aswin1906/github-advisory-2019.csv huggingface dataset:
ipip downloads Resources over HTTP
Advisory: GHSA-9gqh-q4cx-f2h9
Aliases: CVE-2016-10594
Published: 2019-02-18T23:50:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: ipip
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.0.0
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `ipip` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability, and the README states that the package is deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in geoip-lite-country
Advisory: GHSA-ff29-f57w-2mm3
Aliases: CVE-2016-10568
Published: 2019-02-18T23:54:03Z
Affected: package: ecosystem: npm
name: geoip-lite-country
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.4
cwe_ids: CWE-311
severity: HIGH

Affected versions of `geoip-lite-country` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 1.1.4 or later.
Downloads Resources over HTTP in selenium-portal
Advisory: GHSA-6fvw-7vch-x489
Aliases: CVE-2016-10667
Published: 2019-02-18T23:44:36Z
Affected: package: ecosystem: npm
name: selenium-portal
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.1-2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `selenium-portal` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-portal`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Cross-Site Scripting in html-pages
Advisory: GHSA-5p26-hw7f-3cpr
Aliases: CVE-2018-16481
Published: 2019-02-07T18:14:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: html-pages
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.1.0
cwe_ids: CWE-64
CWE-79
severity: MODERATE

All versions of `html-pages` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize folder names, allowing attackers to execute arbitrary JavaScript in the victim's browser through folders with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Downloads Resources over HTTP in tomita
Advisory: GHSA-g84j-95x2-7g67
Aliases: CVE-2016-10662
Published: 2019-02-18T23:44:50Z
Affected: package: ecosystem: npm
name: tomita
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `tomita` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `tomita`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
ibapi downloads Resources over HTTP
Advisory: GHSA-92qm-hc53-jjrj
Aliases: CVE-2016-10593
Published: 2019-02-18T23:34:17Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: ibapi
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.6.2
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `ibapi` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `ibapi`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
dalek-browser-ie downloads Resources over HTTP
Advisory: GHSA-65q2-x652-xx84
Aliases: CVE-2016-10605
Published: 2019-02-18T23:50:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: dalek-browser-ie
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.5
cwe_ids: CWE-311
severity: HIGH

Affected versions of `dalek-browser-ie` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-ie`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
dalek-browser-chrome Downloads Resources over HTTP
Advisory: GHSA-6q8q-rvf4-m4pg
Aliases: CVE-2016-10604
Published: 2019-02-18T23:50:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: dalek-browser-chrome
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.11
cwe_ids: CWE-311
severity: HIGH

Affected versions of `dalek-browser-chrome` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-chrome`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available - the author of `dalek` recommends [`TestCafé`](http://devexpress.github.io/testcafe/). 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
closurecompiler downloads Resources over HTTP
Advisory: GHSA-hjgp-8ffr-hwwr
Aliases: CVE-2016-10582
Published: 2019-02-18T23:51:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: closurecompiler
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.6.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `closurecompiler` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `closurecompiler`.


## Recommendation

Update to version 1.6.1 or later.
DoS due to excessively large websocket message in ws
Advisory: GHSA-6663-c963-2gqg
Aliases: CVE-2016-10542
Published: 2019-02-18T23:58:35Z
Affected: package: ecosystem: npm
name: ws
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.1
cwe_ids: CWE-400
severity: HIGH

Affected versions of `ws` do not appropriately limit the size of incoming websocket payloads, which may result in a denial of service condition when the node process crashes after receiving a large payload.



## Recommendation

Update to version 1.1.1 or later. 
Alternatively, set the `maxpayload` option for the `ws` server to a value smaller than 256MB.
Prototype Pollution in lodash
Advisory: GHSA-4xc9-xhrj-v574
Aliases: CVE-2018-16487
Published: 2019-02-07T18:16:48Z
Affected: package: ecosystem: npm
name: lodash
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.17.11
cwe_ids: CWE-400
severity: HIGH

Versions of `lodash` before 4.17.5 are vulnerable to prototype pollution. 

The vulnerable functions are 'defaultsDeep', 'merge', and 'mergeWith' which allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.17.11 or later.
Downloads Resources over HTTP in pk-app-wonderbox
Advisory: GHSA-fwhp-2hqr-6g72
Aliases: CVE-2016-10685
Published: 2019-02-18T23:42:01Z
Affected: package: ecosystem: npm
name: pk-app-wonderbox
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `pk-app-wonderbox` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pk-app-wonderbox`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Moderate severity vulnerability that affects aioxmpp
Advisory: GHSA-32f7-cmr3-vpjv
Published: 2019-02-07T18:18:30Z
Withdrawn: 2020-06-17T15:14:32Z
Affected: package: ecosystem: PyPI
name: aioxmpp
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.10.3
severity: MODERATE

**Withdrawn:** Duplicate of GHSA-6m9g-jr8c-cqw3
Downloads Resources over HTTP in cobalt-cli
Advisory: GHSA-rwvj-jgc4-fqq5
Aliases: CVE-2016-10597
Published: 2019-02-18T23:34:05Z
Affected: package: ecosystem: npm
name: cobalt-cli
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.5.8
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `cobalt-cli` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cobalt-cli`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
mystem downloads Resources over HTTP
Advisory: GHSA-wx3q-6x7x-jjw4
Aliases: CVE-2016-10664
Published: 2019-02-18T23:44:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: mystem
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `mystem` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in grunt-ccompiler
Advisory: GHSA-cmj2-m9m2-6726
Aliases: CVE-2016-10636
Published: 2019-02-18T23:47:11Z
Affected: package: ecosystem: npm
name: grunt-ccompiler
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `grunt-ccompiler` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `grunt-ccompiler`.


## Recommendation

No patch is currently available for this vulnerability, and the repository has been deleted from the owner's github account.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
cloudpub-redis downloads Resources over HTTP
Advisory: GHSA-gf8v-vxf9-7c66
Aliases: CVE-2016-10672
Published: 2019-02-18T23:44:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: cloudpub-redis
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.4.5
cwe_ids: CWE-311
severity: HIGH

Affected versions of `cloudpub-redis` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `cloudpub-redis`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
libsbml downloads Resources over HTTP
Advisory: GHSA-432j-4fw9-2g6f
Aliases: CVE-2016-10668
Published: 2019-02-18T23:44:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: libsbml
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `libsbml` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libsbml`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Sails before 0.12.7 vulnerable to Broken CORS
Advisory: GHSA-qmv4-jgp7-mf68
Aliases: CVE-2016-10549
Published: 2019-02-18T23:40:10Z
Affected: package: ecosystem: npm
name: sails
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.12.7
cwe_ids: CWE-284
severity: HIGH

Affected versions of `sails` have an issue with the CORS configuration where the value of the origin header is reflected as the value for the `Access-Control-Allow-Origin` header. This may allow an attacker to make AJAX requests to vulnerable hosts through cross-site scripting or a malicious HTML Document, effectively bypassing the Same Origin Policy. 

## Mitigating Factors

This is only an issue when `allRoutes` is set to `true` and `origin` is set to `*` or left commented out in the sails CORS config file. 

The problem can be compounded when the cors `credentials` setting is not provided, because at that point authenticated cross domain requests are possible.


## Recommendation

Update to version 0.12.7 or later.

As this vulnerability is primarily a user error, the patch for the vulnerability will simply cause the application to write an error message to the console when a vulnerable configuration is used in a production environment.

Writing a proper CORS configuration is still the responsibility of the user, so it is necessary to check for the error message after installing the patch. Be sure you are not using `allRoutes: true` with `origin:'*'`, and that you uncomment `origin` and set it to a reasonable value. Ensure that if `origin` is set to `*` that you truly mean for all other websites to be able to make cross-domain requests to your API.

Likewise, ensure `credentials` is uncommented out and set to the appropriate value. Make sure to explicitly set which origins may request resources via CORS.
Pylons Colander Denial of Service vulnerability
Advisory: GHSA-rv95-4wxj-6fqq
Aliases: CVE-2017-18361
Published: 2019-02-07T18:18:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: colander
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.7.0
cwe_ids: CWE-835
severity: HIGH

In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.
Cross-Site Scripting in backbone
Advisory: GHSA-j6p2-cx3w-6jcp
Aliases: CVE-2016-10537
Published: 2019-02-18T23:39:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: backbone
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.5.0
cwe_ids: CWE-79
severity: MODERATE

Affected versions of `backbone` are vulnerable to cross-site scripting when users are allowed to supply input to the `Model#Escape` function, and the output is then written to the DOM. 

The vulnerability occurs as a result of the regular expression used to encode metacharacters failing to take HTML Entities such as `&#60;` into account.


## Recommendation

Update to version 0.5.0 or later.
SQL Injection in sequelize
Advisory: GHSA-x2jc-pwfj-h9p3
Aliases: CVE-2016-10554
Published: 2019-02-18T23:54:28Z
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.7.0
database_specific: last_known_affected_version_range: <= 1.7.0-alpha2
cwe_ids: CWE-89
severity: MODERATE

Affected versions of `sequelize` use MySQL's backslash-based escape syntax when connecting to SQLite, despite the fact that SQLite uses PostgreSQL's escape syntax, which can result in a SQL Injection vulnerability.


## Recommendation

Update to version 1.7.0-alpha3 or later.
Remote Memory Disclosure in ws
Advisory: GHSA-2mhh-w6q8-5hxw
Aliases: CVE-2016-10518
Published: 2019-02-18T23:56:42Z
Affected: package: ecosystem: npm
name: ws
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.1
cwe_ids: CWE-201
severity: LOW

Versions of `ws` prior to 1.0.1 are affected by a remote memory disclosure vulnerability.

In certain rare circumstances, applications which allow users to control the arguments of a `client.ping()` call will cause `ws` to send the contents of an allocated but non-zero-filled buffer to the server. This may disclose sensitive information that still exists in memory after previous use of the memory for other tasks.



## Proof of Concept
```
var ws = require('ws')

var server = new ws.Server({ port: 9000 })
var client = new ws('ws://localhost:9000')

client.on('open', function () {
  console.log('open')
  client.ping(50) // this sends a non-zeroed buffer of 50 bytes

  client.on('pong', function (data) {
    console.log('got pong')
    console.log(data) // Data from the client. 
  })
})
```


## Recommendation

Update to version 1.0.1 or greater.