aswin1906/github-advisory-2019.csv huggingface dataset:
Arbitrary File Write in cli
Advisory: GHSA-6cpc-mj5c-m9rq
Aliases: CVE-2016-10538
Published: 2019-02-18T23:40:03Z
Affected: package: ecosystem: npm
name: cli
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.0
cwe_ids: CWE-22
severity: LOW

Affected versions of `cli` use predictable temporary file names. If an attacker can create a symbolic link at the location of one of these temporarly file names, the attacker can arbitrarily write to any file that the user which owns the `cli` process has permission to write to.


## Proof of Concept

By creating Symbolic Links at the following locations, the target of the link can be written to.
```
lock_file = '/tmp/' + cli.app + '.pid',
log_file = '/tmp/' + cli.app + '.log';
```


## Recommendation

Update to version 1.0.0 or later.
Downloads Resources over HTTP in webdriver-launcher
Advisory: GHSA-2vqv-hp3p-fmv8
Aliases: CVE-2016-10651
Published: 2019-02-18T23:47:03Z
Affected: package: ecosystem: npm
name: webdriver-launcher
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `webdriver-launcher` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webdriver-launcher`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2011.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
mcstatic directory traversal vulnerability
Advisory: GHSA-cxmj-qjv6-vx9p
Aliases: CVE-2018-16482
Published: 2019-02-07T18:15:44Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: mcstatic
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.20
cwe_ids: CWE-22
severity: HIGH

A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive information in the file system by appending slashes in the URL path.
Downloads Resources over HTTP in wasdk
Advisory: GHSA-rh7p-9c79-gpp8
Aliases: CVE-2016-10587
Published: 2019-02-18T23:34:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: wasdk
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.54
cwe_ids: CWE-311
severity: HIGH

Affected versions of `wasdk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `wasdk`.


## Recommendation

No fix is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit it are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in haxe
Advisory: GHSA-g785-775g-f2g8
Aliases: CVE-2016-10602
Published: 2019-02-18T23:50:21Z
Affected: package: ecosystem: npm
name: haxe
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 5.0.10
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `haxe` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe`.


## Recommendation

Update to version 5.0.10 or later.
grunt-gh-pages before 0.10.0 may allow unencrypted GitHub credentials to be written to a log file
Advisory: GHSA-rrj3-qmh8-72pf
Aliases: CVE-2016-10526
Published: 2019-02-18T23:39:11Z
Affected: package: ecosystem: npm
name: grunt-gh-pages
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.10.0
database_specific: last_known_affected_version_range: <= 0.9.1
cwe_ids: CWE-391
severity: MODERATE

Versions of `grunt-gh-pages` prior to 0.10.0 are affected by a vulnerability which may cause unencrypted GitHub credentials to be written to a log file in certain circumstances.

In the `grunt-gh-pages` deployment scenario where authentication is performed by injecting a GitHub token directly into the auth portion of the URL, `grunt-gh-pages` will write the token to a log file, unencrypted.


## Recommendation

Update to version 0.10.0 or later.
selenium-wrapper downloads Resources over HTTP
Advisory: GHSA-pr34-8jfr-xhv8
Aliases: CVE-2016-10628
Published: 2019-02-18T23:47:21Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: selenium-wrapper
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.9
cwe_ids: CWE-311
severity: HIGH

Affected versions of `selenium-wrapper` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-wrapper`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in sfml
Advisory: GHSA-5q5w-mf87-57x4
Aliases: CVE-2016-10654
Published: 2019-02-18T23:45:18Z
Affected: package: ecosystem: npm
name: sfml
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `sfml` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in mystem-wrapper
Advisory: GHSA-wg5r-c793-w5w2
Aliases: CVE-2016-10671
Published: 2019-02-18T23:44:28Z
Affected: package: ecosystem: npm
name: mystem-wrapper
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `mystem-wrapper` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `mystem-wrapper`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
nodeschnaps downloads resources over HTTP
Advisory: GHSA-r74q-wqx8-2pr3
Aliases: CVE-2016-10622
Published: 2019-02-18T23:47:31Z
Affected: package: ecosystem: npm
name: nodeschnaps
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `nodeschnaps` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `nodeschnaps`.


## Recommendation

Update to version 1.0.3 or later.
Path Traversal in cordova-plugin-ionic-webview
Advisory: GHSA-xwjh-cp99-cj8q
Aliases: CVE-2018-16202
Published: 2019-02-12T15:36:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: cordova-plugin-ionic-webview
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.0
cwe_ids: CWE-22
severity: HIGH

Versions of `cordova-plugin-ionic-webview` prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications.  The package launches a webserver listening on http://localhost:8080 without restricting access of the app itself, thus escaping the iOS application sandbox and accessing local files.


## Recommendation

Upgrade to version 2.2.0
arrayfire-js downloads Resources over HTTP
Advisory: GHSA-238x-q7xf-p4xw
Aliases: CVE-2016-10598
Published: 2019-02-18T23:50:32Z
Affected: package: ecosystem: npm
name: arrayfire-js
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.21.4
cwe_ids: CWE-311
severity: HIGH

Affected versions of `arrayfire-js` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `arrayfire-js`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in macaca-chromedriver-zxa
Advisory: GHSA-3c87-r9f7-qfgq
Aliases: CVE-2016-10623
Published: 2019-02-18T23:56:56Z
Affected: package: ecosystem: npm
name: macaca-chromedriver-zxa
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.9
cwe_ids: CWE-311
severity: HIGH

Affected versions of `macaca-chromedriver-zxa` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `macaca-chromedriver-zxa`.


## Recommendation

The best mitigation is to manually set the download URL to a safe HTTPS server via the `CHROMEDRIVER_CDNURL` environment variable.

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in haxe-dev
Advisory: GHSA-cwp7-92h5-82wx
Aliases: CVE-2016-10637
Published: 2019-02-18T23:47:10Z
Affected: package: ecosystem: npm
name: haxe-dev
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.2.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `haxe-dev` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `haxe-dev`.


## Recommendation

This package is actively maintained, yet after 2 years, the maintainer has not provided a patch for the vulnerability. This likely means that the maintainer has decided to accept the risk, and this vulnerability will never be patched.

Because of this, the best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Potential Command Injection in shell-quote
Advisory: GHSA-qg8p-v9q4-gh34
Aliases: CVE-2016-10541
Published: 2019-02-18T23:58:29Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: shell-quote
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.1
cwe_ids: CWE-78
CWE-94
severity: CRITICAL

Affected versions of `shell-quote` do not properly escape command line arguments, which may result in command injection if the library is used to escape user input destined for use as command line arguments.



## Proof of Concept:

The following characters are not escaped properly: `>`,`;`,`{`,`}`

Bash has a neat but not well known feature known as "Bash Brace Expansion", wherein a sub-command can be executed without spaces by running it between a set of `{}` and using the `,` instead of ` ` to seperate arguments. Because of this, full command injection is possible even though it was initially thought to be impossible. 

```
   const quote = require('shell-quote').quote;
   console.log(quote(['a;{echo,test,123,234}']));
   // Actual                    "a;{echo,test,123,234}"
   // Expected                  "a\;\{echo,test,123,234\}"
   // Functional Equivalent     "a; echo 'test' '123' '1234'"
```



## Recommendation

Update to version 1.6.1 or later.
Downloads Resources over HTTP in healthcenter
Advisory: GHSA-j336-34q7-cgj3
Aliases: CVE-2016-10684
Published: 2019-02-18T23:42:06Z
Affected: package: ecosystem: npm
name: healthcenter
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.0.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `healthcenter` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `healthcenter`.


## Recommendation

This package has been deprecated, and moved to a new package on npm: [`appmetrics`](https://npmjs.com/package/appmetrics).

In order to mitigate this vulnerability, please install the `appmetrics` package in place of `healthcenter` via the following commands:
```
npm uninstall healthcenter -s
npm install appmetrics -s
```
install-nw downloads Resources over HTTP
Advisory: GHSA-wq7q-7vfh-2x3h
Aliases: CVE-2016-10566
Published: 2019-02-18T23:54:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: install-nw
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.1.5
cwe_ids: CWE-311
severity: HIGH

Affected versions of `install-nw` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `install-nw`.


## Recommendation

Update to version 1.1.5 or later.
wixtoolset downloads Resources over HTTP
Advisory: GHSA-cr8h-x88h-jwj2
Aliases: CVE-2016-10663
Published: 2019-02-18T23:44:45Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: wixtoolset
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `wixtoolset` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `wixtoolset`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in galenframework-cli
Advisory: GHSA-x5ph-4fr4-g7fw
Aliases: CVE-2016-10560
Published: 2019-02-18T23:54:21Z
Affected: package: ecosystem: npm
name: galenframework-cli
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `galenframework-cli` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `galenframework-cli`.


## Recommendation

Update to version 2.3.1 or later.
Tnantoka/public XSS Vulnerability
Advisory: GHSA-649c-x44h-4q7v
Aliases: CVE-2018-16480
Published: 2019-02-07T18:14:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: public
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.4
cwe_ids: CWE-79
severity: MODERATE

A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of sanitization of the file/folder names before rendering.
Insecure Defaults Allow MITM Over TLS in engine.io-client
Advisory: GHSA-4r4m-hjwj-43p8
Aliases: CVE-2016-10536
Published: 2019-02-18T23:39:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: engine.io-client
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.6.9
cwe_ids: CWE-300
severity: MODERATE

Affected versions of `engine.io-client` do not verify certificates by default, and as such may be vulnerable to Man-in-the-Middle attacks.

The vulnerability is related to the way that node.js handles the `rejectUnauthorized` setting. If the value is something that evaluates to false, such as undefined or null, certificate verification will be disabled. 



## Recommendation

Update to version 1.6.9 or later.

If you are unable to upgrade, ensure all calls to socket.io to have a `rejectedUnauthorized: true` flag.
Downloads Resources over HTTP in js-given
Advisory: GHSA-rqwh-c535-j9hw
Aliases: CVE-2016-10638
Published: 2019-02-18T23:47:09Z
Affected: package: ecosystem: npm
name: js-given
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.0.18
cwe_ids: CWE-311
severity: HIGH

Affected versions of `js-given` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `js-given`.


## Recommendation

Update to version 0.0.18 or later.
Downloads Resources over HTTP in baryton-saxophone
Advisory: GHSA-6pwf-whc8-hjf6
Aliases: CVE-2016-10573
Published: 2019-02-18T23:35:18Z
Affected: package: ecosystem: npm
name: baryton-saxophone
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `baryton-saxophone` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `baryton-saxophone`.


## Recommendation

Update to version 3.0.1 or later.
Downloads Resources over HTTP in scala-bin
Advisory: GHSA-3vv5-42wr-m32g
Aliases: CVE-2016-10627
Published: 2019-02-18T23:57:00Z
Affected: package: ecosystem: npm
name: scala-bin
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.3.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `scala-bin` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `scala-bin`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in native-opencv
Advisory: GHSA-mpww-j7xj-cj35
Aliases: CVE-2016-10658
Published: 2019-02-18T23:45:07Z
Affected: package: ecosystem: npm
name: native-opencv
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.0.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `native-opencv` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `native-opencv`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2015.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.