aswin1906/github-advisory-2019.csv huggingface dataset:
Cross-site Scripting in invenio-communities
Advisory: GHSA-mfv8-q39f-mgfg
Aliases: CVE-2019-1020005
Published: 2019-07-16T00:52:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: invenio-communities
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.0a20
database_specific: last_known_affected_version_range: <= 1.0.0a19
cwe_ids: CWE-79
severity: MODERATE

## Cross-Site Scripting (XSS) vulnerability in Jinja templates

### Impact
A Cross-Site Scripting (XSS) vulnerability was discovered in two Jinja templates in the Invenio-Communities module. The vulnerability allows a user to create a new community and include script element tags inside the description and page fields. 

### Patches
The problem has been patched in v1.0.0a20.

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)
Insufficient Entropy in DotNetNuke
Advisory: GHSA-xx3h-j3cx-8qfj
Aliases: CVE-2018-18326
Published: 2019-07-05T21:08:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: NuGet
name: DotNetNuke.Core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 9.3.0
cwe_ids: CWE-331
severity: HIGH

DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. NOTE: this issue exists because of an incomplete fix for CVE-2018-15812.
Inadequate Encryption Strength in DotNetNuke
Advisory: GHSA-j3g9-6fx5-gjv7
Aliases: CVE-2018-18325
Published: 2019-07-05T21:08:16Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: NuGet
name: DotNetNuke.Core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 9.3.0
cwe_ids: CWE-326
severity: HIGH

DNN (aka DotNetNuke) 9.2 through 9.2.2 uses a weak encryption algorithm to protect input parameters. NOTE: this issue exists because of an incomplete fix for CVE-2018-15811.
Cross-Site Scripting in http-file-server
Advisory: GHSA-7j93-2h6r-hm49
Aliases: CVE-2019-5458
Published: 2019-07-31T04:22:36Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: http-file-server
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.2.6
cwe_ids: CWE-79
severity: MODERATE

All versions of `http-file-server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.
Prototype Pollution in lodash
Advisory: GHSA-jf85-cpcp-j695
Aliases: CVE-2019-10744
Published: 2019-07-10T19:45:23Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected: package: ecosystem: npm
name: lodash
ecosystem_specific: affected_functions: lodash.defaultsDeep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.17.12
package: ecosystem: npm
name: lodash-es
ecosystem_specific: affected_functions: lodash.defaultsDeep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.17.14
package: ecosystem: npm
name: lodash-amd
ecosystem_specific: affected_functions: lodash.defaultsDeep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.17.13
package: ecosystem: npm
name: lodash.template
ecosystem_specific: affected_functions: lodash.defaultsDeep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.5.0
package: ecosystem: npm
name: lodash.merge
ecosystem_specific: affected_functions: lodash.defaultsDeep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.6.2
package: ecosystem: npm
name: lodash.mergewith
ecosystem_specific: affected_functions: lodash.defaultsDeep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.6.2
package: ecosystem: npm
name: lodash.defaultsdeep
ecosystem_specific: affected_functions: lodash.defaultsDeep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.6.1
cwe_ids: CWE-20
severity: CRITICAL

Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution.  The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.

## Recommendation

Update to version 4.17.12 or later.
Cross-site scripting invenio-records
Advisory: GHSA-vxh3-mvv7-265j
Aliases: CVE-2019-1020003
Published: 2019-07-16T00:52:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: invenio-records
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.2
package: ecosystem: PyPI
name: invenio-records
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.1.1
versions: 1.1.0
package: ecosystem: PyPI
name: invenio-records
ranges: type: ECOSYSTEM
events: introduced: 1.2.0
fixed: 1.2.2
cwe_ids: CWE-79
severity: MODERATE

## Cross-Site Scripting (XSS) vulnerability in administration interface

### Impact
A Cross-Site Scripting (XSS) vulnerability was discovered when rendering JSON for a record in the administration interface. The vulnerability could be exploited by e.g. a user who had access to upload a new record, that an admin user would then later view in the admin interface.

### Patches
All supported versions of Invenio-Records have been patched. You should upgrade to either v1.0.1, v1.1.1 or v1.2.2

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)
Injection vulnerability that affects ironic-discoverd
Advisory: GHSA-x64g-wjmw-w328
Aliases: CVE-2015-5306
Published: 2019-07-05T21:10:52Z
Affected: package: ecosystem: PyPI
name: python-ironic-inspector-client
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.2.5
severity: MODERATE

OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.
paranoid2 gem Code backdoor
Advisory: GHSA-4g4c-8gqh-m4vm
Aliases: CVE-2019-13589
Published: 2019-07-16T00:41:55Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: paranoid2
versions: 1.1.6
cwe_ids: CWE-829
severity: CRITICAL

The paranoid2 gem 1.1.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.1.5.
strong_password Ruby gem malicious version causing Remote Code Execution vulnerability
Advisory: GHSA-5h5r-ffc4-c455
Aliases: CVE-2019-13354
Published: 2019-07-08T20:32:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: strong_password
ranges: type: ECOSYSTEM
events: introduced: 0.0.7
fixed: 0.0.8
versions: 0.0.7
cwe_ids: CWE-94
severity: CRITICAL

The strong_password gem 0.0.7 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Version 0.0.8 does not contain the backdoor.
Cross-Site Scripting in @nuxt/devalue
Advisory: GHSA-6677-83pp-f862
Aliases: CVE-2019-13506
Published: 2019-07-16T00:42:02Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: @nuxt/devalue
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.3
cwe_ids: CWE-79
severity: MODERATE

Versions of `@nuxt/devalue` prior to 1.2.3 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization attacker may inject arbitrary JavaScript code through object keys.


## Recommendation

Upgrade to version 1.2.3 or later.
Sensitive Data Exposure in parse-server
Advisory: GHSA-8w3j-g983-8jh5
Aliases: CVE-2019-1020013
Published: 2019-07-11T14:23:09Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: npm
name: parse-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.6.0
cwe_ids: CWE-209
severity: MODERATE

Versions of parse-server prior to 3.6.0 could allow an account enumeration attack via account linking.
`ParseError.ACCOUNT_ALREADY_LINKED(208)` was thrown BEFORE the AuthController checks the password and throws a `ParseError.SESSION_MISSING(206)` for Insufficient auth.  An attacker can guess ids and get information about linked accounts/email addresses.

### For more information
If you have any questions or comments about this advisory,
Open an issue in the [parse-server](https://github.com/parse-community/parse-server)
[Parse Community Vulnerability Disclosure Program](https://github.com/parse-community/parse-server/blob/master/SECURITY.md)
Improper Restriction of XML External Entity Reference in DiffPlug Spotless
Advisory: GHSA-7v35-qwwj-p98g
Aliases: CVE-2019-9843
Published: 2019-07-05T21:07:40Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.diffplug.spotless:spotless-plugin-gradle
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.20.0
package: ecosystem: Maven
name: com.diffplug.spotless:spotless-maven-plugin
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.20.0
cwe_ids: CWE-611
severity: HIGH

In DiffPlug Spotless before 1.20.0 (library and Maven plugin) and before 3.20.0 (Gradle plugin), the XML parser would resolve external entities over both HTTP and HTTPS and didn't respect the resolveExternalEntities setting. For example, this allows disclosure of file contents to a MITM attacker if a victim performs a spotlessApply operation on an untrusted XML file.
Remote code execution in Handlebars.js
Advisory: GHSA-6r5x-hmgg-7h53
Published: 2019-07-15T19:46:01Z
Withdrawn: 2019-07-15T19:46:01Z
Affected: package: ecosystem: npm
name: handlebars
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.1.0
severity: MODERATE

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)
Improper Restriction of XML External Entity Reference in ladon
Advisory: GHSA-vg35-vc9f-q7x2
Aliases: CVE-2019-1010268
Published: 2019-07-26T16:09:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: ladon
ecosystem_specific: affected_functions: ladon.interfaces.soap.SOAPRequestHandler.parse_request
ranges: type: ECOSYSTEM
events: introduced: 0.6.1
last_affected: 1.0.7
cwe_ids: CWE-611
severity: CRITICAL

Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.
Django Denial-of-service by filling session store
Advisory: GHSA-h582-2pch-3xv3
Aliases: CVE-2015-5143
Published: 2019-07-05T21:10:39Z
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.21
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.5.0
fixed: 1.7.9
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.8.0
fixed: 1.8.3
severity: HIGH

The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.
Denial of Service in mem
Advisory: GHSA-4xcv-9jjx-gfj3
Published: 2019-07-05T21:07:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: mem
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.0.0
cwe_ids: CWE-400
severity: MODERATE

Versions of `mem` prior to 4.0.0 are vulnerable to Denial of Service (DoS).  The package fails to remove old values from the cache even after a value passes its `maxAge` property. This may allow attackers to exhaust the system's memory if they are able to abuse the application logging.


## Recommendation

Upgrade to version 4.0.0 or later.
Cross-site scripting in CLEditor
Advisory: GHSA-hh56-x62g-gvhc
Aliases: CVE-2019-1010113
Published: 2019-07-26T16:10:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: NuGet
name: CLEditor
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.4.5
cwe_ids: CWE-79
severity: MODERATE

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link (A) element.
OS Command Injection in MiniMagick
Advisory: GHSA-r7j3-vvh2-xrpj
Aliases: CVE-2019-13574
Published: 2019-07-18T13:19:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: mini_magick
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.9.4
cwe_ids: CWE-78
severity: HIGH

In `lib/mini_magick/image.rb` in MiniMagick before 4.9.4, a fetched remote image filename could cause remote command execution because `Image.open` input is directly passed to `Kernel#open`, which accepts a `|` character followed by a command.
samlr XML nodes comment attack
Advisory: GHSA-qpxp-5j56-gg3x
Aliases: CVE-2018-20857
Published: 2019-07-31T04:22:03Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: RubyGems
name: samlr
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.6.2
cwe_ids: CWE-20
severity: HIGH

Zendesk Samlr before 2.6.2 allows an XML nodes comment attack such as a name_id node with user@example.com followed by `<!---->`. and then the attacker's domain name.
Cross-site Scripting in invenio-previewer
Advisory: GHSA-j9m2-6hq2-4r3c
Aliases: CVE-2019-1020019
Published: 2019-07-16T00:52:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: PyPI
name: invenio-previewer
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.0a12
database_specific: last_known_affected_version_range: <= 1.0.0a11
cwe_ids: CWE-79
severity: MODERATE

## Cross-Site Scripting (XSS) vulnerability in JSON, Markdown and iPython Notebook previewers

### Impact
Several Cross-Site Scripting (XSS) vulnerabilities have been found in the JSON, Markdown and iPython Notebook previewers. The vulnerabilities would allow a malicous user to upload a JSON, Markdown or Notebook file with embedded scripts that would be executed by a victims browser.

### Patches
Invenio-Previewer v1.0.0a12 fixes the issue.

### Workarounds
You can remediate the vulnerability without upgrading by disabling the affected previewers. You do this by adding the following to your configuration:

```python
PREVIEWER_PREFERENCE = [
    'csv_dthreejs',
    'simple_image',
    # 'json_prismjs',
    'xml_prismjs',
    # 'mistune',
    'pdfjs',
    # 'ipynb',
    'zip',
]
```

Afterwards, you should not be able to preview JSON, Markdown or iPython Notebook files.

### For more information
If you have any questions or comments about this advisory:
* Email us at [info@inveniosoftware.org](mailto:info@inveniosoftware.org)
Ruby-SAML Improper Authentication vulnerability
Advisory: GHSA-x2fr-v8wf-8wwv
Aliases: CVE-2017-11428
Published: 2019-07-05T21:11:35Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected: package: ecosystem: RubyGems
name: ruby-saml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.7.0
cwe_ids: CWE-287
severity: HIGH

OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.
Infinite Loop in scapy
Advisory: GHSA-mpf2-q34c-fc6j
Aliases: CVE-2019-1010142
Published: 2019-07-22T14:53:58Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: scapy
ranges: type: ECOSYSTEM
events: introduced: 2.4-rc1
fixed: 2.4.1
cwe_ids: CWE-835
severity: HIGH

scapy is affected by a Denial of Service vulnerability resulting in an infinite loop and resource consumption rendering the program unresponsive. The component is: `_RADIUSAttrPacketListField.getfield(self..)`. The attack vector is over the network or in a pcap. both work.
Deserialization of Untrusted Data in FasterXML jackson-databind
Advisory: GHSA-mph4-vhrx-mv67
Aliases: CVE-2019-12384
Published: 2019-07-05T21:07:27Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.9.9.1
database_specific: last_known_affected_version_range: <= 2.9.9
cwe_ids: CWE-502
severity: MODERATE

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.
Deserialization of Untrusted Data in jackson-databind
Advisory: GHSA-qr7j-h6gg-jmgc
Aliases: CVE-2018-11307
Published: 2019-07-16T17:42:21Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.7.9.4
database_specific: last_known_affected_version_range: <= 2.7.9.3
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.11.2
database_specific: last_known_affected_version_range: <= 2.8.11.1
package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.6
cwe_ids: CWE-502
severity: CRITICAL

An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
Vulnerability that affects org.apache.pdfbox:pdfbox
Advisory: GHSA-c9jj-3wvg-q65h
Aliases: CVE-2019-0228
Published: 2019-07-05T21:12:54Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: org.apache.pdfbox:pdfbox
ranges: type: ECOSYSTEM
events: introduced: 2.0.14
fixed: 2.0.15
cwe_ids: CWE-611
severity: CRITICAL

Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.
Code backdoor in simple_captcha2
Advisory: GHSA-wg6j-r28m-7293
Aliases: CVE-2019-14282
Published: 2019-07-31T04:21:19Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: simple_captcha2
versions: 0.2.3
cwe_ids: CWE-94
severity: CRITICAL

The simple_captcha2 gem 0.2.3 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
Pallets Project Flask is vulnerable to Denial of Service via Unexpected memory usage
Advisory: GHSA-5wv5-4vpf-pj6m
Aliases: CVE-2019-1010083
Published: 2019-07-19T16:12:46Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: flask
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0
cwe_ids: CWE-400
severity: HIGH

The Pallets Project Flask before 1.0 is affected by unexpected memory usage. The impact is denial of service. The attack vector is crafted encoded JSON data. The fixed version is 1. NOTE this may overlap CVE-2018-1000656.
Deserialization of Untrusted Data and Code Injection in xstream
Advisory: GHSA-hf23-9pf7-388p
Aliases: CVE-2019-10173
Published: 2019-07-26T16:09:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.thoughtworks.xstream:xstream
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.11
database_specific: last_known_affected_version_range: <= 1.4.10
cwe_ids: CWE-502
CWE-94
severity: CRITICAL

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
Deserialization of untrusted data in FasterXML jackson-databind
Advisory: GHSA-cmfg-87vq-g5g4
Aliases: CVE-2019-12814
Published: 2019-07-17T15:26:12Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.9.9.1
database_specific: last_known_affected_version_range: <= 2.9.9
cwe_ids: CWE-502
severity: MODERATE

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
Inadequate Encryption Strength in DotNetNuke
Advisory: GHSA-h595-8pw6-5q6v
Aliases: CVE-2018-15811
Published: 2019-07-05T21:08:36Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: NuGet
name: DotNetNuke.Core
ranges: type: ECOSYSTEM
events: introduced: 9.2.0
fixed: 9.2.2
cwe_ids: CWE-326
severity: HIGH

DNN (aka DotNetNuke) 9.2 through 9.2.1 uses a weak encryption algorithm to protect input parameters.
Django Incorrect HTTP detection with reverse-proxy connecting via HTTPS
Advisory: GHSA-6c7v-2f49-8h26
Aliases: CVE-2019-12781
Published: 2019-07-03T20:37:25Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 1.11.0
fixed: 1.11.22
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.10
package: ecosystem: PyPI
name: django
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.3
cwe_ids: CWE-319
severity: MODERATE

An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.
Path Traversal in serve-here.js
Advisory: GHSA-g8m7-qhv7-9h5x
Published: 2019-07-05T21:07:14Z
Affected: package: ecosystem: npm
name: serve-here
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 3.2.0
cwe_ids: CWE-22
severity: HIGH

Versions of `serve-here.js` prior to 1.2.0 are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the served folder using relative paths.


## Recommendation

Upgrade to version 1.2.0 or later.
Missing Encryption of Sensitive Data in yarn
Advisory: GHSA-wqfc-cr59-h64p
Aliases: CVE-2019-5448
Published: 2019-07-31T04:22:15Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: yarn
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.17.3
cwe_ids: CWE-311
CWE-319
severity: HIGH

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.