aswin1906/github-advisory-2019.csv huggingface dataset:
SQL Injection in sequelize
Advisory: GHSA-2598-2f59-rmhq
Aliases: CVE-2019-10749
Published: 2019-11-08T17:05:17Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.35.1
cwe_ids: CWE-89
severity: CRITICAL

Versions of `sequelize` prior to 3.35.1 are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the Postgres dialect,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

Upgrade to version 3.35.1 or later.
Validation Bypass in slp-validate
Advisory: GHSA-wmx6-vxcf-c3gr
Aliases: CVE-2019-16761
Published: 2019-11-15T23:10:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
Affected: package: ecosystem: npm
name: slp-validate
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.0.1
versions: 1.0.0
cwe_ids: CWE-20
severity: CRITICAL

Versions of `slp-validate` prior to 1.0.1 are vulnerable to a validation bypass. Bitcoin scripts may cause the validation result from `slp-validate` to differ from the specified SLP consensus. This allows an attacker to create a Bitcoin script that causes a hard-fork from the SLP consensus.


## Recommendation

Upgrade to version 1.0.1 or later.
Unauthenticated crypto and weak IV in Magento\Framework\Encryption
Advisory: GHSA-h7qw-mxrm-c6h2
Aliases: CVE-2016-6485
Published: 2019-11-20T01:33:05Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.0
fixed: 2.2.6
cwe_ids: CWE-327
severity: HIGH

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
XSS issues in the management interface
Advisory: GHSA-7qqr-3pj3-q2f5
Aliases: CVE-2019-13236
Published: 2019-11-12T22:58:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.opencms:opencms-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 11.0.1
cwe_ids: CWE-79
severity: MODERATE

In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
Symfony Service IDs Allow Injection
Advisory: GHSA-pgwj-prpq-jpc2
Aliases: CVE-2019-10910
Published: 2019-11-18T17:27:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: symfony/dependency-injection
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist
name: symfony/dependency-injection
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist
name: symfony/dependency-injection
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist
name: symfony/dependency-injection
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist
name: symfony/dependency-injection
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist
name: symfony/proxy-manager-bridge
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist
name: symfony/proxy-manager-bridge
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist
name: symfony/proxy-manager-bridge
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist
name: symfony/proxy-manager-bridge
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist
name: symfony/proxy-manager-bridge
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.7
cwe_ids: CWE-89
severity: CRITICAL

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, when service ids allow user input, this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.
Remote code execution via vulnerable Symphony dependecy injection
Advisory: GHSA-3q5x-7mxp-rp6j
Aliases: CVE-2019-8135
Published: 2019-11-12T22:59:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.2
fixed: 2.2.10
package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.3
fixed: 2.3.3
cwe_ids: CWE-74
severity: CRITICAL

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.
Potential session hijack in Apache CXF 
Advisory: GHSA-cw6w-q88j-6mqf
Aliases: CVE-2019-12419
Published: 2019-11-08T17:12:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.cxf:cxf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.2.11
package: ecosystem: Maven
name: org.apache.cxf:cxf
ranges: type: ECOSYSTEM
events: introduced: 3.3.0
fixed: 3.3.4
cwe_ids: CWE-863
severity: CRITICAL

Apache CXF before 3.3.4 and 3.2.11 provides all of the components that are required to build a fully fledged OpenId Connect service. There is a vulnerability in the access token services, where it does not validate that the authenticated principal is equal to that of the supplied clientId parameter in the request. If a malicious client was able to somehow steal an authorization code issued to another client, then they could exploit this vulnerability to obtain an access token for the other client.
Path traversal attack on Windows platforms
Advisory: GHSA-89r3-rcpj-h7w6
Aliases: CVE-2019-0207
Published: 2019-11-18T17:19:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.tapestry:tapestry-core
ranges: type: ECOSYSTEM
events: introduced: 5.4.0
fixed: 5.4.5
cwe_ids: CWE-22
severity: HIGH

Tapestry processes assets `/assets/ctx` using classes chain `StaticFilesFilter -> AssetDispatcher -> ContextResource`, which doesn't filter the character `\`, so attacker can perform a path traversal attack to read any files on Windows platform.
Local file inclusion allows unauthorized access to internal resources in Alkacon OpenCms
Advisory: GHSA-36hf-6hp2-9g4c
Aliases: CVE-2019-13237
Published: 2019-11-12T22:58:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: org.opencms:opencms-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 11.0.1
cwe_ids: CWE-200
CWE-22
severity: MODERATE

In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
jackson-databind polymorphic typing issue
Advisory: GHSA-gjmw-vf9h-g25v
Aliases: CVE-2019-17531
Published: 2019-11-13T00:32:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.10.1
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.8.11.5
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.6.7.3
cwe_ids: CWE-502
severity: CRITICAL

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.
Cross-site scripting in Dolibarr
Advisory: GHSA-m553-9wmx-533h
Aliases: CVE-2019-16197
Published: 2019-11-08T20:05:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: dolibarr/dolibarr
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 10.0.2
cwe_ids: CWE-79
severity: MODERATE

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to XSS.
Eval injection in Supybot/Limnoria
Advisory: GHSA-6g88-vr3v-76mf
Aliases: CVE-2019-19010
Published: 2019-11-20T01:31:31Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: limnoria
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2019.11.09
cwe_ids: CWE-94
severity: CRITICAL

Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
Prototype Pollution in angular
Advisory: GHSA-89mq-4x47-5v83
Aliases: CVE-2019-10768
Published: 2019-11-20T15:29:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: angular
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.7.9
cwe_ids: CWE-1321
CWE-20
CWE-915
severity: HIGH

Versions of `angular ` prior to 1.7.9 are vulnerable to prototype pollution. The deprecated API function `merge()` does not restrict the modification of an Object's prototype in the , which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

Upgrade to version 1.7.9 or later. The function was already deprecated and upgrades are not expected to break functionality.
Information disclosure through processing of external XML entities
Advisory: GHSA-427g-2r83-3ccm
Aliases: CVE-2019-8126
Published: 2019-11-12T22:59:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.2
fixed: 2.2.10
package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.3
fixed: 2.3.3
cwe_ids: CWE-611
CWE-776
severity: MODERATE

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.
Cross-site scripting in Jupyter Notebook
Advisory: GHSA-jqwc-jm56-wcwj
Aliases: CVE-2018-21030
Published: 2019-11-08T17:07:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: package: ecosystem: PyPI
name: notebook
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 5.5.0
cwe_ids: CWE-79
severity: MODERATE

Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus, for example, an XSS payload can be placed in an SVG document.
XSS in login form
Advisory: GHSA-2p6p-v69p-9mm9
Aliases: CVE-2019-13235
Published: 2019-11-12T22:58:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.opencms:opencms-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 11.0.1
cwe_ids: CWE-79
severity: MODERATE

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
Unpublished files are exposed publicly
Advisory: GHSA-xm6j-x342-gwq9
Aliases: CVE-2019-16409
Published: 2019-11-12T23:01:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Packagist
name: symbiote/silverstripe-versionedfiles
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.0.3
cwe_ids: CWE-200
severity: MODERATE

In the Versioned Files module through 2.0.3 for SilverStripe 3.x, unpublished versions of files are publicly exposed to anyone who can guess their URL. This guess could be highly informed by a basic understanding of the symbiote/silverstripe-versionedfiles source code. (Users who upgrade from SilverStripe 3.x to 4.x and had Versioned Files installed have no further need for this module, because the 4.x release has built-in versioning. However, nothing in the upgrade process automates the destruction of these insecure artefacts, nor alerts the user to the criticality of destruction.)
Lack of access control on upoaded files
Advisory: GHSA-jvx5-rm6q-gx7p
Aliases: CVE-2019-12245
Published: 2019-11-12T23:01:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.6.8
package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 3.7.0
fixed: 3.7.4
package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.3.6
package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 4.4.0
fixed: 4.4.4
cwe_ids: CWE-732
severity: MODERATE

SilverStripe through 4.3.3 has incorrect access control for protected files uploaded via Upload::loadIntoFile(). An attacker may be able to guess a filename in silverstripe/assets via the AssetControlExtension.
Session fixation in change password form
Advisory: GHSA-w7r7-r8r9-vrg2
Aliases: CVE-2019-12203
Published: 2019-11-12T23:01:39Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.6.8
package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 3.7.0
fixed: 3.7.4
package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.3.6
package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 4.4.0
fixed: 4.4.4
cwe_ids: CWE-384
severity: MODERATE

SilverStripe through 4.3.3 allows session fixation in the "change password" form.
Apache Airflow vulnerable to XSS and local file disclosure
Advisory: GHSA-q3p4-gw7r-wqjc
Aliases: CVE-2019-12417
Published: 2019-11-22T13:45:22Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: apache-airflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.10.6
cwe_ids: CWE-79
severity: MODERATE

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.
Bypass of sitemp access restrictions
Advisory: GHSA-62fx-3v4f-mwxm
Aliases: CVE-2019-8133
Published: 2019-11-12T22:59:40Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.2
fixed: 2.2.10
package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.3
fixed: 2.3.3
severity: MODERATE

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with privileges to generate sitemaps can bypass configuration that restricts directory access. The bypass allows overwrite of a subset of configuration files which can lead to denial of service.
Potential to access user credentials from the log files when debug logging enabled
Advisory: GHSA-8vh8-vc28-m2hf
Aliases: CVE-2019-10212
Published: 2019-11-20T01:33:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: io.undertow:undertow-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.20
cwe_ids: CWE-532
severity: CRITICAL

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
Potential DOS attack due to unrestricted attachment count in messages
Advisory: GHSA-58p8-9g59-q2hr
Aliases: CVE-2019-12406
Published: 2019-11-08T17:15:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.cxf:cxf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.2.11
package: ecosystem: Maven
name: org.apache.cxf:cxf
ranges: type: ECOSYSTEM
events: introduced: 3.3.0
fixed: 3.3.4
package: ecosystem: Maven
name: org.apache.cxf:apache-cxf
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.2.11
package: ecosystem: Maven
name: org.apache.cxf:apache-cxf
ranges: type: ECOSYSTEM
events: introduced: 3.3.0
fixed: 3.3.4
cwe_ids: CWE-770
severity: MODERATE

Apache CXF before 3.3.4 and 3.2.11 does not restrict the number of message attachments present in a given message. This leaves open the possibility of a denial of service type attack, where a malicious user crafts a message containing a very large number of message attachments. From the 3.3.4 and 3.2.11 releases, a default limit of 50 message attachments is enforced. This is configurable via the message property "attachment-max-count".
Magento Cross-Site Scripting via Attribute Set Name
Advisory: GHSA-xv69-f7x5-r4qw
Aliases: CVE-2019-8145
Published: 2019-11-12T22:59:43Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.2
fixed: 2.2.10
package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.3
fixed: 2.3.3
cwe_ids: CWE-79
severity: MODERATE

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code into the attribute set name when listing the products.
Loofah Allows Cross-site Scripting
Advisory: GHSA-c3gv-9cxf-6f57
Aliases: CVE-2019-15587
Published: 2019-11-05T23:58:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: RubyGems
name: loofah
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.1
cwe_ids: CWE-79
severity: MODERATE

In the Loofah gem for Ruby through v2.3.0, unsanitized JavaScript may occur in sanitized output when a crafted SVG element is republished.
Cross-site Scripting in Grav
Advisory: GHSA-6268-v434-45m5
Aliases: CVE-2019-16126
Published: 2019-11-08T20:06:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: getgrav/grav
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.7.0-beta.8
database_specific: last_known_affected_version_range: <= 1.7.0-beta.7
cwe_ids: CWE-79
severity: MODERATE

Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
Signature validation bypass in XmlSecLibs
Advisory: GHSA-pqm6-cgwr-x6pf
Aliases: CVE-2019-3465
Published: 2019-11-08T20:06:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: robrichards/xmlseclibs
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.1.1
package: ecosystem: Packagist
name: robrichards/xmlseclibs
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.4
cwe_ids: CWE-347
severity: HIGH

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.
jackson-databind polymorphic typing issue
Advisory: GHSA-fmmc-742q-jg75
Aliases: CVE-2019-16943
Published: 2019-11-13T00:32:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.10.1
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.8.11.5
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.6.7.3
cwe_ids: CWE-502
severity: CRITICAL

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 prior to 2.9.10.1, 2.8.11.5, and 2.6.7.3. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
Advisory: GHSA-vvwv-h69m-wg6f
Aliases: CVE-2019-12331
Published: 2019-11-20T01:39:57Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: phpoffice/phpspreadsheet
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.8.0
cwe_ids: CWE-611
severity: HIGH

PHPOffice PhpSpreadsheet before 1.8.0 has an XXE issue. The XmlScanner decodes the sheet1.xml from an .xlsx to utf-8 if something else than UTF-8 is declared in the header. This was a security measurement to prevent CVE-2018-19277 but the fix is not sufficient. By double-encoding the the xml payload to utf-7 it is possible to bypass the check for the string ?<!ENTITY? and thus allowing for an xml external entity processing (XXE) attack.