aswin1906/github-advisory-2020.csv huggingface dataset:
Ciphertext Malleability Issue in Tink Java
Advisory: GHSA-g5vf-v6wf-7w2r (CVE-2020-8929)
Published: 2020-10-16T00:51:24Z

### Impact
Tink's Java version before 1.5 under some circumstances allowed attackers to change the key ID part of the ciphertext, resulting in the attacker creating a second ciphertext that will decrypt to the same plaintext. This can be a problem in particular in the case of encrypting with a deterministic AEAD with a single key, and relying on the fact that there is only a single valid ciphertext per plaintext.

No loss of confidentiality or loss of plaintext integrity occurs due to this problem, only ciphertext integrity is compromised.

### Patches
The issue was fixed in this [pull request](https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899).

### Workarounds
The only workaround is to backport the fixing [pull request](https://github.com/google/tink/commit/93d839a5865b9d950dffdc9d0bc99b71280a8899).

### Details
Tink uses the first five bytes of a ciphertext for a version byte and a four byte key ID. Since each key has a well defined prefix, this extends non-malleability properties (but technically not indistinguishability). However, in the Java version this prefix lookup used a hash map indexed by unicode strings instead of the byte array, which means that invalid Unicode characters would be [replaced by U+FFFD](https://en.wikipedia.org/wiki/UTF-8#Invalid_sequences_and_error_handling) by the [Java API's default behavior](https://docs.oracle.com/javase/7/docs/api/java/lang/String.html#String(byte[],%20java.nio.charset.Charset)). This means several different values for the five bytes would result in the same hash table key, which allows an attacker to exchange one invalid byte sequence for another, creating a mutated ciphertext that still decrypts (to the same plaintext).

### Acknowledgements
We'd like to thank Peter Esbensen for finding this issue and raising it internally.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Tink](https://github.com/google/tink/issues)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: Maven, name: com.google.crypto.tink:tink, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.5.0
Prototype pollution in object-path
Advisory: GHSA-cwx2-736x-mf6w (CVE-2020-15256)
Published: 2020-10-19T20:55:55Z

### Impact
A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable.
 
### Patches
Upgrade to version >= 0.11.5

### Workarounds
Don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.

### References
[Read more about the prototype pollution vulnerability](https://codeburst.io/what-is-prototype-pollution-49482fc4b638)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [object-path](https://github.com/mariocasciaro/object-path)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Affected packages:
package: ecosystem: npm, name: object-path, ecosystem_specific: affected_functions: object-path.set, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.11.5
Environment Variable Injection in GitHub Actions
Advisory: GHSA-mfwh-5m23-j46w (CVE-2020-15228)
Published: 2020-10-01T17:16:20Z

### Impact
The `@actions/core` npm module `addPath` and `exportVariable` functions communicate with the Actions Runner over stdout by generating a string in a specific format. Workflows that log untrusted data to stdout may invoke these commands, resulting in the path or environment variables being modified without the intention of the workflow or action author. 

### Patches
The runner will release an update that disables the `set-env` and `add-path` workflow commands in the near future. For now, users should upgrade to `@actions/core v1.2.6` or later, and replace any instance of the `set-env` or `add-path` commands in their workflows with the new [Environment File Syntax](https://github.com/actions/toolkit/blob/main/docs/commands.md#environment-files). Workflows and actions using the old commands or older versions of the toolkit will start to warn, then error out during workflow execution.

### Workarounds
None, it is strongly suggested that you upgrade as soon as possible.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Actions Toolkit](https://github.com/actions/toolkit/issues)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: @actions/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.6
Heap buffer overflow in CefSharp
Advisory: GHSA-pv36-h7jh-qm62 (CVE-2020-15999)
Published: 2020-10-27T19:47:38Z

### Impact
A memory corruption bug(Heap overflow) in the FreeType font rendering library.

> This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .

As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/ 

Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.

### Patches
Upgrade to 85.3.130 or higher

### References
- https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/
- https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999
- https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942

To review the `CEF/Chromium` patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: NuGet, name: CefSharp.Common, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 85.3.130
package: ecosystem: NuGet, name: CefSharp.Wpf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 85.3.130
package: ecosystem: NuGet, name: CefSharp.WinForms, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 85.3.130
package: ecosystem: NuGet, name: CefSharp.Wpf.HwndHost, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 85.3.130
Improper Authorization in Strapi
Advisory: GHSA-4p55-xj37-fx7g (CVE-2020-27665)
Published: 2020-10-29T18:29:31Z

In Strapi before 3.2.5, there is no `admin::hasPermissions` restriction for CTB (aka content-type-builder) routes.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: strapi-plugin-content-type-builder, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.5
Potential access control security issue in apollo-adminservice
Advisory: GHSA-xpmx-h7xq-xffh (CVE-2020-15170)
Published: 2020-10-02T16:33:41Z

### Impact
If users expose apollo-adminservice to internet(which is not recommended), there are potential security issues since apollo-adminservice is designed to work in intranet and it doesn't have built-in access control. Malicious hackers may access apollo-adminservice apis directly to access/edit the application's configurations.

### Patches
Access control for admin service was added in #3233 and was released in [v1.7.1](https://github.com/ctripcorp/apollo/releases/tag/v1.7.1).

### Workarounds
To fix the potential issue without upgrading, simply follow the advice that do not expose apollo-adminservice to internet.

### Credits
[Lexu](https://github.com/lllllx) reported the issue and provided the required information to reproduce it.

### References
[Apollo Security Guidence](https://github.com/ctripcorp/apollo/wiki/Apollo%E4%BD%BF%E7%94%A8%E6%8C%87%E5%8D%97#71-%E5%AE%89%E5%85%A8%E7%9B%B8%E5%85%B3)

### For more information
If you have any questions or comments about this advisory:
* Open an [issue](https://github.com/ctripcorp/apollo/issues)
* Email to one of the active [project maintainers](https://github.com/ctripcorp/apollo/graphs/contributors)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Affected packages:
package: ecosystem: Maven, name: com.ctrip.framework.apollo:apollo-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.7.1
Cross-site Scripting in Joplin
Advisory: GHSA-6r7x-hc8m-985r (CVE-2020-9038)
Published: 2020-10-13T17:29:25Z

Joplin through 1.0.184 allows Arbitrary File Read via Cross-site Scripting (XSS).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: joplin, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.1
Regular Expression Denial of Service in npm-user-validate
Advisory: GHSA-xgh6-85xh-479p ()
Published: 2020-10-16T18:56:26Z

`npm-user-validate` before version `1.0.1` is vulnerable to a Regular Expression Denial of Service (REDos). The regex that validates user emails took exponentially longer to process long input strings beginning with `@` characters.

### Impact
The issue affects the `email` function. If you use this function to process arbitrary user input with no character limit the application may be susceptible to Denial of Service.

### Patches
The issue is patched in version 1.0.1 by improving the regular expression used and also enforcing a 254 character limit.

### Workarounds
Restrict the character length to a reasonable degree before passing a value to `.emal()`; Also, consider doing a more rigorous sanitizing/validation beforehand.

Affected packages:
package: ecosystem: npm, name: npm-user-validate, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.1, database_specific: last_known_affected_version_range: <= 1.0.0
Withdrawn: HTTP Request Smuggling in Agoo
Advisory: GHSA-h385-52j6-9984 (CVE-2020-7670)
Published: 2020-10-20T19:15:38Z
Withdrawn: 2021-01-13T19:25:43Z

# Withdrawn reason
Withdrawn on 1/13/2021 due to [this comment from the maintainer](https://github.com/ohler55/agoo/issues/88#issuecomment-723580783).  This is no longer considered a vulnerability.

# Original description
agoo through 2.12.3 allows request smuggling attacks where agoo is used as a backend and a frontend proxy also being vulnerable. It is possible to conduct HTTP request smuggling attacks by sending the Content-Length header twice. Furthermore, invalid Transfer Encoding headers were found to be parsed as valid which could be leveraged for TE:CL smuggling attacks.

Affected packages:
package: ecosystem: RubyGems, name: agoo, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 2.13.0
Arbitrary Code Execution in blazar-dashboard
Advisory: GHSA-939m-4xpw-v34v (CVE-2020-26943)
Published: 2020-10-27T17:55:04Z

An issue was discovered in OpenStack blazar-dashboard before 1.3.1, 2.0.0, and 3.0.0. A user allowed to access the Blazar dashboard in Horizon may trigger code execution on the Horizon host as the user the Horizon service runs under (because the Python eval function is used). This may result in Horizon host unauthorized access and further compromise of the Horizon service. All setups using the Horizon dashboard with the blazar-dashboard plugin are affected.

Affected packages:
package: ecosystem: PyPI, name: blazar-dashboard, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.1
package: ecosystem: PyPI, name: blazar-dashboard, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.1, versions: 2.0.0
package: ecosystem: PyPI, name: blazar-dashboard, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.1, versions: 3.0.0
Command Injection in jison
Advisory: GHSA-vr9x-mm65-2438 (CVE-2020-8178)
Published: 2020-10-08T21:38:51Z
Withdrawn: 2020-10-19T18:55:38Z

**Withdrawn:** This vulnerability is not present in the released npm package.  Rather the vulnerable code is
part of the repo, but not part of the package. See linked hackerone report for more details.

Insufficient input validation in npm package `jison` <= 0.4.18 may lead to OS command injection attacks.

Affected packages:
package: ecosystem: npm, name: jison, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.4.18
Cross-site scripting (XSS) vulnerability in the fallback authentication endpoint
Advisory: GHSA-3x8c-fmpc-5rmq (CVE-2020-26891)
Published: 2020-10-16T16:56:04Z

### Impact
The fallback authentication endpoint served via Synapse was vulnerable to cross-site scripting (XSS) attacks. The impact depends on the configuration of the domain that Synapse is deployed on, but may allow access to cookies and other browser data, CSRF vulnerabilities, and access to other resources served on the same domain or parent domains.

### Patches
This is fixed by #8444, which is included in Synapse v1.21.0.

### Workarounds
If the homeserver is not configured to use reCAPTCHA, consent (terms of service), or single sign-on then the affected endpoint can be blocked at a reverse proxy:

* `/_matrix/client/r0/auth/.*/fallback/web`
* `/_matrix/client/unstable/auth/.*/fallback/web`

Affected packages:
package: ecosystem: PyPI, name: matrix-synapse, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.21.0
Markdown-supplied Shell Command Execution
Advisory: GHSA-c84h-w6cr-5v8q (CVE-2020-15271)
Published: 2020-10-27T17:59:54Z

### Impact

lookatme versions prior to 2.3.0 automatically loaded the built-in "terminal" and "file_loader" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system.

### Patches

Users should upgrade to lookatme versions 2.3.0 or above.

### Workarounds

The `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme.

### References

* https://github.com/d0c-s4vage/lookatme/pull/110
* https://github.com/d0c-s4vage/lookatme/releases/tag/v2.3.0

### For more information

If you have any questions or comments about this advisory:

* Open an issue in [d0c-s4vage/lookatme](https://github.com/d0c-s4vage/lookatme)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: lookatme, ecosystem_specific: affected_functions: lookatme.contrib.load_contribs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.0
Malicious code in `loadyaml`
Advisory: GHSA-mfc2-93pr-jf92 ()
Published: 2020-10-01T17:10:15Z

npm packages `loadyaml` and `electorn` were removed from the npm registry for containing malicious code. Upon installation the package runs a preinstall script that writes a public comment on GitHub containing the following information:
- IP and IP-based geolocation
- home directory name
- local username 

The malicious packages have been removed from the npm registry and the leaked content removed from GitHub.

Affected packages:
package: ecosystem: npm, name: loadyaml, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.0.2
Authenticated XML External Entity Processing
Advisory: GHSA-8xv9-qcr9-ww9j ()
Published: 2020-10-19T21:32:18Z

### Impact
Authenticated XML External Entity Processing

### Patches
We recommend to update to the current version 6.3.2.1. You can get the update to 6.3.2.1 regularly via the Auto-Updater or directly via the download overview.

https://www.shopware.com/en/download/#shopware-6

### Workarounds
For older versions of 6.1 and 6.2 the corresponding changes are also available via plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### For more information
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-10-2020

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: Packagist, name: shopware/platform, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.2.1, database_specific: last_known_affected_version_range: <= 6.3.2.0
package: ecosystem: Packagist, name: shopware/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.2.1, database_specific: last_known_affected_version_range: <= 6.3.2.0
Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls
Advisory: GHSA-f8cm-364f-q9qh (CVE-2020-15269)
Published: 2020-10-20T20:03:52Z

### Impact
The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. 

### Patches
Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. 

### Workarounds
In your project directory create a decorator file `app/controllers/spree/api/v2/base_controller_decotatror.rb` with contents:

```ruby
module Spree
  module Api
    module V2
      module BaseControllerDecorator
        private

        def spree_current_user
          return nil unless doorkeeper_token
          return @spree_current_user if @spree_current_user

          doorkeeper_authorize!

          @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)
        end
     end
  end
end

Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)
```

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: spree, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.7.11
package: ecosystem: RubyGems, name: spree, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.0.4
package: ecosystem: RubyGems, name: spree, ranges: type: ECOSYSTEM, events: introduced: 4.1.0
fixed: 4.1.11
Inline attribute values were not processed.
Advisory: GHSA-589w-hccm-265x (CVE-2020-15263)
Published: 2020-10-19T20:17:47Z

### Impact
Inline attributes have not been processed escape.
If the data that came from users was not processed, then an XSS vulnerability is possible

### Patches
Fixed in 9.4.4

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: orchid/platform, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.4.4
Directory Traversal vulnerability in GET/PUT allows attackers to Disclose Information or Write Files via a crafted GET/PUT request
Advisory: GHSA-hwv5-w8gm-fq9f (CVE-2020-15239)
Published: 2020-10-06T18:21:02Z

### Impact

#### Information Disclosure

When the GET method is attacked, attackers can read files which have a `.data` suffix and which are accompanied by a JSON file with the `.meta` suffix. This can lead to Information Disclosure and in some shared-hosting scenarios also to circumvention of authentication or other limitations on the outbound (GET) traffic.

For example, in a scenario where a single server has multiple instances of the application running (with separate DATA_ROOT settings), an attacker who has knowledge about the directory structure is able to read files from any other instance to which the process has read access.

If instances have individual authentication (for example, HTTP authentication via a reverse proxy, source IP based filtering) or other restrictions (such as quotas), attackers may circumvent those limits in such a scenario by using the Directory Traversal to retrieve data from the other instances.

#### File Write

If the associated XMPP server (or anyone knowing the SECRET_KEY) is malicious, they can write files outside the DATA_ROOT. The files which are written are constrained to have the `.meta` and the `.data` suffixes; the `.meta` file will contain the JSON with the Content-Type of the original request and the `.data` file will contain the payload.

### Patches

PR #12 fixes the issue. The PR has been merged into version 0.4.0 and 0.4.0 has been released and pushed to PyPI. Users are advised to upgrade immediately.

### Workarounds

- Apache can apparently be configured to filter such malicious paths when reverse-proxying. 
- There are no other workarounds known.

### References

- [Pull Request #12](https://github.com/horazont/xmpp-http-upload/pull/12)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: xmpp-http-upload, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.0
Insufficient Verification of Data Authenticity in python-keystoneclient
Advisory: GHSA-9vg3-cf92-h2h7 (CVE-2013-2167)
Published: 2020-03-10T20:39:05Z

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: python-keystoneclient, ecosystem_specific: affected_functions: keystoneclient.middleware.auth_token.AuthProtocol._protect_cache_value, keystoneclient.middleware.auth_token.AuthProtocol._unprotect_cache_value, keystoneclient.middleware.auth_token.AuthProtocol._get_cache_key, keystoneclient.middleware.auth_token.AuthProtocol._cache_get, keystoneclient.middleware.auth_token.AuthProtocol._cache_store, keystoneclient.middleware.auth_token.AuthProtocol._cache_put, keystoneclient.middleware.memcache_crypt.generate_aes_key, keystoneclient.middleware.memcache_crypt.compute_mac, keystoneclient.middleware.memcache_crypt.hash_data, keystoneclient.middleware.memcache_crypt.sign_data, keystoneclient.middleware.memcache_crypt.verify_signed_data, keystoneclient.middleware.memcache_crypt.encrypt_data, keystoneclient.middleware.memcache_crypt.decrypt_data, ranges: type: ECOSYSTEM, events: introduced: 0.2.3
fixed: 0.3.0, database_specific: last_known_affected_version_range: <= 0.2.5
Improper Input Validation in Twisted
Advisory: GHSA-h96w-mmrf-2h6v (CVE-2020-10108)
Published: 2020-03-31T15:42:42Z

In Twisted Web before 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: Twisted, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 20.3.0
python-docutils allows insecure usage of temporary files
Advisory: GHSA-cg75-6938-wx58 (CVE-2009-5042)
Published: 2020-03-13T20:04:51Z

python-docutils allows insecure usage of temporary files

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: docutils, ranges: type: ECOSYSTEM, events: introduced: 0.5
fixed: 0.6
Directory Traversal in Next.js
Advisory: GHSA-fq77-7p7r-83rj (CVE-2020-5284)
Published: 2020-03-30T20:40:50Z

### Impact

- **Not affected**: Deployments on ZEIT Now v2 ([https://zeit.co](https://zeit.co/)) are not affected
- **Not affected**: Deployments using the `serverless` target
- **Not affected**: Deployments using `next export`
- **Affected**: Users of Next.js below 9.3.2

We recommend everyone to upgrade regardless of whether you can reproduce the issue or not.

### Patches

https://github.com/zeit/next.js/releases/tag/v9.3.2

### References

https://github.com/zeit/next.js/releases/tag/v9.3.2

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: next, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 9.3.2
Holder can generate proof of ownership for credentials it does not control in vp-toolkit
Advisory: GHSA-ff5x-w9wg-h275 ()
Published: 2020-03-06T01:15:46Z

### Impact
The [`verifyVerifiablePresentation()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-presentation-signer.ts#L97) method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the [`credentialSubject.id`](https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L150) DID matches the signer of the VP proof.

The **verifier** is impacted by this vulnerability.

### Patches
Patch will be available in version 0.2.2.

### Workarounds
- Compute the address out of the `verifiablePresentation.proof.n.verificationMethod` using `getAddressFromPubKey()` from `crypt-util@0.1.5` and match it with the `credentialSubject.id` address from the credential.

### References
[Github issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/14)

### For more information
If you have any questions or comments about this advisory:
* Discuss in the existing [issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/14)
* [Contact me](https://github.com/rabomarnix)

Affected packages:
package: ecosystem: npm, name: vp-toolkit, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.2
Remote code execution in PHPMailer
Advisory: GHSA-5f37-gxvh-23v6 (CVE-2016-10033)
Published: 2020-03-05T22:09:17Z

### Impact
The `mailSend` function in the default `isMail` transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \&quot; (backslash double quote) in a crafted `Sender` property.

### Patches
Fixed in 5.2.18

### Workarounds
Filter and validate user input before passing it to internal functions.

### References
https://nvd.nist.gov/vuln/detail/CVE-2016-10033
Related to a follow-on issue in https://nvd.nist.gov/vuln/detail/CVE-2016-10045

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: phpmailer/phpmailer, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.18
Insufficient Nonce Validation in Eclipse Milo Client
Advisory: GHSA-pq4w-qm9g-qx68 (CVE-2019-19135)
Published: 2020-03-16T22:46:50Z

### Impact
Credential replay affecting those connected to a server when *all 3* of the following conditions are met:
- `SecurityPolicy` is `None`
- using username/password or X509-based authentication
- the server has a defect causing it to send null/empty or zeroed nonces 

### Patches
The problem has been patched in version `0.3.6`. A more relaxed treatment of validation as agreed upon by the OPC UA Security Working Group is implemented in version `0.3.7`.

### Workarounds
Do not use username/password or X509-based authentication with `SecurityPolicy` of `None`.

### References
https://opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2019-19135.pdf

### For more information
If you have any questions or comments about this advisory:
* Open an issue at [https://github.com/eclipse/milo/issues](https://github.com/eclipse/milo/issues)
* Email [the mailing list](mailto:milo-dev@eclipse.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.eclipse.milo:sdk-client, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.6, database_specific: last_known_affected_version_range: <= 0.3.4
Link Following in rply
Advisory: GHSA-m8qc-mf6p-pfq9 (CVE-2014-1938)
Published: 2020-03-11T20:56:34Z

python-rply before 0.7.4 insecurely creates temporary files.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: rply, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.7.4
Potential buffer overflow in psd-tools
Advisory: GHSA-22jr-vc7j-g762 (CVE-2020-10571)
Published: 2020-03-16T22:46:19Z

### Impact
An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malformed PSD input data during decoding to the PIL.Image or NumPy format, leading to a Buffer Overflow.

### Patches
Users of psd-tools version v1.8.37 to v1.9.3 should upgrade to v1.9.4.

### Workarounds
Without Cython present on installation, buffer overflow does not occur but IndexError will be thrown. However, already installed psd-tools with Cython extention should be upgraded.

### References
https://github.com/psd-tools/psd-tools/pull/198

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [psd-tools](https://github.com/psd-tools/psd-tools/issues)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: psd-tools, ranges: type: ECOSYSTEM, events: introduced: 1.8.37
fixed: 1.9.4, database_specific: last_known_affected_version_range: < 1.9.3
Cross-site scripting in PHPMailer
Advisory: GHSA-58mj-pw57-4vm2 (CVE-2017-11503)
Published: 2020-03-05T22:09:13Z

PHPMailer versions prior to 5.2.24 (released July 26th 2017) have an XSS vulnerability in one of the code examples, CVE-2017-11503. The code_generator.phps example did not filter user input prior to output. This file is distributed with a `.phps` extension, so it it not normally executable unless it is explicitly renamed, and the file is not included when PHPMailer is loaded through composer, so it is safe by default. There was also an undisclosed potential XSS vulnerability in the default exception handler (unused by default). Patches for both issues kindly provided by Patrick Monnerat of the Fedora Project.

### Impact
PHPMailer 5.2.23 has XSS in the &quot;From Email Address&quot; and &quot;To Email Address&quot; fields of code_generator.php.

### Patches
Fixed in 5.2.24

### Workarounds
None.

### References
https://nvd.nist.gov/vuln/detail/CVE-2017-11503

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: phpmailer/phpmailer, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.24
Validation Bypass in kind-of
Advisory: GHSA-6c8f-qphg-qjgp (CVE-2019-20149)
Published: 2020-03-31T15:59:54Z

Versions of `kind-of` 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation. 


## Recommendation

Upgrade to versions 6.0.3 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: kind-of, ecosystem_specific: affected_functions: kind-of.ctorName, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.3
Incorrect Default Permissions in keyring
Advisory: GHSA-8867-vpm3-g98g (CVE-2012-5578)
Published: 2020-03-10T20:56:41Z

Python keyring has insecure permissions on new databases allowing world-readable files to be created

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: keyring, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.10
Prevent cache poisoning via a Response Content-Type header in Symfony
Advisory: GHSA-mcx4-f5f5-4859 (CVE-2020-5255)
Published: 2020-03-30T20:09:16Z

Description
-----------

When a `Response` does not contain a `Content-Type` header, Symfony falls back to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response's content and `Content-Type` header. When the response is cached, this can lead to a corrupted cache where the cached format is not the right one.

Resolution
----------

Symfony does not use the `Accept` header anymore to guess the `Content-Type`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6) for the 4.4 branch.

Credits
-------

I would like to thank Xavier Lacot from JoliCode for reporting & Yonel Ceruto and Tobias Schultze for fixing the issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: Packagist, name: symfony/http-foundation, ranges: type: ECOSYSTEM, events: introduced: 4.4.0
fixed: 4.4.7
package: ecosystem: Packagist, name: symfony/http-foundation, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.0.7
Exceptions displayed in non-debug configurations in Symfony
Advisory: GHSA-m884-279h-32v2 (CVE-2020-5274)
Published: 2020-03-30T20:09:31Z

Description
-----------

When `ErrorHandler` renders an exception HTML page, it uses un-escaped properties from the related Exception class to render the stacktrace. The security issue comes from the fact that the stacktraces were also displayed in non-`debug` environments.

Resolution
----------

The `ErrorHandler` class now escapes all properties coming from the related Exception, and the stacktrace is not displayed anymore in non-`debug` environments.

The patches for this issue are available [here](https://github.com/symfony/symfony/commit/cf80224589ac05402d4f72f5ddf80900ec94d5ad) and [here](https://github.com/symfony/symfony/commit/629d21b800a15dc649fb0ae9ed7cd9211e7e45db) for branch 4.4.

Credits
-------

I would like to thank Luka Sikic for reporting & Yonel Ceruto and Jérémy Derussé for fixing the issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: symfony/http-foundation, ranges: type: ECOSYSTEM, events: introduced: 4.4.0
fixed: 4.4.4
package: ecosystem: Packagist, name: symfony/http-foundation, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.0.4
Cross-Site Scripting in http_server
Advisory: GHSA-754x-4jwp-cqp6 (CVE-2019-15600)
Published: 2020-03-31T17:02:26Z

All versions of `http_server` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: http_server, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 1.0.12
Phar object injection in PHPMailer
Advisory: GHSA-7w4p-72j7-v7c2 (CVE-2018-19296)
Published: 2020-03-05T22:08:55Z

PHPMailer versions prior to 6.0.6 and 5.2.27 are vulnerable to an object injection attack by passing phar:// paths into `addAttachment()` and other functions that may receive unfiltered local paths, possibly leading to RCE. See [this article](https://knasmueller.net/5-answers-about-php-phar-exploitation) for more info on this type of vulnerability. Mitigated by blocking the use of paths containing URL-protocol style prefixes such as `phar://`. Reported by Sehun Oh of cyberone.kr.

### Impact
Object injection, possible remote code execution

### Patches
Fixed in 6.0.6 and 5.2.27

### Workarounds
Validate and sanitise user input before using.

### References
https://nvd.nist.gov/vuln/detail/CVE-2018-19296

### For more information
If you have any questions or comments about this advisory:
* Open a private issue in [the PHPMailer project](https://github.com/PHPMailer/PHPMailer)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: phpmailer/phpmailer, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.27
package: ecosystem: Packagist, name: phpmailer/phpmailer, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.6
regular expression denial-of-service (ReDoS) in Bleach
Advisory: GHSA-vqhp-cxgc-6wmm (CVE-2020-6817)
Published: 2020-03-30T19:45:56Z

### Impact

`bleach.clean` behavior parsing style attributes could result in a regular expression denial of service (ReDoS).

Calls to ``bleach.clean`` with an allowed tag with an allowed ``style`` attribute are vulnerable to ReDoS. For example, ``bleach.clean(..., attributes={'a': ['style']})``.

### Patches

3.1.4

### Workarounds

* do not whitelist the style attribute in `bleach.clean` calls

* limit input string length

### References

* https://bugzilla.mozilla.org/show_bug.cgi?id=1623633
* https://www.regular-expressions.info/redos.html
* https://blog.r2c.dev/posts/finding-python-redos-bugs-at-scale-using-dlint-and-r2c/
* https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6817

### Credits

* Reported by schwag09 of r2c

### For more information
If you have any questions or comments about this advisory:

* Open an issue at https://github.com/mozilla/bleach/issues
* Email us at security@mozilla.org

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: bleach, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.4
Information disclosure in parse-server
Advisory: GHSA-h4mf-75hf-67w4 (CVE-2020-5251)
Published: 2020-03-04T20:20:27Z

1. you can fetch all the users' objects, by using regex in the NoSQL query.
Using the NoSQL, you can use a regex on sessionToken `("_SessionToken":{"$regex":"r:027f"}}` and find valid accounts this way.

Using this method, it's possible to retrieve accounts without interaction from the users.

GET /parse/users/me HTTP/1.1
```
{
  "_ApplicationId": "appName",
  "_JavaScriptKey": "javascriptkey",
  "_ClientVersion": "js2.10.0",
  "_InstallationId": "ca713ee2-6e60-d023-a8fe-14e1bfb2f300",
  "_SessionToken": {
    "$regex": "r:5"
  }
}
```
When trying it with an update query the same thing luckily doesn't seem to work:
POST /parse/classes/_User/PPNk59jPPZ

2. There is another similar vulnerability in verify email and the request password reset.

If you sign up with someone else's email address, you can simply use regex in the token param to verify the account: `http://localhost:1337/parse/apps/kickbox/verify_email?token[$regex]=a&username=some@email.com`

The same thing can be done for reset password: `http://localhost:1337/parse/apps/kickbox/request_password_reset?token[$regex]=a&username=some@email.com`

You may need to do it a few times with a different letter/number, but as long as the tokens contain the character it will succeed.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: parse-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.1.0, database_specific: last_known_affected_version_range: <= 4.0.0
Incorrect Default Permissions in keyring
Advisory: GHSA-p86x-652p-6385 (CVE-2012-5577)
Published: 2020-03-11T21:36:38Z

Python keyring lib before 0.10 created keyring files with world-readable permissions.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: keyring, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.10
Holder can (re)create authentic credentials after receiving a credential in vp-toolkit
Advisory: GHSA-p94w-42g3-f7h4 ()
Published: 2020-03-06T01:16:00Z

### Impact
The [`verifyVerifiableCredential()`](https://github.com/rabobank-blockchain/vp-toolkit/blob/master/src/service/signers/verifiable-credential-signer.ts#L57) method check the cryptographic integrity of the Verifiable Credential, but it does not check if the [`credential.issuer`](https://github.com/rabobank-blockchain/vp-toolkit-models/blob/develop/src/model/verifiable-credential.ts#L129) DID matches the signer of the credential.

The **verifier** is impacted by this vulnerability.

### Patches
Patch will be available in version 0.2.2.

### Workarounds
In case you trust certain issuers for certain credentials as a verifier, trust the issuer&#39;s public key from the `credential.proof.verificationMethod` field.

### References
[Github issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13)

### For more information
If you have any questions or comments about this advisory:
* Discuss in the existing [issue](https://github.com/rabobank-blockchain/vp-toolkit/issues/13)
* [Contact me](https://github.com/rabomarnix)

Affected packages:
package: ecosystem: npm, name: vp-toolkit, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.2
Prototype Pollution in Dojox
Advisory: GHSA-3hw5-q855-g6cw (CVE-2020-5259)
Published: 2020-03-10T18:03:32Z

The Dojox jQuery wrapper `jqMix` mixin method is vulnerable to Prototype Pollution. 

Affected Area:
```
//https://github.com/dojo/dojox/blob/master/jq.js#L442
		var tobj = {};
		for(var x in props){
			// the "tobj" condition avoid copying properties in "props"
			// inherited from Object.prototype.  For example, if obj has a custom
			// toString() method, don't overwrite it with the toString() method
			// that props inherited from Object.prototype
			if((tobj[x] === undefined || tobj[x] != props[x]) && props[x] !== undefined && obj != props[x]){
				if(dojo.isObject(obj[x]) && dojo.isObject(props[x])){
					if(dojo.isArray(props[x])){
						obj[x] = props[x];
					}else{
						obj[x] = jqMix(obj[x], props[x]);
					}
				}else{
					obj[x] = props[x];
				}
```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.11.10
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.12.0
fixed: 1.12.8
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.13.0
fixed: 1.13.7
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.14.0
fixed: 1.14.6
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.15.0
fixed: 1.15.3
package: ecosystem: npm, name: dojox, ranges: type: ECOSYSTEM, events: introduced: 1.16.0
fixed: 1.16.2
Deserialization of Untrusted Data in jackson-databind
Advisory: GHSA-gww7-p5w4-wrfv (CVE-2019-20330)
Published: 2020-03-04T20:52:11Z

FasterXML jackson-databind 2.x before 2.6.7.4, 2.7.x before 2.7.9.7, 2.8.x before 2.8.11.5, and 2.9.x before 2.9.10.2 lacks certain `net.sf.ehcache` blocking.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.6.7.4, database_specific: last_known_affected_version_range: <= 2.6.7.3
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.7.0
fixed: 2.7.9.7, database_specific: last_known_affected_version_range: <= 2.7.9.6
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.11.5, database_specific: last_known_affected_version_range: <= 2.8.11.4
package: ecosystem: Maven, name: com.fasterxml.jackson.core:jackson-databind, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.9.0
fixed: 2.9.10.2, database_specific: last_known_affected_version_range: <= 2.9.10.1
HTTP Request Smuggling in Twisted
Advisory: GHSA-p5xh-vx83-mxcj (CVE-2020-10109)
Published: 2020-03-31T15:40:12Z

In Twisted Web through 20.3.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: Twisted, ecosystem_specific: affected_functions: twisted.web.http.HTTPChannel, twisted.web.http.HTTPChannel.headerReceived, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 20.3.0
Withdrawn: ESLint dependencies are vulnerable (ReDoS and Prototype Pollution)
Advisory: GHSA-7fhm-mqm4-2wp7 ()
Published: 2020-03-13T20:36:16Z
Withdrawn: 2020-04-03T21:47:06Z

**Withdrawn**
GitHub has withdrawn this advisory in place of GHSA-vh95-rmgr-6w4m and GHSA-6chw-6frg-f759.
The reason for withdrawing is that some mistakes were made during the ingestion of CVE-2020-7598
which caused this advisory to be published with incorrect information.

In order to provide accurate advisory information, new advisories were created:

- minimist: https://github.com/advisories/GHSA-vh95-rmgr-6w4m
- acorn: https://github.com/advisories/GHSA-6chw-6frg-f759

Affected packages:
package: ecosystem: npm, name: minimist, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.2
package: ecosystem: npm, name: acorn, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.7.4
package: ecosystem: npm, name: acorn, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.4.1
package: ecosystem: npm, name: acorn, ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 7.1.1
package: ecosystem: npm, name: acorn, ranges: type: ECOSYSTEM, events: introduced: 7.0.0
fixed: 7.1.1
Path Traversal in statics-server
Advisory: GHSA-j27j-4w6m-8fc4 (CVE-2019-15596)
Published: 2020-03-31T17:02:12Z

All versions of `statics-server` are vulnerable to Path Traversal. The package fails to limit access to files outside of the served folder through symlinks.


## Recommendation

No fix is currently available. Do not use `statics-server` in production or consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: statics-server, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.0.9
2FA bypass through deleting devices in wagtail-2fa
Advisory: GHSA-9gjv-6qq6-v7qm (CVE-2020-5240)
Published: 2020-03-13T21:18:55Z

### Impact
Any user with access to the CMS can view and delete other users&#39; 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other user&#39;s device they can disable the target user&#39;s 2FA devices and potentially compromise the account if they figure out their password.

### Patches
The problem has been patched in version 1.4.1.

### Workarounds
There is no workaround for this issue.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [github.com/labd/wagtail-2fa](https://github.com/labd/wagtail-2fa)
* Email us at [security@labdigital.nl](mailto:security@labdigital.nl)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: wagtail-2fa, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.1