aswin1906/github-advisory-2019.csv huggingface dataset:
Cross-site scripting in Apache Tomcat
Advisory: GHSA-jjpq-gp5q-8q6w
Aliases: CVE-2019-0221
Published: 2019-05-30T03:30:42Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 9.0.0
fixed: 9.0.17
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 8.0.0
fixed: 8.5.40
package: ecosystem: Maven
name: org.apache.tomcat.embed:tomcat-embed-core
ranges: type: ECOSYSTEM
events: introduced: 7.0.0
fixed: 7.0.94
cwe_ids: CWE-79
severity: MODERATE

The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.
Cross-Site Scripting in webpack-bundle-analyzer
Advisory: GHSA-pgr8-jg6h-8gw6
Published: 2019-05-23T09:26:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Affected: package: ecosystem: npm
name: webpack-bundle-analyzer
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.3.2
cwe_ids: CWE-79
severity: MODERATE

Versions of `webpack-bundle-analyzer` prior to 3.3.2 are vulnerable to Cross-Site Scripting. The package uses `JSON.stringify()` without properly escaping input which may lead to Cross-Site Scripting.


## Recommendation

Upgrade to version 3.3.2 or later.
Improper Input Validation in tar-fs
Advisory: GHSA-x2mc-8fgj-3wmr
Aliases: CVE-2018-20835
Published: 2019-05-01T18:37:18Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: npm
name: tar-fs
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.16.2
cwe_ids: CWE-20
severity: HIGH

A vulnerability was found in tar-fs before 1.16.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.
Cross-Site Scripting in shave
Advisory: GHSA-gh4g-3gm9-5wrq
Aliases: CVE-2019-12313
Published: 2019-05-29T18:38:08Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: shave
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.5.3
cwe_ids: CWE-79
severity: MODERATE

Versions of `shave` prior to 2.5.3 are vulnerable to Cross-Site Scripting. The `shave` package overwrites HTML elements and in doing so fails to properly encode the output. If encoded HTML input is passed into `shave` the output will be decoded which may lead to Cross-Site Scripting.


## Recommendation

Upgrade to version 2.5.3 or later.
Improper Input Validation in Apache Sanselan
Advisory: GHSA-rjx9-2936-9ffx
Aliases: CVE-2018-17201
Published: 2019-05-14T04:01:06Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.sanselan:sanselan
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.97-incubator
cwe_ids: CWE-20
severity: HIGH

Certain input files could make the code hang when Apache Sanselan 0.97-incubator was used to parse them, which could be used in a DoS attack. Note that Apache Sanselan (incubating) was renamed to Apache Commons Imaging.
Cross-site Scripting in Apache UIMA
Advisory: GHSA-vm59-329q-p468
Aliases: CVE-2018-8035
Published: 2019-05-14T04:00:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.uima:uima-ducc-web
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.0.0
database_specific: last_known_affected_version_range: <= 2.2.2
cwe_ids: CWE-79
severity: MODERATE

This vulnerability relates to the user's browser processing of DUCC webpage input data.The javascript comprising Apache UIMA DUCC (<= 2.2.2) which runs in the user's browser does not sufficiently filter user supplied inputs, which may result in unintended execution of user supplied javascript code.
Path Traversal in DKPro Core
Advisory: GHSA-23gj-368h-92pq
Aliases: CVE-2019-11082
Published: 2019-05-29T18:05:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: de.tudarmstadt.ukp.dkpro.core:de.tudarmstadt.ukp.dkpro.core.api.datasets-asl
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.10.0
cwe_ids: CWE-22
severity: HIGH

core/api/datasets/internal/actions/Explode.java in the Dataset API in DKPro Core through 1.10.0 allows Directory Traversal, resulting in the overwrite of local files with the contents of an archive.
Reflected Cross-Site Scripting in jquery.terminal
Advisory: GHSA-2hwp-g4g7-mwwj
Published: 2019-05-29T20:25:35Z
Affected: package: ecosystem: npm
name: jquery.terminal
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.21.0
cwe_ids: CWE-79
severity: MODERATE

Versions of `jquery.terminal` prior to 1.21.0 are vulnerable to Reflected Cross-Site Scripting. If the application has either of the options `anyLinks` or `invokeMethods` set to true, the application may execute arbitrary JavaScript through crafted malicious payloads due to insufficient sanitization.


## Recommendation

Upgrade to version 1.21.0 or later
Cross-Site Scripting in react-svg
Advisory: GHSA-8xqr-4cpm-wx7g
Published: 2019-05-31T23:47:27Z
Affected: package: ecosystem: npm
name: react-svg
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.2.18
cwe_ids: CWE-79
severity: HIGH

Versions of `react-svg` before 2.2.18 are vulnerable to cross-site scripting (xss). This is due to the fact that scripts found in SVG files are run by default.


## Recommendation

Update to version 2.2.18 or later.
Symfony Cross-site Scripting (XSS) vulnerability
Advisory: GHSA-g996-q5r8-w7g2
Aliases: CVE-2019-10909
Published: 2019-11-12T23:00:53Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist
name: symfony/symfony
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist
name: symfony/framework-bundle
ranges: type: ECOSYSTEM
events: introduced: 2.7.0
fixed: 2.7.51
package: ecosystem: Packagist
name: symfony/framework-bundle
ranges: type: ECOSYSTEM
events: introduced: 2.8.0
fixed: 2.8.50
package: ecosystem: Packagist
name: symfony/framework-bundle
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.4.26
package: ecosystem: Packagist
name: symfony/framework-bundle
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.1.12
package: ecosystem: Packagist
name: symfony/framework-bundle
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.7
package: ecosystem: Packagist
name: drupal/core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 8.5.15
package: ecosystem: Packagist
name: drupal/core
ranges: type: ECOSYSTEM
events: introduced: 8.6.0
fixed: 8.6.15
cwe_ids: CWE-79
severity: MODERATE

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, validation messages are not escaped, which can lead to XSS when user input is included. This is related to symfony/framework-bundle.
JSON-jwt Gem lacked element count during splitting of JWE string
Advisory: GHSA-cff7-6h4q-q5pj
Aliases: CVE-2019-18848
Published: 2019-11-14T15:25:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: RubyGems
name: json-jwt
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.11.0
cwe_ids: CWE-287
severity: HIGH

The json-jwt gem before 1.11.0 for Ruby lacks an element count during the splitting of a JWE string.
Composer JavaScript injection possible via html comments
Advisory: GHSA-fm68-89m8-4gjj
Aliases: CVE-2019-8233
Published: 2019-11-12T22:59:47Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.2
fixed: 2.2.10
package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.3
fixed: 2.3.3
cwe_ids: CWE-79
severity: MODERATE

In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments.
Critical severity vulnerability that affects slpjs
Advisory: GHSA-425c-ccf3-3jrr
Aliases: CVE-2019-16762
Published: 2019-11-15T23:10:35Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:H
Affected: package: ecosystem: npm
name: slpjs
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.21.4
cwe_ids: CWE-20
severity: CRITICAL

## Validator parsing discrepancy due to string encoding

### Impact
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus.

### Patches
All versions > 0.21.3 are patched.

### Workarounds
Upgrade to any version >= 0.21.4.

### References
The bug was located and fixed [here](https://github.com/simpleledger/slpjs/commit/ac8809b42e47790a6f0205991b36f2699ed10c84#diff-fe58606994c412ba56a65141a7aa4a62L701).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [slpjs repo](https://github.com/simpleledger/slpjs/issues)
* Email us at [info@slp.cash](mailto:info@slp.cash)
SQL Injection in usmanhalalit/pixie
Advisory: GHSA-68wg-qv6r-j4vp
Aliases: CVE-2019-10766
Published: 2019-11-20T17:44:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: usmanhalalit/pixie
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.3
package: ecosystem: Packagist
name: usmanhalalit/pixie
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.2
cwe_ids: CWE-89
severity: CRITICAL

Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 allow SQL Injection in the limit() function due to improper sanitization.
The rack-cors rubygem may allow directory traveral
Advisory: GHSA-pf8f-w267-mq2h
Aliases: CVE-2019-18978
Published: 2019-11-15T20:26:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: RubyGems
name: rack-cors
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.4
cwe_ids: CWE-22
severity: MODERATE

An issue was discovered in the rack-cors (aka Rack CORS Middleware) gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format.
Cross-site Scripting in Bolt
Advisory: GHSA-cj8p-53v9-2c26
Aliases: CVE-2019-15485
Published: 2019-11-08T15:28:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: bolt/bolt
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.6.10
cwe_ids: CWE-79
severity: MODERATE

Bolt before 3.6.10 has XSS via createFolder or createFile in `Controller/Async/FilesystemManager.php`.
2FA bypass in Wagtail through new device path
Advisory: GHSA-89px-ww3j-g2mm
Aliases: CVE-2019-16766
Published: 2019-11-29T17:05:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected: package: ecosystem: PyPI
name: wagtail-2fa
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.0
cwe_ids: CWE-290
CWE-304
severity: HIGH

## 2FA bypass through new device path

### Impact
If someone gains access to someone's Wagtail login credentials, they can log into the CMS and bypass the 2FA check by changing the URL. They can then add a new device and gain full access to the CMS.

### Patches
This problem has been patched in version 1.3.0.

### Workarounds
There is no workaround at the moment.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)
* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)
SQL Injection in sequelize
Advisory: GHSA-j9xp-92vc-559j
Aliases: CVE-2019-10748
Published: 2019-11-06T17:11:10Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.35.1
package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.44.3
package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.8.11
cwe_ids: CWE-89
severity: CRITICAL

Affected versions of `sequelize` are vulnerable to SQL Injection. The package fails to sanitize JSON path keys in the MariaDB and MySQL dialects,  which may allow attackers to inject SQL statements and execute arbitrary SQL queries.


## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.8.11 or later.
If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.
If you are using `sequelize` 3.x, upgrade to version 3.35.1 or later.
SQL Injection in SimpleSAMLphp
Advisory: GHSA-852q-xxj4-x2rx
Aliases: CVE-2019-15537
Published: 2019-11-08T20:05:45Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: cesnet/simplesamlphp-module-proxystatistics
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.1.0
cwe_ids: CWE-89
severity: CRITICAL

The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php.
Cross-Site Scripting in vant
Advisory: GHSA-9xr8-8hmc-389f
Published: 2019-11-22T13:45:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: package: ecosystem: npm
name: vant
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.1.8
cwe_ids: CWE-79
severity: HIGH

Versions of `vant` prior to 2.1.8 are vulnerable to Cross-Site Scripting. The text value of the `Picker` component column is not sanitized, which may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.1.8 or later.
Pannellum Cross-Site Scripting due to data not being sanitized for URIs or vbscript
Advisory: GHSA-m52x-29pq-w3vv
Aliases: CVE-2019-16763
Published: 2019-11-22T18:18:03Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N
Affected: package: ecosystem: npm
name: pannellum
ranges: type: ECOSYSTEM
events: introduced: 2.5.0
fixed: 2.5.5
cwe_ids: CWE-79
severity: MODERATE

Versions of `pannellum` prior to 2.5.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs for data URIs, which may allow attackers to execute arbitrary code in a victim's browser. 


## Recommendation

Upgrade to version 2.5.6 or later.
Default Express middleware security check is ignored in production
Advisory: GHSA-4j6x-w426-6rc6
Published: 2019-11-08T17:31:17Z
Affected: package: ecosystem: npm
name: @cubejs-backend/api-gateway
ranges: type: ECOSYSTEM
events: introduced: 0.11.0
fixed: 0.11.17
database_specific: last_known_affected_version_range: <= 0.11.16
severity: HIGH

## Default Express middleware security check is ignored in production

### Impact
All Cube.js deployments that use affected versions of `@cubejs-backend/api-gateway` with default express authentication middleware in production environment are affected.

### Patches
@cubejs-backend/api-gateway@0.11.17

### Workarounds
Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware

### For more information
If you have any questions or comments about this advisory:
* Open an issue in https://github.com/cube-js/cube.js/issues
* Reach out us in community Slack: https://slack.cube.dev/
Missing warning can lead to unauthenticated admin access in SilverStripe
Advisory: GHSA-cg8j-8w52-735v
Aliases: CVE-2019-12204
Published: 2019-11-12T23:01:25Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.6
package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 4.4.0
fixed: 4.4.4
package: ecosystem: Packagist
name: silverstripe/cms
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.3.6
package: ecosystem: Packagist
name: silverstripe/cms
ranges: type: ECOSYSTEM
events: introduced: 4.4.0
fixed: 4.4.4
severity: CRITICAL

In SilverStripe through 4.3.3, a missing warning about leaving install.php in a public webroot can lead to unauthenticated admin access.
Authorization Bypass Through User-Controlled Key in Bagisto
Advisory: GHSA-pwrf-q7h8-jjr7
Aliases: CVE-2019-16403
Published: 2019-11-08T20:06:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: bagisto/bagisto
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.1.5
cwe_ids: CWE-639
severity: MODERATE

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.
user/group information can be corrupted across storing in fsimage and reading back from fsimage
Advisory: GHSA-hx83-rpqf-m267
Aliases: CVE-2018-11768
Published: 2019-11-20T01:38:00Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.8.5
package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.9.2
package: ecosystem: Maven
name: org.apache.hadoop:hadoop-main
ranges: type: ECOSYSTEM
events: introduced: 3.0.0
fixed: 3.1.1
cwe_ids: CWE-119
severity: HIGH

In Apache Hadoop 3.1.0 to 3.1.1, 3.0.0-alpha1 to 3.0.3, 2.9.0 to 2.9.1, and 2.0.0-alpha to 2.8.4, the user/group information can be corrupted across storing in fsimage and reading back from fsimage.
XSS in search engine
Advisory: GHSA-fxp8-7h5w-h235
Aliases: CVE-2019-13234
Published: 2019-11-12T22:58:11Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.opencms:opencms-core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 11.0.1
cwe_ids: CWE-79
severity: MODERATE

In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
SilverStripe Priviledge escalation through cache pollution
Advisory: GHSA-6r58-4xgr-gm6m
Aliases: CVE-2019-12617
Published: 2019-11-12T23:01:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Affected: package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 4.0.0
fixed: 4.3.6
package: ecosystem: Packagist
name: silverstripe/framework
ranges: type: ECOSYSTEM
events: introduced: 4.4.0
fixed: 4.4.4
severity: LOW

In SilverStripe through 4.3.3, there is access escalation for CMS users with limited access through permission cache pollution.
Timing attacks might allow practical recovery of the long-term private key
Advisory: GHSA-mr6r-82x4-f4jj
Aliases: CVE-2019-10764
Published: 2019-11-20T01:34:50Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: package: ecosystem: Packagist
name: simplito/elliptic-php
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.6
cwe_ids: CWE-203
severity: HIGH

In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which might allow practical recovery of the long-term private key.
Uncontrolled deserialization of a pickled object in rediswrapper allows attackers to execute arbitrary scripts
Advisory: GHSA-vrcf-g539-x6h3
Aliases: CVE-2019-17206
Published: 2019-11-20T01:37:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: PyPI
name: rediswrapper
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.3.0
cwe_ids: CWE-502
severity: CRITICAL

Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts.
Stored Cross-Site Scripting vulnerability in admin component of DotNetNuke
Advisory: GHSA-5whq-j5qg-wjvp
Aliases: CVE-2019-12562
Published: 2019-11-18T17:16:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: NuGet
name: DotNetNuke.Core
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 9.4.0
cwe_ids: CWE-79
severity: MODERATE

Cross-site scripting (XSS) is possible in DNN (formerly DotNetNuke) before 9.4.0 by remote authenticated users via the Display Name field in the admin notification function.
Use of Cryptographically Weak Pseudo-Random Number Generator in org.pac4j:pac4j-saml
Advisory: GHSA-rc75-cf5c-mxvh
Aliases: CVE-2019-10755
Published: 2019-11-06T17:06:28Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: org.pac4j:pac4j-saml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.8.2
cwe_ids: CWE-338
severity: MODERATE

The SAML identifier generated within SAML2Utils.java was found to make use of the apache commons-lang3 RandomStringUtils class which makes them predictable due to RandomStringUtils PRNG's algorithm not being cryptographically strong. This issue only affects the 3.X release of pac4j-saml.
Possible remote code execution via a remote procedure call
Advisory: GHSA-9ggp-4jpr-7ppj
Published: 2019-11-20T01:35:53Z
Withdrawn: 2021-02-17T19:44:50Z
Affected: package: ecosystem: PyPI
name: rpyc
ranges: type: ECOSYSTEM
events: introduced: 4.1.0
fixed: 4.1.2
severity: HIGH

Withdrawn: duplicate of GHSA-pj4g-4488-wmxm

## Original Description

In RPyC 4.1.x through 4.1.1, a remote attacker can dynamically modify object attributes to construct a remote procedure call that executes code for an RPyC service with default configuration settings.
Using JS libraries with known security vulnerabilities
Advisory: GHSA-89ch-hqf9-rgp3
Aliases: CVE-2019-8121
Published: 2019-11-12T22:59:28Z
Affected: package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.2
fixed: 2.2.10
package: ecosystem: Packagist
name: magento/community-edition
ranges: type: ECOSYSTEM
events: introduced: 2.3
fixed: 2.3.3
severity: HIGH

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.
XXE in PHPSpreadsheet due to encoding issue
Advisory: GHSA-xcrg-29h7-h4cj
Aliases: CVE-2018-19277
Published: 2019-11-20T01:38:52Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Packagist
name: phpoffice/phpspreadsheet
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.5.0
cwe_ids: CWE-91
severity: HIGH

securityScan() in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file