aswin1906/github-advisory-2019.csv huggingface dataset:
closure-util downloads Resources over HTTP
Advisory: GHSA-2hpj-g53m-9gj6
Aliases: CVE-2016-10583
Published: 2019-02-18T23:58:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: closure-util
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.0.0-beta.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `closure-util` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `closure-util`.


## Recommendation

To mitigate this issue:
1. Install the package using npm's `--ignore-scripts` flag.
2. Navigate to the package directory, and open `default-config.json` in a text editor
3. Change the download URLs in the `compiler_url` and `library_url` to `https` equivalents
4. run `npm i` in the package directory.
clang-extra downloads Resources over HTTP
Advisory: GHSA-59m2-j944-839w
Aliases: CVE-2016-10655
Published: 2019-02-18T23:45:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: clang-extra
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `clang-extra` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `clang-extra`.


## Recommendation

No patch is currently available for this vulnerability. The package author stated that no patch is possible until llvm provides HTTPS support, and a patch would be possible if that ever happened in the future.

The best mitigation option is to reduce the risk of exploitation as much as possible. This can be done by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in bionode-sra
Advisory: GHSA-735c-r4vc-6gm9
Aliases: CVE-2016-10613
Published: 2019-02-18T23:56:45Z
Affected: package: ecosystem: npm
name: bionode-sra
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.0.0
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `bionode-sra` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. The author of this package has suggested using [urllib-sync](https://www.npmjs.com/package/urllib-sync).

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
poco downloads Resources over HTTP
Advisory: GHSA-f757-9c4x-chff
Aliases: CVE-2016-10659
Published: 2019-02-18T23:54:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: poco
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.5.4
cwe_ids: CWE-311
severity: HIGH

Affected versions of `poco` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `poco`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in operadriver
Advisory: GHSA-2wrq-wmqf-8vcc
Aliases: CVE-2016-10565
Published: 2019-02-18T23:35:48Z
Affected: package: ecosystem: npm
name: operadriver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.2.3
cwe_ids: CWE-311
severity: HIGH

operadriver is a Opera Driver for Selenium.

operadriver versions below 0.2.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

Update to version 0.2.3 or later.
Path Traversal in simplehttpserver
Advisory: GHSA-45j8-pm75-5v8x
Aliases: CVE-2018-16493
Published: 2019-02-07T18:18:04Z
Affected: package: ecosystem: npm
name: static-resource-server
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.7.2
cwe_ids: CWE-548
severity: HIGH

Versions of `simplehttpserver` prior to 0.2.1 are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 


## Recommendation

Upgrade to version 0.2.1 or later.
Downloads Resources over HTTP in chromedriver
Advisory: GHSA-jh5w-6964-x5cf
Aliases: CVE-2016-10579
Published: 2019-02-18T23:58:05Z
Affected: package: ecosystem: npm
name: chromedriver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.26.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `chromedriver` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. This may result in arbitrary code execution if an attacker intercepts and modifies the downloaded binary file, replacing it with a malicious one. 



## Recommendation

Update to version 2.26.1 or later.
Downloads Resources over HTTP in mongodb-instance
Advisory: GHSA-7r8m-45gc-m2c8
Aliases: CVE-2016-10572
Published: 2019-02-18T23:52:14Z
Affected: package: ecosystem: npm
name: mongodb-instance
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.0.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `mongodb-instance` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mongodb-instance`.


## Recommendation

Update to version 0.0.3 or later.
Downloads Resources over HTTP in nw
Advisory: GHSA-hv96-xxx2-5v7w
Aliases: CVE-2016-10588
Published: 2019-02-18T23:51:04Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: nw
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.23.6-1
database_specific: last_known_affected_version_range: <= 0.23.6-sdk
cwe_ids: CWE-311
severity: HIGH

Affected versions of `nw` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nw`.


## Recommendation

Update to version 0.23.6-1 or later.
Directory Traversal in bitty
Advisory: GHSA-f5mh-hq6h-whxv
Aliases: CVE-2016-10561
Published: 2019-02-18T23:38:29Z
Affected: package: ecosystem: npm
name: bitty
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.10
cwe_ids: CWE-22
severity: MODERATE

Affected versions of `bitty` are vulnerable to directory traversal via the URL path in GET requests.


## Recommendation

The `bitty` package is not currently maintained, and has not seen an update since 2015. 

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality, such as [serve](https://www.npmjs.com/package/serve).
Downloads Resources over HTTP in mystem3
Advisory: GHSA-747p-jfqv-f43r
Aliases: CVE-2016-10626
Published: 2019-02-18T23:47:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: mystem3
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.8
database_specific: last_known_affected_version_range: <= 1.0.7
cwe_ids: CWE-311
severity: HIGH

Affected versions of `mystem3` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem3`.


## Recommendation

Update to version 1.0.8 or later.
Downloads Resources over HTTP in embedza
Advisory: GHSA-mq7g-6rv4-pj95
Aliases: CVE-2016-10569
Published: 2019-02-18T23:35:23Z
Affected: package: ecosystem: npm
name: embedza
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.4
cwe_ids: CWE-311
severity: HIGH

Affected versions of `embedza` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `embedza`.


## Recommendation

Update to version 1.2.4 or later.
Directory Traversal in restafary
Advisory: GHSA-xg5r-8j97-2wrj
Aliases: CVE-2016-10528
Published: 2019-02-18T23:39:22Z
Affected: package: ecosystem: npm
name: restafary
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.1
cwe_ids: CWE-22
severity: MODERATE

Affected versions of `restafary` are susceptible to a directory traversal vulnerability when a root path is specified in the configuration.


Proof of Concept

```
curl -i -s -k  -X 'GET' -H 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' 'http://localhost:8000/api/v1/fs/..%2f..%2fetc/passwd'
```


## Recommendation

Update to version 1.6.1 or later.
Downloads Resources over HTTP in fis-parser-sass-bin
Advisory: GHSA-5pq8-2q24-mj3p
Aliases: CVE-2016-10660
Published: 2019-02-18T23:45:03Z
Affected: package: ecosystem: npm
name: fis-parser-sass-bin
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `fis-parser-sass-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fis-parser-sass-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Prototype Pollution in mpath
Advisory: GHSA-h466-j336-74wx
Aliases: CVE-2018-16490
Published: 2019-02-07T18:17:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: mpath
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.5.1
cwe_ids: CWE-1321
CWE-400
severity: HIGH

Versions of `mpath` before 0.5.1 are vulnerable to prototype pollution. Provided certain input `mpath` can add or modify properties of the `Object` prototype. These properties will be present on all objects.


## Recommendation

Update to version `0.5.1` or later.
Downloads Resources over HTTP in openframe-glslviewer
Advisory: GHSA-g2pf-qjgf-6fw3
Aliases: CVE-2016-10607
Published: 2019-02-18T23:33:42Z
Affected: package: ecosystem: npm
name: openframe-glslviewer
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.8
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `openframe-glslviewer` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `openframe-glslviewer`.


## Recommendation

No patch is currently available for this vulnerability, and the package hasn't been updated since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
dalek-browser-ie-canary downloads Resources over HTTP
Advisory: GHSA-x56r-5r34-qg74
Aliases: CVE-2016-10612
Published: 2019-02-18T23:47:47Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: dalek-browser-ie-canary
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.4-2014-04-04-12-11-49
cwe_ids: CWE-311
severity: HIGH

Affected versions of `dalek-browser-ie-canary` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `dalek-browser-ie-canary`.


## Recommendation

No patch is currently available for this vulnerability, and the package author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
SSL Validation Defaults to False in electron-packager
Advisory: GHSA-q43m-ffwr-rpcc
Aliases: CVE-2016-10534
Published: 2019-02-18T23:58:24Z
Affected: package: ecosystem: npm
name: electron-packager
ranges: type: ECOSYSTEM
events: introduced: 5.2.1
fixed: 7.0.0
cwe_ids: CWE-295
severity: LOW

Affected versions of `electron-packager` configure the generated application to disable SSL certificate verification by default. 

This could allow an attacker with a privileged network position to launch a Man In The Middle (MITM) attack on the install process, intercepting the step where electron-packager downloads Electron for supported target platforms and architectures, and replacing the valid download with a tampered malicious one.

This only affects users using the electron-packager CLI. The strict-ssl option defaults to true for the node.js API.


## Recommendation

1. Update to version 7.0.0 or later.
2. Delete the `electron-download` cache folder, which is by default located at `~/.electron`.
nw-with-arm downloads Resources over HTTP
Advisory: GHSA-9jf3-f2pg-7868
Aliases: CVE-2016-10629
Published: 2019-02-18T23:57:01Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: nw-with-arm
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.14.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `nw-with-arm` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nw-with-arm`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
selenium-chromedriver Downloads Resources over HTTP
Advisory: GHSA-7p6h-3fmw-539q
Aliases: CVE-2016-10624
Published: 2019-02-18T23:47:27Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: selenium-chromedriver
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `selenium-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-chromedriver`.


## Recommendation

No patch is currently available for this vulnerability, and the author has marked the package as deprecated.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised yo
Downloads Resources over HTTP in jvminstall
Advisory: GHSA-qx9m-27wh-7fjg
Aliases: CVE-2016-10631
Published: 2019-02-18T23:57:03Z
Affected: package: ecosystem: npm
name: jvminstall
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `jvminstall` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `jvminstall`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in kindlegen
Advisory: GHSA-h7pc-85cg-wmch
Aliases: CVE-2016-10575
Published: 2019-02-18T23:35:10Z
Affected: package: ecosystem: npm
name: kindlegen
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `kindlegen` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `kindlegen`.


## Recommendation

Update to version 1.1.0 or greater.
sauce-connect downloads Resources over HTTP
Advisory: GHSA-mq76-m7gv-xhfm
Aliases: CVE-2016-10599
Published: 2019-02-18T23:34:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: sauce-connect
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `sauce-connect` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `sauce-connect`.


## Recommendation

No patch is currently available for this vulnerability, and this package has not been updated since 2013.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
SQL Injection in sequelize
Advisory: GHSA-9c2p-jw8p-f84v
Aliases: CVE-2016-10556
Published: 2019-02-18T23:54:24Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.20.0
database_specific: last_known_affected_version_range: <= 3.19.3
cwe_ids: CWE-89
severity: HIGH

Affected versions of `sequelize` cast arrays to strings and fail to properly escape the resulting SQL statement, resulting in a SQL injection vulnerability.


## Proof of Concept
In Postgres, SQLite, and Microsoft SQL Server there is an issue where arrays are treated as strings and improperly escaped.

Example Query:
```
database.query('SELECT * FROM TestTable WHERE Name IN (:names)', {
  replacements: {
    names: directCopyOfUserInput
  }
});
```

If the user inputs the value of `:names` as:
```
["test", "'); DELETE TestTable WHERE Id = 1 --')"]
```

The resulting SQL statement will be:
```sql
SELECT Id FROM Table WHERE Name IN ('test', '\'); DELETE TestTable WHERE Id = 1 --')
```
As the backslash has no special meaning in PostgreSQL, MSSQL, or SQLite, the statement will delete the record in TestTable with an Id of 1.


## Recommendation

Update to version 3.20.0 or later.