aswin1906/github-advisory-2019.csv huggingface dataset:
prebuild-lwip downloads Resources over HTTP
Advisory: GHSA-r36x-p5pv-9mfx
Aliases: CVE-2016-10652
Published: 2019-02-18T23:45:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: prebuild-lwip
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.4
cwe_ids: CWE-311
severity: HIGH

Affected versions of `prebuild-lwip` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Bootstrap Vulnerable to Cross-Site Scripting
Advisory: GHSA-9v3m-8fp8-mj99
Aliases: CVE-2019-8331
Published: 2019-02-22T20:54:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: RubyGems
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.1
package: ecosystem: RubyGems
name: bootstrap-sass
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.1
package: ecosystem: NuGet
name: Bootstrap.Less
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.1
package: ecosystem: NuGet
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.3.1
package: ecosystem: NuGet
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.1
package: ecosystem: NuGet
name: bootstrap.sass
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.1
package: ecosystem: npm
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.3.1
package: ecosystem: npm
name: bootstrap
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.1
package: ecosystem: npm
name: bootstrap-sass
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.1
cwe_ids: CWE-79
severity: MODERATE

Versions of `bootstrap` prior to 3.4.1 for 3.x and 4.3.1 for 4.x are vulnerable to Cross-Site Scripting (XSS). The  `data-template` attribute of the tooltip and popover plugins lacks input sanitization and may allow attacker to execute arbitrary JavaScript.


## Recommendation

For `bootstrap` 4.x upgrade to 4.3.1 or later.
For `bootstrap` 3.x upgrade to 3.4.1 or later.
Downloads Resources over HTTP in iedriver
Advisory: GHSA-jfgq-g48x-jq83
Aliases: CVE-2016-10562
Published: 2019-02-18T23:54:20Z
Affected: package: ecosystem: npm
name: iedriver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `iedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `iedriver`.


## Recommendation

Update to iedriver version 3.0.0 or greater.
appium-chromedriver downloads Resources over HTTP
Advisory: GHSA-hc94-2wfr-4pwf
Aliases: CVE-2016-10557
Published: 2019-02-18T23:40:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: appium-chromedriver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.9.4
cwe_ids: CWE-311
severity: HIGH

Affected versions of `appium-chromedriver` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read items send over HTTP at will. In this case, that includes the chromedriver binary, which may result in remote code execution if overwritten with a malicious binary.


## Recommendation

Update to version 2.9.4 or later.
Downloads Resources over HTTP in serc.js
Advisory: GHSA-vcph-57hv-89c4
Aliases: CVE-2016-10678
Published: 2019-02-18T23:42:11Z
Affected: package: ecosystem: npm
name: serc.js
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `serc.js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `serc.js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in massif
Advisory: GHSA-4v2c-g2xc-47fv
Aliases: CVE-2016-10682
Published: 2019-02-18T23:54:38Z
Affected: package: ecosystem: npm
name: massif
versions: 0.0.1-1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `massif` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `massif`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in tomita-parser
Advisory: GHSA-722q-3g9x-vp8q
Aliases: CVE-2016-10666
Published: 2019-02-18T23:54:41Z
Affected: package: ecosystem: npm
name: tomita-parser
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `tomita-parser` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `tomita-parser`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in openframe-image
Advisory: GHSA-mgr2-3mpv-43gc
Aliases: CVE-2016-10616
Published: 2019-02-18T23:47:37Z
Affected: package: ecosystem: npm
name: openframe-image
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.3
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `openframe-image` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in windows-iedriver
Advisory: GHSA-w9mf-24h3-9wxf
Aliases: CVE-2016-10689
Published: 2019-02-18T23:41:58Z
Affected: package: ecosystem: npm
name: windows-iedriver
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.48.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `windows-iedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-iedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in nodewebkit
Advisory: GHSA-gc6c-5v9w-xmhw
Aliases: CVE-2016-10580
Published: 2019-02-18T23:51:27Z
Affected: package: ecosystem: npm
name: nodewebkit
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.11.6
cwe_ids: CWE-311
severity: HIGH

Affected versions of `nodewebkit` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodewebkit`.


## Recommendation

No patch is currently available, and the package author has deprecated this package. 

The best path forward in mitigating this vulnerability is to use the [official installer](https://www.npmjs.com/nw) instead of this package, as per the package author's instructions.
dwebp-bin downloads Resources over HTTP
Advisory: GHSA-4pf7-579w-f4gm
Aliases: CVE-2016-10633
Published: 2019-02-18T23:57:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: dwebp-bin
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.0
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `dwebp-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dwebp-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in unicode
Advisory: GHSA-qjf4-7642-c57p
Aliases: CVE-2016-10578
Published: 2019-02-18T23:51:52Z
Affected: package: ecosystem: npm
name: unicode
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 9.0.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `unicode` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 9.0.0 or later.
Denial of Service and Content Injection in i18n-node-angular
Advisory: GHSA-97gv-3p2c-xw7j
Aliases: CVE-2016-10524
Published: 2019-02-18T23:39:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:H
Affected: package: ecosystem: npm
name: i18n-node-angular
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.0
cwe_ids: CWE-400
CWE-74
severity: HIGH

Versions of `i18n-node-angular` prior to 1.4.0 are affected by denial of service and cross-site scripting vulnerabilities. The vulnerabilities exist in a REST endpoint that was created for development purposes, but was not disabled in production in affected versions.


## Recommendation

Update to version 1.4.0 or later.
Denial of Service in mqtt-packet
Advisory: GHSA-g3r2-65gc-qpqc
Aliases: CVE-2016-10523
Published: 2019-02-18T23:38:45Z
Affected: package: ecosystem: npm
name: mqtt-packet
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.6
package: ecosystem: npm
name: mqtt-packet
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.0.5
cwe_ids: CWE-400
severity: HIGH

Versions of `mqtt-packet` prior to 3.4.6, or 4.x prior to 4.0.5 are affected by a denial of service vulnerability wherein specific sequences of MQTT packets can crash the application.




## Recommendation

Version 3.x: Update to version 3.4.6 or later.
Version 4.x: Update to version 4.0.5 or later.
Downloads Resources over HTTP in node-thulac
Advisory: GHSA-m2w9-rm58-mhm9
Aliases: CVE-2016-10640
Published: 2019-02-18T23:47:06Z
Affected: package: ecosystem: npm
name: node-thulac
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.1.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `node-thulac` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `node-thulac`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Path Traversal in http-live-simulator
Advisory: GHSA-7c9w-qmrq-ff8r
Aliases: CVE-2018-16479
Published: 2019-02-07T18:14:21Z
Affected: package: ecosystem: npm
name: http-live-simulator
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.7
cwe_ids: CWE-22
severity: HIGH

Versions of `http-live-simulator` prior to 1.0.7 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. For example: `curl --path-as-is http://localhost:8080//../../../../etc/passwd`.


## Recommendation

Upgrade to version 1.0.7
Downloads Resources over HTTP in webrtc-native
Advisory: GHSA-7xvg-m3vx-2hhv
Aliases: CVE-2016-10600
Published: 2019-02-18T23:50:26Z
Affected: package: ecosystem: npm
name: webrtc-native
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.4.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `webrtc-native` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webrtc-native`.


## Recommendation

No direct patch is currently available for this vulnerability. 

However, if the native components of `webrtc-native` are built from source, this avoids download the precompiled binary, therefore mitigating the insecure download. 

The package author has provided instructions for building from source [here](https://github.com/vmolsa/webrtc-native/wiki/Getting-started#building-from-source).
Authentication Bypass by Spoofing in express-cart
Advisory: GHSA-wj36-v8j4-pc7c
Aliases: CVE-2018-16483
Published: 2019-02-07T18:16:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: express-cart
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.6
cwe_ids: CWE-290
severity: HIGH

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.
Authentication Bypass in hapi-auth-jwt2
Advisory: GHSA-mg8r-9g6j-hwv9
Aliases: CVE-2016-10525
Published: 2019-02-18T23:39:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: hapi-auth-jwt2
ranges: type: ECOSYSTEM
events: introduced: 5.1.1
fixed: 5.1.2
versions: 5.1.1
cwe_ids: CWE-287
severity: CRITICAL

Versions of `hapi-auth-jwt2` prior to version 5.1.2 are affected by a complete authentication bypass vulnerability when in the `try` authentication mode. 


## Recommendation

Update to version 5.1.2 or later.
Cross-Site Scripting in m-server
Advisory: GHSA-gmxv-xf2q-6j8m
Aliases: CVE-2018-16484
Published: 2019-02-07T18:16:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: m-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.2
cwe_ids: CWE-79
severity: MODERATE

Versions of `m-server` before 1.4.2 are vulnerable to stored cross-site scripting. This vulnerability is exploitable if an attacker is able to control the name of a file that `m-server` is serving.


## Recommendation

Update to version 1.4.2 or later.
openframe-ascii-image downloads Resources over HTTP
Advisory: GHSA-xj6f-x7jm-85ff
Aliases: CVE-2016-10690
Published: 2019-02-18T23:41:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: openframe-ascii-image
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `openframe-ascii-image` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `openframe-ascii-image`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in aerospike
Advisory: GHSA-v5v3-8jqf-vg27
Aliases: CVE-2016-10558
Published: 2019-02-18T23:54:22Z
Affected: package: ecosystem: npm
name: aerospike
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.4.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `aerospike` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `aerospike`.


## Recommendation

Update to version 2.4.2 or later
robot-js downloads Resources over HTTP
Advisory: GHSA-6v7p-j23v-4xmw
Aliases: CVE-2016-10608
Published: 2019-02-18T23:48:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: robot-js
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.0.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `robot-js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `robot-js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in jser-stat
Advisory: GHSA-5w4p-h4gm-3w26
Aliases: CVE-2016-10592
Published: 2019-02-18T23:50:53Z
Affected: package: ecosystem: npm
name: jser-stat
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 4.0.3
cwe_ids: CWE-311
severity: MODERATE

Affected versions of `jser-stat` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Rendertron discloses absolute paths of files
Advisory: GHSA-vqmr-957g-r7w3
Aliases: CVE-2017-18355
Published: 2019-02-12T15:36:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: rendertron
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0
cwe_ids: CWE-200
severity: HIGH

Installed packages are exposed by node_modules in Rendertron 1.0.0, allowing remote attackers to read absolute paths on the server by examining the "_where" attribute of package.json files.