aswin1906/github-advisory-2019.csv huggingface dataset:
scalajs-standalone-bin Downloads Resources over HTTP
Advisory: GHSA-cvx3-pqmj-x57x
Aliases: CVE-2016-10634
Published: 2019-02-18T23:47:13Z
Affected: package: ecosystem: npm
name: scalajs-standalone-bin
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.4.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `scalajs-standalone-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `scalajs-standalone-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Cross-site Scripting in Ignite Realtime Openfire
Advisory: GHSA-5qfv-rr79-chx5
Aliases: CVE-2019-15488
Published: 2019-08-27T17:37:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.igniterealtime.openfire:xmppserver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.4.1
cwe_ids: CWE-79
severity: MODERATE

Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.
Cross-site Scripting in Jooby
Advisory: GHSA-f5f4-m7qp-w6gc
Aliases: CVE-2019-15477
Published: 2019-08-27T17:40:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.jooby:jooby
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.4
cwe_ids: CWE-79
severity: MODERATE

Jooby before 1.6.4 has XSS via the default error handler.
XML External Entity (XXE) Injection in Apache Solr
Advisory: GHSA-3gm7-v7vw-866c
Aliases: CVE-2019-0193
Published: 2019-08-01T19:17:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.solr:solr-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 8.2.0
cwe_ids: CWE-94
severity: HIGH

In Apache Solr, the DataImportHandler, an optional but popular module to pull in data from databases and other sources, has a feature in which the whole DIH configuration can come from a request's "dataConfig" parameter. The debug mode of the DIH admin screen uses this to allow convenient debugging / development of a DIH config. Since a DIH config can contain scripts, this parameter is a security risk. Starting with version 8.2.0 of Solr, use of this parameter requires setting the Java System property "enable.dih.dataConfigParam" to true.
assign-deep Vulnerable to Prototype Pollution
Advisory: GHSA-66rh-8fw6-59q6
Aliases: CVE-2019-10745
Published: 2019-08-21T16:15:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: assign-deep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.4.8
package: ecosystem: npm
name: assign-deep
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.0.1
versions: 1.0.0
cwe_ids: CWE-1321
CWE-20
CWE-915
severity: HIGH

Versions of `assign-deep` prior to 1.0.1 and 0.4.8 are vulnerable to Prototype Pollution. The `assign` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.

## Recommendation

Upgrade to versions 1.0.1, 0.4.8, or later.
Uncontrolled Resource Consumption in MetadataExtractor
Advisory: GHSA-cwqq-w8c3-r2jw
Aliases: CVE-2019-14262
Published: 2019-08-23T00:04:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: NuGet
name: MetadataExtractor
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.0
database_specific: last_known_affected_version_range: <= 2.1.0
cwe_ids: CWE-400
severity: HIGH

MetadataExtractor 2.1.0 allows stack consumption.
Identity Spoofing in libp2p-secio
Advisory: GHSA-rch7-f4h5-x9rj
Published: 2019-08-23T00:04:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: package: ecosystem: npm
name: libp2p-secio
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.9.0
cwe_ids: CWE-290
severity: CRITICAL

Affected versions of `libp2p-secio` does not correctly verify that the `PeerId` of `DstPeer` matches the `PeerId` discovered in the crypto handshake, resulting in a high severity identity spoofing vulnerability. 


## Recommendation

Update to version 0.9.0 or later.
Uncontrolled Recursion in Django
Advisory: GHSA-v9qg-3j8p-r63v
Aliases: CVE-2019-14235
Published: 2019-08-06T01:43:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11.0
fixed: 1.11.23
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.11
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.4
cwe_ids: CWE-674
severity: HIGH

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.
Allocation of Resources Without Limits or Throttling in Apache Tika
Advisory: GHSA-mfwh-gqx8-c787
Aliases: CVE-2019-10088
Published: 2019-08-06T01:43:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.tika:tika-core
ranges: type: ECOSYSTEM
events: introduced: 1.7
fixed: 1.22
cwe_ids: CWE-770
severity: HIGH

A carefully crafted or corrupt zip file can cause an OOM in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Users should upgrade to 1.22 or later.
SQL Injection in Django
Advisory: GHSA-6r97-cj55-9hrq
Aliases: CVE-2019-14234
Published: 2019-08-16T14:00:34Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11.0
fixed: 1.11.23
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.11
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.4
cwe_ids: CWE-89
severity: CRITICAL

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of "OR 1=1" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.
Improper input validation in Apache Santuario XML Security for Java
Advisory: GHSA-4q98-wr72-h35w
Aliases: CVE-2019-12400
Published: 2019-08-27T17:41:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.santuario:xmlsec
ranges: type: ECOSYSTEM
events: introduced: 2.0.3
fixed: 2.1.4
cwe_ids: CWE-20
severity: MODERATE

In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
Allocation of Resources Without Limits or Throttling in Apache Tika
Advisory: GHSA-4mq5-mj59-qq9c
Aliases: CVE-2019-10093
Published: 2019-08-06T01:43:38Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.tika:tika-parsers
ranges: type: ECOSYSTEM
events: introduced: 1.19
fixed: 1.22
cwe_ids: CWE-770
severity: MODERATE

In Apache Tika 1.19 to 1.21, a carefully crafted 2003ml or 2006ml file could consume all available SAXParsers in the pool and lead to very long hangs. Apache Tika users should upgrade to 1.22 or later.
Denial of Service in rgb2hex
Advisory: GHSA-65p8-3hm4-h9h8
Published: 2019-08-23T00:04:48Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: rgb2hex
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.6
cwe_ids: CWE-400
severity: MODERATE

All versions of `rgb2hex` are vulnerable to Regular Expression Denial of Service (ReDoS) when an attacker can pass in a specially crafted invalid color value.


## Recommendation

Update to version 0.1.6 or later.
Deserialization of Untrusted Data in Apache Storm
Advisory: GHSA-25pc-85qf-6j69
Aliases: CVE-2018-11779
Published: 2019-08-01T19:17:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.storm:storm-kafka
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.2.3
package: ecosystem: Maven
name: org.apache.storm:storm-kafka-client
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.2.3
cwe_ids: CWE-502
severity: CRITICAL

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class.
Deserialization of untrusted data in FasterXML jackson-databind
Advisory: GHSA-6fpp-rgj9-8rwc
Aliases: CVE-2019-14379
Published: 2019-08-01T19:18:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.9.2
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.4
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.7.9.6
cwe_ids: CWE-1321
CWE-915
severity: CRITICAL

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2, 2.8.11.4, and 2.7.9.6 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
Pallets Werkzeug Insufficient Entropy
Advisory: GHSA-gq9m-qvpx-68hc
Aliases: CVE-2019-14806
Published: 2019-08-21T16:15:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: PyPI
name: werkzeug
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.15.3
cwe_ids: CWE-331
severity: HIGH

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
Vulnerability in Azure Active Directory Authentication Library
Advisory: GHSA-xc6x-cq47-9chw
Aliases: CVE-2019-1258
Published: 2019-08-16T14:03:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: NuGet
name: microsoft.identitymodel.clients.activedirectory
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.2.0
database_specific: last_known_affected_version_range: <= 5.1.1
severity: HIGH

An elevation of privilege vulnerability exists in Azure Active Directory Authentication Library On-Behalf-Of flow, in the way the library caches tokens, aka 'Azure Active Directory Authentication Library Elevation of Privilege Vulnerability'.
Undertow Missing Authorization when requesting a protected directory without trailing slash
Advisory: GHSA-w69w-jvc7-wjgv
Aliases: CVE-2019-10184
Published: 2019-08-01T19:18:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: io.undertow:undertow-servlet
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.23
cwe_ids: CWE-862
severity: HIGH

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
Improper Certificate Validation in Twisted
Advisory: GHSA-65rm-h285-5cc5
Aliases: CVE-2019-12855
Published: 2019-08-16T14:02:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: package: ecosystem: PyPI
name: twisted
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 19.7.0
cwe_ids: CWE-295
severity: HIGH

In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.
rest-client Gem Contains Malicious Code
Advisory: GHSA-333g-rpr4-7hxq
Aliases: CVE-2019-15224
Published: 2019-08-20T14:29:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: rest-client
ranges: type: ECOSYSTEM
events: introduced: 1.6.10
fixed: 1.7.0
database_specific: last_known_affected_version_range: <= 1.6.13
package: ecosystem: RubyGems
name: cron_parser
ranges: type: ECOSYSTEM
events: introduced: 1.0.13
last_affected: 1.0.14
package: ecosystem: RubyGems
name: cron_parser
versions: 0.1.4
package: ecosystem: RubyGems
name: coin_base
ranges: type: ECOSYSTEM
events: 0
package: ecosystem: RubyGems
name: blockchain_wallet
ranges: type: ECOSYSTEM
events: 0
package: ecosystem: RubyGems
name: awesome-bot
ranges: type: ECOSYSTEM
events: 0
package: ecosystem: RubyGems
name: doge-coin
ranges: type: ECOSYSTEM
events: 0
package: ecosystem: RubyGems
name: capistrano-colors
ranges: type: ECOSYSTEM
events: 0
package: ecosystem: RubyGems
name: bitcoin_vanity
ranges: type: ECOSYSTEM
events: 0
package: ecosystem: RubyGems
name: coming-soon
ranges: type: ECOSYSTEM
events: 0
package: ecosystem: RubyGems
name: omniauth_amazon
ranges: type: ECOSYSTEM
events: 0
cwe_ids: CWE-94
severity: CRITICAL

The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x.
Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory.
These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
Prototype Pollution in deeply
Advisory: GHSA-8j4w-5fw4-rm27
Aliases: CVE-2019-10750
Published: 2019-08-27T17:45:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: deeply
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.1.0
cwe_ids: CWE-400
severity: CRITICAL

Versions of `deeply` prior to 1.0.1 are vulnerable to Prototype Pollution. The package fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

Upgrade to version 3.1.0 or later.
Cross-site scripting in fat_free_crm
Advisory: GHSA-4p8f-mmfj-r45g
Aliases: CVE-2018-20975
Published: 2019-08-21T16:15:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: RubyGems
name: fat_free_crm
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.18.1
cwe_ids: CWE-79
severity: MODERATE

Fat Free CRM before 0.18.1 has XSS in the `tags_helpe`r in `app/helpers/tags_helper.rb`.
SQL Injection in connect-pg-simple
Advisory: GHSA-xqh8-5j36-4556
Aliases: CVE-2019-15658
Published: 2019-08-26T16:59:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: connect-pg-simple
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.0.1
cwe_ids: CWE-89
severity: HIGH

### Impact
An unlikely SQL injection if the case of an unsanitized table name input.

### Patches
The user should upgrade to `6.0.1`. Due to its low impact a backport has not been made to the `5.x` branch.

### Workarounds
If there is no likelihood that the `tableName` or `schemaName` options sent to the constructor could be of an unsanitized nature, then no workaround is needed. Else the input could be sanitized and escaped before sending it in. Take note though that such an escaping would need to be removed when upgrading to `6.0.1` or later, to avoid double escaping.

### References
* [Security issue disclosure](https://github.com/voxpelli/node-connect-pg-simple/issues/151)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [voxpelli/node-connect-pg-simple](https://github.com/voxpelli/node-connect-pg-simple)
* Email maintainer at [pelle@kodfabrik.se](mailto:pelle@kodfabrik.se)
Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ
Advisory: GHSA-jvpp-hxjj-5ccc
Aliases: CVE-2015-7559
Published: 2019-08-01T19:17:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.activemq:activemq-client
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 5.15.5
cwe_ids: CWE-20
CWE-306
severity: MODERATE

It was found that the Apache ActiveMQ client before 5.15.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
Cross-site scripting in Apache Ranger
Advisory: GHSA-fpqp-v323-44xv
Aliases: CVE-2019-12397
Published: 2019-08-16T14:01:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.ranger:ranger
ranges: type: ECOSYSTEM
events: introduced: 0.7.0
fixed: 2.0.0
database_specific: last_known_affected_version_range: <= 1.2.0
cwe_ids: CWE-79
severity: MODERATE

Policy import functionality in Apache Ranger 0.7.0 to 1.2.0 is vulnerable to a cross-site scripting issue. Upgrade to 2.0.0 or later version of Apache Ranger with the fix.
Allocation of Resources Without Limits or Throttling in Apache Tika
Advisory: GHSA-mm7m-xg4h-6m52
Aliases: CVE-2019-10094
Published: 2019-08-06T01:43:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.tika:tika-core
ranges: type: ECOSYSTEM
events: introduced: 1.7
fixed: 1.22
cwe_ids: CWE-770
severity: HIGH

A carefully crafted package/compressed file that, when unzipped/uncompressed yields the same file (a quine), causes a StackOverflowError in Apache Tika's RecursiveParserWrapper in versions 1.7-1.21. Apache Tika users should upgrade to 1.22 or later.
Cross-Site Scripting in selectize-plugin-a11y
Advisory: GHSA-8cpw-73f2-w58m
Aliases: CVE-2019-15482
Published: 2019-08-27T17:38:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: selectize-plugin-a11y
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0
cwe_ids: CWE-79
severity: MODERATE

Versions of `selectize-plugin-a11y ` prior to 1.1.0 are vulnerable to Cross-Site Scripting. The `accessibility.liveRegion.speak` function does not sanitize the `msg` variable before rendering it as HTML. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.1.0 or later.
Django Denial-of-service in django.utils.text.Truncator
Advisory: GHSA-c4qh-4vgv-qc6g
Aliases: CVE-2019-14232
Published: 2019-08-06T01:43:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11.0
fixed: 1.11.23
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.11
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.4
cwe_ids: CWE-400
severity: HIGH

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If `django.utils.text.Truncator`'s chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.
Improper Key Verification in openpgp
Advisory: GHSA-hfmf-q43v-2ffj
Aliases: CVE-2019-9154
Published: 2019-08-23T21:42:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: openpgp
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.2.0
database_specific: last_known_affected_version_range: <= 4.1.2
cwe_ids: CWE-347
severity: HIGH

Versions of `openpgp` prior to 4.2.0 are vulnerable to Improper Key Verification. The OpenPGP standard allows signature packets to have subpackets which may be hashed or unhashed. Unhashed subpackets are not cryptographically protected and cannot be trusted. The `openpgp` package does not verify whether a subpacket is hashed. Furthermore, due to the order of parsing a signature packet information from unhashed subpackets overwrites information from hashed subpackets. This may allow an attacker to modify the contents of a key certification signature or revocation signature. Doing so could convince a victim to use an obsolete key for encryption. An attack require a victim to import a manipulated key or update an existing key with a manipulated version.


## Recommendation

Upgrade to version 4.2.0 or later. 
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Message Signature Bypass in openpgp
Advisory: GHSA-qwqc-28w3-fww6
Aliases: CVE-2019-9153
Published: 2019-08-23T21:42:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: openpgp
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.2.0
database_specific: last_known_affected_version_range: <= 4.1.2
cwe_ids: CWE-347
severity: HIGH

Versions of `openpgp` prior to 4.2.0 are vulnerable to Message Signature Bypass. The package fails to verify that a message signature is of type `text`. This allows an attacker to to construct a message with a signature type that only verifies subpackets without additional input (such as `standalone` or `timestamp`). For example, an attacker that captures a `standalone` signature packet from a victim can construct arbitrary signed messages that would be verified correctly.


## Recommendation

Upgrade to version 4.2.0 or later.
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Cross-site Scripting in pandao
Advisory: GHSA-x65c-4fgj-5fc3
Aliases: CVE-2019-14653
Published: 2019-08-23T00:05:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: editor.md
versions: 1.5.0
cwe_ids: CWE-79
severity: MODERATE

pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.