aswin1906/github-advisory-2019.csv huggingface dataset:
Low severity vulnerability that affects Gw2Sharp
Advisory: GHSA-4vr3-9v7h-5f8v
Published: 2019-06-18T15:38:41Z
Affected: package: ecosystem: NuGet
name: Gw2Sharp
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.3.1
severity: LOW

## Leaking cached authenticated requests

### Impact
If you've been using one `MemoryCacheMethod` object in multiple instances of `Gw2WebApiClient` and are requesting authenticated endpoints with different access tokens, then you are likely to run into this bug.

When using an instance of `MemoryCacheMethod` and using it with multiple instances of `Gw2WebApiClient`, there's a possibility that cached authenticated responses are leaking to another request to the same endpoint, but with a different Guild Wars 2 access token. The latter request wouldn't start however, and would return the first cached response immediately. This means that the second response (or later responses) may contain the same data as the first response, therefore leaking data from another authenticated endpoint.

The occurence of this is limited however. The Guild Wars 2 API doesn't use the `Expires` header on most (if not all) authenticated endpoints. This header is checked when caching responses. If this header isn't available, the response isn't cached at all. You should still update to at least version 0.3.1 in order to be certain that it won't happen.

### Patches
This bug has been fixed in version 0.3.1. When using an authenticated endpoint, it will prepend the SHA-1 hash of the access token to the cache id.

### Workarounds
For version 0.3.0 and lower, you can use one separate instance of `MemoryCacheMethod` per `Gw2WebApiClient` if you need to use it.

### For more information
If you have any questions or comments about this advisory, you can open an issue in [the Gw2Sharp repository](https://github.com/Archomeda/Gw2Sharp) or contact me on [Discord](https://discord.gg/hNcpDT3).
Unauthorized File Access in harp
Advisory: GHSA-6fmm-47qc-p4m4
Aliases: CVE-2019-5438
Published: 2019-06-13T16:12:26Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: npm
name: harp
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.40.3
cwe_ids: CWE-22
severity: MODERATE

All versions of `harp` are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Command Injection in wiki-plugin-datalog
Advisory: GHSA-pm52-wwrw-c282
Published: 2019-06-13T18:59:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected: package: ecosystem: npm
name: wiki-plugin-datalog
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.6
cwe_ids: CWE-94
severity: HIGH

Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system.


## Recommendation

Upgrade to version 0.1.6 or later.
Cross-site Scripting in JSPWiki
Advisory: GHSA-cj6j-32rg-45r2
Aliases: CVE-2019-10077
Published: 2019-06-06T15:29:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M4
database_specific: last_known_affected_version_range: <= 2.11.0.M3
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-main
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M4
database_specific: last_known_affected_version_range: <= 2.11.0.M3
cwe_ids: CWE-79
severity: MODERATE

A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.
Open Redirect in Spring Security OAuth
Advisory: GHSA-mmf6-6597-3v6m
Aliases: CVE-2019-11269
Published: 2019-06-13T20:18:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.18
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.5
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.5
package: ecosystem: Maven
name: org.springframework.security.oauth:spring-security-oauth
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.6
cwe_ids: CWE-601
severity: MODERATE

Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
Forced Logout in keycloak-connect
Advisory: GHSA-68hw-vfh7-xvg8
Aliases: CVE-2019-10157
Published: 2019-06-13T20:38:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: keycloak-connect
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.8.3
cwe_ids: CWE-287
CWE-345
severity: MODERATE

Versions of `keycloak-connect` prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the `/k_logout` route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely.


## Recommendation

Upgrade to version 4.4.0 or later.
Arbitrary Code Injection in mobile-icon-resizer
Advisory: GHSA-mxjr-xmcg-fg7w
Published: 2019-06-27T17:25:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: mobile-icon-resizer
ranges: type: ECOSYSTEM
events: introduced: 0.2.0
fixed: 0.4.3
cwe_ids: CWE-94
severity: MODERATE

mobile-icon-resizer resizes large images for use as icons for iOS and Android.

mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3.

mobile-icon-resizer takes an options object as an argument to define the resulting icons as such:
```
var options = {
  config: './config.js'
}
resize(options, function(err){});
```
config.js would need to be a file on the filesystem and look something like:
```
var config = {
  iOS: {
    "images": [
     /* iOS image definitions are not vulnerable */
    ]
  },
  android: {
    "images" : [
      {
        "baseRatio" : "console.log('Executing script as baseRatio property')",
        "folder" : "drawable-ldpi"
      },
      {
        "ratio" : "console.log('Executing script as ratio property')",
        "folder" : "drawable-mdpi"
      },
    /* other android image defintiions ... */
    ]
  }
};

exports = module.exports = config;
```
The parameters `ratio` and `baseRatio` are passed directly to `eval()`, thus allowing dynamic javascript payloads to be executed.


## Recommendation

Update to version 0.4.3 or later.
Sensitive Data Exposure in sequelize-cli
Advisory: GHSA-3xc7-xg67-pw99
Published: 2019-06-05T20:43:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Affected: package: ecosystem: npm
name: sequelize-cli
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 5.4.0
cwe_ids: CWE-532
severity: LOW

Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.


## Recommendation

Upgrade to version 5.5.0 or later.
Insecure Comparison in secure-compare
Advisory: GHSA-h9x2-5rm7-x4gm
Aliases: CVE-2015-9238
Published: 2019-06-03T17:28:23Z
Affected: package: ecosystem: npm
name: secure-compare
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.1
cwe_ids: CWE-697
severity: HIGH

Versions of `secure-compare` prior to 3.0.1 are affected by a vulnerability that results in the package always returning true when comparing two strings of the same length, despite differences in the contents of those strings.


## Recommendation

Upgrade to version 3.0.1 or later.
Directory Traversal in lactate
Advisory: GHSA-68gr-cmcp-g3mj
Published: 2019-06-14T16:39:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: lactate
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.13.12
cwe_ids: CWE-22
severity: HIGH

A crafted `GET` request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. This allows for a remote attacker to gain access to arbitrary files on the filesystem that the process has access to read.

Mitigating factors:
Only files that the user running `lactate` has permission to read will be accessible via this vulnerability.


[Proof of concept](https://hackerone.com/reports/296645):
Please globally install the `lactate` package and `cd` to a directory you wish to serve assets from. Next, run `lactate -p 8081` to start serving files from this location.

The following cURL request can be used to demonstrate this vulnerability by requesting the target `/etc/passwd` file:

```
curl "http://127.0.0.1:8081/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd"
```
```
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
[...]
```


## Recommendation

As there is currently no fix for this issue selecting an alternative static web server would be the best choice.
Cross-site Scripting in HAPI FHIR
Advisory: GHSA-52mh-p2m2-w625
Aliases: CVE-2019-12741
Published: 2019-06-07T20:56:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: ca.uhn.hapi.fhir:hapi-fhir-base
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.8.0
cwe_ids: CWE-79
severity: MODERATE

XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)
Prototype Pollution in @apollo/gateway
Advisory: GHSA-74cr-77xc-8g6r
Published: 2019-06-13T20:37:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: @apollo/gateway
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.6.2
cwe_ids: CWE-1321
CWE-400
severity: HIGH

Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

Upgrade to version 0.6.2 or later.
Rate Limiting Bypass in express-brute
Advisory: GHSA-984p-xq9m-4rjw
Published: 2019-06-07T21:01:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: express-brute
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.1
cwe_ids: CWE-77
severity: MODERATE

All versions of `express-brute` are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Command Injection in fs-path
Advisory: GHSA-gc94-6w89-hpqr
Published: 2019-06-12T16:37:07Z
Affected: package: ecosystem: npm
name: fs-path
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.0.25
cwe_ids: CWE-77
severity: HIGH

All versions of `fs-path` are vulnerable to command injection is unsanitized user input is passed in.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Privilege Escalation in express-cart
Advisory: GHSA-3fc5-9x9m-vqc4
Published: 2019-06-03T17:31:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: express-cart
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.6
severity: CRITICAL

Versions of `express-cart` before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users.


## Recommendation

Update to version 1.1.6 or later.
Command Injection in open
Advisory: GHSA-28xh-wpgr-7fm8
Published: 2019-06-20T15:35:49Z
Affected: package: ecosystem: npm
name: open
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.0.0
cwe_ids: CWE-77
severity: CRITICAL

Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.

The package does come with the following warning in the readme:

```
The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.
```


## Recommendation

`open` is now the deprecated `opn` package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.
Command Injection in opencv
Advisory: GHSA-f698-m2v9-5fh3
Published: 2019-06-04T20:11:44Z
Affected: package: ecosystem: npm
name: opencv
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.1.0
cwe_ids: CWE-77
severity: LOW

Versions of `opencv`prior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands.


## Recommendation

Upgrade to version 6.1.0.
Prototype Pollution in lutils-merge
Advisory: GHSA-f7qw-5pvg-mmwp
Published: 2019-06-13T18:58:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: lutils-merge
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.6
cwe_ids: CWE-400
severity: MODERATE

All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

The package is deprecated and no fixes are available. Consider using an alternative package.
Prototype Pollution in handlebars
Advisory: GHSA-q42p-pg8m-cqh6
Published: 2019-06-05T14:07:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: handlebars
ecosystem_specific: affected_functions: handlebars.helpers.lookup
ranges: type: ECOSYSTEM
events: introduced: 4.1.0
fixed: 4.1.2
package: ecosystem: npm
name: handlebars
ecosystem_specific: affected_functions: handlebars.helpers.lookup
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.0.14
package: ecosystem: npm
name: handlebars
ecosystem_specific: affected_functions: handlebars.helpers.lookup
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.7
cwe_ids: CWE-471
severity: HIGH

Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.


## Recommendation

For handlebars 4.1.x upgrade to 4.1.2 or later.
For handlebars 4.0.x upgrade to 4.0.14 or later.
Denial of Service in http-proxy-agent
Advisory: GHSA-8w57-jfpm-945m
Published: 2019-06-11T16:16:07Z
Affected: package: ecosystem: npm
name: http-proxy-agent
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.1.0
cwe_ids: CWE-400
severity: HIGH

Versions of `http-proxy-agent` before 2.1.0 are vulnerable to denial of service and uninitialized memory leak when unsanitized options are passed to `Buffer`. An attacker may leverage these unsanitized options to consume system resources.


## Recommendation

Update to version 2.1.0 or later.
Cross-Site Scripting via JSONP
Advisory: GHSA-28hp-fgcr-2r4h
Published: 2019-06-27T17:25:42Z
Affected: package: ecosystem: npm
name: angular
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.0
cwe_ids: CWE-79
severity: MODERATE

JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.
Path Traversal in statics-server
Advisory: GHSA-74cp-qw7f-7hpw
Published: 2019-06-05T14:10:23Z
Affected: package: ecosystem: npm
name: statics-server
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.9
cwe_ids: CWE-22
severity: MODERATE

All versions of `statics-server` are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
NoSQL Injection in sequelize
Advisory: GHSA-wfp9-vr4j-f49j
Published: 2019-06-04T20:04:27Z
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.12.0
cwe_ids: CWE-89
severity: HIGH

Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.


## Recommendation

Upgrade to version 4.12.0 or later
Credential exposure through log files in Undertow
Advisory: GHSA-jwgx-9mmh-684w
Aliases: CVE-2019-3888
Published: 2019-06-13T20:02:56Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: io.undertow:undertow-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.21
cwe_ids: CWE-532
severity: CRITICAL

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)
Code injection in RubyGems
Advisory: GHSA-76wm-422q-92mq
Aliases: CVE-2019-8324
Published: 2019-06-20T16:06:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 2.6.0
fixed: 2.7.9
package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.2
cwe_ids: CWE-94
severity: HIGH

An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.
Insecure Default Configuration in redbird
Advisory: GHSA-8948-ffc6-jg52
Published: 2019-06-06T15:32:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: redbird
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.9.0
cwe_ids: CWE-20
severity: MODERATE

Versions of `redbird` prior to 0.9.1 have a vulnerable default configuration of allowing TLS 1.0 connections on `lib/proxy.js`. The package does not provide an option to disable TLS 1.0 which is deprecated and vulnerable.


## Recommendation

Upgrade to version 0.9.1 or later.
Regular Expression Denial of Service in clean-css
Advisory: GHSA-wxhq-pm8v-cw75
Published: 2019-06-05T20:50:16Z
Affected: package: ecosystem: npm
name: clean-css
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.1.11
cwe_ids: CWE-1333
severity: LOW

Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.


## Recommendation

Upgrade to version 4.1.11 or higher.
Out-of-bounds Read in npmconf
Advisory: GHSA-57cf-349j-352g
Published: 2019-06-12T16:37:00Z
Affected: package: ecosystem: npm
name: npmconf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.1.3
cwe_ids: CWE-125
severity: MODERATE

Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.


## Recommendation

Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.
Sandbox Bypass Leading to Arbitrary Code Execution in constantinople
Advisory: GHSA-4vmm-mhcq-4x9j
Published: 2019-06-14T16:15:14Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected: package: ecosystem: npm
name: constantinople
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.1.1
severity: CRITICAL

Versions of `constantinople` prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.


## Recommendation

Update to version 3.1.1 or later.
Denial of Service in ws
Advisory: GHSA-5v72-xg48-5rpm
Published: 2019-06-04T19:37:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: ws
ranges: type: ECOSYSTEM
events: introduced: 0.2.6
fixed: 1.1.5
package: ecosystem: npm
name: ws
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 3.3.1
cwe_ids: CWE-400
severity: HIGH

Affected versions of `ws` can crash when a specially crafted `Sec-WebSocket-Extensions` header containing `Object.prototype` property names as extension or parameter names is sent.

## Proof of concept

```
const WebSocket = require('ws');
const net = require('net');

const wss = new WebSocket.Server({ port: 3000 }, function () {
  const payload = 'constructor';  // or ',;constructor'

  const request = [
    'GET / HTTP/1.1',
    'Connection: Upgrade',
    'Sec-WebSocket-Key: test',
    'Sec-WebSocket-Version: 8',
    `Sec-WebSocket-Extensions: ${payload}`,
    'Upgrade: websocket',
    '\r\n'
  ].join('\r\n');

  const socket = net.connect(3000, function () {
    socket.resume();
    socket.write(request);
  });
});
```


## Recommendation

Update to version 3.3.1 or later.
Cross-Site Scripting in JSPWiki
Advisory: GHSA-cxx2-fp39-rf3r
Aliases: CVE-2019-10076
Published: 2019-06-06T15:29:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M4
database_specific: last_known_affected_version_range: <= 2.11.0.M3
package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-main
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M4
database_specific: last_known_affected_version_range: <= 2.11.0.M3
cwe_ids: CWE-79
severity: MODERATE

A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.