aswin1906/github-advisory-2020.csv huggingface dataset:
CSRF Vulnerability in rails-ujs
Advisory: GHSA-xq5j-gw7f-jgj8 (CVE-2020-8167)
Published: 2020-07-07T16:34:10Z

There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.

Versions Affected:  rails <= 6.0.3
Not affected:       Applications which don't use rails-ujs.
Fixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1

Impact
------

This is a regression of CVE-2015-1840.

In the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.

Workarounds
-----------

To work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.

For example, code like this:

    link_to params

to code like this:

    link_to filtered_params

    def filtered_params
      # Filter just the parameters that you trust
    end

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: actionview, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.2.4.3, database_specific: last_known_affected_version_range: <= 5.2.4.2
package: ecosystem: RubyGems, name: actionview, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.0.3.1, database_specific: last_known_affected_version_range: <= 6.0.3
dot-prop Prototype Pollution vulnerability
Advisory: GHSA-ff7x-qrg7-qggm (CVE-2020-8116)
Published: 2020-07-29T20:56:59Z

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: dot-prop, ecosystem_specific: affected_functions: dot-prop.set, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.2.1
package: ecosystem: npm, name: dot-prop, ecosystem_specific: affected_functions: dot-prop.set, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.1.1
Command injection via Celery broker in Apache Airflow
Advisory: GHSA-976r-qfjj-c24w (CVE-2020-11981)
Published: 2020-07-27T16:57:33Z

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: apache-airflow, ecosystem_specific: affected_functions: airflow.www_rbac.views.Airflow.index, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.11
Directory traversal in rollup-plugin-server
Advisory: GHSA-34gh-3cwv-wvp2 (CVE-2020-7683)
Published: 2020-07-29T18:07:11Z

This affects all versions of package rollup-plugin-server. There is no path sanitization in readFile operation performed inside the readFileFromContentBase function.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: rollup-plugin-server, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.7.0
Potential XSS vulnerability in Kitodo.Presentation
Advisory: GHSA-fpqv-x9hm-35j9 (CVE-2020-16095)
Published: 2020-07-31T17:39:22Z

### Impact
Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting (XSS). Only sites using the `ListView`, `Navigation` or `PageView` plugins are affected.

It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site Scripting, although there is currently no known way to exploit this in Kitodo.Presentation.

### Patches
An updated version of Kitodo.Presentation is available on [GitHub](https://github.com/kitodo/kitodo-presentation/releases/tag/v3.1.2), [Packagist](https://packagist.org/packages/kitodo/presentation#v3.1.2) and in the [TYPO3 Extension Repository](https://extensions.typo3.org/extension/dlf/). Users are advised to update as soon as possible.

The issue was also fixed in release 2.3.1 of the 2.x branch, although it is generally not recommended to run this branch since it depends on an outdated TYPO3 version.

### References
TYPO3 Security Advisory [TYPO3-EXT-SA-2020-015](https://typo3.org/security/advisory/typo3-ext-sa-2020-015)
jQuery Security Advisory [GHSA-gxr4-xjj5-5px2](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2)
Open Bug Bounty Report [OBB-1219978](https://www.openbugbounty.org/reports/1219978/)

### Contact
If you have any questions or comments about this advisory:
* [Open an issue](https://github.com/kitodo/kitodo-presentation/issues/new/choose)
* Email us at [security@kitodo.org](mailto:security@kitodo.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: kitodo/presentation, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.2
Command injection in codecov (npm package)
Advisory: GHSA-xp63-6vf5-xf3v (CVE-2020-15123)
Published: 2020-07-20T17:20:20Z

### Impact

The `upload` method has a command injection vulnerability. Clients of the `codecov-node` library are unlikely to be aware of this, so they might unwittingly write code that contains a vulnerability.

A similar CVE was issued: [CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh), but the fix was incomplete. It only blocked `&`, and command injection is still possible using backticks instead to bypass the sanitizer.

We have written a [CodeQL](https://codeql.com) query, which automatically detects this vulnerability. You can see the results of the query on the `codecov-node` project [here](https://lgtm.com/query/7714424068617023832/).


### Patches
This has been patched in version 3.7.1

### Workarounds

None, however, the attack surface is low in this case. Particularly in the standard use of codecov, where the module is used directly in a build pipeline, not built against as a library in another application that may supply malicious input and perform command injection. 

### References
*  [CVE-2020-7597](https://github.com/advisories/GHSA-5q88-cjfq-g2mh)

### For more information
If you have any questions or comments about this advisory:
* Contact us via our [Security Email](mailto:security@codecov.io)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: codecov, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.7.1
Command Injection in Kylin
Advisory: GHSA-gprm-xqrc-c2j3 (CVE-2020-1956)
Published: 2020-07-27T22:51:44Z

Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.kylin:kylin-core-common, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.6.6
package: ecosystem: Maven, name: org.apache.kylin:kylin-core-common, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.2
Path Traversal in socket.io-file
Advisory: GHSA-9h4g-27m8-qjrg (CVE-2020-15779)
Published: 2020-07-07T19:24:47Z

All versions of `socket.io-file` are vulnerable to Path Traversal. The package fails to sanitize user input and uses it to generate the file upload paths. The `socket.io-file::createFile` message contains a `name` option that is passed directly to `path.join()`.   It is possible to upload files to arbitrary folders on the server by sending relative paths on the `name` value, such as `../../test.js`.  The `uploadDir` and `rename` options can be used to define the file upload path.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: socket.io-file, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 2.0.31
Privilege escalation in mysql-connector-jav
Advisory: GHSA-jcq3-cprp-m333 (CVE-2019-2692)
Published: 2020-07-01T17:12:20Z

Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/J). Supported versions that are affected are 8.0.15 and prior. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where MySQL Connectors executes to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.0 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).

Severity: type: CVSS_V3
score: CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: mysql:mysql-connector-java, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 8.0.16
Multiple stored XSS in RBAC Admin screens in Apache Airflow
Advisory: GHSA-q4p3-qw5c-mhpc (CVE-2020-11983)
Published: 2020-07-27T16:57:25Z

An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly, allowing authenticated users with appropriate permissions to create stored XSS attacks.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: apache-airflow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.11
Potential Remote Code Execution in TYPO3 with mediace extension
Advisory: GHSA-4h44-w6fm-548g (CVE-2020-15086)
Published: 2020-07-29T16:15:12Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1)
> * CWE-325, CWE-20, CWE-200, CWE-502

### Problem
It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains as described below.

* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007), [CVE-2020-15099](https://nvd.nist.gov/vuln/detail/CVE-2020-15099): Potential Privilege Escalation
  + the database server used for a TYPO3 installation must be accessible for an attacker (either via internet or shared hosting network)
  + `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5, high)
* [TYPO3-CORE-SA-2016-013](https://typo3.org/security/advisory/typo3-core-sa-2016-013), [CVE-2016-5091](https://nvd.nist.gov/vuln/detail/CVE-2016-5091): Insecure Deserialization & Remote Code Execution
  + an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation
  + `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1, critical)

The overall severity of this vulnerability is critical (9.1) based on mentioned attack chains and the fact it does not require any privileges.

### Solution
In case the extension is not used and required at all, it is suggested to uninstall and remove it from the system completely. Otherwise, an updated version 7.6.5 is available from the TYPO3 extension manager, Packagist and the TYPO3 extension repository:

* https://extensions.typo3.org/extension/download/mediace/7.6.5/zip/
* https://packagist.org/packages/friendsoftypo3/mediace#7.6.5

As a precautionary measure it is advised to change `encryptionKey` and database credentials in `typo3conf/LocalConfiguration.php`.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-EXT-SA-2020-014](https://typo3.org/security/advisory/typo3-ext-sa-2020-014)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: friendsoftypo3/mediace, ranges: type: ECOSYSTEM, events: introduced: 7.6.2
fixed: 7.6.5
npm CLI exposing sensitive information through logs
Advisory: GHSA-93f3-23rq-pjfp (CVE-2020-15095)
Published: 2020-07-07T18:56:16Z

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: npm, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.14.6
Context isolation bypass via leaked cross-context objects in Electron
Advisory: GHSA-m93v-9qjc-3g79 (CVE-2020-4076)
Published: 2020-07-07T00:01:07Z

### Impact
Apps using `contextIsolation` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### Non-Impacted Versions
* `9.0.0-beta.*`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.2.4
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.2.4
Out-of-bounds read in Pillow
Advisory: GHSA-43fq-w8qq-v88h (CVE-2020-11538)
Published: 2020-07-27T21:52:36Z

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: Pillow, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.1.0
XSS in Mapfish Print relating to JSONP support
Advisory: GHSA-w534-q4xf-h5v2 (CVE-2020-15231)
Published: 2020-07-07T16:32:49Z

### Impact
A user can use the JSONP support to do a Cross-site scripting.

### Patches
Use version >= 3.24

### Workarounds
No

### References
* https://github.com/mapfish/mapfish-print/pull/1397/commits/89155f2506b9cee822e15ce60ccae390a1419d5e
* https://cwe.mitre.org/data/definitions/79.html

### For more information
If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.mapfish.print:print-lib, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.24
package: ecosystem: Maven, name: org.mapfish.print:print-servlet, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.24
package: ecosystem: Maven, name: org.mapfish.print:print-standalone, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.24
Broken access control on files
Advisory: GHSA-43jj-2rwc-2m3f (CVE-2019-14273)
Published: 2020-07-15T17:38:04Z

In SilverStripe assets 4.0, there is broken access control on files.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: Packagist, name: silverstripe/framework, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.5
package: ecosystem: Packagist, name: silverstripe/framework, ranges: type: ECOSYSTEM, events: introduced: 4.4.0
fixed: 4.4.4
Unsafe object creation in json RubyGem
Advisory: GHSA-jphg-qwrw-7w9g (CVE-2020-10663)
Published: 2020-07-27T18:08:21Z

The JSON gem through 2.2.0 for Ruby, as used in Ruby 2.4 through 2.4.9, 2.5 through 2.5.7, and 2.6 through 2.6.5, has an Unsafe Object Creation Vulnerability. This is quite similar to CVE-2013-0269/GHSA-x457-cw4h-hq5f, but does not rely on poor garbage-collection behavior within Ruby. Specifically, use of JSON parsing methods can lead to creation of a malicious object within the interpreter, with adverse effects that are application-dependent.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: RubyGems, name: json, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.0
Insecure defaults in UmbracoForms
Advisory: GHSA-8m73-w2r2-6xxj (CVE-2020-7685)
Published: 2020-07-29T17:29:51Z

This affects all versions of package UmbracoForms. When using the default configuration for upload forms, it is possible to upload arbitrary file types. The package offers a way for users to mitigate the issue. The users of this package can create a custom workflow and frontend validation that blocks certain file types, depending on their security needs and policies.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: NuGet, name: UmbracoForms, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 8.4.1
Possible pod name collisions in jupyterhub-kubespawner
Advisory: GHSA-v7m9-9497-p9gr (CVE-2020-15110)
Published: 2020-07-22T23:07:16Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

JupyterHub deployments using:

- KubeSpawner <= 0.11.1 (e.g. zero-to-jupyterhub 0.9.0) and
- enabled named_servers (not default), and
- an Authenticator that allows:
  - usernames with hyphens or other characters that require escape (e.g. `user-hyphen` or `user@email`), and
  - usernames which may match other usernames up to but not including the escaped character (e.g. `user` in the above cases)

In this circumstance, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Patch will be released in kubespawner 0.12 and zero-to-jupyterhub 0.9.1

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

#### KubeSpawner

Specify configuration:

for KubeSpawner
```python
from traitlets import default
from kubespawner import KubeSpawner

class PatchedKubeSpawner(KubeSpawner):
    @default("pod_name_template")
    def _default_pod_name_template(self):
        if self.name:
            return "jupyter-{username}-{servername}"
        else:
            return "jupyter-{username}"

    @default("pvc_name_template")
    def _default_pvc_name_template(self):
        if self.name:
            return "claim-{username}-{servername}"
        else:
            return "claim-{username}"

c.JupyterHub.spawner_class = PatchedKubeSpawner
```

**Note for KubeSpawner:** this configuration will behave differently before and after the upgrade, so will need to be removed when upgrading. Only apply this configuration while still using KubeSpawner ≤ 0.11.1 and remove it after upgrade to ensure consistent pod and pvc naming.

Changing the name template means pvcs for named servers will have different names. This will result in orphaned PVCs for named servers across Hub upgrade! This may appear as data loss for users, depending on configuration, but the orphaned PVCs will still be around and data can be migrated manually (or new PVCs created manually to reference existing PVs) before deleting the old PVCs and/or PVs.

### References
_Are there any links users can visit to find out more?_

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [kubespawner](https://github.com/jupyterhub/kubespawner)
* Email us at [security@ipython.org](mailto:security@ipython.org)

Credit: Jining Huang

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: jupyterhub-kubespawner, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.12, database_specific: last_known_affected_version_range: <= 0.11.1
SQL Injection in Kylin
Advisory: GHSA-7hmh-8gwv-mfvq (CVE-2020-1937)
Published: 2020-07-27T22:51:47Z

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.kylin:kylin-server-base, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.6.5
package: ecosystem: Maven, name: org.apache.kylin:kylin-server-base, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.1, versions: 3.0.0
Cross-site Scripting in October
Advisory: GHSA-3pc2-fm7p-q2vg (CVE-2020-4061)
Published: 2020-07-02T16:55:11Z

### Impact
Pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack.

### Patches
Issue has been patched in Build 467 (v1.0.467).

### Workarounds
Apply https://github.com/octobercms/october/commit/b384954a29b89117e1c0d6035b3ede4f46df67c5 to your installation manually if unable to upgrade to Build 467.

### References
- https://research.securitum.com/the-curious-case-of-copy-paste/

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat Assessment
Assessed as Low given that by the nature of the attack it can only impact users that do it to themselves by copying and pasting from malicious websites.

### Acknowledgements

Thanks to [Michał Bentkowski of Securitum](https://research.securitum.com/authors/michal-bentkowski/) for finding the original issue in Froala and @tomaszstrojny for reporting the issue to the October CMS team.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: october/backend, ranges: type: ECOSYSTEM, events: introduced: 1.0.319
fixed: 1.0.467
Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
Advisory: GHSA-3x94-fv5h-5q2c (CVE-2020-15099)
Published: 2020-07-29T16:15:32Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5)
> * CWE-20, CWE-200

### Problem
In case an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal _encryptionKey_ was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch _typo3conf/LocalConfiguration.php_ which again contains the _encryptionKey_ as well as credentials of the database management system being used.

In case a database server is directly accessible either via internet or in a shared hosting network, this allows to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions.

### Solution
Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.5.20
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.4.6
Remote code execution in Apache Airflow
Advisory: GHSA-rvmq-4x66-q7j3 (CVE-2020-11978)
Published: 2020-07-27T16:57:33Z

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: apache-airflow, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.11
HTTP response splitting in uvicorn
Advisory: GHSA-f97h-2pfx-f59f (CVE-2020-7695)
Published: 2020-07-29T18:07:20Z

Uvicorn before 0.11.7 is vulnerable to HTTP response splitting. CRLF sequences are not escaped in the value of HTTP headers. Attackers can exploit exploit this to add arbitrary headers to HTTP responses, or even return an arbitrary response body, whenever crafted input is used to construct HTTP headers.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: uvicorn, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.11.7
Authorization header is not sanitized in an error object in auth0
Advisory: GHSA-5jpf-pj32-xx53 (CVE-2020-15125)
Published: 2020-07-29T16:26:22Z

### Overview
Versions before and including `2.27.0` use a block list of specific keys that should be sanitized from the request object contained in the error object.  When a request to Auth0 management API fails, the key for `Authorization` header is not sanitized and the `Authorization` header value can be logged exposing a bearer token.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using `auth0` npm package
- You are using a Machine to Machine application authorized to use Auth0's management API https://auth0.com/docs/flows/concepts/client-credentials

### How to fix that?
Upgrade to version `2.27.1`

### Will this update impact my users?
The fix provided in patch will not affect your users.

### Credit
http://github.com/osdiab

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: auth0, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.27.1
GraphQL: Security breach on Viewer query
Advisory: GHSA-236h-rqv8-8q73 (CVE-2020-15126)
Published: 2020-07-22T23:06:47Z

### Impact
An authenticated user using the viewer GraphQL query can bypass all read security on his User object and can also bypass all objects linked via relation or Pointer on his User object.

### Patches
This vulnerability has been patched in Parse Server 4.3.0.

### Workarounds
No

### References
See [commit 78239ac](https://github.com/parse-community/parse-server/commit/78239ac9071167fdf243c55ae4bc9a2c0b0d89aa) for details.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: parse-server, ranges: type: ECOSYSTEM, events: introduced: 3.5.0
fixed: 4.3.0
Directory traversal in rollup-plugin-server
Advisory: GHSA-vr98-27qj-3c8q (CVE-2020-7686)
Published: 2020-07-29T18:07:35Z

This affects all versions of package rollup-plugin-dev-server. There is no path sanitization in `readFile` operation inside the `readFileFromContentBase` function.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: rollup-plugin-server, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.7.0
Directory traversal in Apache RocketMQ
Advisory: GHSA-5x3v-2gxr-59m2 (CVE-2019-17572)
Published: 2020-07-01T17:26:15Z

In Apache RocketMQ 4.2.0 to 4.6.0, when the automatic topic creation in the broker is turned on by default, an evil topic like “../../../../topic2020” is sent from rocketmq-client to the broker, a topic folder will be created in the parent directory in brokers, which leads to a directory traversal vulnerability. Users of the affected versions should apply one of the following: Upgrade to Apache RocketMQ 4.6.1 or later.

Affected packages:
package: ecosystem: Maven, name: org.apache.rocketmq:rocketmq-broker, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.6.1
Command Injection in git-tags-remote
Advisory: GHSA-gm9x-q798-hmr4 ()
Published: 2020-07-29T14:53:40Z

All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the `repo` value passed to the function is user-controlled.  

The following proof-of-concept creates a file in `/tmp`:  
```
const gitTagsRemote = require('git-tags-remote');

gitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo "Injection Success" > /tmp/command-injection.test')
.then(tags => console.log(tags));
```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: git-tags-remote, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.4
Context isolation bypass via contextBridge in Electron
Advisory: GHSA-h9jc-284h-533g (CVE-2020-4077)
Published: 2020-07-07T00:01:10Z

### Impact
Apps using both `contextIsolation` and `contextBridge` are affected.

This is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions.

### Workarounds
There are no app-side workarounds, you must update your Electron version to be protected.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.2.4
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.2.4
Arbitrary file read via window-open IPC in Electron
Advisory: GHSA-f9mq-jph6-9mhm (CVE-2020-4075)
Published: 2020-07-07T00:01:13Z

### Impact
The vulnerability allows arbitrary local file read by defining unsafe window options on a child window opened via window.open.

### Workarounds
Ensure you are calling `event.preventDefault()` on all [`new-window`](https://electronjs.org/docs/api/web-contents#event-new-window) events where the `url` or `options` is not something you expect.

### Fixed Versions
* `9.0.0-beta.21`
* `8.2.4`
* `7.2.4`

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@electronjs.org](mailto:security@electronjs.org)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.2.4
package: ecosystem: npm, name: electron, ranges: type: ECOSYSTEM, events: introduced: 8.0.0
fixed: 8.2.4
Out-of-bounds reads in Pillow
Advisory: GHSA-vj42-xq3r-hr3r (CVE-2020-10994)
Published: 2020-07-27T21:52:39Z

In `libImaging/Jpeg2KDecode.c` in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: Pillow, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.1.0
Signature Malleabillity in elliptic
Advisory: GHSA-vh7m-p724-62c2 (CVE-2020-13822)
Published: 2020-07-29T20:40:35Z

The Elliptic package before version 6.5.3 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected packages:
package: ecosystem: npm, name: elliptic, ecosystem_specific: affected_functions: elliptic.ec, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.5.3
Improper Input Validation in sails-hook-sockets
Advisory: GHSA-f7f4-hqp2-7prc (CVE-2018-21036)
Published: 2020-07-24T20:10:21Z

Sails.js before v1.0.0-46 allows attackers to cause a denial of service with a single request because there is no error handler in sails-hook-sockets to handle an empty pathname in a WebSocket request.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: sails-hook-sockets, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.5.5
Directory traversal in fast-http
Advisory: GHSA-7phr-5m9x-rw9q (CVE-2020-7687)
Published: 2020-07-27T16:02:57Z

This affects all versions of package fast-http. There is no path sanitization in the path provided at fs.readFile in index.js.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: fast-http, ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.1.3
False-positive validity for NFT1 genesis transactions in SLPJS
Advisory: GHSA-cc2p-4jhr-xhhx (CVE-2020-15130)
Published: 2020-07-30T14:58:42Z

### Impact
In the npm package named "slpjs", versions prior to 0.27.4 are vulnerable to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification.

### Patches
npm package "slpjs" has been patched and is published and tagged as version 0.27.4.

### Workarounds
Upgrade to slpjs 0.27.4.

### References
* Package location: https://www.npmjs.com/package/slpjs
* SLP NFT1 spec: https://slp.dev/specs/slp-nft-1/#nft1-protocol-requirements
* Git commit hash fixing this issue: https://github.com/simpleledger/slpjs/commit/290c20e8bff13ac81459d43e54cac232b5e3456c
* Unit tests have been added to assist validator implementations in avoiding this bug: https://github.com/simpleledger/slp-unit-test-data/commit/8c942eacfae12686dcf1f3366321445a4fba73e7

### For more information
If you have any questions or comments about this advisory please open an issue in the [slp-validate](https://github.com/simpleledger/slpjs/issues) repository.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: slpjs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.27.4
Uncontrolled resource consumption in jpeg-js
Advisory: GHSA-w7q9-p3jq-fmhm (CVE-2020-8175)
Published: 2020-07-27T15:46:57Z

Uncontrolled resource consumption in `jpeg-js` before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: jpeg-js, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.0
Sensitive information exposure through logs in npm-registry-fetch
Advisory: GHSA-jmqm-f2gx-4fjv ()
Published: 2020-07-07T18:59:10Z

Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: npm-registry-fetch, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.0.5
package: ecosystem: npm, name: npm-registry-fetch, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 8.1.1
User passwords are stored in clear text in the Django session
Advisory: GHSA-vhr6-pvjm-9qwf (CVE-2020-15105)
Published: 2020-07-10T20:55:00Z

### Impact

django-two-factor-auth versions 1.11 and before store the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authentication code. This means that the password is stored in clear text in the session for an arbitrary amount of time, and potentially forever if the user begins the login process by entering their username and password, and then leaves before entering their two-factor authentication code.

The severity of this issue depends on which type of session storage you have configured: in the worst case, if you're using Django's default database session storage, then users' password are stored in clear text in your database. In the best case, if you're using Django's signed cookie session, then users' passwords are only stored in clear text within their browser's cookie store. In the common case of using Django's cache session store, the users' password are stored in clear text in whatever cache storage you have configured (typically Memcached or Redis).

### Patches

Upgrade to version 1.12 to resolve this issue.

After upgrading, users should be sure to delete any clear text passwords that have been stored. For example, if you're using the database session backend, you'll likely want to delete any session record from the database and purge that data from any database backups or replicas.

In addition, affected organizations who have suffered a database breach while using an affected version should inform their users that their clear text passwords have been compromised. All organizations should encourage users whose passwords were insecurely stored to change these passwords on any sites where they were used.

### Workarounds

Switching Django's session storage to use signed cookies instead of the database or cache lessens the impact of this issue, but should not be done without a thorough understanding of the security tradeoffs of using signed cookies rather than a server-side session storage. There is no way to fully mitigate the issue without upgrading.

### References

For an explanation of why storing cleartext password is a substantial vulnerability: [Hashing Passwords: One-Way Road to Security](https://auth0.com/blog/hashing-passwords-one-way-road-to-security/).  
For documentation on configuring the Django session storage engine: [Django session documentation](https://docs.djangoproject.com/en/3.0/topics/http/sessions/).

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [the repo](https://github.com/Bouke/django-two-factor-auth)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N
Affected packages:
package: ecosystem: PyPI, name: django-two-factor-auth, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.12.0
Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
Advisory: GHSA-m5vr-3m74-jwxp (CVE-2020-15098)
Published: 2020-07-29T16:15:19Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2)
> * CWE-325, CWE-20, CWE-200, CWE-502

### Problem
It has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains as described below.

* [TYPO3-CORE-SA-2020-007](https://typo3.org/security/advisory/typo3-core-sa-2020-007), [CVE-2020-15099](https://nvd.nist.gov/vuln/detail/CVE-2020-15099): Potential Privilege Escalation
  + the database server used for a TYPO3 installation must be accessible for an attacker (either via internet or shared hosting network)
  + `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (7.5, high)
* [TYPO3-CORE-SA-2016-013](https://typo3.org/security/advisory/typo3-core-sa-2016-013), [CVE-2016-5091](https://nvd.nist.gov/vuln/detail/CVE-2016-5091): Insecure Deserialization & Remote Code Execution
  + an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation
  + `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (9.1, critical)

The overall severity of this vulnerability is **high (8.2)** based on mentioned attack chains and the requirement of having a valid backend user session (authenticated).

### Solution
Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described.

### Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.

### References
* [TYPO3-CORE-SA-2020-008](https://typo3.org/security/advisory/typo3-core-sa-2020-008)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 9.0.0
fixed: 9.5.20
package: ecosystem: Packagist, name: typo3/cms-core, ranges: type: ECOSYSTEM, events: introduced: 10.0.0
fixed: 10.4.6
XML external entity injection in Terracotta Quartz Scheduler
Advisory: GHSA-9qcf-c26r-x5rf (CVE-2019-13990)
Published: 2020-07-01T17:55:03Z

initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.quartz-scheduler:quartz, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.2
Incorrect access control in typo3_forum
Advisory: GHSA-57gr-jvqr-3hwm (CVE-2020-15513)
Published: 2020-07-29T18:07:38Z

The typo3_forum extension before 1.2.1 for TYPO3 has Incorrect Access Control.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: Packagist, name: mittwald/typo3_forum, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.1
Server side template injection in Apache Camel
Advisory: GHSA-9vfj-5g7h-4p24 (CVE-2020-11994)
Published: 2020-07-29T18:08:48Z

Server-Side Template Injection and arbitrary file disclosure on Camel templating components

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.camel:camel-robotframework, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.4.0
Buffer overflow in Pillow
Advisory: GHSA-8843-m7mw-mxqm (CVE-2020-10379)
Published: 2020-07-27T21:52:41Z

In Pillow before 7.1.0, there are two Buffer Overflows in `libImaging/TiffDecode.c`.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: Pillow, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.1.0
Out-of-bounds reads in Pillow
Advisory: GHSA-cqhg-xjhh-p8hf (CVE-2020-10177)
Published: 2020-07-27T21:52:43Z

Pillow before 7.1.0 has multiple out-of-bounds reads in `libImaging/FliDecode.c`.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: Pillow, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 7.1.0
Directory traversal in Rack::Directory app bundled with Rack
Advisory: GHSA-5f9h-9pjv-v6j7 (CVE-2020-8161)
Published: 2020-07-06T21:31:02Z

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: RubyGems, name: rack, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.1.3
Remote Code Execution in scratch-vm
Advisory: GHSA-vc9j-fhvv-8vrf (CVE-2020-14000)
Published: 2020-07-27T19:55:52Z

MIT Lifelong Kindergarten Scratch scratch-vm before `0.2.0-prerelease.20200714185213` loads extension URLs from untrusted project.json files with certain `_` characters, resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is `getExtensionIdForOpcode` in serialization/sb3.js. The use of `_` is incompatible with a protection mechanism in older versions, in which URLs were split and consequently deserialization attacks were prevented. 

**NOTE**: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: scratch-vm, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.0-prerelease.20200714185213, database_specific: last_known_affected_version_range: <= 0.2.0-prerelease.20200709173451
Command Injection in Kylin
Advisory: GHSA-qwfw-gxx2-mmv2 (CVE-2020-13925)
Published: 2020-07-27T22:51:37Z

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.apache.kylin:kylin-server-base, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.0
Remote code execution in turn extension for TYPO3
Advisory: GHSA-q7j5-9j77-g4gq (CVE-2020-15515)
Published: 2020-07-29T18:07:41Z

The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: marcwillmann/turn, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.3
XXE attack in Mapfish Print
Advisory: GHSA-vjv6-gq77-3mjw (CVE-2020-15232)
Published: 2020-07-07T16:32:45Z

### Impact
A user can do to an XML External Entity (XXE) attack with the provided SDL style.

### Patches
Use version >= 3.24

### Workarounds
No

### References
* https://cwe.mitre.org/data/definitions/611.html
* https://github.com/mapfish/mapfish-print/pull/1397/commits/e1d0527d13db06b2b62ca7d6afb9e97dacd67a0e

### For more information
If you have any questions or comments about this advisory Comment the pull request: https://github.com/mapfish/mapfish-print/pull/1397


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.mapfish.print:print-lib, ranges: type: ECOSYSTEM, events: introduced: 3.0
fixed: 3.24
package: ecosystem: Maven, name: org.mapfish.print:print-servlet, ranges: type: ECOSYSTEM, events: introduced: 3.0
fixed: 3.24
package: ecosystem: Maven, name: org.mapfish.print:print-standalone, ranges: type: ECOSYSTEM, events: introduced: 3.0
fixed: 3.24
Sandbox bypass in constantinople
Advisory: GHSA-hg7c-66ff-9q8g ()
Published: 2020-07-31T16:18:53Z
Withdrawn: 2020-07-31T16:18:53Z

constantinople before 3.1.1 affected by a sandbox bypass.

Affected packages:
package: ecosystem: npm, name: constantinople, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.1