aswin1906/github-advisory-2020.csv huggingface dataset:
Reflected Cross-Site Scripting in redis-commander
Advisory: GHSA-8c8c-4vfj-rrpc ()
Published: 2020-09-01T19:05:11Z

Affected versions of `redis-commander` contain a cross-site scripting vulnerability in the `highlighterId` paramter of the clipboard.swf component on hosts serving Redis Commander.

Mitigating factors:
Flash must be installed / enabled for this to work. The below proof of concept was verified to work using Firefox 57.0 on Windows 10 by manually installing the [Flash NPAPI Windows plugin](https://get.adobe.com/flashplayer/otherversions/)

## Proof of concept

```
http://instance/jstree/_docs/syntax/clipboard.swf?highlighterId=\%22))}%20catch(e)%20{alert(document.domain);}//
```


## Recommendation

No direct patch for this vulnerability is currently available.

At this time, the best mitigation is to use an alternative, functionally equivalent package, or to use extreme caution when using redis-commander, ensuring that redis-commmander is the only web page you have open, and avoiding clicking on any links.

Affected packages:
package: ecosystem: npm, name: redis-commander, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
fixed: 0.5.0
Malicious Package in bufver-xor
Advisory: GHSA-cr4x-w2v7-4mmf ()
Published: 2020-09-03T22:26:13Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bufver-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in bootstrap-vue
Advisory: GHSA-c7pp-x73h-4m2v ()
Published: 2020-09-02T15:53:46Z

Versions of `bootstrap-vue` prior to 2.0.0-rc.12 are vulnerable to Cross-Site Scripting. Due to insufficient input sanitization, components may be vulnerable to Cross-Site Scripting through the `options` variable. This may lead to the execution of malicious JavaScript on the user's browser.


## Recommendation

Upgrade to version 2.0.0-rc.12 or later.

Affected packages:
package: ecosystem: npm, name: bootstrap-vue, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0-rc.12, database_specific: last_known_affected_version_range: <= 2.0.0-rc.11
Denial of Service in @hapi/accept
Advisory: GHSA-9vrw-m88g-w75q ()
Published: 2020-09-03T15:45:53Z

Versions of `@hapi/accept` prior to 3.2.4 or 5.0.1 are vulnerable to Denial of Service. The Accept-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 3.2.4 or 5.0.1.

Affected packages:
package: ecosystem: npm, name: @hapi/accept, ranges: type: ECOSYSTEM, events: introduced: 3.2.0
fixed: 3.2.4
package: ecosystem: npm, name: @hapi/accept, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 5.0.1
Malicious Package in discord_debug_log
Advisory: GHSA-5x8q-gj67-rhf2 ()
Published: 2020-09-02T21:18:33Z

All versions of `discord_debug_log` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: discord_debug_log, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in zjjserver
Advisory: GHSA-xgf5-5gjr-4hjq (CVE-2017-16201)
Published: 2020-09-01T18:15:20Z

Affected versions of `zjjserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: zjjserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in gaoxiaotingtingting
Advisory: GHSA-qhf6-vqq9-q2p7 (CVE-2017-16108)
Published: 2020-09-01T16:58:58Z

Affected versions of `gaoxiaotingtingting` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: gaoxiaotingtingting, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in @ionic/core
Advisory: GHSA-r3xc-47qg-h929 ()
Published: 2020-09-03T17:06:09Z

Versions of  `@ionic/core` prior to 4.0.3, 4.1.3, 4.2.1 or 4.3.1 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser. This issue affects the components:
- `<ion-alert>.message`
- `<ion-searchbar>.placeholder`
- `<ion-infinite-scroll-content>.loadingText`
- `<ion-refresher-content>.pullingText`
- `<ion-refresher-content>.refershingText`


## Recommendation

- If you are using @ionic/core 4.0.x, upgrade to 4.0.3 or later.
- If you are using @ionic/core 4.1.x, upgrade to 4.1.3 or later.
- If you are using @ionic/core 4.2.x, upgrade to 4.2.1 or later.
- If you are using @ionic/core 4.3.x, upgrade to 4.3.1 or later.

Affected packages:
package: ecosystem: npm, name: @ionic/core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.0.3
package: ecosystem: npm, name: @ionic/core, ranges: type: ECOSYSTEM, events: introduced: 4.1.0
fixed: 4.1.3
package: ecosystem: npm, name: @ionic/core, ranges: type: ECOSYSTEM, events: introduced: 4.2.0
fixed: 4.2.1
package: ecosystem: npm, name: @ionic/core, ranges: type: ECOSYSTEM, events: introduced: 4.3.0
fixed: 4.3.1
Directory Traversal in peiserver
Advisory: GHSA-74f5-4m28-gq5c (CVE-2017-16214)
Published: 2020-09-01T18:09:59Z

Affected versions of `peiserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: peiserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-4f9m-pxwh-68hg ()
Published: 2020-09-11T21:20:14Z

Versions of `swagger-ui` prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 3.20.9 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.20.9
Malicious Package in aysnc
Advisory: GHSA-gfjr-xqhm-qvv3 ()
Published: 2020-09-02T20:16:09Z

All versions of `aysnc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: aysnc, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in test-module-a
Advisory: GHSA-76xq-58hj-vwm2 ()
Published: 2020-09-11T21:16:59Z

All versions of `test-module-a` contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking,


## Recommendation

Remove the package from your system. If you own any packages that were compromised please contact npm security immediately at security@npmjs.com. Also enable 2FA for publishing to further secure packages you maintain.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: test-module-a, ranges: type: ECOSYSTEM, events: introduced: 0
Potential XSS injection In PrestaShop contactform
Advisory: GHSA-95hx-62rh-gg96 (CVE-2020-15178)
Published: 2020-09-15T17:34:17Z

### Impact
An attacker is able to inject javascript while using the contact form. 

### Patches
The problem is fixed in v4.3.0

### References
[Cross-site Scripting (XSS) - Stored (CWE-79)](https://cwe.mitre.org/data/definitions/79.html)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: prestashop/contactform, ranges: type: ECOSYSTEM, events: introduced: 1.0.1
fixed: 4.3.0
Cross-Site Scripting in mavon-editor
Advisory: GHSA-jfcc-rm7f-xgf8 ()
Published: 2020-09-03T20:36:35Z

All versions of `mavon-editor` are vulnerable to Cross-Site Scripting. The package fails to sanitize entered input, allowing attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: mavon-editor, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.2
Forgeable Public/Private Tokens in jws
Advisory: GHSA-gjcw-v447-2w7q (CVE-2016-1000223)
Published: 2020-09-01T15:23:18Z

Affected versions of the `jws` package allow users to select what algorithm the server will use to verify a provided JWT. A malicious actor can use this behaviour to arbitrarily modify the contents of a JWT while still passing verification. For the common use case of the JWT as a bearer token, the end result is a complete authentication bypass with minimal effort.




## Recommendation

Update to version 3.0.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: jws, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.0
Malicious Package in ns-sha3
Advisory: GHSA-j67m-jg9p-ppg4 ()
Published: 2020-09-03T23:18:05Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ns-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in mfrs
Advisory: GHSA-jjgw-jf33-7fg9 (CVE-2017-16193)
Published: 2020-09-01T18:22:48Z

Affected versions of `mfrs` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: mfrs, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in tomato
Advisory: GHSA-wqhw-frpx-5mmp ()
Published: 2020-09-02T16:01:33Z

All versions of `tomato` are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: tomato, ranges: type: ECOSYSTEM, events: introduced: 0
Improper Authorization in googleapis
Advisory: GHSA-7543-mr7h-6v86 ()
Published: 2020-09-02T16:00:26Z

Versions of `googleapis` prior to 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials.


## Recommendation

Upgrade to version 39.1.0.

Affected packages:
package: ecosystem: npm, name: googleapis, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 39.1.0
Unsafe Merging of CORS Configuration Conflict in hapi
Advisory: GHSA-j3g2-m5jj-6336 (CVE-2015-9243)
Published: 2020-09-01T15:20:00Z

Versions of `hapi` prior to 11.1.4 are affected by a vulnerability that causes route-level CORS configuration to override connection-level or server-level CORS defaults. This may result in a situation where CORS permissions are less restrictive than intended.




## Recommendation

Update hapi to version 11.1.4 or later.

Affected packages:
package: ecosystem: npm, name: hapi, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 11.1.4
Malicious Package in bowee
Advisory: GHSA-wgvj-6v57-wjh3 ()
Published: 2020-09-02T21:30:14Z

Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bowee, ranges: type: ECOSYSTEM, events: introduced: 0
Invalid root may become trusted root in The Update Framework (TUF)
Advisory: GHSA-f8mr-jv2c-v8mg (CVE-2020-15163)
Published: 2020-09-09T17:29:27Z

### Impact
The Python TUF reference implementation `tuf<0.12` will incorrectly trust a previously downloaded root metadata file which failed verification at download time. This allows an attacker who is able to serve multiple new versions of root metadata (i.e. by a man-in-the-middle attack) culminating in a version which has not been correctly signed to control the trust chain for future updates.

While investigating the reported vulnerability, we discovered that the detailed client workflow was not fully implemented. Specifically, for step 1.3 the newly downloaded root metadata was not being verified with a threshold of keys specified in the new root metadata file.
This missing step of the client workflow has been implemented in [PR #1101](https://github.com/theupdateframework/tuf/pull/1101), which is included in [v0.14.0](https://github.com/theupdateframework/tuf/releases/tag/v0.14.0) of tuf.

### Patches
A [fix](https://github.com/theupdateframework/tuf/pull/885), is available in version [0.12](https://github.com/theupdateframework/tuf/releases/tag/v0.12.0) and newer.

### Workarounds
No workarounds are known for this issue.

### References
* Pull request resolving the invalid root becoming trusted issue [PR 885](https://github.com/theupdateframework/tuf/pull/885)
* Pull request implementing self verification of newly downloaded root metadata [PR 1101](https://github.com/theupdateframework/tuf/pull/1101)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: PyPI, name: tuf, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.12
Command Injection in npm-git-publish
Advisory: GHSA-49mg-94fc-2fx6 ()
Published: 2020-09-04T17:32:49Z

All versions of `npm-git-publish` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `execSync` call, which may allow attackers to execute arbitrary code in the system. The `publish` function is vulnerable through the `gitRemoteUrl` variable.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: npm-git-publish, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in wallet-address-validtaor
Advisory: GHSA-pc7q-c837-3wjq ()
Published: 2020-09-03T17:02:58Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: wallet-address-validtaor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffar-xor
Advisory: GHSA-f64g-whxf-w8f2 ()
Published: 2020-09-03T21:44:06Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffar-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in libubx
Advisory: GHSA-m7xv-7p93-g6q8 ()
Published: 2020-09-03T00:35:35Z

Version 1.0.3 of `libubx` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.2

Affected packages:
package: ecosystem: npm, name: libubx, versions: 1.0.3
Malicious Package in midway-dataproxy
Advisory: GHSA-mq9h-cwc2-6j5r ()
Published: 2020-09-03T17:42:27Z

All versions of `midway-dataproxy` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: midway-dataproxy, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in colne
Advisory: GHSA-mhxg-pr3j-v9gr ()
Published: 2020-09-03T19:41:22Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: colne, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-g336-c7wv-8hp3 ()
Published: 2020-09-01T15:58:06Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting via the `url` query string parameter.


## Recommendation

Update to 2.2.1 or later.

Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.1
Malicious Package in momen
Advisory: GHSA-h5vm-jhq7-w647 ()
Published: 2020-09-02T20:17:13Z

All versions of `momen` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: momen, ranges: type: ECOSYSTEM, events: introduced: 0
Arbitrary File Write in bin-links
Advisory: GHSA-gqf6-75v8-vr26 ()
Published: 2020-09-04T16:56:11Z

Versions of `bin-links` prior to 1.1.5 are vulnerable to an Arbitrary File Write. The package fails to restrict access to folders outside of the intended `node_modules` folder through the `bin` field. This allows attackers to create arbitrary files in the system. Note it is not possible to overwrite files that already exist.


## Recommendation

Upgrade to version 1.1.5 or later.

Affected packages:
package: ecosystem: npm, name: bin-links, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.5
Malicious Package in bs85
Advisory: GHSA-gvm7-8fq3-qjj2 ()
Published: 2020-09-03T19:43:18Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bs85, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Remote Code Execution in office-converter
Advisory: GHSA-9p64-h5q4-phpm ()
Published: 2020-09-02T15:44:58Z

All versions of `office-converter` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: office-converter, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in pm-controls
Advisory: GHSA-84qj-9qf2-q92r ()
Published: 2020-09-03T00:32:30Z

Version 1.1.8 of `pm-controls` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised. Users may downgrade to 1.1.7

Affected packages:
package: ecosystem: npm, name: pm-controls, versions: 1.1.8
Malicious Package in singale
Advisory: GHSA-crfh-jmv2-2f9v ()
Published: 2020-09-03T17:03:11Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: singale, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Regular Expression Denial of Service in sql-injection
Advisory: GHSA-hvxq-j2r4-4jm8 ()
Published: 2020-09-03T20:31:04Z

All versions of `sql-injection` are vulnerable to Regular Expression Denial of Service. The package processes a request's body with regular expressions that may take exponentially longer to execute for large inputs.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: sql-injection, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in soletta-dev-app
Advisory: GHSA-8mgg-5x65-m4m4 ()
Published: 2020-09-11T21:08:19Z

All versions of `soletta-dev-app` are vulnerable to Command Injection. The package does not validate user input on the `/api/service/status` API endpoint, passing contents of the `service` query parameter to an exec call. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: soletta-dev-app, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in koa-body-parse
Advisory: GHSA-wqgq-mfvj-6qxp ()
Published: 2020-09-03T19:49:03Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: koa-body-parse, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in portionfatty12
Advisory: GHSA-p8fm-w787-x6x3 ()
Published: 2020-09-02T15:50:28Z

All versions of `portionfatty12` are considered malicious. The package is malware designed to steal user's data. When installed it uploads the user's public SSH keys to a remote server.


## Recommendation

This package is not available on the npm Registry anymore. If you happen to find this package in your environment you should consider the system it was installed on compromised and assess if further response (such as rotating all credentials found on the compromised machine) is necessary.


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: portionfatty12, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
DOM-based XSS in gmail-js
Advisory: GHSA-c7pp-g2v2-2766 (CVE-2016-1000228)
Published: 2020-09-01T15:32:04Z

Affected versions of `gmail-js` are vulnerable to cross-site scripting in the `tools.parse_response`, `helper.get.visible_emails_post`, and `helper.get.email_data_post` functions, which pass user input directly into the Function constructor.



## Recommendation

Update to version 0.6.5 or later.

Affected packages:
package: ecosystem: npm, name: gmail-js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.6.5, database_specific: last_known_affected_version_range: <= 0.6.4
Malicious Package in node-ftp
Advisory: GHSA-5jgp-pg4f-q8vj ()
Published: 2020-09-03T19:55:42Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: node-ftp, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in wallet-address-vaildator
Advisory: GHSA-m6q2-9pfm-2wvr ()
Published: 2020-09-03T17:02:49Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: wallet-address-vaildator, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Out of bounds access in tensorflow-lite
Advisory: GHSA-hx2x-85gr-wrpq (CVE-2020-15212)
Published: 2020-09-25T18:29:00Z

### Impact
In TensorFlow Lite models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/lite/kernels/internal/reference/reference_ops.h#L2625-L2631

Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `output_data` buffer.

This might result in a segmentation fault but it can also be used to further corrupt the memory and can be chained with other vulnerabilities to create more advanced exploits.

### Patches
We have patched the issue in 204945b and will release patch releases for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1, or 2.3.1.

### Workarounds
A potential workaround would be to add a custom `Verifier` to the model loading code to ensure that the segment ids are all positive, although this only handles the case when the segment ids are stored statically in the model.

A similar validation could be done if the segment ids are generated at runtime between inference steps.

If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered from a variant analysis of [GHSA-p2cq-cprg-frvm](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p2cq-cprg-frvm).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Denial of Service in @commercial/hapi
Advisory: GHSA-66mv-xh68-h6v2 ()
Published: 2020-09-03T15:48:53Z

Affected versions of `@commercial/hapi` are vulnerable to Denial of Service. The CORS request handler has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to versions 16.8.2, 17.9.2, 18.4.1, 19.1.1 or later.

Affected packages:
package: ecosystem: npm, name: @commercial/hapi, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 16.8.2
package: ecosystem: npm, name: @commercial/hapi, ranges: type: ECOSYSTEM, events: introduced: 17.0.0
fixed: 17.9.2
package: ecosystem: npm, name: @commercial/hapi, ranges: type: ECOSYSTEM, events: introduced: 18.0.0
fixed: 18.4.1
package: ecosystem: npm, name: @commercial/hapi, ranges: type: ECOSYSTEM, events: introduced: 19.0.0
fixed: 19.1.1
Denial of Service in yar
Advisory: GHSA-gg6m-fhqv-hg56 (CVE-2014-4179)
Published: 2020-09-01T15:15:36Z

Versions of `yar` prior to 2.2.0 are affected by a denial of service vulnerability related to an invalid encrypted session cookie value.

When an invalid encryped session cookie value is provided, the process will crash.


## Recommendation

Update to version 2.2.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: yar, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.0
Denial of Service in @hapi/subtext
Advisory: GHSA-4rgj-8mq3-hggj ()
Published: 2020-09-03T20:32:11Z

Versions of `@hapi/subtext` prior to 6.1.2 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

Upgrade to version 6.1.2 or later.

Affected packages:
package: ecosystem: npm, name: @hapi/subtext, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.1.2
Malicious Package in jw-sha3
Advisory: GHSA-8g3r-968r-c644 ()
Published: 2020-09-03T23:15:58Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jw-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in dmmcquay.lab6
Advisory: GHSA-ccw5-7vfh-p5hm (CVE-2017-16208)
Published: 2020-09-01T18:14:15Z

Affected versions of `dmmcquay.lab6` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: dmmcquay.lab6, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in budfer-xor
Advisory: GHSA-6584-gfwm-3vc3 ()
Published: 2020-09-03T21:43:01Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: budfer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in radic-util
Advisory: GHSA-8qh7-xw58-3ww7 ()
Published: 2020-09-11T21:25:37Z

Version 1.0.2 of `radic-util` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.1

Affected packages:
package: ecosystem: npm, name: radic-util, versions: 1.0.2
Cross-Site Scripting in console-feed
Advisory: GHSA-g9wg-wq4f-2x5w ()
Published: 2020-09-03T19:00:10Z

Versions of `console-feed` prior to 2.8.10 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape the rendered output. If an application uses `console-feed` and a malicious JavaScript payload was passed to a `console.log('%_', payload)` call, the package would render HTML containing the malicious payload.


## Recommendation

Upgrade to version 2.8.10 or later.

Affected packages:
package: ecosystem: npm, name: console-feed, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.10
Malicious Package in wbe3
Advisory: GHSA-hg7w-2pf7-mxm2 ()
Published: 2020-09-03T17:02:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: wbe3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in giting
Advisory: GHSA-7r9x-hr76-jr96 ()
Published: 2020-09-04T17:26:18Z

All versions of `gitting` are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an `exec` call, which may allow attackers to execute arbitrary code in the system. The `pull` function is vulnerable through the `branch` variable.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: giting, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in fsk-server
Advisory: GHSA-c3hr-wwh3-qm54 (CVE-2017-16090)
Published: 2020-09-01T16:47:09Z

Affected versions of `fsk-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: fsk-server, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
XSS in client rendered block templates in rendr
Advisory: GHSA-v5hp-35hw-cw5x (CVE-2016-1000230)
Published: 2020-09-01T15:33:10Z

Affected versions of `rendr` are vulnerable to cross-site scripting when client side rendering is done inside a `_block`.

Server side rendering is not affected and is properly escaped.


## Recommendation

Update to version 1.1.4 or later.

Affected packages:
package: ecosystem: npm, name: rendr, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.4, database_specific: last_known_affected_version_range: <= 1.1.3
Malicious Package in foever
Advisory: GHSA-j3qq-qvc8-c6g7 ()
Published: 2020-09-01T21:15:09Z

All versions of `foever` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: foever, ranges: type: ECOSYSTEM, events: introduced: 0
Cross-Site Scripting in ag-grid-community
Advisory: GHSA-7p6w-x2gr-rrf8 ()
Published: 2020-09-02T21:28:05Z

Versions of `ag-grid-community` prior to 14.0.0 are vulnerable to Cross-Site Scripting (XSS). Grid contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid. 


## Recommendation

Upgrade to version 14.0.0 or later

Affected packages:
package: ecosystem: npm, name: ag-grid-community, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 14.0.0
Malicious Package in buffe2-xor
Advisory: GHSA-3f97-rj68-2pjf ()
Published: 2020-09-03T21:48:35Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffe2-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in superhappyfuntime
Advisory: GHSA-6qgx-f452-7699 ()
Published: 2020-09-03T23:28:39Z

All versions of `superhappyfuntime` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: superhappyfuntime, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in google-closure-library
Advisory: GHSA-r9q4-w3fm-wrm2 ()
Published: 2020-09-02T21:21:43Z

Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through Mutation Cross-Site Scripting.


## Recommendation

Upgrade to version 20190301.0.0 or later.

Affected packages:
package: ecosystem: npm, name: google-closure-library, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 20190301.0.0
Malicious Package in codify
Advisory: GHSA-2q6w-rxf3-4wc9 ()
Published: 2020-09-01T19:49:18Z

Version 0.3.1 of `codify` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.3.1 of this module is found installed you will want to replace it with a version before or after 0.3.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: codify, versions: 0.3.1
Open Redirect in apostrophe
Advisory: GHSA-h97g-4mx7-5p2p ()
Published: 2020-09-03T17:11:36Z

Versions of `apostrophe` prior to 2.92.0 are vulnerable to Open Redirect. The package redirected requests to third-party websites if escaped URLs followed by a trailing `/` were appended at the end.



## Recommendation

Update to version 2.92.0 or later.

Affected packages:
package: ecosystem: npm, name: apostrophe, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.92.0
Malicious Package in buffer-xmr
Advisory: GHSA-5327-gfq5-8f4m ()
Published: 2020-09-03T21:56:23Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xmr, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in addax
Advisory: GHSA-4q8f-5xxj-946r ()
Published: 2020-09-03T02:40:51Z

Versions of `addax` prior to 1.1.0 are vulnerable to Command Injection. The package does not validate user input on the `presignPath` function which receives input directly from the API endpoint. Exploiting the vulnerability requires authentication. This may allow attackers to run arbitrary commands in the system.


## Recommendation

Upgrade to version 1.1.0 or later.

Affected packages:
package: ecosystem: npm, name: addax, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.0
Malicious Package in sj-tw-sec
Advisory: GHSA-692h-g37c-qv44 ()
Published: 2020-09-03T23:25:30Z

All versions of `sj-tw-sec` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: sj-tw-sec, ranges: type: ECOSYSTEM, events: introduced: 0.0.0