aswin1906/github-advisory-2019.csv huggingface dataset:
Django Denial-of-service in strip_tags()
Advisory: GHSA-h5jv-4p7w-64jg
Aliases: CVE-2019-14233
Published: 2019-08-06T01:43:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11.0
fixed: 1.11.23
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.11
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.4
cwe_ids: CWE-400
severity: HIGH

An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.
Invalid Curve Attack in openpgp
Advisory: GHSA-77jf-fjjf-xcww
Aliases: CVE-2019-9155
Published: 2019-08-23T21:42:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: openpgp
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.0
cwe_ids: CWE-327
severity: MODERATE

Versions of `openpgp` prior to 4.3.0 are vulnerable to an Invalid Curve Attack. The package's implementation of ECDH fails to verify the validity of the communication partner's public key. The package calculates the resulting key secret based on an altered curve instead of the specified elliptic curve. Attackers may exfiltrate the victim's private key by choosing the altered curve. An attack requires the attacker being able to initiate message decryption and record the result. Furthermore the victim's key must offer an ECDH public key.


## Recommendation

Upgrade to version 4.3.0 or later.
If you are upgrading from a version <4.0.0 it is highly recommended to read the `High-Level API Changes` section of the `openpgp` 4.0.0 release: https://github.com/openpgpjs/openpgpjs/releases/tag/v4.0.0
Cross-Site Scripting in cyberchef
Advisory: GHSA-jp6r-xcjj-5h7r
Aliases: CVE-2019-15532
Published: 2019-08-27T17:36:32Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: cyberchef
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 8.31.3
cwe_ids: CWE-79
severity: MODERATE

Versions of `cyberchef` prior to 8.31.3 are vulnerable to Cross-Site Scripting. In `Text Encoding Brute Force` the table rows are created by concatenating the `value` variable unsanitized in the HTML code. If this variable is controlled by user input it allows attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 8.31.3 or later.
Open Redirect in httpie
Advisory: GHSA-xjjg-vmw6-c2p9
Aliases: CVE-2019-10751
Published: 2019-08-27T17:44:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: httpie
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.3
cwe_ids: CWE-601
severity: HIGH

All versions of the HTTPie package prior to version 1.0.3 are vulnerable to Open Redirect that allows an attacker to write an arbitrary file with supplied filename and content to the current directory, by redirecting a request from HTTP to a crafted URL pointing to a server in his or hers control.
Cross-site Scripting in django-js-reverse
Advisory: GHSA-vx6v-2rg6-865h
Aliases: CVE-2019-15486
Published: 2019-08-27T17:39:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: django-js-reverse
ecosystem_specific: affected_functions: django_js_reverse.core.generate_js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.9.1
cwe_ids: CWE-79
severity: MODERATE

django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.
NLTK Vulnerable To Path Traversal
Advisory: GHSA-mr7p-25v2-35wr
Aliases: CVE-2019-14751
Published: 2019-08-23T21:53:51Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: PyPI
name: nltk
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.4.5
cwe_ids: CWE-22
severity: HIGH

NLTK Downloader before 3.4.5 is vulnerable to a directory traversal, allowing attackers to write arbitrary files via a `../` (dot dot slash) in an NLTK package (ZIP archive) that is mishandled during extraction.
Arbitrary Code Execution in eslint-utils
Advisory: GHSA-3gx7-xhv7-5mx3
Aliases: CVE-2019-15657
Published: 2019-08-26T16:59:56Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: eslint-utils
ecosystem_specific: affected_functions: eslint-utils.getStaticValue
ranges: type: ECOSYSTEM
events: introduced: 1.2.0
fixed: 1.4.1
cwe_ids: CWE-20
severity: CRITICAL

Versions of `eslint-utils` >=1.2.0 or <1.4.1 are vulnerable to Arbitrary Code Execution. The `getStaticValue` does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The `getStringIfConstant` and `getPropertyName` functions are not affected.


## Recommendation

Upgrade to version 1.4.1 or later.
Nokogiri Command Injection Vulnerability
Advisory: GHSA-cr5j-953j-xw5p
Aliases: CVE-2019-5477
Published: 2019-08-19T19:27:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: nokogiri
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.10.4
package: ecosystem: RubyGems
name: rexical
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.7
cwe_ids: CWE-78
severity: CRITICAL

A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.
TODO
Advisory: GHSA-8rf6-w2mx-4xjh
Aliases: CVE-2019-15149
Published: 2019-08-19T23:45:47Z
Withdrawn: 2019-08-20T14:13:17Z
Affected: package: ecosystem: PyPI
name: mitogen
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.2.8
severity: CRITICAL

** DISPUTED ** core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism.
Prototype Pollution in mixin-deep
Advisory: GHSA-fhjf-83wg-r2j9
Aliases: CVE-2019-10746
Published: 2019-08-27T17:42:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: mixin-deep
ecosystem_specific: affected_functions: mixin-deep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.2
package: ecosystem: npm
name: mixin-deep
ecosystem_specific: affected_functions: mixin-deep
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.1
versions: 2.0.0
cwe_ids: CWE-88
severity: CRITICAL

Versions of `mixin-deep` prior to 2.0.1 or 1.3.2 are vulnerable to Prototype Pollution. The `mixinDeep` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

If you are using `mixin-deep` 2.x, upgrade to version 2.0.1 or later.
If you are using `mixin-deep` 1.x, upgrade to version 1.3.2 or later.
Cross-site Scripting in pandao editor.md
Advisory: GHSA-5q54-8p9j-x74j
Aliases: CVE-2019-14517
Published: 2019-08-23T00:05:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: editor.md
versions: 1.5.0
cwe_ids: CWE-79
severity: MODERATE

pandao Editor.md 1.5.0 allows XSS via the Javas&#99;ript: string.
Sensitive data written to disk unencrypted in Spark
Advisory: GHSA-fp5j-3fpf-mhj5
Aliases: CVE-2019-10099
Published: 2019-08-08T15:18:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.apache.spark:spark-core_2.11
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.3
cwe_ids: CWE-312
severity: HIGH

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Cross-site scripting in recommender-xblock
Advisory: GHSA-3j5x-7ccf-ppgm
Aliases: CVE-2018-20858
Published: 2019-08-21T16:15:33Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: recommender-xblock
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.1
cwe_ids: CWE-79
severity: MODERATE

Recommender before 1.3.1 allows XSS. It is possible for a learner to craft a fake resource to recommender, that includes script which could possibly steal credentials from staff if they are lured into viewing the recommended resource.
Prototype Pollution in set-value
Advisory: GHSA-4g88-fppr-53pp
Aliases: CVE-2019-10747
Published: 2019-08-27T17:43:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: set-value
ecosystem_specific: affected_functions: set-value
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.1
package: ecosystem: npm
name: set-value
ecosystem_specific: affected_functions: set-value
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.0.1
versions: 3.0.0
cwe_ids: CWE-1321
severity: CRITICAL

Versions of `set-value` prior to 3.0.1 or 2.0.1 are vulnerable to Prototype Pollution. The `set` function fails to validate which Object properties it updates. This allows attackers to modify the prototype of Object, causing the addition or modification of an existing property on all objects.




## Recommendation

If you are using `set-value` 3.x, upgrade to version 3.0.1 or later.
If you are using `set-value` 2.x, upgrade to version 2.0.1 or later.
Deserialization of untrusted data in FasterXML jackson-databind
Advisory: GHSA-gwp4-hfv6-p7hw
Aliases: CVE-2019-14439
Published: 2019-08-01T19:18:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.9.2
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.14
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.9.6
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.6.7.3
cwe_ids: CWE-502
severity: HIGH

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2, 2.8.11.14, 2.7.9.6, and 2.6.7.3. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
Aubio is vulnerable to a NULL pointer dereference in new_aubio_filterbank
Advisory: GHSA-7vvr-h4p5-m7fh
Aliases: CVE-2018-19801
Published: 2019-07-26T16:10:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: aubio
ranges: type: ECOSYSTEM
events: introduced: 0.4.0
fixed: 0.4.9
cwe_ids: CWE-476
severity: HIGH

aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in `new_aubio_filterbank` via invalid n_filters.
Aubio is vulnerable to a NULL pointer dereference in new_aubio_notes function
Advisory: GHSA-c6jq-h4jp-72pr
Aliases: CVE-2018-19802
Published: 2019-07-26T16:10:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: aubio
ranges: type: ECOSYSTEM
events: introduced: 0.4.0
fixed: 0.4.9
cwe_ids: CWE-476
severity: HIGH

aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference in `new_aubio_notes` function within `src/notes/notes.c`.
XML Injection in python-libnmap
Advisory: GHSA-9ccv-p7fg-m73x
Aliases: CVE-2019-1010017
Published: 2019-07-18T15:38:41Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: python-libnmap
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.7.2
cwe_ids: CWE-91
severity: HIGH

### Description

python-libnmap is affected by a Billion-Laughs -style XML injection vulnerability.

### PoC

```python
ty = NmapParser()

payload = """
<!DOCTYPE lolz [
 <!ENTITY lol "lol">
 <!ELEMENT lolz (#PCDATA)>
 <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
 <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
 <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
]>
<lolz><hello>&lol3;</hello></lolz>
"""

ty.parse(payload)
```
python-engineio vulnerable to Cross-Site Request Forgery (CSRF) 
Advisory: GHSA-j3jp-gvr5-7hwq
Aliases: CVE-2019-13611
Published: 2019-07-30T20:47:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: python-engineio
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.9.0
database_specific: last_known_affected_version_range: <= 3.8.2
cwe_ids: CWE-352
severity: HIGH

## WebSocket cross-origin vulnerability

### Impact
This is a Cross-Site Request Forgery (CSRF) vulnerability. It affects Socket.IO and Engine.IO web servers that authenticate clients using cookies.

### Patches
python-engineio version 3.9.0 patches this vulnerability by adding server-side Origin header checks.

### Workarounds
Do not use cookies for client authentication, or else add a CSRF token to the connection URL.

### References
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)
https://www.christian-schneider.net/CrossSiteWebSocketHijacking.html

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [python-engineio](http://github.com/miguelgrinberg/python-engineio)
HPACK Denial of Service vulnerability (HPACK Bomb)
Advisory: GHSA-ffq8-576r-v26g
Aliases: CVE-2016-6581
Published: 2019-07-05T21:11:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: hpack
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 2.3.0
severity: HIGH

A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.
datagrid contains code Injection backdoor
Advisory: GHSA-rqp5-pg7w-832p
Aliases: CVE-2019-14281
Published: 2019-07-31T04:21:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: datagrid
versions: 1.0.6
cwe_ids: CWE-94
severity: CRITICAL

The datagrid gem 1.0.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
aubio Buffer Overflow vulnerability
Advisory: GHSA-grmf-4fq6-2r79
Aliases: CVE-2018-19800
Published: 2019-07-26T16:10:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: aubio
ranges: type: ECOSYSTEM
events: introduced: 0.4.0
fixed: 0.4.9
cwe_ids: CWE-119
severity: CRITICAL

aubio v0.4.0 to v0.4.8 has a Buffer Overflow in `new_aubio_tempo`.
field_test gem contains injection vulnerability
Advisory: GHSA-wg9m-gw3h-hg83
Aliases: CVE-2019-13146
Published: 2019-07-16T00:42:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: package: ecosystem: RubyGems
name: field_test
ranges: type: ECOSYSTEM
events: introduced: 0.3.0
fixed: 0.3.1
versions: 0.3.0
cwe_ids: CWE-74
severity: MODERATE

The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).
SQL Injection in marginalia
Advisory: GHSA-hrj5-qp7x-rpg6
Aliases: CVE-2019-1010191
Published: 2019-07-26T16:10:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: marginalia
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6
cwe_ids: CWE-89
severity: CRITICAL

marginalia < 1.6 is affected by SQL Injection. The impact is an injection of any SQL queries when a user controller argument is added as a component. This issue affects users that add a component that is user controller, for instance a parameter or a header. The attack vector is inputting of SQL to a vulnerable vector (header, http parameter, etc). The fixed version is 1.6.
Authentication bypass via incorrect XML canonicalization and DOM traversal in saml2-js
Advisory: GHSA-5p5w-j3g7-w4wv
Aliases: CVE-2017-11429
Published: 2019-07-05T21:11:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: saml2-js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.12.4
package: ecosystem: npm
name: saml2-js
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.2
cwe_ids: CWE-287
severity: MODERATE

Versions of `saml2-js` prior to 1.12.4 or 2.0.2 are vulnerable to authentication bypass.

The `saml2-js` library may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

Security Assertion Markup Language (SAML) is an XML-based markup language for security assertions regarding authentication and permissions, most commonly used for single sign-on (SSO) services.

Some XML DOM traversal and canonicalization APIs may be inconsistent in handling of comments within XML nodes. Incorrect use of these APIs by some SAML libraries results in incorrect parsing of the inner text of XML nodes such that any inner text after the comment is lost prior to cryptographically signing the SAML message. Text after the comment therefore has no impact on the signature on the SAML message.

A remote attacker can modify SAML content for a SAML service provider without invalidating the cryptographic signature, which may allow attackers to bypass primary authentication for the affected SAML service provider


## Recommendation

If you use 1.x upgrade to version 1.12.4 or greater 
If you use 2.x upgrade to version 2.02 or greater
OmniAuth-SAML authentication bypass via incorrect XML canonicalization and DOM traversal
Advisory: GHSA-94hm-8q65-rmxm
Aliases: CVE-2017-11430
Published: 2019-07-05T21:11:43Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: package: ecosystem: RubyGems
name: omniauth-saml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.10.0
cwe_ids: CWE-287
severity: HIGH

OmniAuth OmniAuth-SAML 1.9.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Cross-Site Scripting in min-http-server
Advisory: GHSA-j657-59rv-qwm6
Aliases: CVE-2019-5457
Published: 2019-07-31T04:22:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: min-http-server
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.6
cwe_ids: CWE-79
severity: MODERATE

All versions of `min-http-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available, consider using an alternative package until a fix is made available.
Deserialization of Untrusted Data in EthereumJ
Advisory: GHSA-hf4p-jm7r-vjjj
Aliases: CVE-2018-15890
Published: 2019-07-26T16:10:39Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.ethereum:ethereumj-core
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.12.0
cwe_ids: CWE-502
severity: CRITICAL

An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server.
Server-Side Request Forgery in Hawt Hawtio
Advisory: GHSA-mcg9-64cp-xwp7
Aliases: CVE-2019-9827
Published: 2019-07-05T21:08:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: io.hawt:hawtio-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.5.0
cwe_ids: CWE-918
severity: CRITICAL

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI.
High severity vulnerability that affects postfix-mta-sts-resolver
Advisory: GHSA-h92m-42h4-82f6
Aliases: CVE-2019-16791
Published: 2019-07-05T21:06:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected: package: ecosystem: PyPI
name: postfix-mta-sts-resolver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.5.1
cwe_ids: CWE-757
severity: HIGH

## Incorrect query parsing

### Impact
All users of versions prior to 0.5.1 can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.

### Patches
Problem has been patched in version 0.5.1

### Workarounds
Users may remediate this vulnerability without upgrading by applying [these patches](https://gist.github.com/Snawoot/b9da85d6b26dea5460673b29df1adc6b) to older suppoorted versions.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [postfix-mta-sts-resolver repo](https://github.com/Snawoot/postfix-mta-sts-resolver)
* Email me at [vladislav at vm-0 dot com](mailto:vladislav-ex-gh-advisory@vm-0.com)