges: type: ECOSYSTEM
events: introduced: 1.50.1
fixed: 1.53
cwe_ids: CWE-116
CWE-74
severity: HIGH

An issue was discovered in LibreNMS 1.50.1. The scripts that handle graphing options (includes/html/graphs/common.inc.php and includes/html/graphs/graphs.inc.php) do not sufficiently validate or encode several fields of user supplied input. Some parameters are filtered with mysqli_real_escape_string, which is only useful for preventing SQL injection attacks; other parameters are unfiltered. This allows an attacker to inject RRDtool syntax with newline characters via the html/graph.php and html/graph-realtime.php scripts. RRDtool syntax is quite versatile and an attacker could leverage this to perform a number of attacks, including disclosing directory structure and filenames, disclosing file content, denial of service, or writing arbitrary files. NOTE, relative to CVE-2019-10665, this requires authentication and the pathnames differ.
Server-Side Request Forgery in unoconv
Advisory: GHSA-27p5-7cw6-m45h
Aliases: CVE-2019-17400
Published: 2019-10-24T20:46:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: PyPI
name: unoconv
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.9.0
cwe_ids: CWE-918
severity: HIGH

The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
Materialize-css vulnerable to Cross-site Scripting in autocomplete component
Advisory: GHSA-7752-f4gf-94gc
Aliases: CVE-2019-11003
Published: 2019-04-09T19:44:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: materialize-css
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.0
package: ecosystem: npm
name: @materializecss/materialize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0-alpha
cwe_ids: CWE-79
severity: MODERATE

All versions of `materialize-css` are vulnerable to Cross-Site Scripting. The `autocomplete` component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Tryton Improper Access Control
Advisory: GHSA-f6f2-pwrj-64h3
Aliases: CVE-2019-10868
Published: 2019-04-10T14:31:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: PyPI
name: trytond
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.21
package: ecosystem: PyPI
name: trytond
ranges: type: ECOSYSTEM
events: introduced: 4.4.0
fixed: 4.4.19
package: ecosystem: PyPI
name: trytond
ranges: type: ECOSYSTEM
events: introduced: 4.6.0
fixed: 4.6.14
package: ecosystem: PyPI
name: trytond
ranges: type: ECOSYSTEM
events: introduced: 4.8.0
fixed: 4.8.10
package: ecosystem: PyPI
name: trytond
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.0.6
cwe_ids: CWE-862
severity: MODERATE

In `trytond/model/modelstorage.py` in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to guess values.
NULL Pointer Dereference in Google TensorFlow
Advisory: GHSA-mfg7-x5m7-6p8w
Aliases: CVE-2019-9635
Published: 2019-04-30T15:37:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: tensorflow
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.12.1
cwe_ids: CWE-476
severity: MODERATE

NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.
SQL Injection in sequelize
Advisory: GHSA-2777-2vq8-c4v4
Aliases: CVE-2019-11069
Published: 2019-04-11T16:33:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.3.0
cwe_ids: CWE-20
severity: HIGH

Versions of `sequelize` prior to 5.3.0 (excluding v3 and v4) are vulnerable to SQL Injection. PostgreSQL option`standard_conforming_strings` is not set to `on` by default, which may allow attackers to inject SQL statements due to poor handling of backslashes in string literals.


## Recommendation

Upgrade to version 5.3.0 or later.
Cross-Site Scripting in simple-markdown
Advisory: GHSA-qj3f-9gmq-fwv5
Aliases: CVE-2019-9844
Published: 2019-04-09T19:47:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: simple-markdown
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.4.4
cwe_ids: CWE-79
severity: MODERATE

Versions of `simple-markdown` prior to 0.4.4 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization the package may render output containing malicious JavaScript. This vulnerability can be exploited through input of links containing `data` or VBScript URIs and a base64-encoded payload.


## Recommendation

Upgrade to version 0.4.4 or later.
High severity vulnerability that affects Microsoft.ChakraCore
Advisory: GHSA-fv38-4c3m-25v8
Aliases: CVE-2019-0592
Published: 2019-04-09T19:43:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: Microsoft.ChakraCore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.7
cwe_ids: CWE-787
severity: HIGH

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0611.
Improper Authorization in org.apache.hbase:hbase
Advisory: GHSA-535v-4x9q-446c
Aliases: CVE-2019-0212
Published: 2019-04-02T15:47:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.hbase:hbase
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.5
package: ecosystem: Maven
name: org.apache.hbase:hbase
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.4
cwe_ids: CWE-285
severity: HIGH

In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.
Cross-site Scripting in Apache Zeppelin
Advisory: GHSA-r2v5-5vcr-h3vq
Aliases: CVE-2018-1328
Published: 2019-04-24T16:07:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.zeppelin:zeppelin
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.8.0
cwe_ids: CWE-79
severity: MODERATE

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph".
Cross-site Scripting in Eclipse Jetty
Advisory: GHSA-7vx9-xjhr-rw6h
Aliases: CVE-2019-10241
Published: 2019-04-23T16:06:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 9.2.27.v20190403
database_specific: last_known_affected_version_range: <= 9.2.26.v20180806
package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.3.0
fixed: 9.3.26.v20190403
database_specific: last_known_affected_version_range: <= 9.3.25.v20180904
package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.4.0
fixed: 9.4.16.v20190411
database_specific: last_known_affected_version_range: <= 9.4.15.v20190215
cwe_ids: CWE-79
severity: MODERATE

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
Improper Restriction of Operations within the Bounds of a Memory Buffer in Google TensorFlow
Advisory: GHSA-q492-f7gr-27rp
Aliases: CVE-2018-10055
Published: 2019-04-30T15:37:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Affected: package: ecosystem: PyPI
name: tensorflow
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.7.1
cwe_ids: CWE-119
severity: HIGH

Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or read from other parts of process memory via a crafted configuration file.
Improper Input Validation in net.sf.robocode:robocode.host allows for external service interaction
Advisory: GHSA-q2xp-75m7-gv52
Aliases: CVE-2019-10648
Published: 2019-04-02T15:36:49Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: net.sf.robocode:robocode.host
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.9.3.7
database_specific: last_known_affected_version_range: <= 1.9.3.5
cwe_ids: CWE-20
CWE-862
severity: CRITICAL

Robocode through 1.9.3.5 allows remote attackers to cause external service interaction (DNS), as demonstrated by a query for a unique subdomain name within an attacker-controlled DNS zone, because of a .openStream call within java.net.URL.
XSS in jQuery as used in Drupal, Backdrop CMS, and other products
Advisory: GHSA-6c3j-c64m-qhgq
Aliases: CVE-2019-11358
Published: 2019-04-26T16:29:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: jquery
ranges: type: ECOSYSTEM
events: introduced: 1.1.4
fixed: 3.4.0
package: ecosystem: RubyGems
name: jquery-rails
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.4
package: ecosystem: NuGet
name: jQuery
ranges: type: ECOSYSTEM
events: introduced: 1.1.4
fixed: 3.4.0
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.0a1
fixed: 2.1.9
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.2a1
fixed: 2.2.2
package: ecosystem: Maven
name: org.webjars.npm:jquery
ranges: type: ECOSYSTEM
events: introduced: 1.1.4
fixed: 3.4.0
cwe_ids: CWE-1321
CWE-79
severity: MODERATE

jQuery from 1.1.4 until 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles `jQuery.extend(true, {}, ...)` because of `Object.prototype` pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype`.