aswin1906/github-advisory-2019.csv huggingface dataset:
Sanitization bypass using HTML Entities in marked
Advisory: GHSA-vfvf-mqq8-rwqc
Aliases: CVE-2016-10531
Published: 2019-02-18T23:58:20Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected: package: ecosystem: npm
name: marked
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.3.6
cwe_ids: CWE-79
severity: MODERATE

Affected versions of `marked` are susceptible to a cross-site scripting vulnerability in link components when `sanitize:true` is configured. 

## Proof of Concept

This flaw exists because link URIs containing HTML entities get processed in an abnormal manner. Any HTML Entities get parsed on a best-effort basis and included in the resulting link, while if that parsing fails that character is omitted.

For example:

A link URI such as
```
javascript&#x58document;alert&#40;1&#41;
```
Renders a valid link that when clicked will execute `alert(1)`.


## Recommendation

Update to version 0.3.6 or later.
Downloads Resources over HTTP in redis-srvr
Advisory: GHSA-j3cr-j9jx-mf4p
Aliases: CVE-2016-10639
Published: 2019-02-18T23:47:07Z
Affected: package: ecosystem: npm
name: redis-srvr
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.8.17-beta.6
cwe_ids: CWE-311
severity: HIGH

Affected versions of `redis-srvr` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `redis-srvr`.


## Recommendation

No patch is currently available for this vulnerability, and the package has not seen an update since 2014.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in google-closure-tools-latest
Advisory: GHSA-69r7-cw26-px6h
Aliases: CVE-2016-10677
Published: 2019-02-18T23:42:14Z
Affected: package: ecosystem: npm
name: google-closure-tools-latest
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.1.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `google-closure-tools-latest` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `google-closure-tools-latest`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, and instead install the [closure compiler](https://github.com/google/closure-compiler) manually.

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in selenium-download
Advisory: GHSA-2mvm-66q7-m256
Aliases: CVE-2016-10559
Published: 2019-02-18T23:40:25Z
Affected: package: ecosystem: npm
name: selenium-download
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.7
cwe_ids: CWE-311
severity: HIGH

Affected versions of `selenium-download` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-download`.


## Recommendation

Update to version 2.0.7 or later.
Downloads Resources over HTTP in windows-seleniumjar-mirror
Advisory: GHSA-455m-q3h9-34pf
Aliases: CVE-2016-10670
Published: 2019-02-18T23:44:29Z
Affected: package: ecosystem: npm
name: windows-seleniumjar-mirror
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.52.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `windows-seleniumjar-mirror` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-seleniumjar-mirror`.


## Recommendation

No patch is currently available for this vulnerability.

Currently, the best mitigation is to download the selenium jar file manually from [seleniumHQ](https://www.seleniumhq.org/download/).

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in go-ipfs-dep
Advisory: GHSA-g3xp-v2ff-x5c3
Aliases: CVE-2016-10563
Published: 2019-02-18T23:54:18Z
Affected: package: ecosystem: npm
name: go-ipfs-dep
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.4.4
cwe_ids: CWE-311
severity: HIGH

Affected versions of `go-ipfs-deps` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 0.4.4 or later.
Prototype Pollution in just-extend
Advisory: GHSA-675m-85rw-j3w4
Aliases: CVE-2018-16489
Published: 2019-02-07T18:17:12Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: just-extend
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.0.0
cwe_ids: CWE-1321
CWE-400
severity: CRITICAL

Versions of `just-extend` before 4.0.0 are vulnerable to prototype pollution. Provided certain input `just-extend` can add or modify properties of the `Object` prototype. These properties will be present on all objects.


## Recommendation

Update to version `4.0.0` or later.
Downloads Resources over HTTP in macaca-chromedriver
Advisory: GHSA-769c-qphh-g3wm
Aliases: CVE-2016-10586
Published: 2019-02-18T23:51:09Z
Affected: package: ecosystem: npm
name: macaca-chromedriver
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.29
cwe_ids: CWE-311
severity: HIGH

Affected versions of `macaca-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `macaca-chromedriver`.


## Recommendation

Update to version 1.0.29 or later.
Regular Expression Denial of Service in jshamcrest
Advisory: GHSA-xj62-87pg-vcv3
Aliases: CVE-2016-10521
Published: 2019-02-18T23:38:51Z
Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: jshamcrest
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.7.1
cwe_ids: CWE-400
severity: HIGH

The `jshamcrest` package is affected by a regular expression denial of service vulnerability when certain types of user input are passed in to the emailAddress validator.


## Proof of concept

```js
var js = require('jshamcrest')
var emailAddress = new js.JsHamcrest.Matchers.emailAddress();


var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=1;i<=10000000;i=i+1) {
    console.log("COUNT: " + i);
    var str = '66666666666666666666666666666@ffffffffffffffffffffffffffffffff.' + genstr(i, 'a') + '{'
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    emailAddress.matches(str)

    var end = process.hrtime(start);
    console.log(end);
}
```

### Results
It takes about 116 characters to get a 1.6 second event loop block.
```
[ 1, 633084590 ]
COUNT: 51
LENGTH: 116
```

# Timeline
- October 25, 2015 - Vulnerability Identified
- October 25, 2015 - Maintainers notified (no response)


## Recommendation

The `jshamcrest` package currently has no patched versions available.

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=validator).
Downloads Resources over HTTP in libxl
Advisory: GHSA-7vrq-vg6p-32fw
Aliases: CVE-2016-10585
Published: 2019-02-18T23:34:48Z
Affected: package: ecosystem: npm
name: libxl
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.4.5
cwe_ids: CWE-269
CWE-311
severity: HIGH

Affected versions of `libxl` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libxl`.


## Recommendation

The module author recommends installing the bindings using a pinned and verified version of SDK instead of the automated download. More information is available in the modules [README](https://www.npmjs.com/package/libxl).
fuseki downloads Resources over HTTP
Advisory: GHSA-3627-w2qr-5fxr
Aliases: CVE-2016-10576
Published: 2019-02-18T23:52:07Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: fuseki
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `fuseki` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `fuseki`.


## Recommendation

Update to version 1.0.1 or later.
Path Traversal in total.js
Advisory: GHSA-3q32-j57w-q4w7
Aliases: CVE-2019-8903
Published: 2019-02-20T15:40:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: total.js
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 3.2.3
cwe_ids: CWE-22
severity: HIGH

Affected versions of `total.js` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files outside the `/public` folder by using relative paths.  
The files served are limited to these file types: `flac`, `jpg`, `jpeg`, `png`, `gif`, `ico`, `js`, `css`, `txt`, `xml`, `woff`, `woff2`, `otf`, `ttf`, `eot`, `svg`, `zip`, `rar`, `pdf`, `docx`, `xlsx`, `doc`, `xls`, `html`, `htm`, `appcache`, `manifest`, `map`, `ogv`, `ogg`, `mp4`, `mp3`, `webp`, `webm`, `swf`, `package`, `json`, `md`, `m4v`, `jsx`, `heif`, `heic`.


## Recommendation

- If you are using version 2.1.x, upgrade to 2.1.1 or later.
- If you are using version 2.2.x, upgrade to 2.2.1 or later.
- If you are using version 2.3.x, upgrade to 2.3.1 or later.
- If you are using version 2.4.x, upgrade to 2.4.1 or later.
- If you are using version 2.5.x, upgrade to 2.5.1 or later.
- If you are using version 2.6.x, upgrade to 2.6.3 or later.
- If you are using version 2.7.x, upgrade to 2.7.1 or later.
- If you are using version 2.8.x, upgrade to 2.8.1 or later.
- If you are using version 2.9.x, upgrade to 2.9.5 or later.
- If you are using version 3.0.x, upgrade to 3.0.1 or later.
- If you are using version 3.1.x, upgrade to 3.1.1 or later.
- If you are using version 3.2.x, upgrade to 3.2.4 or later.
m-server Vulnerable to Directory Traversal
Advisory: GHSA-899g-6q6w-7v94
Aliases: CVE-2018-16485
Published: 2019-02-18T23:58:00Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected: package: ecosystem: npm
name: m-server
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.4.1
cwe_ids: CWE-22
severity: MODERATE

Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tree e.g. /etc/passwd by appending slashes to the URL request.
node-browser downloads Resources over HTTP
Advisory: GHSA-8r98-rqg5-4vm3
Aliases: CVE-2016-10618
Published: 2019-02-18T23:56:50Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: node-browser
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.3
cwe_ids: CWE-311
severity: HIGH

Affected versions of `node-browser` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in httpsync
Advisory: GHSA-4x5j-v9v9-w8gw
Aliases: CVE-2016-10614
Published: 2019-02-18T23:47:40Z
Affected: package: ecosystem: npm
name: httpsync
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.8
cwe_ids: CWE-311
severity: HIGH

Affected versions of `httpsync` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `httpsync`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
chromedriver126 downloads Resources over HTTP
Advisory: GHSA-jppx-hw2f-8gx4
Aliases: CVE-2016-10609
Published: 2019-02-18T23:33:30Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: chromedriver126
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 1.0.15
cwe_ids: CWE-311
severity: HIGH

Affected versions of `chromedriver126` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `chromedriver126`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
libsbmlsim downloads Resources over HTTP
Advisory: GHSA-x268-6jhm-2mx8
Aliases: CVE-2016-10675
Published: 2019-02-18T23:42:22Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: libsbmlsim
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `libsbmlsim` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `libsbmlsim`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
ibm_db downloads Resources over HTTP
Advisory: GHSA-c4qp-h3m6-785f
Aliases: CVE-2016-10577
Published: 2019-02-18T23:51:59Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: ibm_db
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 1.0.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `ibm_db` insecurely download resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Update to version 1.0.2 or later.
Downloads Resources over HTTP in webdrvr
Advisory: GHSA-wr2c-ppj9-f2fv
Aliases: CVE-2016-10601
Published: 2019-02-18T23:33:54Z
Affected: package: ecosystem: npm
name: webdrvr
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 2.43.0-1
cwe_ids: CWE-311
severity: HIGH

Affected versions of `webdrvr` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `webdrvr`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.
Downloads Resources over HTTP in strider-sauce
Advisory: GHSA-8gf4-pcj6-54rp
Aliases: CVE-2016-10611
Published: 2019-02-18T23:47:53Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: strider-sauce
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.6.2
cwe_ids: CWE-311
severity: HIGH

Affected versions of `strider-sauce` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `strider-sauce`.



## Recommendation

While the package author has created a patch for this vulnerability, they have not yet published it to npm or bumped the version number.

In order to resolve the vulnerability, you will need to install the module manually from github:
```
npm install github:Strider-CD/strider-sauce#5ff6d65
```

As this vulnerability does not have a version bump included with the patch, it is possible that you have received a report for a vulnerable package, yet have installed the patched version and are no longer vulnerable. If that is the case, this advisory can be disregarded.
Regular Expression Denial of Service in riot-compiler
Advisory: GHSA-pp4v-55vr-9gxh
Aliases: CVE-2016-10527
Published: 2019-02-18T23:39:13Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected: package: ecosystem: npm
name: riot-compiler
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.3.22
cwe_ids: CWE-400
severity: HIGH

Affected versions of `riot-compiler` are susceptible to a regular expression denial of service vulnerability.


## Recommendation

Update to version 2.3.22 or later.
Downloads Resources over HTTP in unicode-json
Advisory: GHSA-hw4r-xr38-hm8j
Aliases: CVE-2016-10610
Published: 2019-02-18T23:47:59Z
Affected: package: ecosystem: npm
name: unicode-json
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.0
cwe_ids: CWE-311
severity: HIGH

Affected versions of `unicode-json` insecurely downloads resources over HTTP. 

In scenarios where an attacker has a privileged network position, they can modify or read such resources at will. While the exact severity of impact for a vulnerability like this is highly variable and depends on the behavior of the package itself, it ranges from being able to read sensitive information all the way up to and including remote code execution.


## Recommendation

Install version 2.0.0 or greater.
selenium-binaries downloads resources over HTTP
Advisory: GHSA-h4mc-r4f4-hcf4
Aliases: CVE-2016-10589
Published: 2019-02-18T23:34:37Z
Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected: package: ecosystem: npm
name: selenium-binaries
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 0.15.0
cwe_ids: CWE-311
severity: HIGH

Versions of `selenium-binaries` prior to 0.15.0 insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `selenium-binaries`.


## Recommendation

A fix for this vulnerability is available on the `master` branch of the repository as part of version 0.15.0.

Another mitigation currently available is to use an alternate package, such as [selenium-webdriver](https://www.npmjs.com/package/selenium-webdriver), the official selenium bindings for node.js.
Resources Downloaded over Insecure Protocol in igniteui
Advisory: GHSA-2r5h-gh4x-8hp9
Aliases: CVE-2016-10552
Published: 2019-02-18T23:40:14Z
Affected: package: ecosystem: npm
name: igniteui
ranges: type: ECOSYSTEM
events: introduced: 0
last_affected: 0.0.5
cwe_ids: CWE-311
severity: LOW

Affected versions of `igniteui` download Javascript and CSS resources over an unencrypted HTTP connection. An attacker with a privileged network position can intercept and view or modify any content sent or recieved over an unencrypted HTTP connection.




## Recommendation

The `igniteui` package has been deprecated by the package author and now exists under [`ignite-ui`](https://preview.npmjs.com/package/ignite-ui), which should be used in place of this package.