aswin1906/github-advisory-2019.csv huggingface dataset:
Rejected CVE ID
Advisory: GHSA-943p-xc6m-c6gr
Aliases: CVE-2018-7574
Published: 2019-04-30T15:37:27Z
Withdrawn: 2020-05-13T15:49:20Z
Affected: package: ecosystem: PyPI
name: tensorflow
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.7.0
severity: HIGH

** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2018-7576,
CVE-2018-21233. Reason: this candidate was intended for one issue, but the
description and references inadvertently combined multiple issues. Notes:
All CVE users should consult CVE-2018-7576 and CVE-2018-21233 to determine
which ID is appropriate. All references and descriptions in this candidate
have been removed to prevent accidental usage.
Apache Airflow vulnerable to CSRF Attacks
Advisory: GHSA-w6j4-3gh2-9f5j
Aliases: CVE-2019-0229
Published: 2019-04-18T14:27:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: apache-airflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.10.3
cwe_ids: CWE-352
severity: HIGH

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
Improper Authentication in Apache Zeppelin
Advisory: GHSA-9x2h-hvg6-4r5p
Aliases: CVE-2018-1317
Published: 2019-04-24T16:06:52Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.zeppelin:zeppelin
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.8.0
cwe_ids: CWE-287
severity: HIGH

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.
Ansible Path Traversal vulnerability
Advisory: GHSA-74vq-h4q8-x6jv
Aliases: CVE-2019-3828
Published: 2019-04-15T16:19:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: ansible
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.5.15
package: ecosystem: PyPI
name: ansible
ranges: type: ECOSYSTEM
events: introduced: 2.6.0
fixed: 2.6.14
package: ecosystem: PyPI
name: ansible
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.8
cwe_ids: CWE-22
severity: MODERATE

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
Path Traversal in http-live-simulator
Advisory: GHSA-2hhw-p8mg-jrm6
Aliases: CVE-2019-5423
Published: 2019-04-08T15:18:40Z
Affected: package: ecosystem: npm
name: http-live-simulator
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.6
cwe_ids: CWE-22
severity: HIGH

Versions of `http-live-simulator` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 1.0.6
High severity vulnerability that affects Microsoft.ChakraCore
Advisory: GHSA-6jf5-rmhv-38cw
Aliases: CVE-2019-0639
Published: 2019-04-09T19:44:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: Microsoft.ChakraCore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.7
cwe_ids: CWE-190
severity: HIGH

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
High severity vulnerability that affects Microsoft.ChakraCore
Advisory: GHSA-7ph8-f946-q5r7
Aliases: CVE-2019-0611
Published: 2019-04-09T19:43:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: Microsoft.ChakraCore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.7
cwe_ids: CWE-787
severity: HIGH

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0592.
High severity vulnerability that affects Microsoft.ChakraCore
Advisory: GHSA-8qh8-cv77-h83g
Aliases: CVE-2019-0769
Published: 2019-04-09T19:43:46Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: Microsoft.ChakraCore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.7
cwe_ids: CWE-787
severity: HIGH

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
CoAPthon3 vulnerable to Deserialization of Untrusted Data
Advisory: GHSA-c6fm-rgw4-8q73
Aliases: CVE-2018-12679
Published: 2019-04-08T15:18:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: CoAPthon3
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.1
cwe_ids: CWE-502
severity: HIGH

The Serialize.deserialize() method in CoAPthon3 1.0 and 1.0.1 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, example collect CoAP server and client) when they receive crafted CoAP messages.
Improper Input Validation in Google TensorFlow
Advisory: GHSA-qx2v-j445-g354
Aliases: CVE-2018-7577
Published: 2019-04-30T15:37:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Affected: package: ecosystem: PyPI
name: tensorflow
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.7.1
cwe_ids: CWE-20
severity: HIGH

Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from other parts of process memory.
SQLAlchemy vulnerable to SQL Injection via order_by parameter
Advisory: GHSA-887w-45rq-vxgf
Aliases: CVE-2019-7164
Published: 2019-04-16T15:50:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: SQLAlchemy
ecosystem_specific: affected_functions: sqlalchemy.dialects.postgresql.base.PGDDLCompiler.visit_create_index
sqlalchemy.dialects.postgresql.base.PGDDLCompiler.visit_exclude_constraint
sqlalchemy.orm.session.Session.execute
sqlalchemy.sql.compiler.SQLCompiler.visit_textual_label_reference
sqlalchemy.sql.compiler.SQLCompiler.visit_function
sqlalchemy.sql.compiler.DDLCompiler.define_constraint_cascades
sqlalchemy.sql.compiler.DDLCompiler.define_constraint_deferrability
sqlalchemy.sql.compiler.IdentifierPreparer.validate_sql_phrase
sqlalchemy.sql.elements._document_text_coercion
sqlalchemy.sql.elements._expression_literal_as_text
sqlalchemy.sql.elements._literal_as
sqlalchemy.sql.elements._interpret_as_column_or_from
sqlalchemy.sql.selectable._interpret_as_from
sqlalchemy.sql.selectable.HasSuffixes._setup_suffixes
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.0
cwe_ids: CWE-89
severity: CRITICAL

SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.
Information Exposure vulnerability in Eclipse Jetty
Advisory: GHSA-r28m-g6j9-r2h5
Aliases: CVE-2019-10246
Published: 2019-04-23T16:07:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.2.0
fixed: 9.2.28.v20190418
database_specific: last_known_affected_version_range: <= 9.2.27.v20190403
package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.3.0
fixed: 9.3.27.v20190418
database_specific: last_known_affected_version_range: <= 9.3.26.v20190403
package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.4.0
fixed: 9.4.17.v20190418
database_specific: last_known_affected_version_range: <= 9.4.16.v20190411
cwe_ids: CWE-200
CWE-213
severity: MODERATE

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
Bootstrap-sass contains code execution backdoor
Advisory: GHSA-vqqv-v9m2-48p2
Aliases: CVE-2019-10842
Published: 2019-04-04T16:28:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: bootstrap-sass
ranges: type: ECOSYSTEM
events: introduced: 3.2.0.3
fixed: 3.2.0.4
versions: 3.2.0.3
cwe_ids: CWE-94
severity: CRITICAL

Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3, when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval(), which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.
Microsoft.ChakraCore vulnerable to Exposure of Sensitive Information to an Unauthorized Actor 
Advisory: GHSA-jhx3-2w5x-x39x
Aliases: CVE-2019-0746
Published: 2019-04-09T19:43:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected: package: ecosystem: NuGet
name: Microsoft.ChakraCore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.7
cwe_ids: CWE-200
severity: MODERATE

An information disclosure vulnerability exists when the scripting engine does not properly handle objects in memory in Microsoft Edge, aka 'Scripting Engine Information Disclosure Vulnerability'.
High severity vulnerability that affects Microsoft.ChakraCore
Advisory: GHSA-fvpg-qx3g-7mp7
Aliases: CVE-2019-0771
Published: 2019-04-09T19:43:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: Microsoft.ChakraCore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.7
cwe_ids: CWE-787
severity: HIGH

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0773, CVE-2019-0783.
High severity vulnerability that affects Microsoft.ChakraCore
Advisory: GHSA-pjpj-f6r8-56rm
Aliases: CVE-2019-0609
Published: 2019-04-09T19:43:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: Microsoft.ChakraCore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.7
cwe_ids: CWE-787
severity: HIGH

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
Cross-Site Scripting in buttle
Advisory: GHSA-gm29-35c7-8cfw
Aliases: CVE-2019-5422
Published: 2019-04-08T15:18:38Z
Affected: package: ecosystem: npm
name: buttle
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.0
cwe_ids: CWE-79
severity: HIGH

All versions of `buttle` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Moderate severity vulnerability that affects roundup
Advisory: GHSA-926q-wxr6-3crq
Aliases: CVE-2019-10904
Published: 2019-04-09T19:47:14Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: roundup
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.6
cwe_ids: CWE-79
severity: MODERATE

Roundup 1.6 allows XSS via the URI because frontends/roundup.cgi and roundup/cgi/wsgi_handler.py mishandle 404 errors.
Improper Limitation of a Pathname ('Path Traversal')  in org.apache.jspwiki:jspwiki-war
Advisory: GHSA-pffw-p2q5-w6vh
Aliases: CVE-2019-0225
Published: 2019-04-08T16:23:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M3
database_specific: last_known_affected_version_range: <= 2.11.0.M2
cwe_ids: CWE-22
severity: HIGH

A specially crafted url could be used to access files under the ROOT directory of the application on Apache JSPWiki 2.9.0 to 2.11.0.M2, which could be used by an attacker to obtain registered users' details.
Apache Airflow vulnerable to Stored XSS
Advisory: GHSA-8p7v-2jvj-v54r
Aliases: CVE-2019-0216
Published: 2019-04-12T20:42:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: apache-airflow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.10.3
cwe_ids: CWE-79
severity: MODERATE

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views.
Server-Side Request Forgery (SSRF) in com.ctrip.framework.apollo:apollo
Advisory: GHSA-fvx3-g627-phm2
Aliases: CVE-2019-10686
Published: 2019-04-18T14:27:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.ctrip.framework.apollo:apollo
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.3.0
cwe_ids: CWE-918
severity: CRITICAL

An SSRF vulnerability was found in an API from Ctrip Apollo through 1.4.0-SNAPSHOT. An attacker may use it to do an intranet port scan or raise a GET request via `/system-info/health` because the `%23` substring is mishandled.
Duplicate Advisory: Prototype Pollution in jquery
Advisory: GHSA-wv67-q8rr-grjp
Aliases: CVE-2019-5428
Published: 2019-04-23T15:59:10Z
Withdrawn: 2019-04-26T14:50:56Z
Affected: package: ecosystem: npm
name: jquery
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.0
package: ecosystem: NuGet
name: jquery
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.0
package: ecosystem: Maven
name: org.webjars.npm:jquery
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.0
package: ecosystem: RubyGems
name: jquery-rails
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.0
severity: MODERATE

## Duplicate Advisory
This advisory is a duplicate of [GHSA-6c3j-c64m-qhgq](https://github.com/advisories/GHSA-6c3j-c64m-qhgq). This link is maintained to preserve external references.

## Original Description
Versions of `jquery`  prior to 3.4.0 are vulnerable to Prototype Pollution. The extend() method allows an attacker to modify the prototype for `Object` causing changes in properties that will exist on all objects.

## Recommendation
Upgrade to version 3.4.0 or later.
Session Fixation in Apache Zeppelin
Advisory: GHSA-c538-924g-99q4
Aliases: CVE-2017-12619
Published: 2019-04-24T16:06:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.zeppelin:zeppelin
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.7.3
cwe_ids: CWE-384
severity: HIGH

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session. Issue was reported by "stone lone".
Spring Security uses insufficiently random values
Advisory: GHSA-v2r2-7qm7-jj6v
Aliases: CVE-2019-3795
Published: 2019-04-16T15:10:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Maven
name: org.springframework.security:spring-security-core
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.12
package: ecosystem: Maven
name: org.springframework.security:spring-security-core
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.0.12
package: ecosystem: Maven
name: org.springframework.security:spring-security-core
ranges: type: ECOSYSTEM
events: introduced: 5.1.0
fixed: 5.1.5
cwe_ids: CWE-330
severity: MODERATE

Spring Security versions 4.2.x prior to 4.2.12, 5.0.x prior to 5.0.12, and 5.1.x prior to 5.1.5 contain an insecure randomness vulnerability when using SecureRandomFactoryBean#setSeed to configure a SecureRandom instance. In order to be impacted, an honest application must provide a seed and make the resulting random material available to an attacker for inspection.
Materialize-css vulnerable to Cross-site Scripting in tooltip component
Advisory: GHSA-98f7-p5rc-jx67
Aliases: CVE-2019-11002
Published: 2019-04-09T19:44:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: materialize-css
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.0
package: ecosystem: npm
name: @materializecss/materialize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0-alpha
cwe_ids: CWE-79
severity: MODERATE

All versions of `materialize-css` are vulnerable to Cross-Site Scripting. The `tooltip` component does not sufficiently sanitize user input, allowing an attacker to execute arbitrary JavaScript code if the malicious input is rendered by a user.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
Improper Input Validation in python-dbusmock
Advisory: GHSA-74xw-82v7-hmrm
Aliases: CVE-2015-1326
Published: 2019-04-23T16:04:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: python-dbusmock
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.15.1
cwe_ids: CWE-20
severity: HIGH

python-dbusmock before version 0.15.1 AddTemplate() D-Bus method call or DBusTestCase.spawn_server_template() method could be tricked into executing malicious code if an attacker supplies a .pyc file.
SQLAlchemy is vulnerable to SQL Injection via group_by parameter 
Advisory: GHSA-38fc-9xqv-7f7q
Aliases: CVE-2019-7548
Published: 2019-04-16T15:50:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: SQLAlchemy
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.0
cwe_ids: CWE-89
severity: HIGH

SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.
Improper Control of Generation of Code ('Code Injection') in org.apache.activemq:activemq-client
Advisory: GHSA-jpv3-g4cc-6vfx
Aliases: CVE-2019-0222
Published: 2019-04-02T15:46:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.activemq:activemq-client
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.15.9
cwe_ids: CWE-94
severity: HIGH

In Apache ActiveMQ 5.0.0 - 5.15.8, unmarshalling corrupt MQTT frame can lead to broker Out of Memory exception making it unresponsive.
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
Advisory: GHSA-gc52-xj6p-9pxp
Aliases: CVE-2019-3868
Published: 2019-04-30T15:37:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.keycloak:keycloak-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.0.0
cwe_ids: CWE-200
severity: MODERATE

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user?s browser session.
High severity vulnerability that affects Microsoft.ChakraCore
Advisory: GHSA-3w9q-c44j-37jj
Aliases: CVE-2019-0773
Published: 2019-04-09T19:43:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: Microsoft.ChakraCore
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.7
cwe_ids: CWE-787
severity: HIGH

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0609, CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0783.
Billion laughs attack in c3p0
Advisory: GHSA-84p2-vf58-xhxv
Aliases: CVE-2019-5427
Published: 2019-04-23T16:03:18Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: com.mchange:c3p0
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.9.5.4
database_specific: last_known_affected_version_range: <= 0.9.5.3
cwe_ids: CWE-776
severity: HIGH

c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
High severity vulnerability that affects org.apache.tomcat.embed:tomcat-embed-core
Advisory: GHSA-8vmx-qmch-mpqg
Aliases: CVE-2019-0232
Published: 2019-04-18T14:27:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 9.0.0
fixed: 9.0.17
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 8.0.0
fixed: 8.5.40
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 7.0.0
fixed: 7.0.94
cwe_ids: CWE-78
severity: HIGH

When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).