aswin1906/github-advisory-2019.csv huggingface dataset:
Cross-site Scripting in Chartkick
Advisory: GHSA-g45g-g52h-39rg
Aliases: CVE-2019-12732
Published: 2019-06-07T20:56:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: RubyGems
name: chartkick
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.2.0
cwe_ids: CWE-79
severity: MODERATE

The Chartkick gem through 3.1.0 for Ruby allows XSS.
Cross-Site Scripting in ids-enterprise
Advisory: GHSA-hpfq-8wx8-cgqw
Published: 2019-06-13T18:59:18Z
Affected: package: ecosystem: npm
name: ids-enterprise
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.18.2
cwe_ids: CWE-79
severity: HIGH

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
Improper Locking in Apache Tomcat
Advisory: GHSA-q4hg-rmq2-52q9
Aliases: CVE-2019-10072
Published: 2019-06-26T01:09:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 9.0.0.M1
fixed: 9.0.20
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 8.5.0
fixed: 8.5.40
cwe_ids: CWE-667
severity: MODERATE

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
NoSQL Injection in loopback-connector-mongodb
Advisory: GHSA-m734-r4g6-34f9
Published: 2019-06-04T19:36:17Z
Affected: package: ecosystem: npm
name: loopback-connector-mongodb
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.6.0
cwe_ids: CWE-89
severity: HIGH

Versions of `loopback-connector-mongodb` before 3.6.0 are vulnerable to NoSQL injection.

MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless disabled ([instructions here](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js)).

A proof of concept malicious query:

```
GET /POST filter={"where": {"$where": "function(){sleep(5000); return this.title.contains('Hello');}"}}
```

The above makes the database sleep for 5 seconds and then returns all “Posts” with the title containing the word `Hello`.




## Recommendation

Update to version 3.6.0 or later.
Parse Server before v3.4.1 vulnerable to Denial of Service
Advisory: GHSA-2479-qvv7-47qq
Aliases: CVE-2019-1020012
Published: 2019-06-13T16:22:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: parse-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.1
cwe_ids: CWE-444
severity: HIGH

### Impact

If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).


### Patches
Afflicted installations will also have to remove the offending collection from their database.

Yes, patched in 3.4.1

### Workarounds

Yes, user can apply: https://github.com/parse-community/parse-server/commit/8709daf698ea69b59268cb66f0f7cee75b52daa5

### References
Nothing other than this advisory at this time

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [parse-server](https://github.com/parse-community/parse-server)
* Email us at [security@parseplatform.org](mailto:security@parseplatform.org)
Code Injection in PyXDG
Advisory: GHSA-r6v3-hpxj-r8rv
Aliases: CVE-2019-12761
Published: 2019-06-07T20:56:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: pyxdg
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.26
cwe_ids: CWE-94
severity: HIGH

A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.
Remote Memory Exposure in floody
Advisory: GHSA-3p92-886g-qxpq
Published: 2019-06-04T15:42:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: floody
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.1
cwe_ids: CWE-201
severity: MODERATE

Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure.

.write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.

Proof of Concept: 

```
var f = require('floody')(process.stdout); 
f.write(USERSUPPLIEDINPUT); 
'f.stop();


## Recommendation

Update to version 0.1.1 or later.
Prototype Pollution
Advisory: GHSA-hxcm-v35h-mg2x
Published: 2019-06-07T21:12:50Z
Affected: package: ecosystem: npm
name: querystringify
ecosystem_specific: affected_functions: querystringify.parse
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.0
cwe_ids: CWE-1321
severity: HIGH

A vulnerability was found in querystringify before 2.0.0. It's possible to override built-in properties of the resulting query string object if a malicious string is inserted in the query string.
Cross-Site Scripting in ids-enterprise
Advisory: GHSA-49r3-3h96-rwj6
Published: 2019-06-13T19:09:31Z
Affected: package: ecosystem: npm
name: ids-enterprise
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.18.2
cwe_ids: CWE-79
severity: HIGH

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
RubyGems Escape sequence injection vulnerability in verbose
Advisory: GHSA-fr32-gr5c-xq5c
Aliases: CVE-2019-8321
Published: 2019-06-20T16:06:04Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 2.6.0
fixed: 2.7.9
package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.2
cwe_ids: CWE-88
severity: HIGH

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.
Path Traversal in m-server
Advisory: GHSA-vc6r-4x6g-mmqc
Published: 2019-06-11T16:16:23Z
Affected: package: ecosystem: npm
name: m-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.2
cwe_ids: CWE-22
severity: MODERATE

Versions of `m-server` before 1.4.2 are vulnerable to path traversal allowing a remote attacker to display content of arbitrary files from the server.


## Recommendation

Update to version 1.4.2 or later.
Memory Exposure in concat-stream
Advisory: GHSA-g74r-ffvr-5q9f
Published: 2019-06-03T17:26:44Z
Affected: package: ecosystem: npm
name: concat-stream
ranges: type: ECOSYSTEM
events: introduced: 1.5.0
fixed: 1.5.2
package: ecosystem: npm
name: concat-stream
ranges: type: ECOSYSTEM
events: introduced: 1.4.0
fixed: 1.4.11
package: ecosystem: npm
name: concat-stream
ranges: type: ECOSYSTEM
events: introduced: 1.3.0
fixed: 1.3.2
cwe_ids: CWE-200
severity: MODERATE

Versions of `concat-stream` before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into `write()`

Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.



## Recommendation

Update to version 1.5.2, 1.4.11, 1.3.2 or later.

If you are unable to update make sure user provided input into the `write()` function is not a number.
Cross-Site Scripting in ids-enterprise
Advisory: GHSA-crfx-5phg-hmw9
Published: 2019-06-13T18:59:12Z
Affected: package: ecosystem: npm
name: ids-enterprise
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.18.2
cwe_ids: CWE-79
severity: HIGH

Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 4.18.2 or later
Regular Expression Denial of Service
Advisory: GHSA-qx4v-6gc5-f2vv
Published: 2019-06-20T14:32:56Z
Affected: package: ecosystem: npm
name: esm
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.1.0
cwe_ids: CWE-400
severity: MODERATE

A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.
Regular Expression Denial of Service in underscore.string
Advisory: GHSA-v2p6-4mp7-3r9v
Published: 2019-06-14T16:26:22Z
Affected: package: ecosystem: npm
name: underscore.string
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.3.5
cwe_ids: CWE-400
severity: MODERATE

Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS).

The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.


## Recommendation

Upgrade to version 3.3.5 or higher.
High severity vulnerability that affects gun
Advisory: GHSA-886v-mm6p-4m66
Published: 2019-06-05T09:48:02Z
Affected: package: ecosystem: npm
name: gun
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.2019.416
cwe_ids: CWE-22
severity: HIGH

## Urgent Upgrade

The static file server module included with GUN had a **serious vulnerability**:

 - Using `curl --path-as-is` allowed reads on any parent directory or files.

This did not work via the browser or via curl without as-is option.

 ### Fixed

This has been fixed since version `0.2019.416` and higher.

 ### Who Was Effected?

Most NodeJS users who use the default setup, such as:

 - `npm start`
 - `node examples/http.js`
 - `Heroku` 1-click-deploy
 - `Docker`
 - `Now`

If you have a custom NodeJS code then you are probably safe *unless* you have something like `require('http').createServer(Gun.serve(__dirname))` in it.

If you have not upgraded, it is **mandatory** or else it is highly likely your environment variables and AWS (or other) keys could be leaked.

 ### Credit

It was reported and fixed by [JK0N](https://github.com/amark/gun/pull/527), but I did not understand the `--path-as-is` condition.

Joonas Loppi from [function61](http://function61.com) rediscovered it and explained the urgency to me to fix it.
RubyGems Escape sequence injection in errors
Advisory: GHSA-4wm8-fjv7-j774
Aliases: CVE-2019-8325
Published: 2019-06-20T16:08:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 2.6.0
fixed: 2.7.9
package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.2
cwe_ids: CWE-74
severity: HIGH

An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)
Command Injection in dot
Advisory: GHSA-4859-gpc7-4j66
Published: 2019-06-05T21:24:29Z
Affected: package: ecosystem: npm
name: dot
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.1.2
cwe_ids: CWE-77
severity: MODERATE

All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.
Regular Expression Denial of Service
Advisory: GHSA-6394-6h9h-cfjg
Published: 2019-06-07T21:12:35Z
Affected: package: ecosystem: npm
name: nwmatcher
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.4
cwe_ids: CWE-400
severity: MODERATE

A Regular Expression vulnerability was found in nwmatcher before 1.4.4. The fix replacing multiple repeated instances of the "\s*" pattern.
Denial of Service in canvas
Advisory: GHSA-vpq5-4rc8-c222
Published: 2019-06-05T14:10:45Z
Affected: package: ecosystem: npm
name: canvas
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.10
severity: MODERATE

Versions of `canvas` prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.


## Recommendation

Upgrade to version 1.6.10
Reverse Tabnapping in swagger-ui
Advisory: GHSA-x9p2-fxq6-2m5f
Published: 2019-06-20T14:33:07Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected: package: ecosystem: npm
name: swagger-ui
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.18.0
cwe_ids: CWE-1022
severity: MODERATE

Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is commonly used for phishing attacks.


## Recommendation

Upgrade to version 3.18.0 or later.
Cross-Site Scripting (XSS) in cloudcmd
Advisory: GHSA-m8fw-534v-xm85
Published: 2019-06-04T15:43:29Z
Affected: package: ecosystem: npm
name: cloudcmd
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 9.1.6
cwe_ids: CWE-79
severity: HIGH

Versions of `cloudcmd` before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a file for this vulnerability to be exploitable.


## Recommendation

Update to version 9.1.6 or later.
Out-of-bounds Read in stringstream
Advisory: GHSA-mf6x-7mm4-x2g7
Aliases: CVE-2018-21270
Published: 2019-06-20T18:22:32Z
Affected: package: ecosystem: npm
name: stringstream
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.0.6
cwe_ids: CWE-125
severity: MODERATE

All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.
Marked ReDoS due to email addresses being evaluated in quadratic time
Advisory: GHSA-xf5p-87ch-gxw2
Published: 2019-06-05T14:10:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected: package: ecosystem: npm
name: marked
ranges: type: ECOSYSTEM
events: introduced: 0.3.14
fixed: 0.6.2
cwe_ids: CWE-400
severity: MODERATE

Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.


## Recommendation

Upgrade to version 0.6.2 or later.
Twisted CRLF Injection
Advisory: GHSA-6cc5-2vg4-cc7m
Aliases: CVE-2019-12387
Published: 2019-06-10T18:05:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: twisted
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 19.2.1
cwe_ids: CWE-74
CWE-93
severity: MODERATE

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
Path Traversal in localhost-now
Advisory: GHSA-73cw-jxmm-qpgh
Published: 2019-06-11T16:40:48Z
Affected: package: ecosystem: npm
name: localhost-now
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.2
cwe_ids: CWE-22
severity: HIGH

All versions of `localhost-now` are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2

Proof of concept:

```
$ curl -v --path-as-is "http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd" 
```


## Recommendation

No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.
Code Injection in js-yaml
Advisory: GHSA-8j8c-7jfh-h6hx
Published: 2019-06-04T20:14:07Z
Affected: package: ecosystem: npm
name: js-yaml
ecosystem_specific: affected_functions: js-yaml.load
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.13.1
cwe_ids: CWE-94
severity: HIGH

Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected.

An example payload is 
`{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1` 
which returns the object 
{
  "1553107949161": 1
}


## Recommendation

Upgrade to version 3.13.1.
Memory Exposure in bl
Advisory: GHSA-wrw9-m778-g6mc
Published: 2019-06-03T17:27:57Z
Affected: package: ecosystem: npm
name: bl
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.9.5
package: ecosystem: npm
name: bl
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.0.1
versions: 1.0.0
cwe_ids: CWE-200
severity: MODERATE

Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure.

`bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory


## Recommendation

Update to version 0.9.5, 1.0.1 or later.
RubyGems Delete directory using symlink when decompressing tar
Advisory: GHSA-5x32-c9mf-49cc
Aliases: CVE-2019-8320
Published: 2019-06-20T16:06:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected: package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 2.7.6
fixed: 2.7.9
package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.3
cwe_ids: CWE-22
severity: HIGH

A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.
ruby-openid SSRF via claimed_id request
Advisory: GHSA-fqfj-cmh6-hj49
Aliases: CVE-2019-11027
Published: 2019-06-13T16:15:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: ruby-openid
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.9.0
cwe_ids: CWE-918
severity: CRITICAL

Ruby OpenID (aka ruby-openid) through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the "example app" provided by the project are at highest risk.
Regular Expression Denial of Service in remarkable
Advisory: GHSA-q22g-8fr4-qpj4
Aliases: CVE-2019-12041
Published: 2019-06-06T15:32:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: remarkable
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.7.2
cwe_ids: CWE-400
severity: HIGH

lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.
Failure to sanitize quotes which can lead to sql injection in squel
Advisory: GHSA-4qhx-g9wp-g9m6
Published: 2019-06-14T16:09:01Z
Affected: package: ecosystem: npm
name: squel
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 5.13.0
cwe_ids: CWE-74
CWE-89
severity: CRITICAL

All versions of `squel` are vulnerable to sql injection.

The `squel` package does not properly escape user provided input when provided using the `setFields` method. This could lead to sql injection if the query was then executed.

Proof of concept demonstrating the injection of a single quote into a generated sql statement from user provided input.
```
> console.log(squel.insert().into('buh').setFields({foo: "bar'baz"}).toString());
INSERT INTO buh (foo) VALUES ('bar'baz')
```


## Recommendation

There is no fix at this time and the issue has been reported publicly. Consider using another query builder that provides strong guarantees for input sanitization to prevent sql injection attacks.
Prototype Pollution in upmerge
Advisory: GHSA-gm9g-2g8v-fvxj
Published: 2019-06-06T15:32:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: upmerge
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.8
cwe_ids: CWE-345
CWE-400
severity: MODERATE

All versions of `upmerge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.
RubyGems Escape sequence injection vulnerability in gem owner
Advisory: GHSA-mh37-8c3g-3fgc
Aliases: CVE-2019-8322
Published: 2019-06-20T16:06:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 2.6.0
fixed: 2.7.9
package: ecosystem: RubyGems
name: rubygems-update
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.2
cwe_ids: CWE-74
severity: HIGH

An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.
Memory Exposure in tunnel-agent
Advisory: GHSA-xc7v-wxcw-j472
Published: 2019-06-03T17:08:26Z
Affected: package: ecosystem: npm
name: tunnel-agent
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.6.0
cwe_ids: CWE-200
severity: MODERATE

Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Proof-of-concept:
```js
require('request')({
  method: 'GET',
  uri: 'http://www.example.com',
  tunnel: true,
  proxy:{
    protocol: 'http:',
    host:'127.0.0.1',
    port:8080,
    auth:USERSUPPLIEDINPUT // number
  }
});
```


## Recommendation

Update to version 0.6.0 or later.