aswin1906/github-advisory-2020.csv huggingface dataset:
Potential Command Injection in libnotify
Advisory: GHSA-6898-wx94-8jq8 (CVE-2013-7381)
Published: 2020-08-31T22:50:48Z

Versions 1.0.3 and earlier of libnotify are affected by a shell command injection vulnerability. This may result in execution of arbitrary shell commands, if user input is passed into libnotify.notify.

Untrusted input passed in the call to libnotify.notify could result in execution of shell commands. Callers may be unaware of this.

### Example
```js
var libnotify = require('libnotify')
libnotify.notify('UNTRUSTED INPUT', { title: \"\" }, function () {
    console.log(arguments);
})
```

Special thanks to Neal Poole for submitting the pull request to fix this issue.


## Recommendation

Update to version 1.0.4 or greater

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: libnotify, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.4, database_specific: last_known_affected_version_range: <= 1.0.3
API Admin Auth Weakness in tomato
Advisory: GHSA-9vxc-g2jx-qj3p (CVE-2013-7379)
Published: 2020-08-31T22:59:07Z

Versions of `tomato` prior to 0.0.6 are affected by a somewhat complex authentication bypass vulnerability in the admin service when only a single access key is configured on the server. The vulnerability allows an attacker to guess the password for the admin service, no matter how complex that password is, in less than 200 requests.


## Details
The tomato API has an admin service that is enabled by setting up an `access_key` in the config options. This `access_key` is intended to protect the API admin from unauthorized access.


Tomato verifies the `access_key` by checking to see if the server `access_key` incorporates the user provided value at any location. This allows an attacker to provide a single character as an `access_key`, and so long as the server key contains at least one instance of that character it will be considered a valid key.

## Proof of Concept
This is the snippet of code that does the comparison to authorize requests.

```
if (access_key && config.master.api.access_key.indexOf(access_key) !== -1) {
```

For an access_key that is set to anything that includes the letter 'a' the following request would be authorized.

```
$ curl -X POST "http://localhost:8081/api/exec" -H "Content-Type: application/json" -d @test -H "access-key: a"
{
 "cmd": "ls",
 "path": ".",
 "stdout": "app.js\nconfig.js\nlog\nnode_modules\nserver.js\n",
 "stderr": ""
}
```



## Recommendation

Update to version 0.0.6 or later.

Affected packages:
package: ecosystem: npm, name: tomato, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.0.6, database_specific: last_known_affected_version_range: <= 0.0.5
Content Injection in remarkable
Advisory: GHSA-f9vc-q3hh-qhfv (CVE-2014-10065)
Published: 2020-08-31T22:56:00Z

Versions 1.4.0 and earlier of `remarkable` are affected by a cross-site scripting vulnerability. This occurs because vulnerable versions of `remarkable` did not properly whitelist link protocols, and consequently allowed `javascript:` to be used. 


### Proof of Concept

Markdown Source:
```
[link](<javascript:alert(1)>)
```

Rendered HTML:
```
<a href="javascript:alert(1)">link</a>
```


## Recommendation

Update to version 1.4.1 or later

Affected packages:
package: ecosystem: npm, name: remarkable, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.1
Server-Side Request Forgery in @uppy/companion
Advisory: GHSA-9m4x-8w29-r78g (CVE-2020-8205)
Published: 2020-08-13T18:54:19Z

The @uppy/companion npm package before versions 1.13.2 and 2.0.0-alpha.5 is vulnerable to a Server-Side Request Forgery (SSRF) vulnerability, which allows an attacker to scan local or external networks or otherwise interact with internal systems.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: @uppy/companion, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.13.2
package: ecosystem: npm, name: @uppy/companion, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.0.0-alpha.0
fixed: 2.0.0-alpha.5, database_specific: last_known_affected_version_range: <= 2.0.0-alpha.4
Cross Site Scripting and RCE in baserCMS
Advisory: GHSA-673x-f5wx-fxpw (CVE-2020-15159)
Published: 2020-08-28T21:45:15Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE).

* Impact: XSS to RCE via Arbitrary file upload.
* Attack vector is: Administrator must be logged in.
* Components are: ThemeFilesController.php, UploaderFilesController.php.
* Tested baserCMS Version : 4.3.6 (Latest)
* Affected baserCMS Version : 4.2.0 ~ 4.3.6 (XSS), 3.0.10 ~ 4.3.6 (RCE)
* Patches : https://basercms.net/security/20200827

Found by Vulnerability Research team in [Flatt Security Inc.](https://flatt.tech/)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: baserproject/basercms, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.7, database_specific: last_known_affected_version_range: <= 4.3.6
Open Redirect in ecstatic
Advisory: GHSA-x4rf-4mqf-cm8w ()
Published: 2020-08-19T22:44:22Z
Withdrawn: 2020-08-19T22:44:22Z

Withdrawn: Duplicate of GHSA-9q64-mpxx-87fg

Affected packages:
package: ecosystem: npm, name: ecstatic, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.2
package: ecosystem: npm, name: ecstatic, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.3.2
package: ecosystem: npm, name: ecstatic, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.1.2
Missing Origin Validation in parcel-bundler
Advisory: GHSA-5j4m-89xf-mf5p ()
Published: 2020-08-27T22:58:46Z
Withdrawn: 2020-08-27T22:58:46Z

Withdrawn: Duplicate of GHSA-37q6-576q-vgr7

Affected packages:
package: ecosystem: npm, name: parcel-bundler, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.0
Stored XSS in October
Advisory: GHSA-w4pj-7p68-3vgv (CVE-2020-11083)
Published: 2020-08-05T14:52:44Z

### Impact
A user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field.

### Patches
Issue has been patched in Build 466 (v1.0.466) & RainLab.Blog v1.4.1 by restricting the ability to store JS in markdown to only users that have been explicitly granted the `backend.allow_unsafe_markdown` permission.

### Workarounds
Apply https://github.com/octobercms/october/commit/9ecfb4867baae14a0d3f99f5b5c1e8a979ae8746 & https://github.com/rainlab/blog-plugin/commit/6ae19a6e16ef3ba730692bc899851342c858bb94 to your installation manually if unable to upgrade to Build 466 or v1.4.1 of RainLab.Blog (if using that plugin).

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1100" alt="Screen Shot 2020-03-31 at 2 01 52 PM" src="https://user-images.githubusercontent.com/7253840/78070158-8f7ef580-7358-11ea-950c-226533f6a0a3.png">

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: october/backend, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.466
Insecure serialization leading to RCE in serialize-javascript
Advisory: GHSA-hxcc-f52p-wc94 (CVE-2020-7660)
Published: 2020-08-11T17:21:13Z

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js". 

An object such as `{"foo": /1"/, "bar": "a\"@__R-<UID>-0__@"}` was serialized as `{"foo": /1"/, "bar": "a\/1"/}`, which allows an attacker to escape the `bar` key. This requires the attacker to control the values of both `foo` and `bar` and guess the value of `<UID>`. The UID has a keyspace of approximately 4 billion making it a realistic network attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: serialize-javascript, ecosystem_specific: affected_functions: serialize-javascript, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.0
Unintended read access in kramdown gem
Advisory: GHSA-mqm2-cgpr-p4m6 (CVE-2020-14001)
Published: 2020-08-07T22:27:41Z

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: RubyGems, name: kramdown, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.0
Cross Site Scripting(XSS) Vulnerability in Latest Release 4.3.6 Site basic settings
Advisory: GHSA-4r3m-j6x5-48m3 (CVE-2020-15155)
Published: 2020-08-28T21:20:42Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components is toolbar.php. The issue is fixed in version 4.3.7.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: baserproject/basercms, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.7, database_specific: last_known_affected_version_range: <= 4.3.6
Remote Code Execution in Red Discord Bot
Advisory: GHSA-7257-96vg-qf6x (CVE-2020-15147)
Published: 2020-08-21T17:03:24Z

### Impact
A RCE exploit has been discovered in the Streams module: this exploit allows Discord users with specifically crafted "going live" messages to inject code into the Streams module's going live message. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information.

### Patches
This critical exploit has been fixed on version ``3.3.12`` & ``3.4``.

### Workarounds
Unloading the Streams module with ``unload streams`` can render this exploit not accessible. We still highly recommend updating to ``3.3.12`` or ``3.4`` to completely patch this issue.

### References
* https://github.com/Cog-Creators/Red-DiscordBot/pull/4183

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)
* Over on our [Discord server](https://discord.gg/red)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: Red-DiscordBot, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.3.12, database_specific: last_known_affected_version_range: <= 3.3.11
Remote Code Execution in SyliusResourceBundle
Advisory: GHSA-h6m7-j4h3-9rf5 (CVE-2020-15146)
Published: 2020-08-19T19:52:30Z

### Impact

Request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: `<=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3`.

### Example

```yaml
sylius_grid:
    grids:
        foo:
            fields:
                bar:
                    options:
                        baz: "expr:service('sylius.repository.product').find($id)"
```

In this case, `$id` can be prepared in a way that calls other services. 

If you visit `/route?id="~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"`, it will result in a following expression `expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"")`, which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

### Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

### Workarounds

The fix requires adding `addslashes` in `OptionsParser::parseOptionExpression` to sanitize user input before evaluating it using the expression language.

```php
- return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+ return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
```

### Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.14
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.4.0
fixed: 1.4.7
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.5.0
fixed: 1.5.2
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.6.0
fixed: 1.6.4
Field Test CSRF vulnerability
Advisory: GHSA-w542-cpp9-r3g7 (CVE-2020-16252)
Published: 2020-08-05T14:53:34Z

The Field Test dashboard is vulnerable to cross-site request forgery (CSRF) with non-session based authentication methods in versions v0.2.0 through v0.3.2.

## Impact
The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods, like basic authentication. Session-based authentication methods (like Devise's default authentication) are not affected.

A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, a single endpoint is affected, which allows for changing the variant assigned to a user.

All users running an affected release should upgrade immediately.

## Technical Details
Field Test uses the `protect_from_forgery` method from Rails to prevent CSRF. However, this defaults to `:null_session`, which has no effect on non-session based authentication methods. This has been changed to `protect_from_forgery with: :exception`.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: RubyGems, name: field_test, ranges: type: ECOSYSTEM, events: introduced: 0.2.0
fixed: 0.4.0, database_specific: last_known_affected_version_range: <= 0.3.2
Incorrect threshold signature computation in TUF
Advisory: GHSA-pwqf-9h7j-7mv8 (CVE-2020-6174)
Published: 2020-08-21T16:25:26Z

### Impact
Metadadata signature verification, as used in `tuf.client.updater`, counted each of multiple signatures with identical authorized keyids  separately towards the threshold. Therefore, an attacker with access to a valid signing key could create multiple valid signatures in order to meet the minimum threshold of keys before the metadata was considered valid.

The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.

### Patches
A [fix](https://github.com/theupdateframework/tuf/pull/974) is available in version [0.12.2](https://github.com/theupdateframework/tuf/releases/tag/v0.12.2) or newer.

### Workarounds
No workarounds are known for this issue.

### References
* [CVE-2020-6174](https://nvd.nist.gov/vuln/detail/CVE-2020-6174)
* Pull request resolving the issue [PR 974](https://github.com/theupdateframework/tuf/pull/974)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: tuf, ecosystem_specific: affected_functions: tuf.sig.verify, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.12.2
Denial of service in fastify
Advisory: GHSA-xw5p-hw6r-2j98 (CVE-2020-8192)
Published: 2020-08-05T14:53:22Z

A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.

Affected packages:
package: ecosystem: npm, name: fastify, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.15.1
Regular Expression Denial of Service in is-my-json-valid
Advisory: GHSA-4x7c-cx64-49w8 ()
Published: 2020-08-19T22:06:03Z
Withdrawn: 2020-08-19T22:06:03Z

Withdrawn: Duplicate of GHSA-f522-ffg8-j8r6

Affected packages:
package: ecosystem: npm, name: is-my-json-valid, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.17.2
package: ecosystem: npm, name: is-my-json-valid, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.1
CSRF vulnerability in save-server
Advisory: GHSA-wwrj-35w6-77ff (CVE-2020-15135)
Published: 2020-08-04T14:54:08Z

### Impact
Versions prior to version v1.05 are affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version v1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version.

This is patched by implementing [Double submit](https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f).

The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including:
- Upload file
- Delete file
- Add redirect


#### If you are logged in as root, this attack is significantly more severe. They can (in addition to the above):
- Create users
- Delete users
- Update users (change password)

If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password.

Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. 
### Patches
This issue has been patched. Update to version v1.0.7 or above to benefit from this fix.

### Workarounds
None. You should upgrade.

### References
What is CSRF: https://owasp.org/www-community/attacks/csrf
Fix type: https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Save-server](https://github.com/Neztore/save-server/)
* Email us at [hi@nezto.re](mailto:hi@nezto.re)
* Join our discord (preferred): [Invite](https://discord.gg/QevWabU) 

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
Affected packages:
package: ecosystem: npm, name: save-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.7, database_specific: last_known_affected_version_range: < 1.0.5
Reliance on Cookies without validation in OctoberCMS
Advisory: GHSA-55mm-5399-7r63 (CVE-2020-15128)
Published: 2020-08-05T14:52:54Z

### Impact
Previously encrypted cookie values were not tied to the name of the cookie the value belonged to. This meant that certain classes of attacks that took advantage of other theoretical vulnerabilities in user facing code (nothing exploitable in the core project itself) had a higher chance of succeeding. 

Specifically, if your usage exposed a way for users to provide unfiltered user input and have it returned to them as an encrypted cookie (ex. storing a user provided search query in a cookie) they could then use the generated cookie in place of other more tightly controlled cookies; or if your usage exposed the plaintext version of an encrypted cookie at any point to the user they could theoretically provide encrypted content from your application back to it as an encrypted cookie and force the framework to decrypt it for them. 

### Patches
Issue has been patched in Build 468 (v1.0.468).

>**NOTE**: If you are using the cookie session driver, all of your session data will be invalidated. All other session drivers should smoothly upgrade to the changes (although the backend authentication persist cookie will also be invalidated requiring users to login again once their current session expires).

### Workarounds
Apply https://github.com/octobercms/library/commit/28310d4fb336a1741b39498f4474497644a6875c to your installation manually if unable to upgrade to Build 468.

### References
- https://blog.laravel.com/laravel-cookie-security-releases
- https://github.com/laravel/framework/compare/4c7d118181d6c7f1f883643702df807ced016c5e...a731824421f9ebc586728ea9c7cff231a249aaa9

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Low given that it is not directly exploitable within the core but requires other security vulnerabilities within the application to have an effect and the severity of its effect depends entirely on the severity of those other holes in the application's defences.

### Acknowledgements

Thanks to [Takashi Terada of Mitsui Bussan Secure Directions, Inc.](https://www.linkedin.com/in/takeshi-terada-b570a6100/) for finding the original issue in Laravel and @taylorotwell for sharing the report with the October CMS team.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: october/rain, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.468
Cross-site scripting vulnerability in TinyMCE
Advisory: GHSA-vrv8-v4w8-f95h (CVE-2020-12648)
Published: 2020-08-11T14:55:01Z

### Impact
A cross-site scripting (XSS) vulnerability was discovered in the core parser. The vulnerability allowed arbitrary JavaScript execution when inserting a specially crafted piece of content into the editor via the clipboard or APIs. This impacts all users who are using TinyMCE 4.9.10 or lower and TinyMCE 5.4.0 or lower.

### Patches
This vulnerability has been patched in TinyMCE 4.9.11 and 5.4.1 by improved HTML parsing and sanitization logic.

### Workarounds
The workarounds available are:
- upgrade to either TinyMCE 4.9.11 or TinyMCE 5.4.1
or
- enable the media plugin, which overrides the default parsing behaviour for iframes
or
- add the following workaround to update the parsing schema rules for iframes:

#### Example: Change the default schema for iframes
```js
setup: function(editor) {
  editor.on('PreInit', function() {
    editor.schema.getSpecialElements()['iframe'] = /</iframe[^>]*>/gi;
  });
}
```

### Acknowledgements
Tiny Technologies would like to thank George Steketee and Chris Davis at [Bishop Fox](https://www.bishopfox.com/) for discovering this vulnerability.

### References
https://www.tiny.cloud/docs/release-notes/release-notes54/#securityfixes

### For more information
If you have any questions or comments about this advisory:
* Open an issue in the [TinyMCE repo](https://github.com/tinymce/tinymce/issues)
* Email us at [infosec@tiny.cloud](mailto:infosec@tiny.cloud)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: tinymce, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.9.11
package: ecosystem: npm, name: tinymce, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.4.1
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Advisory: GHSA-69p9-9qm9-h447 ()
Published: 2020-08-19T22:34:43Z
Withdrawn: 2020-08-19T22:34:43Z

Withdrawn: Duplicate of GHSA-hgch-jjmr-gp7w

Affected packages:
package: ecosystem: npm, name: safer-eval, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.2
Ability to change order address without triggering address validations in solidus
Advisory: GHSA-3mvg-rrrw-m7ph (CVE-2020-15109)
Published: 2020-08-04T22:17:57Z

### Impact

This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment.

All stores with at least two shipping zones and different costs of shipment per zone are impacted. 

E.g.
1. Store admin configured the store so that there are two zones in US:
-  East Cost Zone - Shipping Method cost: $1
- West Cost Zone - Shipping Method cost: $10

The attacker user can know that shipping to NY is less expensive than to LA just by testing different addresses in checkout.

2. The attacker user enters any NY shipping address in the address step
3. The attacker user chooses the $1 delivery option
4. The attacker user crafts a request with their real LA address, similar to:

```
// POST #checkout/update:

{
  state: 'payment',
  order: {
    ship_address_attributes: {
      city: 'Los Angeles',
      ...
    }
  }
}
```
5. The attacker user proceeds with checking out with a new address and the $1 shipment costs.

Another scenario where this could be dangerous is:

> You cannot ship products in some zones and you are relying on Solidus Shipping Method building only to filter out unwanted zones. Malicious users can enter an allowed zone's address and change back to an unwanted one in the payment step by crafting a request with some proper ship_address_attributes.

This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted.

### Patches

A PR has been attached to fix the security concern for each of all the Solidus supported versions following the rules of the [Solidus Security Policy](https://solidus.io/security).

### Workarounds

When it's not possible to upgrade to a supported patched version, please use this gist to patch the store:

https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: RubyGems, name: solidus_frontend, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.6
package: ecosystem: RubyGems, name: solidus_frontend, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.6
package: ecosystem: RubyGems, name: solidus_frontend, ranges: type: ECOSYSTEM, events: introduced: 2.10.0
fixed: 2.10.2
package: ecosystem: RubyGems, name: solidus_api, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.6
package: ecosystem: RubyGems, name: solidus_api, ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.6
package: ecosystem: RubyGems, name: solidus_api, ranges: type: ECOSYSTEM, events: introduced: 2.10.0
fixed: 2.10.2
Remote Code Execution in Red Discord Bot
Advisory: GHSA-55j9-849x-26h4 (CVE-2020-15140)
Published: 2020-08-21T16:30:52Z

### Impact
A RCE exploit has been discovered in the Trivia module: this exploit allows Discord users with specifically crafted usernames to inject code into the Trivia module's leaderboard command. By abusing this exploit, it's possible to perform destructive actions and/or access sensitive information.

### Patches
This critical exploit has been fixed on version 3.3.11.

### Workarounds
Unloading the Trivia module with ``unload trivia`` can render this exploit not accessible. We still highly recommend updating to 3.3.11 to completely patch this issue.

### References
https://github.com/Cog-Creators/Red-DiscordBot/pull/4175

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Cog-Creators/Red-DiscordBot](https://github.com/Cog-Creators/Red-DiscordBot)
* Over on our [Discord server](https://discord.gg/red)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: Red-DiscordBot, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.3.11
Heap Based Buffer Overflow in libyaml
Advisory: GHSA-m75h-cghq-c8h5 (CVE-2013-6393)
Published: 2020-08-31T22:51:50Z

Versions 0.2.2 and earlier depend on native libyaml version 0.1.5 or earlier. As such, they are affected by a heap-based buffer overflow vulnerability that may result in a crash or arbitrary code execution when parsing YAML tags.





## Recommendation

- Update to version 0.2.3 that includes a version of LibYAML that contains a fix for this issue.

Affected packages:
package: ecosystem: npm, name: libyaml, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.3
Cross-Site Scripting in @novnc/novnc
Advisory: GHSA-49rv-g7w5-m8xx (CVE-2017-18635)
Published: 2020-08-28T21:24:59Z

Versions of `@novnc/novnc` prior to 0.6.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to validate input from the remote VNC server such as the VNC server name. This allows an attacker in control of the remote server to execute arbitrary JavaScript in the noVNC web page. It affects any users of `include/ui.js` and users of `vnc_auto.html` and `vnc.html`.


## Recommendation

Upgrade to version 0.6.2 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: @novnc/novnc, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.6.2
Validation Bypass in paypal-ipn
Advisory: GHSA-h698-r4hm-w94p (CVE-2014-10067)
Published: 2020-08-31T22:54:56Z

Versions 2.x.x and earlier of `paypal-ipn` are affected by a validation bypass vulnerability. 

paypal-ipn uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the production PayPal site or the sandbox.

A motivated attacker could craft a request string using the simulator to fool the application into entering the sandbox mode, potentially allowing purchases without valid payment.


## Recommendation

Upgrade to version 3.0.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: paypal-ipn, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.0
Code execution in Spring Integration
Advisory: GHSA-86qr-9vqc-pgc6 (CVE-2020-5413)
Published: 2020-08-05T14:53:06Z

Spring Integration framework provides Kryo Codec implementations as an alternative for Java (de)serialization. When Kryo is configured with default options, all unregistered classes are resolved on demand. This leads to the "deserialization gadgets" exploit when provided data contains malicious code for execution during deserialization. In order to protect against this type of attack, Kryo can be configured to require a set of trusted classes for (de)serialization. Spring Integration should be proactive against blocking unknown "deserialization gadgets" when configuring Kryo in code.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.springframework.integration:spring-integration-core, ranges: type: ECOSYSTEM, events: introduced: 4.3.0
fixed: 4.3.23
package: ecosystem: Maven, name: org.springframework.integration:spring-integration-core, ranges: type: ECOSYSTEM, events: introduced: 5.3.0
fixed: 5.3.2
package: ecosystem: Maven, name: org.springframework.integration:spring-integration-core, ranges: type: ECOSYSTEM, events: introduced: 5.1.0
fixed: 5.1.12
package: ecosystem: Maven, name: org.springframework.integration:spring-integration-core, ranges: type: ECOSYSTEM, events: introduced: 5.2.0
fixed: 5.2.8
Client Denial of Service on TUF
Advisory: GHSA-2828-9vh6-9m6j (CVE-2020-6173)
Published: 2020-08-21T16:25:48Z

### Impact
An attacker who can gain file access to the repository and modify metadata files may cause a denial of service to clients by creating many invalid signatures on a metadata file. Having a large number of signatures to verify will delay the moment when the client will determine the signature is not valid. This delay may be for at least a few minutes, but possibly could be longer especially if multiple files are impacted.

The tuf maintainers would like to thank Erik MacLean of Analog Devices, Inc. for reporting this issue.

### Patches
No fix exists for this issue. 

### Workarounds
No workarounds are known for this issue.

### References
* [CVE-2020-6173](https://nvd.nist.gov/vuln/detail/CVE-2020-6173)
* [Issue #973](https://github.com/theupdateframework/tuf/issues/973)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: PyPI, name: tuf, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.13.0
Path Traversal in openapi-python-client
Advisory: GHSA-7wgr-7666-7pwj (CVE-2020-15141)
Published: 2020-08-20T14:38:13Z

### Impact
Path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk.

Giving this a CVSS score of 3.0 (Low) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N/E:P/RL:U/RC:C

### Patches
A fix is being worked on for version 0.5.3

### Workarounds
Inspect OpenAPI documents before generating clients for them.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [openapi-python-client](https://github.com/triaxtec/openapi-python-client/issues)
* Email us at [danthony@triaxtec.com](mailto:danthony@triaxtec.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: openapi-python-client, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.5.3
Observable Timing Discrepancy in OpenMage LTS
Advisory: GHSA-crf2-xm6x-46p6 (CVE-2020-15151)
Published: 2020-08-19T18:02:36Z

### Impact
This vulnerability allows to circumvent the **formkey protection** in the Admin Interface and increases the attack surface for  **Cross Site Request Forgery** attacks 

### Patches
The latest OpenMage Versions up from 19.4.6 and 20.0.2 have this Issue solved


### References
Related to Adobes CVE-2020-9690 ( https://helpx.adobe.com/security/products/magento/apsb20-47.html )
fixed in Magento2 https://github.com/magento/magento2/commit/52d72b8010c9cecb5b8e3d98ec5edc1ddcc65fb4
as part of 2.4.0/2.3.5-p2

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: openmage/magento-lts, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 19.4.6
package: ecosystem: Packagist, name: openmage/magento-lts, ranges: type: ECOSYSTEM, events: introduced: 20.0.0
fixed: 20.0.2
Cross-Site Scripting in dompurify
Advisory: GHSA-chqj-j4fh-rw7m (CVE-2019-16728)
Published: 2020-08-28T21:25:11Z

Versions of `dompurify` prior to 2.0.3 are vulnerable to Cross-Site Scripting (XSS). The package has an XSS filter bypass due to Mutation XSS in both Chrome and Safari through a combination of `<svg>`/`<math>` elements and `</p>`/`</br>`. An example payload is: `<svg></p><style><a id="</style><img src=1 onerror=alert(1)>">`. This allows attackers to bypass the XSS protection and execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 2.0.3 or later. You may also disallow `<svg>` and `<math>` through `dompurify` configurations:
```DOMPurify.sanitize(input, {
     FORBID_TAGS: ['svg', 'math']
 });```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: dompurify, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.3
Reset Password / Login vulnerability in Sulu
Advisory: GHSA-wfm4-pq59-wg6r (CVE-2020-15132)
Published: 2020-08-05T21:27:44Z

### Impact

_What kind of vulnerability is it? Who is impacted?_

This vulnerability consists of a few related issues:

#### Forget password leaks information if the user exists

When the "Forget password" feature on the login screen is used, Sulu asks the user for a username or email address. If the given string is not found, a response with a `400` error code is returned, along with a error message saying that this user name does not exist:

```json
{
    "code": 0,
    "message": "Entity with the type \u0022Sulu\\Bundle\\SecurityBundle\\Entity\\User\u0022 and the id \u0022asdf\u0022 not found."
}
```

This enables attackers to retrieve valid usernames.

#### Forgot password leaks user email if user exists

The response of the "Forgot Password" request returns the email address to which the email was sent, if the operation was successful:

```json
{"email":"admin@localhost.local"}
```

This information should not be exposed, as it can be used to gather email addresses.

#### Response time of login gives hint if the username exists

If the username the user enters in the login screen does not exists, the request responds much faster than if the username exists. This again allows attackers to retrieve valid usernames.

#### Reset Token for Forgot Password feature is not hashed

The reset token in the user database table is not hashed. That means that somebody could try to request a new password using the Forgot Password feature, and look that up in the database, if the attacker somehow got access to the database. Hashing the reset token would fix that problem.

### Patches

This problem was fixed in Release 1.6.34, 2.0.10 and 2.1.1.

### Workarounds

Override the files manually in your project and change them accordingly.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: sulu/sulu, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.6.34
package: ecosystem: Packagist, name: sulu/sulu, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.10
package: ecosystem: Packagist, name: sulu/sulu, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.1
Cross-Site Scripting in highcharts
Advisory: GHSA-gr4j-r575-g665 ()
Published: 2020-08-25T14:04:47Z

Versions of `highcharts` prior to 7.2.2 or 8.1.1 are vulnerable to Cross-Site Scripting (XSS).  The package fails to sanitize `href` values and does not restrict URL schemes, allowing attackers to execute arbitrary JavaScript in a victim's browser if they click the link.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N/
Affected packages:
package: ecosystem: npm, name: highcharts, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.2.2
package: ecosystem: npm, name: highcharts, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.1.1
PgHero gem allows CSRF
Advisory: GHSA-v6fx-752r-ccp2 (CVE-2020-16253)
Published: 2020-08-05T14:53:43Z

The PgHero gem through 2.6.0 for Ruby allows CSRF. PgHero normally uses the `protect_from_forgery` method from Rails to prevent CSRF. However, this defaults to `:null_session`, which has no effect on non-session based authentication methods. Thus the ruby gem is vulnerable with non-session based authentication methods like basic authentication.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Affected packages:
package: ecosystem: RubyGems, name: pghero, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.7.0
Yarn Improper link resolution before file access (Link Following)
Advisory: GHSA-5xf4-f2fq-f69j (CVE-2019-10773)
Published: 2020-02-14T23:10:16Z

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: yarn, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.22.0, database_specific: last_known_affected_version_range: <= 1.21.1
Improper Input Validation in Apache Solr
Advisory: GHSA-ww97-9w65-2crx (CVE-2019-17558)
Published: 2020-02-12T18:45:28Z

Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.solr:solr-core, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 8.4.0, database_specific: last_known_affected_version_range: <= 5.5.5
package: ecosystem: Maven, name: org.apache.solr:solr-core, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 8.4.0, database_specific: last_known_affected_version_range: <= 6.6.6
package: ecosystem: Maven, name: org.apache.solr:solr-core, ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 8.4.0, database_specific: last_known_affected_version_range: <= 7.7.2
package: ecosystem: Maven, name: org.apache.solr:solr-core, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.4.0, database_specific: last_known_affected_version_range: <= 8.3.1
XSS in Bleach when noscript and raw tag whitelisted
Advisory: GHSA-q65m-pv3f-wr5r (CVE-2020-6802)
Published: 2020-02-24T17:33:44Z

### Impact

A [mutation XSS](https://cure53.de/fp170.pdf) affects users calling `bleach.clean` with `noscript` and a raw tag (see below) in the allowed/whitelisted tags option.

### Patches

v3.1.1

### Workarounds

* modify `bleach.clean` calls to not whitelist `noscript` and one or more of the following raw tags:

```
title
textarea
script
style
noembed
noframes
iframe
xmp
```

* A strong [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) without `unsafe-inline` and `unsafe-eval` [`script-src`s](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src)) will also help mitigate the risk.

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1615315
* https://cure53.de/fp170.pdf
* https://nvd.nist.gov/vuln/detail/CVE-2020-6802
* https://www.checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach

### Credits

* Reported by [Yaniv Nizry](https://twitter.com/ynizry) from the CxSCA AppSec group at Checkmarx

### For more information

If you have any questions or comments about this advisory:

* Open an issue at [https://github.com/mozilla/bleach/issues](https://github.com/mozilla/bleach/issues)
* Email us at [security@mozilla.org](mailto:security@mozilla.org)


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: bleach, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.1
HTTP Response Splitting in Puma
Advisory: GHSA-84j7-475p-hp8v (CVE-2020-5247)
Published: 2020-02-28T16:53:55Z

In Puma (RubyGem) before 4.3.2 and 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting.

While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS).

This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server.

This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters.  

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Affected packages:
package: ecosystem: RubyGems, name: puma, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.12.4, database_specific: last_known_affected_version_range: < 3.12.3
package: ecosystem: RubyGems, name: puma, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.3, database_specific: last_known_affected_version_range: < 4.3.2
codecov NPM module allows remote attackers to execute arbitrary commands
Advisory: GHSA-5q88-cjfq-g2mh (CVE-2020-7597)
Published: 2020-02-19T17:29:39Z

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: codecov, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.6.5
Potential HTTP request smuggling in Apache Tomcat
Advisory: GHSA-767j-jfh2-jvrc (CVE-2019-17569)
Published: 2020-02-28T01:10:58Z

The refactoring present in Apache Tomcat versions 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Encoding headers were incorrectly processed leading to a possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. Such a reverse proxy is considered unlikely.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 7.0.98
fixed: 7.0.100
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 8.5.48
fixed: 8.5.51
package: ecosystem: Maven, name: org.apache.tomcat.embed:tomcat-embed-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.28
fixed: 9.0.31
package: ecosystem: Maven, name: org.apache.tomcat:tomcat, ranges: type: ECOSYSTEM, events: introduced: 7.0.98
fixed: 7.0.100
package: ecosystem: Maven, name: org.apache.tomcat:tomcat, ranges: type: ECOSYSTEM, events: introduced: 8.5.48
fixed: 8.5.51
package: ecosystem: Maven, name: org.apache.tomcat:tomcat, ranges: type: ECOSYSTEM, events: introduced: 9.0.28
fixed: 9.0.31
Deserialization of Untrusted Data in Apache Olingo
Advisory: GHSA-gj76-429m-56wc (CVE-2019-17556)
Published: 2020-02-04T22:38:22Z

Apache Olingo versions 4.0.0 to 4.6.0 provide the AbstractService class, which is public API, uses ObjectInputStream and doesn't check classes being deserialized. If an attacker can feed malicious metadata to the class, then it may result in running attacker's code in the worse case.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.olingo:odata-client-proxy, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.7.0, database_specific: last_known_affected_version_range: <= 4.6.0
HTTP Request Smuggling in Netty
Advisory: GHSA-ff2w-cq2g-wv5f (CVE-2020-7238)
Published: 2020-02-21T18:55:50Z

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: io.netty:netty-handler, ranges: type: ECOSYSTEM, events: introduced: 4.1.43
fixed: 4.1.45, database_specific: last_known_affected_version_range: <= 4.1.44