aswin1906/github-advisory-2019.csv huggingface dataset:
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URL
Advisory: GHSA-8cw6-5qvp-q3wj
Aliases: CVE-2018-8024
Published: 2019-03-14T15:40:57Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.spark:spark-core_2.10
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.3
package: ecosystem: Maven
name: org.apache.spark:spark-core_2.10
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.2
package: ecosystem: Maven
name: org.apache.spark:spark-core_2.11
ranges: type: ECOSYSTEM
events: introduced: 2.1.0
fixed: 2.1.3
package: ecosystem: Maven
name: org.apache.spark:spark-core_2.11
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.2
package: ecosystem: Maven
name: org.apache.spark:spark-core_2.11
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.1
versions: 2.3.0
cwe_ids: CWE-200
severity: MODERATE

In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible  for a malicious user to construct a URL pointing to a Spark cluster's UI's  job and stage info pages, and if a user can be tricked into accessing  the URL, can be used to cause script to execute and expose information  from the user's view of the Spark UI. While some browsers like recent  versions of Chrome and Safari are able to block this type of attack,  current versions of Firefox (and possibly others) do not.
Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server
Advisory: GHSA-h2f4-v4c4-6wx4
Aliases: CVE-2018-12545
Published: 2019-03-28T18:33:38Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.4.0
fixed: 9.4.12.v20180830
database_specific: last_known_affected_version_range: <= 9.4.12.RC2
package: ecosystem: Maven
name: org.eclipse.jetty:jetty-server
ranges: type: ECOSYSTEM
events: introduced: 9.3.0
fixed: 9.3.25.v20180904
database_specific: last_known_affected_version_range: <= 9.3.24.v20180605
cwe_ids: CWE-400
severity: HIGH

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
Improper Authentication in org.apache.hive:hive, org.apache.hive:hive-exec, and org.apache.hive:hive-service
Advisory: GHSA-5gvm-hrw5-h6xf
Aliases: CVE-2015-1772
Published: 2019-03-14T15:40:44Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected: package: ecosystem: Maven
name: org.apache.hive:hive
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.0.1
versions: 1.0.0
package: ecosystem: Maven
name: org.apache.hive:hive
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.1.1
versions: 1.1.0
package: ecosystem: Maven
name: org.apache.hive:hive-exec
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.0.1
versions: 1.0.0
package: ecosystem: Maven
name: org.apache.hive:hive-exec
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.1.1
versions: 1.1.0
package: ecosystem: Maven
name: org.apache.hive:hive-service
ranges: type: ECOSYSTEM
events: introduced: 1.0.0
fixed: 1.0.1
versions: 1.0.0
package: ecosystem: Maven
name: org.apache.hive:hive-service
ranges: type: ECOSYSTEM
events: introduced: 1.1.0
fixed: 1.1.1
versions: 1.1.0
cwe_ids: CWE-287
severity: HIGH

The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, mishandles simple unauthenticated and anonymous bind configurations, which allows remote attackers to bypass authentication via a crafted LDAP request.
Haml vulnerable to cross-site scripting
Advisory: GHSA-r53w-g4xm-3gc6
Aliases: CVE-2017-1002201
Published: 2019-10-21T21:59:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: RubyGems
name: haml
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 5.0.0
cwe_ids: CWE-79
severity: MODERATE

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like `< > " '` must be escaped properly. In this case, the `'` character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code.
Malicious URL drafting attack against iodines static file server may allow path traversal
Advisory: GHSA-85rf-xh54-whp3
Published: 2019-10-07T16:52:13Z
Affected: package: ecosystem: RubyGems
name: iodine
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.7.34
database_specific: last_known_affected_version_range: < 0.7.33
cwe_ids: CWE-22
severity: LOW

### Impact

A path traversal vulnerability was detected in iodine's static file service. This vulnerability effects any application running iodine's static file server on an effected iodine version.

Malicious URL drafting may cause the static file server to attempt a response containing data from files that shouldn't be normally accessible from the public folder.

### Patches

The vulnerability was patched in version 0.7.34. Please upgrade to the latest version.

### Workarounds

A possible workaround would be to disable the static file service and it's `X-Sendfile` support, sending static files using nginx or a source code solution (sending the data dynamically).

However, it would be better to upgrade iodine to the latest version, as it also contains non-security related fixes.

### For more information
If you have any questions or comments about this advisory:
* Email [Boaz Segev](https://github.com/boazsegev)
SQL Injection in LibreNMS
Advisory: GHSA-878x-85hc-gc4g
Aliases: CVE-2019-12465
Published: 2019-10-11T18:43:29Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected: package: ecosystem: Packagist
name: librenms/librenms
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.53
cwe_ids: CWE-89
severity: HIGH

An issue was discovered in LibreNMS 1.50.1. A SQL injection flaw was identified in the ajax_rulesuggest.php file where the term parameter is used insecurely in a database query for showing columns of a table, as demonstrated by an ajax_rulesuggest.php?debug=1&term= request.
netaddr before 1.5.3 and 2.0.4 has Incorrect Default Permissions
Advisory: GHSA-49pj-69vf-c689
Aliases: CVE-2019-17383
Published: 2019-10-14T21:43:19Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: netaddr
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.0.4
package: ecosystem: RubyGems
name: netaddr
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.5.3
cwe_ids: CWE-276
severity: CRITICAL

The netaddr gem before 1.5.3 and 2.0.4 for Ruby has misconfigured file permissions, such that a gem install may result in 0777 permissions in the target filesystem.
Polymorphic Typing in FasterXML jackson-databind
Advisory: GHSA-mx7p-6679-8g3q
Aliases: CVE-2019-16942
Published: 2019-10-28T20:51:15Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: Maven
name: com.fasterxml.jackson.core:jackson-databind
ranges: type: ECOSYSTEM
events: introduced: 2.0.0
fixed: 2.9.10.1
database_specific: last_known_affected_version_range: <= 2.9.10
cwe_ids: CWE-502
severity: CRITICAL

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
Insufficiently Protected Credentials in Pivotal Reactor Netty
Advisory: GHSA-j52r-xc68-q8f4
Aliases: CVE-2019-11284
Published: 2019-10-23T14:14:32Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected: package: ecosystem: Maven
name: io.projectreactor.netty:reactor-netty
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.8.11
cwe_ids: CWE-522
severity: HIGH

Pivotal Reactor Netty, versions prior to 0.8.11, passes headers through redirects, including authorization ones. A remote unauthenticated malicious user may gain access to credentials for a different server than they have access to.
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Advisory: GHSA-hgch-jjmr-gp7w
Aliases: CVE-2019-10760
Published: 2019-10-17T18:27:30Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: safer-eval
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.3.2
cwe_ids: CWE-94
severity: CRITICAL

Versions of `safer-eval` before 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.


## Recommendation

Upgrade to version 1.3.2.
Cross-site Scripting in node-red-dashboard
Advisory: GHSA-xg59-m7wx-853q
Aliases: CVE-2019-10756
Published: 2019-10-25T19:41:24Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: node-red-dashboard
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.17.0
cwe_ids: CWE-79
severity: MODERATE

It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the ui_notification node accepting raw HTML by default.
Incorrect Access Control vulnerability in api-platform/core
Advisory: GHSA-974j-wjxx-wggj
Aliases: CVE-2019-1000011
Published: 2019-10-14T21:23:26Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected: package: ecosystem: Packagist
name: api-platform/core
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.10
package: ecosystem: Packagist
name: api-platform/core
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.6
cwe_ids: CWE-284
severity: MODERATE

API Platform version from 2.2.0 to 2.3.5 contains an Incorrect Access Control vulnerability in GraphQL delete mutations that can result in a user authorized to delete a resource can delete any resource. This attack appears to be exploitable via the user must be authorized. This vulnerability appears to have been fixed in 2.3.6.
Missing Authorization in Drupal
Advisory: GHSA-v3f6-f29f-rgvp
Aliases: CVE-2017-6923
Published: 2019-10-10T19:31:31Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: Packagist
name: drupal/core
ranges: type: ECOSYSTEM
events: introduced: 8.0
fixed: 8.3.7
cwe_ids: CWE-862
severity: MODERATE

In Drupal 8.x prior to 8.3.7 When creating a view, you can optionally use Ajax to update the displayed data via filter parameters. The views subsystem/module did not restrict access to the Ajax endpoint to only views configured to use Ajax. This is mitigated if you have access restrictions on the view. It is best practice to always include some form of access restrictions on all views, even if you are using another module to display them.
Cross-site scripting in Apache JSPWiki
Advisory: GHSA-7qmg-qg53-mrp8
Aliases: CVE-2019-12404
Published: 2019-10-11T18:41:59Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M5
database_specific: last_known_affected_version_range: <= 2.11.0.M4
cwe_ids: CWE-79
severity: MODERATE

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to InfoContent.jsp, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Ruby_parser-legacy Incorrect Permission Assignment for Critical Resource
Advisory: GHSA-hhwc-8g49-j8jx
Aliases: CVE-2019-18409
Published: 2019-10-25T19:41:34Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: RubyGems
name: ruby_parser-legacy
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.0
cwe_ids: CWE-732
severity: HIGH

The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local privilege escalation because of world-writable files. For example, if the brakeman gem (which has a legacy dependency) 4.5.0 through 4.7.0 is used, a local user can insert malicious code into the `ruby_parser-legacy-1.0.0/lib/ruby_parser/legacy/ruby_parser.rb` file.
Out-of-Memory Error in Bouncy Castle Crypto
Advisory: GHSA-2mh8-gx2m-mr75
Aliases: CVE-2019-17359
Published: 2019-10-17T18:15:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.bouncycastle:bcprov-jdk14
ranges: type: ECOSYSTEM
events: introduced: 1.63
fixed: 1.64
versions: 1.63
cwe_ids: CWE-770
severity: HIGH

The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is fixed in 1.64.
Cross-site scripting in Swagger-UI
Advisory: GHSA-c427-hjc3-wrfw
Aliases: CVE-2019-17495
Published: 2019-10-15T19:27:05Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: swagger-ui
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.23.11
cwe_ids: CWE-352
CWE-79
severity: CRITICAL

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
Cross-site Scripting in YII2-CMS
Advisory: GHSA-rfh8-25h9-mhgf
Aliases: CVE-2019-16130
Published: 2019-10-14T21:12:08Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Packagist
name: yii2mod/yii2-cms
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.9.2
cwe_ids: CWE-79
severity: MODERATE

YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
High severity vulnerability that affects indico
Advisory: GHSA-67cx-rhhq-mfhq
Published: 2019-10-11T18:28:07Z
Affected: package: ecosystem: PyPI
name: indico
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.1.10
package: ecosystem: PyPI
name: indico
ranges: type: ECOSYSTEM
events: introduced: 2.2.0
fixed: 2.2.3
cwe_ids: CWE-77
severity: HIGH

## Local file disclosure through LaTeX injection

### Impact
An external audit of the Indico codebase has discovered a vulnerability in Indico's LaTeX sanitization code, which could have malicious users to run unsafe LaTeX commands on the server. Such commands allowed for example to read local files (e.g. `indico.conf`).

As far as we know it is not possible to write files or execute code using this vulnerability.

### Patches
You need to update to [Indico 2.2.3](https://github.com/indico/indico/releases/tag/v2.2.3) as soon as possible.
We also released [Indico 2.1.10](https://github.com/indico/indico/releases/tag/v2.1.10) in case you cannot update to 2.2 for some reason.
See https://docs.getindico.io/en/stable/installation/upgrade/ for instructions on how to update.

### Workarounds
Setting `XELATEX_PATH = None` in `indico.conf` will result in an error when building a PDF, but without being able to run xelatex, the vulnerability cannot be abused.

### For more information
If you have any questions or comments about this advisory:
* Open a thread in [our forum](https://talk.getindico.io/)
* Email us privately at [indico-team@cern.ch](mailto:indico-team@cern.ch)
Denial of service via deserialization attack in nifi
Advisory: GHSA-xwx6-vmj4-5rv8
Aliases: CVE-2017-15703
Published: 2019-10-25T19:42:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected: package: ecosystem: Maven
name: org.apache.nifi:nifi-framework-cluster-protocol
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.5.0
cwe_ids: CWE-502
severity: MODERATE

A vulnerability found in Apache NIFI before 1.5.0-RC1. Attacker can perform XXE attacks through JAXB.
SQL Injection in sequelize
Advisory: GHSA-m9jw-237r-gvfv
Aliases: CVE-2019-10752
Published: 2019-10-25T19:43:16Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.44.3
package: ecosystem: npm
name: sequelize
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.15.1
cwe_ids: CWE-89
severity: CRITICAL

Affected versions of `sequelize` are vulnerable to SQL Injection. The function `sequelize.json()` incorrectly formatted sub paths for JSON queries, which allows attackers to inject SQL statements and execute arbitrary SQL queries if user input is passed to the query.  Exploitation example:  

```js
return User.findAll({
  where: this.sequelize.json("data.id')) AS DECIMAL) = 1 DELETE YOLO INJECTIONS; -- ", 1)
});
```


## Recommendation

If you are using `sequelize` 5.x, upgrade to version 5.15.1 or later.
If you are using `sequelize` 4.x, upgrade to version 4.44.3 or later.
Low severity vulnerability that affects eye.js
Advisory: GHSA-mgv2-57vj-99xc
Published: 2019-10-07T16:54:24Z
Affected: package: ecosystem: npm
name: eye.js
ranges: type: ECOSYSTEM
events: introduced: 1.2.0
fixed: 1.2.1
versions: 1.2.0
severity: LOW

## Test breaking

### Impact
In v1.2.0, tests are broken: all tests are always succeeding. If tests are looking for security vulnerabilities, these were compromised.

### Patches
Users should upgrade to `v1.2.1`

### Workarounds
Users who don't use eye.js for looking for vulnerabilities are safe. Upgrading will just fix some bugs.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [EyeJS](https://github.com/arguiot/EyeJS)
* Email us at [arguiot@gmail.com](mailto:arguiot@gmail.com)
Exposure of Sensitive Information to an Unauthorized Actor in LibreNMS
Advisory: GHSA-f4hh-xxqh-wgpq
Aliases: CVE-2019-10667
Published: 2019-10-11T18:43:20Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected: package: ecosystem: Packagist
name: librenms/librenms
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.50.1
cwe_ids: CWE-200
severity: MODERATE

An issue was discovered in LibreNMS through 1.47. Information disclosure can occur: an attacker can fingerprint the exact code version installed and disclose local file paths.
Cross-site scripting in Apache JSPWiki
Advisory: GHSA-3rx2-x6mx-grj3
Aliases: CVE-2019-10089
Published: 2019-10-11T18:41:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: Maven
name: org.apache.jspwiki:jspwiki-war
ranges: type: ECOSYSTEM
events: introduced: 2.9.0
fixed: 2.11.0.M5
database_specific: last_known_affected_version_range: <= 2.11.0.M4
cwe_ids: CWE-79
severity: MODERATE

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the WYSIWYG editor, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
Missing Authentication for Critical Function in LibreNMS
Advisory: GHSA-277v-gwfr-hmpj
Aliases: CVE-2019-10668
Published: 2019-10-11T18:43:06Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: package: ecosystem: Packagist
name: librenms/librenms
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.50.1
cwe_ids: CWE-306
severity: MODERATE

An issue was discovered in LibreNMS through 1.47. A number of scripts import the Authentication libraries, but do not enforce an actual authentication check. Several of these scripts disclose information or expose functions that are of a sensitive nature and are not expected to be publicly accessible.
Renovate vulnerable to leakage of temporary repository tokens into Pull Request comments
Advisory: GHSA-v7x3-7hw7-pcjg
Published: 2019-10-21T16:02:33Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected: package: ecosystem: npm
name: renovate
ranges: type: ECOSYSTEM
events: introduced: 13.87.0
fixed: 19.38.7
cwe_ids: CWE-200
severity: MODERATE

### Impact

Temporary repository tokens were leaked into Pull Requests comments in during certain Go Modules update failure scenarios.

### Patches

The problem has been patched. Self-hosted users should upgrade to v19.38.7 or later.

### Workarounds

Disable Go Modules support.

### References

Blog post: https://renovatebot.com/blog/go-modules-vulnerability-disclosure

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Renovate](http://github.com/renovatebot/renovate)
DOS attack in Pillow when processing specially crafted image files
Advisory: GHSA-j7mj-748x-7p78
Aliases: CVE-2019-16865
Published: 2019-10-22T14:40:42Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: PyPI
name: pillow
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 6.2.0
cwe_ids: CWE-770
severity: HIGH

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.
Sandbox Breakout in realms-shim
Advisory: GHSA-6jg8-7333-554w
Published: 2019-10-04T17:56:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: realms-shim
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.2.0
package: ecosystem: npm
name: ses
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.6.3
severity: CRITICAL

Versions of `realms-shim` prior to 1.2.0 are vulnerable to a Sandbox Breakout. `Reflect.construct` can be used on the sandboxed Function constructor to reach the prototypes of the primal Realm, which may allow an attacker to escape the sandbox and execute arbitrary code.


## Recommendation

Upgrade to version 1.2.0 or later.
Improper Input Validation in Automattic Mongoose
Advisory: GHSA-8687-vv9j-hgph
Aliases: CVE-2019-17426
Published: 2019-10-22T20:19:54Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected: package: ecosystem: npm
name: mongoose
ecosystem_specific: affected_functions: mongoose.cast
ranges: type: ECOSYSTEM
events: introduced: 5.0.0
fixed: 5.7.5
package: ecosystem: npm
name: mongoose
ecosystem_specific: affected_functions: mongoose.cast
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.13.21
cwe_ids: CWE-20
severity: CRITICAL

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a `_bsontype` attribute is ignored. For example, adding `"_bsontype":"a"` can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).
SQL Injection in knex
Advisory: GHSA-58v4-qwx5-7f59
Aliases: CVE-2019-10757
Published: 2019-10-21T16:12:13Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: knex
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.19.5
cwe_ids: CWE-89
severity: CRITICAL

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB.