aswin1906/github-advisory-2020.csv huggingface dataset:
Sandbox Breakout / Arbitrary Code Execution in safer-eval
Advisory: GHSA-876r-hj45-fw7g ()
Published: 2020-09-03T21:18:41Z

All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. It is possible to escape the sandbox by forcing exceptions recursively in the evaluated code. This may allow attacker to execute arbitrary code in the system.


## Recommendation

The package is not suited to receive arbitrary user input. Consider using an alternative package.

Affected packages:
package: ecosystem: npm, name: safer-eval, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
personnummer/js vulnerable to Improper Input Validation
Advisory: GHSA-vpgc-7h78-gx8f ()
Published: 2020-09-04T18:05:14Z

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.

The vulnerability is determined to be low severity.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2  
D 3.0.1  
[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3  
Elixir 3.0.0  
[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1  
[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0  
[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2  
Perl 3.0.0  
[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2  
[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1  
[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

Affected packages:
package: ecosystem: npm, name: personnummer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.0
Malicious Package in sb58
Advisory: GHSA-674r-xx4c-gj7x ()
Published: 2020-09-03T17:04:05Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: sb58, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in ks-sha3
Advisory: GHSA-563h-49v8-g7x4 ()
Published: 2020-09-03T23:17:01Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ks-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in lodash.mergewith
Advisory: GHSA-779f-wgxg-qr8f ()
Published: 2020-09-03T18:10:22Z

Versions of `lodash.mergewith` before 4.6.2 are vulnerable to prototype pollution. The function `mergeWith` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.2 or later.

Affected packages:
package: ecosystem: npm, name: lodash.mergewith, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.6.2
Malicious Package in tensorplow
Advisory: GHSA-m2fp-c79h-rr79 ()
Published: 2020-09-02T21:42:56Z

All versions of `tensorplow` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: tensorplow, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in yttivy
Advisory: GHSA-96qc-ghj4-rq27 (CVE-2017-16219)
Published: 2020-09-01T18:24:56Z

Affected versions of `yttivy` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: yttivy, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in github-jquery-widgets
Advisory: GHSA-c722-pv5w-cfg2 ()
Published: 2020-09-11T21:20:14Z

Version 0.1.2 of `github-jquery-widgets` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.1.1

Affected packages:
package: ecosystem: npm, name: github-jquery-widgets, versions: 0.1.2
Malicious Package in js-wha3
Advisory: GHSA-785g-gx74-gr39 ()
Published: 2020-09-03T23:12:48Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-wha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
fury-adapter-swagger allows arbitrary file read from system
Advisory: GHSA-2r7f-4h2c-5x73 (CVE-2016-1000249)
Published: 2020-09-01T16:38:33Z

`fury-adapter-swagger` from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like `/dev/zero`.

## Proof of Concept:

```yaml
---
swagger: '2.0'
info:
  title: Read local files
  version: '1.0'

paths:
  /foo:
    get:
      responses:
        200:
          description: Some description
          examples:
            text/html:
              example:
                $ref: '/etc/passwd'
```


## Recommendation

Upgrade to version 0.9.7 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: fury-adapter-swagger, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.2.0
fixed: 0.9.7
Cross-Site Scripting in atlasboard-atlassian-package
Advisory: GHSA-25v4-mcx4-hh35 ()
Published: 2020-09-04T17:28:28Z

All versions of `atlasboard-atlassian-package` prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS).  The package fails to properly sanitize user input that is rendered as HTML, which may allow attackers to execute arbitrary JavaScript in a victim's browser. This requires attackers being able to change issue summaries in Jira tickets.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: atlasboard-atlassian-package, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in equest
Advisory: GHSA-mvch-rh6h-2m47 ()
Published: 2020-09-11T21:10:29Z

All versions of `equest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: equest, ranges: type: ECOSYSTEM, events: introduced: 0
Prototype Pollution in lodash.defaultsdeep
Advisory: GHSA-h5mp-5q4p-ggf5 ()
Published: 2020-09-03T18:07:05Z

Versions of `lodash.defaultsdeep` before 4.6.1 are vulnerable to prototype pollution. The function `mergeWith` may allow a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.

Affected packages:
package: ecosystem: npm, name: lodash.defaultsdeep, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.6.1
Nodesass is malware
Advisory: GHSA-xfmw-2vmm-579c (CVE-2017-16080)
Published: 2020-09-01T18:59:50Z

The `nodesass` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.

Affected packages:
package: ecosystem: npm, name: nodesass, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Remote Code Execution in next
Advisory: GHSA-5vj8-3v2h-h38v ()
Published: 2020-09-04T18:04:08Z

Versions of `next` prior to 5.1.0 are vulnerable to Remote Code Execution. The `/path:` route fails to properly sanitize input and passes it to a `require()` call. This allows attackers to execute JavaScript code on the server. Note that prior version 0.9.9 package `next` npm package hosted a different utility (0.4.1 being the latest version of that codebase), and this advisory does not apply to those versions.

## Recommendation

Upgrade to version 5.1.0.

Affected packages:
package: ecosystem: npm, name: next, ranges: type: ECOSYSTEM, events: introduced: 0.9.9
fixed: 5.1.0
Malicious Package in hulp
Advisory: GHSA-fqw7-8v6m-2f86 ()
Published: 2020-09-02T21:37:39Z

All versions of `hulp` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: hulp, ranges: type: ECOSYSTEM, events: introduced: 0
Prototype Pollution in flat-wrap
Advisory: GHSA-g7h8-p22m-2rvx ()
Published: 2020-09-04T15:08:46Z

All versions of `flat-wrap` are vulnerable to prototype pollution. The function `unflatten` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: flat-wrap, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in pidusage
Advisory: GHSA-hfq9-rfpv-j8r8 (CVE-2017-16034)
Published: 2020-09-01T16:49:19Z

Affected versions of `pidusage` pass unsanitized input to `child_process.exec()`, resulting in arbitrary code execution in the `ps` method.
 
This package is vulnerable to this PoC on Darwin, SunOS, FreeBSD, and AIX.

Windows and Linux are not vulnerable. 

## Proof of Concept
```
var pid = require('pidusage');
pid.stat('1 && /usr/local/bin/python');
```


## Recommendation

Update to version 1.1.5 or later.

Affected packages:
package: ecosystem: npm, name: pidusage, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.5, database_specific: last_known_affected_version_range: <= 1.1.4
Non-persistent XSS in the Storefront in Shopware
Advisory: GHSA-qvhr-55hg-3qwv ()
Published: 2020-09-23T17:20:39Z

### Impact
Non-persistent XSS in the Storefront

### Patches
We recommend to update to the current version 6.3.1.1. You can get the update to 6.3.1.1 regularly via the Auto-Updater or directly via the download overview. 

For older versions you can use the Security Plugin:
https://store.shopware.com/en/detail/index/sArticle/518463/number/Swag136939272659

### References
https://docs.shopware.com/en/shopware-6-en/security-updates/security-update-09-2020

Affected packages:
package: ecosystem: Packagist, name: shopware/platform, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.1.1, database_specific: last_known_affected_version_range: <= 6.3.1.0
package: ecosystem: Packagist, name: shopware/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.3.1.1, database_specific: last_known_affected_version_range: <= 6.3.1.0
Sandbox Breakout / Arbitrary Code Execution in @zhaoyao91/eval-in-vm
Advisory: GHSA-jp99-5h8w-gmxc ()
Published: 2020-09-04T15:03:13Z

All versions of `@zhaoyao91/eval-in-vm` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: @zhaoyao91/eval-in-vm, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in tiar
Advisory: GHSA-4hjg-w3ww-38c6 ()
Published: 2020-09-03T18:03:49Z

All versions of `tiar` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: tiar, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-388g-jwpg-x6j4 ()
Published: 2020-09-11T21:20:14Z

Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 3.0.13 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.13
Server-Side Request Forgery in html-pdf-chrome
Advisory: GHSA-5p98-wpc9-g498 ()
Published: 2020-09-04T15:21:32Z

## Recommendation
This package is working as intended. A [Security](https://github.com/westy92/html-pdf-chrome#security) section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether.

## Original Advisory
All versions of `html-pdf-chrome` are vulnerable to Server-Side Request Forgery (SSRF). The package executes HTTP requests if the parsed HTML contains external references to resources, such as `<iframe src="http://localhost" height="800px" width="800px"></iframe>`. This allows attackers to access resources through HTTP that are accessible to the server, including private resources in the hosting environment.

Affected packages:
package: ecosystem: npm, name: html-pdf-chrome, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.6.1
Malicious Package in m-backdoor
Advisory: GHSA-vv52-3mrp-455m ()
Published: 2020-09-03T15:53:36Z

All versions of `m-backdoor` contain malicious code. The package downloads a file from a remote server and executes it as a preinstall script. At the time of the release of this advisory the downloaded file only defaces websites by removing elements randomly from the DOM. 


## Recommendation

Remove the package from your system.

Affected packages:
package: ecosystem: npm, name: m-backdoor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in yyooopack
Advisory: GHSA-c3h5-qchh-46hh (CVE-2017-16167)
Published: 2020-09-01T17:30:17Z

Affected versions of `yyooopack` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: yyooopack, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in bpmn-js-properties-panel
Advisory: GHSA-vpj4-89q8-rh38 ()
Published: 2020-09-03T18:16:59Z

Versions of `bpmn-js-properties-panel` prior to 0.31.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.31.0 or later.

Affected packages:
package: ecosystem: npm, name: bpmn-js-properties-panel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.31.0
Regular Expression Denial of Service in bleach
Advisory: GHSA-mvmf-cvfx-qg55 (CVE-2014-8881)
Published: 2020-09-01T15:16:43Z

All versions of the `bleach` package are vulnerable to a regular expression denial of service attack when certain types of input are passed into the sanitize function.



## Recommendation

The `bleach` package is not currently maintained, and has not seen an update since 2014. 

To mitigate this issue, it is necessary to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=html%20sanitizer&page=1&ranking=optimal).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: npm, name: bleach, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in reequest
Advisory: GHSA-rw4r-h883-8pf9 ()
Published: 2020-09-02T20:30:02Z

All versions of `reequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: reequest, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in buffer-xos
Advisory: GHSA-h2j3-gg8w-4858 ()
Published: 2020-09-03T22:12:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xos, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Template Injection in jsrender
Advisory: GHSA-r87w-47m8-22w3 (CVE-2016-3942)
Published: 2020-09-01T15:24:24Z

Affected versions of `jsrender` are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input.

## Proof of Concept


```js
//POC-REQUEST
{{for ~x!=1?(constructor.constructor("return arguments.callee.caller")()):~y(10)}}
{{:#data}}
{{/for}}
```

```js
//POC-RESPONSE
function anonymous(data,view,j,u) { // template var v,t=j._tag,ret="" +t("for",view,this,[ {view:view,tmpl:1, params:{args:['~x!=1?(constructor.constructor(\"return arguments.callee.caller\")()):~y(10)']}, args:[view.hlp("x")!=1?(data.constructor.constructor("return arguments.callee.caller")()):view.hlp("y")(10)], props:{}}]); return ret; } 
```


## Recommendation

Update to version 0.9.74 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: jsrender, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.9.74, database_specific: last_known_affected_version_range: <= 0.9.73
Path Traversal in file-static-server
Advisory: GHSA-qjfh-xc44-rm9x ()
Published: 2020-09-03T16:49:43Z

All versions of `file-static-server` are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. 


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.


Affected packages:
package: ecosystem: npm, name: file-static-server, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
XSS via Angular Expression in ag-grid
Advisory: GHSA-wfw3-rgfr-6g67 (CVE-2017-16009)
Published: 2020-09-01T16:40:42Z

Affected versions of `ag-grid` are vulnerable to Cross-site Scripting (XSS) via Angular Expressions, if used in combination with AngularJS.


## Recommendation

Avoid using `ag-grid` in combination with AngularJS until a fix is available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: ag-grid, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 18.1.3-beta.1
Malicious Package in jekyll-for-github-projects
Advisory: GHSA-j5qg-46p9-w2rp ()
Published: 2020-09-03T00:33:32Z

Version 0.2.12 of `jekyll-for-github-projects` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.2.11

Affected packages:
package: ecosystem: npm, name: jekyll-for-github-projects, versions: 0.2.12
Information Exposure in type-graphql
Advisory: GHSA-xf64-2f9p-6pqq ()
Published: 2020-09-04T17:24:08Z

Versions of `type-graphql` prior to 0.17.6 are vulnerable to Information Exposure. The package leaks the resolver source code in an error message. It is possible to force this error when no subscription topics are provided in the request.


## Recommendation

Upgrade to version 0.17.6 or later.

Affected packages:
package: ecosystem: npm, name: type-graphql, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.17.6
Malicious Package in serilize
Advisory: GHSA-fw76-p9p2-6pvf ()
Published: 2020-09-03T19:58:58Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: serilize, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Path Traversal in restify-swagger-jsdoc
Advisory: GHSA-gvff-25cc-4f66 ()
Published: 2020-09-03T17:15:56Z

Versions of `restify-swagger-jsdoc` prior to 3.2.1 are vulnerable to Path Traversal.  The package fails to properly sanitize URLs, which may allow attackers to access server files outside the `swagger-ui` folder by using relative paths.  



## Recommendation

Upgrade to version 3.2.1 or later.

Affected packages:
package: ecosystem: npm, name: restify-swagger-jsdoc, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.1
Malicious Package in requesst
Advisory: GHSA-6c37-2rw5-9j7x ()
Published: 2020-09-02T20:25:46Z

All versions of `requesst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: requesst, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in device-mqtt
Advisory: GHSA-563h-697m-j7x5 ()
Published: 2020-09-03T19:18:58Z

Version 1.0.11 of `device-mqtt` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.10

Affected packages:
package: ecosystem: npm, name: device-mqtt, versions: 1.0.11
Potential DoS with NumberFilter conversion to integer values.
Advisory: GHSA-x7gm-rfgv-w973 (CVE-2020-15225)
Published: 2020-09-28T19:05:29Z

### Impact

Automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. 

### Patches

Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. 

In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. 

### Workarounds

Users may manually apply an equivalent validator if they are not able to upgrade.  

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the django-filter repo](https://github.com/carltongibson/django-filter)

Thanks to Marcin Waraksa for the report. 


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: django-filter, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.4.0
Malicious Package in bunfer-xor
Advisory: GHSA-6f93-xj8r-jp82 ()
Published: 2020-09-03T22:28:21Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bunfer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in scryptys
Advisory: GHSA-vrxj-4qhw-5vwq ()
Published: 2020-09-03T17:03:41Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: scryptys, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Segfault in Tensorflow
Advisory: GHSA-x7rp-74x2-mjf3 (CVE-2020-15200)
Published: 2020-09-25T18:28:32Z

### Impact
The `RaggedCountSparseOutput` implementation does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the values in the `splits` tensor generate a valid partitioning of the `values` tensor. Thus, the [following code](https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L248-L265
) sets up conditions to cause a heap buffer overflow:
```cc
    auto per_batch_counts = BatchedMap<W>(num_batches);
    int batch_idx = 0;
    for (int idx = 0; idx < num_values; ++idx) {
      while (idx >= splits_values(batch_idx)) {
        batch_idx++;
      }
      const auto& value = values_values(idx);
      if (value >= 0 && (maxlength_ <= 0 || value < maxlength_)) {
        per_batch_counts[batch_idx - 1][value] = 1;
      }
    }
```

A `BatchedMap` is equivalent to a vector where each element is a hashmap. However, if the first element of `splits_values` is not 0, `batch_idx` will never be 1, hence there will be no hashmap at index 0 in `per_batch_counts`. Trying to access that in the user code results in a segmentation fault.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Malicious Package in commnader
Advisory: GHSA-855m-jchh-9qjc ()
Published: 2020-09-02T20:19:22Z

All versions of `commnader` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: commnader, ranges: type: ECOSYSTEM, events: introduced: 0
Prototype Pollution in deep-setter
Advisory: GHSA-9qrg-h9g8-c65q ()
Published: 2020-09-04T15:14:26Z

All versions of `deep-setter` are vulnerable to prototype pollution. The package does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: deep-setter, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in boogeyman
Advisory: GHSA-9hc2-w9gg-q6jw ()
Published: 2020-09-01T21:07:41Z

All versions of `boogeyman` are considered malicious. This particular package would download a payload from pastebin.com, eval it to read ssh keys and the users `.npmrc` and send them to a private pastebin account.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate your ssh keys and your npm token.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: boogeyman, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in k0a_multer
Advisory: GHSA-v95x-h953-x7fg ()
Published: 2020-09-03T19:47:55Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: k0a_multer, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in pyramid-proportion
Advisory: GHSA-v6vv-hhqc-6hh2 ()
Published: 2020-09-03T19:15:37Z

Version 1.0.5 of `pyramid-proportion` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider a downgrade to version 1.0.4.

Affected packages:
package: ecosystem: npm, name: pyramid-proportion, versions: 1.0.5
Malicious Package in file-logging
Advisory: GHSA-wwwg-6r7f-9c9h ()
Published: 2020-09-03T19:43:28Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: file-logging, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bitconid-rpc
Advisory: GHSA-9298-m7jf-55h2 ()
Published: 2020-09-04T16:42:08Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitconid-rpc, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in river-mock
Advisory: GHSA-2h3x-95c6-885r ()
Published: 2020-09-03T17:46:46Z

All versions of `river-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: river-mock, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in sds
Advisory: GHSA-cxm3-284p-qc4v (CVE-2020-7618)
Published: 2020-09-03T15:53:12Z

Affected versions of `sds` are vulnerable to prototype pollution. The `set` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.

## Recommendation

Upgrade to version 4.0.0 or later

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: npm, name: sds, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.0.0
Malicious Package in rimrafall
Advisory: GHSA-8hq2-fcqm-39hq ()
Published: 2020-09-02T21:46:05Z

Version 1.0.0 of `rimrafall` contains malicious code as a preinstall script. The package attempts to remove all files in the system's root folder.


## Recommendation

If you installed this package it is likely your machine was erased. If not, remove the package from your system and verify if any files were deleted.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: rimrafall, ranges: type: ECOSYSTEM, events: introduced: 0
gfe-sass downloads Resources over HTTP
Advisory: GHSA-72q2-5rxx-xfff (CVE-2017-16040)
Published: 2020-09-01T16:12:12Z

Affected versions of `gfe-sass` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `gfe-sass`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: gfe-sass, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in coffee-project
Advisory: GHSA-3fv6-q5xv-fhpw ()
Published: 2020-09-01T19:50:23Z

Version 1.7.5 of `coffee-project` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.7.5 of this module is found installed you will want to replace it with a version before or after 1.7.5. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.7.4

Affected packages:
package: ecosystem: npm, name: coffee-project, versions: 1.7.5
windows-selenium-chromedriver downloads Resources over HTTP
Advisory: GHSA-j9q7-3rhf-4ppv (CVE-2016-10687)
Published: 2020-09-01T16:11:08Z

Affected versions of `windows-selenium-chromedriver` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `windows-selenium-chromedriver`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: windows-selenium-chromedriver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffermxor
Advisory: GHSA-536f-268f-6gxc ()
Published: 2020-09-03T22:17:36Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffermxor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffur-xor
Advisory: GHSA-p7qp-3fh7-pv4p ()
Published: 2020-09-03T22:24:04Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffur-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in regenrator
Advisory: GHSA-m5p4-7wf9-6w99 ()
Published: 2020-09-01T21:10:53Z

All versions of `regenrator` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: regenrator, ranges: type: ECOSYSTEM, events: introduced: 0
Path Traversal in public
Advisory: GHSA-4vvp-x9h2-x2vf ()
Published: 2020-09-03T20:26:39Z

All versions of `public` are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL.


## Recommendation

No fix is currently available. Do not use `public` in production or consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: public, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in degbu
Advisory: GHSA-xr3g-4gg5-w3wq ()
Published: 2020-09-03T17:06:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: degbu, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
pandora-doomsday is malware
Advisory: GHSA-428f-mh7w-6w2x (CVE-2017-16127)
Published: 2020-09-01T18:56:40Z

The `pandora-doomsday` package is a malicious package that adds itself to the package.json of other packages discovered on the victim host and attempts to publish the package. 

It has been removed from the npm registry.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: pandora-doomsday, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0