aswin1906/github-advisory-2019.csv huggingface dataset:
Apache NiFi information disclosure by XXE
Advisory: GHSA-744r-vv2g-2x6g
Aliases: CVE-2019-10080
Published: 2019-12-02T18:17:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.nifi:nifi-security
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.10.0
package: ecosystem: Maven
name: org.apache.nifi:nifi
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.10.0
cwe_ids: CWE-611
severity: MODERATE

The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.
Apache NiFi user log out issue
Advisory: GHSA-fmqw-vqh5-cwq9
Aliases: CVE-2019-12421
Published: 2019-12-02T18:19:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.nifi:nifi-web-security
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.10.0
package: ecosystem: Maven
name: org.apache.nifi:nifi-web-api
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.10.0
cwe_ids: CWE-613
severity: HIGH

When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.
A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack
Advisory: GHSA-7xx3-m584-x994
Aliases: CVE-2019-16770
Published: 2019-12-05T19:26:37Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: RubyGems
name: puma
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.12.2
package: ecosystem: RubyGems
name: puma
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.3.1
cwe_ids: CWE-770
severity: MODERATE

## Keepalive thread overload/DoS

### Impact

A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.

If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.

### Patches

This vulnerability is patched in Puma 4.3.1 and 3.12.2.

### Workarounds

Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [puma](github.com/puma/puma).
Insert tag injection in the Contao login module
Advisory: GHSA-jc43-qrrp-98f5
Aliases: CVE-2019-19714
Published: 2019-12-17T22:53:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: package: ecosystem: Packagist
name: contao/core-bundle
ranges: type: ECOSYSTEM
events: introduced: 4.8.4
fixed: 4.8.6
cwe_ids: CWE-116
severity: MODERATE

### Impact

It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

### Patches

Update to Contao 4.8.6.

### Workarounds

None.

### References

https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
Moderate severity vulnerability that affects moin
Advisory: GHSA-42fp-4hm3-j8r7
Aliases: CVE-2017-5934
Published: 2019-01-04T17:46:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: moin
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.9.10
cwe_ids: CWE-79
severity: MODERATE

Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Jinjava calls getClass
Advisory: GHSA-45r8-3495-x6rm
Aliases: CVE-2018-18893
Published: 2019-01-04T17:43:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: com.hubspot.jinjava:jinjava
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.6
severity: MODERATE

Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.
Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons
Advisory: GHSA-4rm3-4mq4-mfwr
Aliases: CVE-2018-20595
Published: 2019-01-04T17:43:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.hswebframework.web:hsweb-commons
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.0.4
cwe_ids: CWE-352
severity: HIGH

A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.
Low severity vulnerability that affects org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml
Advisory: GHSA-wr5r-m8pc-85j9
Aliases: CVE-2019-3772
Published: 2019-01-25T16:18:49Z
Affected: package: ecosystem: Maven
name: org.springframework.integration:spring-integration-xml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.19
package: ecosystem: Maven
name: org.springframework.integration:spring-integration-xml
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.0.11
package: ecosystem: Maven
name: org.springframework.integration:spring-integration-xml
ranges: type: ECOSYSTEM
events: introduced: 5.1.0
fixed: 5.1.2
package: ecosystem: Maven
name: org.springframework.integration:spring-integration-ws
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.19
package: ecosystem: Maven
name: org.springframework.integration:spring-integration-ws
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.0.11
package: ecosystem: Maven
name: org.springframework.integration:spring-integration-ws
ranges: type: ECOSYSTEM
events: introduced: 5.1.0
fixed: 5.1.2
cwe_ids: CWE-611
severity: LOW

Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Bleach URI Scheme Restriction Bypass
Advisory: GHSA-m9mq-p2f9-cfqv
Aliases: CVE-2018-7753
Published: 2019-01-04T17:46:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: bleach
ecosystem_specific: affected_functions: bleach.sanitizer.BleachSanitizerFilter.allow_token
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.3
cwe_ids: CWE-20
severity: CRITICAL

An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.
sqla-yaml-fixtures is vulnerable to Code Injection
Advisory: GHSA-2x54-j4m3-r6wx
Aliases: CVE-2019-3575
Published: 2019-01-04T17:44:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: sqla-yaml-fixtures
ecosystem_specific: affected_functions: sqla_yaml_fixtures.load
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.9.1
cwe_ids: CWE-94
severity: HIGH

Sqla_yaml_fixtures versions up to 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in `sqla_yaml_fixtures.load`.
Nokogiri NULL Pointer Dereference
Advisory: GHSA-6qvp-r6r3-9p7h
Aliases: CVE-2018-14404
Published: 2019-01-17T14:05:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: RubyGems
name: nokogiri
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.8.5
cwe_ids: CWE-476
severity: HIGH

A NULL pointer dereference vulnerability exists in the `xpath.c:xmlXPathCompOpEval()` function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the `XPATH_OP_AND` or `XPATH_OP_OR` case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.
Bootstrap XSS vulnerability
Advisory: GHSA-4p24-vmcr-4gqj
Aliases: CVE-2016-10735
Published: 2019-01-17T13:57:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.0
package: ecosystem: npm
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 4.0.0-beta
fixed: 4.0.0-beta.2
cwe_ids: CWE-79
severity: MODERATE

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.

See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.
Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml
Advisory: GHSA-8222-6fc8-mhvf
Aliases: CVE-2019-3773
Published: 2019-01-25T16:18:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.springframework.ws:spring-ws
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.4
package: ecosystem: Maven
name: org.springframework.ws:spring-ws
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.6
database_specific: last_known_affected_version_range: <= 3.0.4
package: ecosystem: Maven
name: org.springframework.ws:spring-xml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.4
package: ecosystem: Maven
name: org.springframework.ws:spring-xml
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.6
database_specific: last_known_affected_version_range: <= 3.0.4
cwe_ids: CWE-611
severity: CRITICAL

Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Django Denial-of-service possibility in urlize and urlizetrunc template filters
Advisory: GHSA-r28v-mw67-m5p9
Aliases: CVE-2018-7536
Published: 2019-01-04T17:50:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.0
fixed: 2.0.3
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11
fixed: 1.11.11
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.8
fixed: 1.8.19
cwe_ids: CWE-185
severity: MODERATE

An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The `django.utils.html.urlize()` function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The `urlize()` function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.
xterm vulnerable to remote code execution 
Advisory: GHSA-mc23-976p-j42x
Aliases: CVE-2019-0542
Published: 2019-01-14T16:19:55Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: xterm
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.8.1
package: ecosystem: npm
name: xterm
ranges: type: ECOSYSTEM
events: introduced: 3.9.0
fixed: 3.9.2
package: ecosystem: npm
name: xterm
ranges: type: ECOSYSTEM
events: introduced: 3.10.0
fixed: 3.10.1
cwe_ids: CWE-94
severity: HIGH

A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters.
Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization
Advisory: GHSA-f9hv-mg5h-xcw9
Aliases: CVE-2018-19360
Published: 2019-01-04T19:06:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.8
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.3
database_specific: last_known_affected_version_range: <= 2.8.11.2
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.9.5
database_specific: last_known_affected_version_range: <= 2.7.9.4
cwe_ids: CWE-502
severity: CRITICAL

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
rendertron can remotely shut down Chrome instance
Advisory: GHSA-4q69-q4q7-x82c
Aliases: CVE-2017-18353
Published: 2019-01-04T17:41:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: rendertron
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0
cwe_ids: CWE-284
severity: HIGH

Rendertron 1.0.0 includes an `_ah/stop` route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application.
Improper Certificate Validation in Apache Airflow
Advisory: GHSA-77rc-x84q-pv4f
Aliases: CVE-2018-20245
Published: 2019-01-25T16:19:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: PyPI
name: apache-airflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.10.1
cwe_ids: CWE-295
severity: HIGH

The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.
Low severity vulnerability that affects org.springframework.batch:spring-batch-core
Advisory: GHSA-3wc8-659g-r88q
Aliases: CVE-2019-3774
Published: 2019-01-25T16:18:56Z
Affected: package: ecosystem: Maven
name: org.springframework.batch:spring-batch-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.10
package: ecosystem: Maven
name: org.springframework.batch:spring-batch-core
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.0.2
package: ecosystem: Maven
name: org.springframework.batch:spring-batch-core
ranges: type: ECOSYSTEM
events: introduced: 4.1.0
fixed: 4.1.1
versions: 4.1.0
cwe_ids: CWE-611
severity: LOW

Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Apache Airflow vulnerable to XSS
Advisory: GHSA-9gqg-3fxr-9hv7
Aliases: CVE-2017-17836
Published: 2019-01-25T16:19:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: apache-airflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.9.0
database_specific: last_known_affected_version_range: <= 1.8.2
cwe_ids: CWE-79
severity: CRITICAL

In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system.
Recurly vulnerable to SSRF
Advisory: GHSA-38rv-5jqc-m2cv
Aliases: CVE-2017-0906
Published: 2019-01-04T17:48:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: recurly
ranges: type: ECOSYSTEM
events: introduced: 2.6.0
fixed: 2.6.2
package: ecosystem: PyPI
name: recurly
ranges: type: ECOSYSTEM
events: introduced: 2.5.0
fixed: 2.5.1
versions: 2.5.0
package: ecosystem: PyPI
name: recurly
ranges: type: ECOSYSTEM
events: introduced: 2.4.0
fixed: 2.4.5
package: ecosystem: PyPI
name: recurly
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.1
versions: 2.3.0
package: ecosystem: PyPI
name: recurly
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.22
package: ecosystem: PyPI
name: recurly
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.16
package: ecosystem: PyPI
name: recurly
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.5
cwe_ids: CWE-918
severity: CRITICAL

The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource.get` method that could result in compromise of API keys or other critical resources.
XSS vulnerability that affects bootstrap
Advisory: GHSA-3mgp-fx93-9xv5
Aliases: CVE-2018-20676
Published: 2019-01-17T13:57:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.0
cwe_ids: CWE-79
severity: MODERATE

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
High severity vulnerability that affects privacyIDEA
Advisory: GHSA-7qqv-r2q4-jxhm
Aliases: CVE-2018-1000809
Published: 2019-01-14T16:19:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: privacyIDEA
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.23.2
cwe_ids: CWE-20
severity: HIGH

privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.
Cross-Site Request Forgery (CSRF) in Apache Airflow
Advisory: GHSA-68wv-rjrm-576p
Aliases: CVE-2017-17835
Published: 2019-01-25T16:19:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: apache-airflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.9.0
database_specific: last_known_affected_version_range: <= 1.8.2
cwe_ids: CWE-352
severity: HIGH

In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.
bootstrap Cross-site Scripting vulnerability
Advisory: GHSA-ph58-4vrj-w6hr
Aliases: CVE-2018-20677
Published: 2019-01-17T13:57:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.0
cwe_ids: CWE-79
severity: MODERATE

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Deserialization of Untrusted Data in jackson-databind
Advisory: GHSA-mx9v-gmh4-mgqw
Aliases: CVE-2018-19361
Published: 2019-01-04T19:07:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.9.5
database_specific: last_known_affected_version_range: <= 2.7.9.4
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.8
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.3
database_specific: last_known_affected_version_range: <= 2.8.11.2
cwe_ids: CWE-502
severity: CRITICAL

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
rendertron LFI vulnerability
Advisory: GHSA-j87c-cj65-vmh5
Aliases: CVE-2017-18354
Published: 2019-01-04T17:41:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: rendertron
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0
cwe_ids: CWE-22
severity: HIGH

Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote attacker.
Plone Open Redirect
Advisory: GHSA-xvwv-6wvx-px9x
Aliases: CVE-2017-1000484
Published: 2019-01-04T17:47:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: plone
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.3.16
package: ecosystem: PyPI
name: plone
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.1.0
cwe_ids: CWE-601
severity: MODERATE

By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website.
Cross-Site Scripting in react-dom
Advisory: GHSA-mvjj-gqq2-p4hw
Aliases: CVE-2018-6341
Published: 2019-01-04T19:05:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: react-dom
ranges: type: ECOSYSTEM
events: introduced: 16.0.0
fixed: 16.0.1
versions: 16.0.0
package: ecosystem: npm
name: react-dom
ranges: type: ECOSYSTEM
events: introduced: 16.1.0
fixed: 16.1.2
package: ecosystem: npm
name: react-dom
ranges: type: ECOSYSTEM
events: introduced: 16.2.0
fixed: 16.2.1
versions: 16.2.0
package: ecosystem: npm
name: react-dom
ranges: type: ECOSYSTEM
events: introduced: 16.3.0
fixed: 16.3.3
package: ecosystem: npm
name: react-dom
ranges: type: ECOSYSTEM
events: introduced: 16.4.0
fixed: 16.4.2
cwe_ids: CWE-79
severity: MODERATE

Affected versions of `react-dom` are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:
- be a server-side React app
- be rendered to HTML using `ReactDOMServer`
- include an attribute name from user input in an HTML tag


## Recommendation

If you are using `react-dom` 16.0.x, upgrade to 16.0.1 or later.  
If you are using `react-dom` 16.1.x, upgrade to 16.1.2 or later.  
If you are using `react-dom` 16.2.x, upgrade to 16.2.1 or later.  
If you are using `react-dom` 16.3.x, upgrade to 16.3.3 or later.  
If you are using `react-dom` 16.4.x, upgrade to 16.4.2 or later.
Moderate severity vulnerability that affects org.apache.karaf:apache-karaf
Advisory: GHSA-chj8-5xgw-wcvj
Aliases: CVE-2016-8750
Published: 2019-01-07T19:14:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.karaf:apache-karaf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.0.8
cwe_ids: CWE-90
severity: MODERATE

Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.