aswin1906/github-advisory-2020.csv huggingface dataset:
Directory Traversal in welcomyzt
Advisory: GHSA-8fv7-vm2p-5495 (CVE-2017-16123)
Published: 2020-09-01T17:23:53Z

`welcomyzt` is a simple file server.

`welcomyzt` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing `../` in the url.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host: localhost
```
 and server Response:
```http
HTTP/1.1 200 OK
Date: Thu, 04 May 2017 23:59:18 GMT
Connection: keep-alive
Transfer-Encoding: chunked

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: welcomyzt, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in priest-runner
Advisory: GHSA-9px9-f7jw-fwhj ()
Published: 2020-09-03T15:49:37Z

All versions of `priest-runner` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to a `spawn` call, which may allow attackers to execute arbitrary code in the system. The `PriestController.prototype.createChild ` function is vulnerable since the `spawn` parameters come from a POST request body.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: priest-runner, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in leaflet-gpx
Advisory: GHSA-gjc9-932x-c59p ()
Published: 2020-09-03T00:34:33Z

Version 1.0.1 of `leaflet-gpx` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider a downgrade to version 1.0.0

Affected packages:
package: ecosystem: npm, name: leaflet-gpx, versions: 1.0.1
RCE in Third Party Library in Shopware
Advisory: GHSA-qvc5-cfrr-384v ()
Published: 2020-09-23T17:20:28Z

### Impact
RCE in Third Party Library

### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. 

For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020

Affected packages:
package: ecosystem: Packagist, name: shopware/platform, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.1.1, database_specific: last_known_affected_version_range: <= 6.3.1.0
package: ecosystem: Packagist, name: shopware/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.1.1, database_specific: last_known_affected_version_range: <= 6.3.1.0
SQL Injection in sails-mysql
Advisory: GHSA-hx5x-49mm-vmhw ()
Published: 2020-09-03T02:36:43Z

Versions of `sails-mysql` prior to 0.10.8 are vulnerable to SQL Injection. The `sort` keyword is not properly sanitized and may allow attackers to inject SQL statements and execute arbitrary SQL queries


## Recommendation

Upgrade to version 0.10.8 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: sails-mysql, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.10.8
Malicious Package in commander-js
Advisory: GHSA-2hqf-qqmq-pgpp ()
Published: 2020-09-02T15:48:16Z

All versions of `commander-js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads an arbitrary file and executes its contents as a post-install script.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: commander-js, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bip30
Advisory: GHSA-wch2-46wj-6x5j ()
Published: 2020-09-04T15:37:15Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bip30, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in malicious-npm-package
Advisory: GHSA-49c6-3wr4-8jr4 ()
Published: 2020-09-04T15:05:26Z

All versions of `malicious-npm-package` contain malicious code. The malware targets Windows systems. It runs a powershell command that downloads an executable file from a remote server and runs it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: malicious-npm-package, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
HTML Injection in marky-markdown
Advisory: GHSA-mg69-6j3m-jvgw ()
Published: 2020-09-03T15:45:08Z

All versions of `marky-markdown` are vulnerable to HTML Injection. The package fails to sanitize `style` attributes in `img` tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML.


## Recommendation

This package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: marky-markdown, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in js-shas
Advisory: GHSA-5wq6-v5cw-jvfr ()
Published: 2020-09-03T23:03:36Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-shas, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffdr-xor
Advisory: GHSA-8549-p68h-m9mc ()
Published: 2020-09-03T21:46:21Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffdr-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in js-sla3
Advisory: GHSA-h6m3-cx24-9626 ()
Published: 2020-09-03T23:11:45Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-sla3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in saync
Advisory: GHSA-pm9v-325f-5g74 ()
Published: 2020-09-02T21:30:11Z

All versions of `saync ` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: saync, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in precode.js
Advisory: GHSA-5w4r-wwc3-6qcp ()
Published: 2020-09-11T21:23:29Z

Version 1.1.1 of `precode.js` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.1.0

Affected packages:
package: ecosystem: npm, name: precode.js, versions: 1.1.1
Prototype Pollution in klona
Advisory: GHSA-4r97-78gf-q24v ()
Published: 2020-09-04T17:53:27Z

Versions of `klona` prior to 1.1.1 are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype when cloning objects, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

Upgrade to version 1.1.1 or later.

Affected packages:
package: ecosystem: npm, name: klona, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.1
Malicious Package in @impala/bmap
Advisory: GHSA-c82c-8pjw-6829 ()
Published: 2020-09-01T19:41:45Z

Version 1.0.3 of `@impala/bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.3 of this module is found installed you will want to replace it with a version before or after 1.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/
Affected packages:
package: ecosystem: npm, name: @impala/bmap, versions: 1.0.3
Malicious Package in body-parse-xml
Advisory: GHSA-jcmh-9fvm-j39w ()
Published: 2020-09-03T19:42:23Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: body-parse-xml, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in babel-loadre
Advisory: GHSA-vvfh-mvjv-w38q ()
Published: 2020-09-04T15:28:19Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: babel-loadre, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in commanedr
Advisory: GHSA-xcgx-27q5-7634 ()
Published: 2020-09-03T19:41:05Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: commanedr, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in react
Advisory: GHSA-g53w-52xc-2j85 (CVE-2013-7035)
Published: 2020-09-04T16:52:57Z

Affected versions of `react` are vulnerable to Cross-Site Scripting (XSS). The package fails to properly sanitize input used to create keys. This may allow attackers to execute arbitrary JavaScript if a key is generated from user input.


## Recommendation

If you are using `react` 0.5.x, upgrade to version 0.5.2 or later.
If you are using `react` 0.4.x, upgrade to version 0.4.2 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: react, ranges: type: ECOSYSTEM, events: introduced: 0.4.0
fixed: 0.4.2
package: ecosystem: npm, name: react, ranges: type: ECOSYSTEM, events: introduced: 0.5.0
fixed: 0.5.2
Heap buffer overflow in Tensorflow
Advisory: GHSA-63xm-rx5p-xvqr (CVE-2020-15195)
Published: 2020-09-25T18:28:29Z

### Impact
The implementation of `SparseFillEmptyRowsGrad` uses a double indexing pattern:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/sparse_fill_empty_rows_op.cc#L263-L269

It is possible for `reverse_index_map(i)` to be an index outside of bounds of `grad_values`, thus resulting in a heap buffer overflow.

### Patches
We have patched the issue in 390611e0d45c5793c7066110af37c8514e6a6c54 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.15.4
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.3
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.2
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Remote Memory Disclosure in bittorrent-dht
Advisory: GHSA-77g4-36jp-5v3m (CVE-2016-10519)
Published: 2020-09-01T15:22:12Z

Versions of `bittorrent-dht` prior to 5.1.3 are affected by a remote memory disclosure vulnerability. This vulnerability allows an attacker to send a specific series of of messages to a listening peer and get it to reveal internal memory.


There are two mitigating factors here, that slightly reduce the impact of this vulnerability:

1. Any modern kernel will zero out new memory pages before handing them off to a process. This means that only memory previously used and deallocated by the node process can be leaked.
1. Node.js manages Buffers by creating a few large internal SlowBuffers, and slicing them up into smaller Buffers which are made accessible in JS. They are not stored on V8's heap, because garbage collection would interfere. The result is that only memory that has been previously allocated as a Buffer can be leaked.


## Recommendation

Update to version 5.1.3 or later.

Affected packages:
package: ecosystem: npm, name: bittorrent-dht, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.1.3
Downloads Resources over HTTP in node-air-sdk
Advisory: GHSA-7hvm-29rf-2gf2 (CVE-2016-10647)
Published: 2020-09-01T16:08:58Z

Affected versions of `node-air-sdk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `node-air-sdk`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Affected packages:
package: ecosystem: npm, name: node-air-sdk, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in node-forge
Advisory: GHSA-92xj-mqp7-vmcj (CVE-2020-7720)
Published: 2020-09-14T21:42:09Z

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: version 0.10.0 is a breaking change removing the vulnerable functions.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Affected packages:
package: ecosystem: npm, name: node-forge, ecosystem_specific: affected_functions: forge.util.setPath, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.10.0
Malicious Package in carloprojectdiscord
Advisory: GHSA-9rwj-8mh9-4876 ()
Published: 2020-09-02T21:19:37Z

All versions of `carloprojectdiscord` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: carloprojectdiscord, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in mx-nested-menu
Advisory: GHSA-48hw-37g6-3gw4 ()
Published: 2020-09-03T02:35:41Z

Version 0.1.30 of `mx-nested-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.1.29

Affected packages:
package: ecosystem: npm, name: mx-nested-menu, versions: 0.1.30
Hardcoded Initialization Vector in parsel
Advisory: GHSA-q643-w9jp-q2qg ()
Published: 2020-09-04T17:34:59Z

All versions of `parsel` have a default hardcoded initialization vector. In cases where the IV is not provided, the package defaults to a hardcoded IV which renders the cipher vulnerable to chosen plaintext attacks.


## Recommendation

The package is deprecated and will not be updated. Consider using an alternative package.

Affected packages:
package: ecosystem: npm, name: parsel, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in js-shi3
Advisory: GHSA-g37j-v5gh-g25c ()
Published: 2020-09-03T23:06:48Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-shi3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in md-data-table
Advisory: GHSA-hgr5-82rc-p936 ()
Published: 2020-09-01T21:24:41Z

All versions of `md-data-table` are vulnerable to cross-site scripting (XSS). This vulnerability is exploitable if an attacker has control over data that is rendered by `mdt-row`


## Recommendation

As there is no fix for this vulnerability at this time we recommend either selecting another package to perform this functionality or properly sanitizing all user data prior to rendering with `md-data-table`

Affected packages:
package: ecosystem: npm, name: md-data-table, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in js-qha3
Advisory: GHSA-vf5m-q45w-8mh9 ()
Published: 2020-09-03T23:00:25Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-qha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in we3b
Advisory: GHSA-36r8-9qq7-mh43 ()
Published: 2020-09-03T17:02:40Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: we3b, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
cross-env.js is malware
Advisory: GHSA-hwhq-3hrj-v6v5 (CVE-2017-16081)
Published: 2020-09-01T19:00:54Z

The `cross-env.js` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation


As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.

Affected packages:
package: ecosystem: npm, name: cross-env.js, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in rceat
Advisory: GHSA-7w7c-867m-4mqc ()
Published: 2020-09-03T17:04:55Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: rceat, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in motiv.scss
Advisory: GHSA-2vqq-jgxx-fxjc ()
Published: 2020-09-11T21:24:33Z

Version 0.4.20 of `motiv.scss` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: motiv.scss, ranges: type: ECOSYSTEM, events: introduced: 0.4.20
fixed: 0.4.21, versions: 0.4.20
Malicious Package in buffer-xo2
Advisory: GHSA-f72h-wf57-7xwh ()
Published: 2020-09-03T21:58:34Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xo2, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Regular Expression Denial of Service in ansi2html
Advisory: GHSA-c2v2-7rcg-2ch7 (CVE-2015-9239)
Published: 2020-09-01T15:17:48Z

The `ansi2html` package is affected by a regular expression denial of service vulnerability when certain types of user input is passed in.


## Proof of concept
```
var ansi2html = require('ansi2html')

var start = process.hrtime();
ansi2html("[1111111111111111111111;0000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;00000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;000000000000000000000000");
console.log(process.hrtime(start));

start = process.hrtime();
ansi2html("[1111111111111111111111;0000000000000000000000000000");
console.log(process.hrtime(start));
```

Results of the above
```
00:29:53-adam_baldwin~/tmp$ node test
[ 0, 119615367 ]
[ 0, 149934565 ]
[ 0, 233325677 ]
[ 3, 46582479 ]
```


## Recommendation

At the time of this writing, February 2018, all versions of `ansi2html` remain vulnerable, and the package has not been updated for 4 years. 

In order to use this package safely, it is necessary to avoid passing user input to the package, or to limit the size of the input string to a size with a parse time you find acceptable. Unfortunately, the match time grows at quite a small character count, so it is unlikely for it to both allow strings of a useful size while protecting against the denial of service attack. 

In the case that user input of significant length must be parsed by ansi2html, the best mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.][available on npm](https://www.npmjs.com/search?q=ansi+html)

Affected packages:
package: ecosystem: npm, name: ansi2html, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
NoSQL injection in express-cart
Advisory: GHSA-f5cv-xrv9-r8w7 ()
Published: 2020-09-01T21:17:16Z

Versions of `express-cart` before 1.1.8 are vulnerable to NoSQL injection. 

The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent directly into the MongoDB query which allows to insert operators. 

These operators can be used to extract the value of the field blindly in the same manner of a blind SQL injection. In this case, the `$regex` operator is used to guess each character of the token from the start.


## Recommendation

Update to version 1.1.8 or later.

Affected packages:
package: ecosystem: npm, name: express-cart, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.8, database_specific: last_known_affected_version_range: <= 1.1.7
Unauthorized File Access in node-git-server
Advisory: GHSA-cv3v-7846-6pxm ()
Published: 2020-09-03T21:15:19Z

Versions of `node-git-server` prior to 0.6.1 are vulnerable to Unauthorized File Access. It is possible to access any git repository by using absolute paths, which may allow attackers to access private repositories.


## Recommendation

Upgrade to version 0.6.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: node-git-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.6.1
Directory Traversal in dasafio
Advisory: GHSA-8xj3-7258-w4q2 (CVE-2017-16179)
Published: 2020-09-01T18:51:22Z

Affected versions of `dasafio` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: dasafio, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in blubird
Advisory: GHSA-rvww-x6m4-4vc2 ()
Published: 2020-09-11T21:12:39Z

Version 3.5.0 of `blubird` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive.


## Recommendation

Remove the package from your environment and verify whether your system is running the cryptocurrency miner.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: blubird, ranges: type: ECOSYSTEM, events: introduced: 0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-22q9-hqm5-mhmc ()
Published: 2020-09-11T21:22:24Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to encode output in GET requests. The request is meant to respond with Content-Type `application/json` which does not trigger the vulnerability but if the web server changes the header to `text/html` it may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.2.1 or later.

Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.1
Malicious Package in js-3ha3
Advisory: GHSA-52c9-458g-whrf ()
Published: 2020-09-03T22:58:17Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-3ha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Out of bounds write in tensorflow-lite
Advisory: GHSA-p2cq-cprg-frvm (CVE-2020-15214)
Published: 2020-09-25T18:28:56Z

### Impact
In TensorFlow Lite models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the dimensionality of output tensor:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/segment_sum.cc#L39-L44

This results in allocating insufficient memory for the output tensor and in a write outside the bounds of the output array:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/reference_ops.h#L2625-L2631

This usually results in a segmentation fault, but depending on runtime conditions it can provide for a write gadget to be used in future memory corruption-based exploits.

### Patches
We have patched the issue in 204945b and will release patch releases for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that the segment ids are sorted, although this only handles the case when the segment ids are stored statically in the model.

A similar validation could be done if the segment ids are generated at runtime between inference steps.

If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by members of the Aivul Team from Qihoo 360.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Malicious Package in coinstirng
Advisory: GHSA-ff6g-gm92-rf32 ()
Published: 2020-09-03T19:42:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: coinstirng, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in another-date-range-picker
Advisory: GHSA-8rxg-9g6f-vq9p ()
Published: 2020-09-01T19:46:01Z

Version 4.1.48 of `another-date-range-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 4.1.48 of this module is found installed you will want to replace it with a version before or after 4.1.48. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/
Affected packages:
package: ecosystem: npm, name: another-date-range-picker, versions: 4.1.48
Malicious Package in radicjs
Advisory: GHSA-56r9-v65c-34jm ()
Published: 2020-09-03T02:33:37Z

Version 0.2.1 of `radicjs` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised. Users may downgrade to 0.2.0

Affected packages:
package: ecosystem: npm, name: radicjs, versions: 0.2.1
Prototype Pollution in sahmat
Advisory: GHSA-83pq-466j-fc6j ()
Published: 2020-09-04T15:17:50Z

All versions of `sahmat ` are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: sahmat, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in wepack-cli
Advisory: GHSA-fpw3-x4xq-6vxq ()
Published: 2020-09-02T18:32:13Z

All versions of `wepack-cli` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: wepack-cli, ranges: type: ECOSYSTEM, events: introduced: 0
Authentication Bypass in otpauth
Advisory: GHSA-rmmc-8cqj-hfp3 ()
Published: 2020-09-03T18:24:43Z

Versions of `otpauth` prior to 3.2.8 are vulnerable to Authentication Bypass. The package's `totp.validate()` function may return positive values for single digit tokens even if they are invalid. This may allow attackers to bypass the OTP authentication by providing single digit tokens.


## Recommendation

Upgrade to version 3.2.8 or later.

Affected packages:
package: ecosystem: npm, name: otpauth, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.8
Directory Traversal in featurebook
Advisory: GHSA-7x92-2j68-h32c ()
Published: 2020-09-01T19:03:02Z

Affected versions of `featurebook` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

The `featurebook` package is not intended to be run in production code nor to be exposed to an untrusted network.


## Proof of Concept
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No direct patch is currently available.

At this time, the best mitigation is to ensure that `featurebook` is not running in production or exposed to an untrusted network.

Affected packages:
package: ecosystem: npm, name: featurebook, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in require-port
Advisory: GHSA-rrvm-gqq8-q2wx ()
Published: 2020-09-03T21:05:26Z

Version 1.0.0 of `require-port` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: require-port, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in http-live-simulator
Advisory: GHSA-xgp2-cc4r-7vf6 ()
Published: 2020-09-03T20:44:21Z

Versions of `http-live-simulator` prior to 1.0.8 are vulnerable to Denial of Service. The package fails to catch an exception that causes the Node process to crash, effectively shutting down the server. This allows an attacker to send an HTTP request that crashes the server.


## Recommendation

Upgrade to version 1.0.8 or later.

Affected packages:
package: ecosystem: npm, name: http-live-simulator, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.8
Prototype Pollution in safe-object2
Advisory: GHSA-qccf-q7p4-3q3j ()
Published: 2020-09-04T15:16:42Z

All versions of `safe-object2` are vulnerable to prototype pollution. The `settter()` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: safe-object2, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Sandbox Breakout / Arbitrary Code Execution in pitboss-ng
Advisory: GHSA-3gpc-w23c-w59w ()
Published: 2020-09-04T15:02:06Z

All versions of `pitboss-ng` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.
  
## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: pitboss-ng, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0
Malicious Package in hdeky
Advisory: GHSA-255r-pghp-r5wh ()
Published: 2020-09-03T17:05:34Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: hdeky, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in coinstrng
Advisory: GHSA-hj5w-xgw9-w4rj ()
Published: 2020-09-03T19:41:44Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: coinstrng, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in yjmyjmyjm
Advisory: GHSA-g376-whg7-896m ()
Published: 2020-09-01T18:45:53Z

Affected versions of `yjmyjmyjm` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

Example request:
```
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: yjmyjmyjm, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in wintiwebdev
Advisory: GHSA-g5m5-v5cp-5p7m (CVE-2017-16181)
Published: 2020-09-01T18:50:16Z

Affected versions of `wintiwebdev` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: wintiwebdev, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Path Traversal in express-cart
Advisory: GHSA-8h8v-6qqm-fwpq ()
Published: 2020-09-01T21:06:38Z

Versions of `express-cart` before 1.1.7 are vulnerable to Path Traversal.


## Recommendation

Update to version 1.1.7 or later.

Affected packages:
package: ecosystem: npm, name: express-cart, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.7, database_specific: last_known_affected_version_range: <= 1.1.5
Prototype Pollution in merge-objects
Advisory: GHSA-992f-wf4w-x36v ()
Published: 2020-09-01T21:16:13Z

All versions of `merge-objects` are vulnerable to Prototype Pollution.


## Recommendation

No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.

Affected packages:
package: ecosystem: npm, name: merge-objects, ranges: type: ECOSYSTEM, events: introduced: 0.0.0