aswin1906/github-advisory-2019.csv huggingface dataset:
Downloads Resources over HTTP in pennyworth
Advisory: GHSA-x3j8-g4v9-67jq
Aliases: CVE-2016-10619
Published: 2019-02-18T23:56:51Z
Affected: package: ecosystem: npm
name: pennyworth
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `pennyworth` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in product-monitor
Advisory: GHSA-h2r4-4xgf-3865
Aliases: CVE-2016-10567
Published: 2019-02-18T23:35:32Z
Affected: package: ecosystem: npm
name: product-monitor
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.5
cwe_ids: CWE-311
severity: HIGH

Affected versions of `product-monitor` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `product-monitor`.


## Recommendation

Update to versions 2.2.5 or later.
Uncontrolled Memory Consumption in Django
Advisory: GHSA-wh4h-v3f2-r2pp
Aliases: CVE-2019-6975
Published: 2019-02-12T15:36:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: django
ecosystem_specific: affected_functions: django.utils.numberformat.format
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.19
package: ecosystem: PyPI
name: django
ecosystem_specific: affected_functions: django.utils.numberformat.format
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.11
package: ecosystem: PyPI
name: django
ecosystem_specific: affected_functions: django.utils.numberformat.format
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.6
cwe_ids: CWE-770
severity: HIGH

Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x before 2.1.6 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the `django.utils.numberformat.format()` function.
Timing Attack in csrf-lite
Advisory: GHSA-hjhr-r3gq-qvp6
Aliases: CVE-2016-10535
Published: 2019-02-18T23:39:44Z
Affected: package: ecosystem: npm
name: csrf-lite
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.2
cwe_ids: CWE-208
severity: HIGH

Affected versions of `csrf-lite` are vulnerable to timing attacks as a result of testing CSRF tokens via a fail-early comparison instead of a constant-time comparison. 

Timing attacks remove the exponential increase in entropy gained from increased secret length, by providing per-character feedback on the correctness of a guess via miniscule timing differences.

Under favorable network conditions, an attacker can exploit this to guess the secret in no more than (16*18)288 guesses, instead of the 16^18 guesses required were the timing attack not present. 


## Recommendation

Update to version 0.1.2 or later.
Downloads Resources over HTTP in prince
Advisory: GHSA-cr79-9pwf-r6f5
Aliases: CVE-2016-10591
Published: 2019-02-18T23:34:24Z
Affected: package: ecosystem: npm
name: prince
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.7
database_specific: last_known_affected_version_range: <= 1.4.6
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `prince` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `prince`.


## Recommendation

Update to version 1.4.6 or later.
Downloads Resources over HTTP in atom-node-module-installer
Advisory: GHSA-87g3-x896-w798
Aliases: CVE-2016-10620
Published: 2019-02-18T23:56:53Z
Affected: package: ecosystem: npm
name: atom-node-module-installer
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.9.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `atom-node-module-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `atom-node-module-installer`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in qbs
Advisory: GHSA-qhm8-m2c4-9mw7
Aliases: CVE-2016-10656
Published: 2019-02-18T23:45:11Z
Affected: package: ecosystem: npm
name: qbs
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.4.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `qbs` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `qbs`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in limbus-buildgen
Advisory: GHSA-rj38-87f3-93p6
Aliases: CVE-2016-10674
Published: 2019-02-18T23:42:27Z
Affected: package: ecosystem: npm
name: limbus-buildgen
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `limbus-buildgen` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `limbus-buildgen`.


## Recommendation

Update to version 0.1.1 or later.
herbivore downloads Resources over HTTP
Advisory: GHSA-7r2x-3qcm-8vfw
Aliases: CVE-2016-10665
Published: 2019-02-18T23:44:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: herbivore
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `herbivore` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `herbivore`.


## Recommendation

The module author has rewritten much of the package, and in that process, patched the vulnerability, but has not published any of the new code to npm.  

In order to get an updated version, it is necessary to install the package from github. This can be done using the following command:
```
npm i samatt/herbivore
```
Downloads Resources over HTTP in co-cli-installer
Advisory: GHSA-5rm3-qhxf-rh3r
Aliases: CVE-2016-10657
Published: 2019-02-18T23:45:10Z
Affected: package: ecosystem: npm
name: co-cli-installer
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `co-cli-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `co-cli-installer`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in box2d-native
Advisory: GHSA-362x-34h3-h6h6
Aliases: CVE-2016-10617
Published: 2019-02-18T23:56:48Z
Affected: package: ecosystem: npm
name: box2d-native
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.8
cwe_ids: CWE-311
severity: HIGH

Affected versions of `box2d-native` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `box2d-native`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
SQL Injection in sequelize
Advisory: GHSA-98pq-pmw9-4gpm
Aliases: CVE-2016-10550
Published: 2019-02-18T23:54:34Z
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.17.0
cwe_ids: CWE-89
severity: HIGH

Affected versions of `sequelize` are vulnerable to SQL Injection in locations where user input is passed into the `limit` or `order` parameters of `sequelize` query calls, such as `findOne` or `findAll`.



## Recommendation

Update to version 3.17.0 or later.
Route Validation Bypass in call
Advisory: GHSA-84fv-prrc-5ggr
Aliases: CVE-2016-10543
Published: 2019-02-18T23:40:04Z
Affected: package: ecosystem: npm
name: call
ranges: type: ECOSYSTEM
events: introduced: 2.0.1
fixed: 3.0.2
cwe_ids: CWE-20
severity: MODERATE

Affected versions of `call` do not validate empty parameters, which may result in a bypass of route validation rules. 

## Proof of Concept

Routing Scheme:
```
/api/{param}/{param2}/details
```
Triggering Request Path:
```
/api///
```


## Recommendation

Update to version 3.0.2 or later.
jdf-sass downloads Resources over HTTP
Advisory: GHSA-8cc8-8vvx-fhgw
Aliases: CVE-2016-10595
Published: 2019-02-18T23:34:11Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: jdf-sass
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.18
cwe_ids: CWE-311
severity: HIGH

Affected versions of `jdf-sass` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `jdf-sass`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Regular Expression Denial of Service in jadedown
Advisory: GHSA-6354-6mhv-mvv5
Aliases: CVE-2016-10520
Published: 2019-02-18T23:38:38Z
Affected: package: ecosystem: npm
name: jadedown
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.3
cwe_ids: CWE-400
severity: LOW

The `jadedown` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in.


### Proof of concept
```js
var jadedown = require('jadedown');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=1;i<=10000000;i=i+1) {
    console.log("COUNT: " + i);
    var str = genstr(i, 'f') + genstr(i, '#') + '{';
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    jadedown(str)

    var end = process.hrtime(start);
    console.log(end);
}

```

Results demonstrating blocking for 5 seconds using only 48 characters.

```
$ node jadedown.js
COUNT: 1
LENGTH: 6
[ 0, 4014065 ]
COUNT: 4
LENGTH: 12
[ 0, 503507 ]
COUNT: 7
LENGTH: 18
[ 0, 325225 ]
COUNT: 10
LENGTH: 24
[ 0, 1632684 ]
COUNT: 13
LENGTH: 30
[ 0, 7541230 ]
COUNT: 16
LENGTH: 36
[ 0, 80889495 ]
COUNT: 19
LENGTH: 42
[ 0, 636009936 ]
COUNT: 22
LENGTH: 48
[ 5, 820586760 ]
```

# Timeline
- October 24, 2015 - Vulnerability Identified
- October 24, 2015 - Maintainers Notified
- October 25, 2015 - Response from Maintainers with intent to fix
- January 5, 2016 - Advisory Published
- January 11, 2016 - CVE Requested


## Recommendation

This package is not actively maintained, and has not seen an update since 2011. 

The package also provides unique functionality in the form of a templating language that is not available elsewhere. If this package is used to process user input, the best available mitigation is to refactor the dependent application to not make use of this module.
Downloads Resources over HTTP in selenium-standalone-painful
Advisory: GHSA-3x83-p476-vv95
Aliases: CVE-2016-10679
Published: 2019-02-18T23:54:40Z
Affected: package: ecosystem: npm
name: selenium-standalone-painful
versions: 2.39.0-2.7.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `selenium-standalone-painful` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-standalone-painful`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in dalek-browser-chrome-canary
Advisory: GHSA-8mrf-g42m-5qc8
Aliases: CVE-2016-10584
Published: 2019-02-18T23:51:14Z
Affected: package: ecosystem: npm
name: dalek-browser-chrome-canary
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.10-2014-03-24-17-36-27
cwe_ids: CWE-311
severity: HIGH

Affected versions of `dalek-browser-chrome-canary` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-chrome-canary`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Prototype Pollution in node.extend
Advisory: GHSA-r96c-57pf-9jjm
Aliases: CVE-2018-16491
Published: 2019-02-07T18:17:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: node.extend
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.7
package: ecosystem: npm
name: node.extend
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.1
versions: 2.0.0
cwe_ids: CWE-400
severity: CRITICAL

Versions of `node.extend` before 1.1.7 or 2.0.1 are vulnerable to prototype pollution. 


## Recommendation

Update to version 1.1.7, 2.0.1 or later.
Downloads Resources over HTTP in bkjs-wand
Advisory: GHSA-4wm5-q7wv-6jx3
Aliases: CVE-2016-10571
Published: 2019-02-18T23:52:20Z
Affected: package: ecosystem: npm
name: bkjs-wand
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.3.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `bkjs-wand` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `bkjs-wand`.


## Recommendation

Update to version 0.3.2 or later.
xd-testing Downloads Resources over HTTP
Advisory: GHSA-j7j5-752x-wr4v
Aliases: CVE-2016-10653
Published: 2019-02-18T23:45:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: xd-testing
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `xd-testing` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `xd-testing`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Prototype Pollution in defaults-deep
Advisory: GHSA-pjxw-22xf-6pwc
Aliases: CVE-2018-16486
Published: 2019-02-07T18:16:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: defaults-deep
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.4
cwe_ids: CWE-345
CWE-400
severity: CRITICAL

All versions of `defaults-deep` are vulnerable to prototype pollution. Provided certain input `defaults-deep` can add or modify properties of the `Object` prototype. These properties will be present on all objects.


## Recommendation

As no patch is currently available for this vulnerability it is our recommendation to select another module that can provide this functionality.
Downloads Resources over HTTP in soci
Advisory: GHSA-p9pm-55vp-2jqw
Aliases: CVE-2016-10669
Published: 2019-02-18T23:44:32Z
Affected: package: ecosystem: npm
name: soci
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.2.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `soci` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `soci`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
High severity vulnerability that affects many_versioned_gem
Advisory: GHSA-hhxm-4f85-rgr8
Published: 2019-02-05T16:25:34Z
Withdrawn: 2020-06-16T21:40:22Z
Affected: package: ecosystem: RubyGems
name: many_versioned_gem
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.2.3
severity: HIGH

### Logs password in plaintext

### Impact

Logs the password used in plaintext.  The password should masked in logs to prevent it leaking.

### Patches
Has the problem been patched? What versions should users upgrade to?

### Workarounds
none

### See also
Are there any links users can visit to find out more information?


#### Package Ecosystem
RubyGems

#### Package Name
many_versioned_gem

#### Affected Versions
< 0.2.2

#### Patches
0.2.3
Critical severity vulnerability that affects Haraka
Advisory: GHSA-w5m8-5v9m-xhx5
Aliases: CVE-2016-1000282
Published: 2019-02-12T17:26:10Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: Haraka
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.8.9
cwe_ids: CWE-77
severity: CRITICAL

Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.
pngcrush-installer downloads Resources over HTTP
Advisory: GHSA-g93h-75m9-3qq4
Aliases: CVE-2016-10570
Published: 2019-02-18T23:52:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: pngcrush-installer
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.8.10
cwe_ids: CWE-311
severity: HIGH

Affected versions of `pngcrush-installer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pngcrush-installer`.


## Recommendation

Update to version 1.8.10 or later.