aswin1906/github-advisory-2020.csv huggingface dataset:
Malicious Package in asyync
Advisory: GHSA-rm7c-x424-g2mw ()
Published: 2020-09-02T18:36:31Z

All versions of `asyync` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: asyync, ranges: type: ECOSYSTEM, events: introduced: 0
Sandbox Breakout / Arbitrary Code Execution in sandbox
Advisory: GHSA-fm4j-4xhm-xpwx ()
Published: 2020-09-02T15:51:34Z

All versions of `sandbox` are vulnerable to Sandbox Escape leading to Remote Code Execution. Due to insufficient input sanitization it is possible to escape the sandbox using constructors.

## Proof of concept
```
var Sandbox = require("sandbox")
s = new Sandbox()
code = `new Function("return (this.constructor.constructor('return (this.process.mainModule.constructor._load)')())")()("util").inspect("hi")`
s.run(code)
```


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: sandbox, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Unsafe deserialization in Yii 2
Advisory: GHSA-699q-wcff-g9mj (CVE-2020-15148)
Published: 2020-09-15T18:19:56Z

### Impact

Remote code execution in case application calls `unserialize()` on user input containing specially crafted string.

### Patches

2.0.38

### Workarounds

Add the following to BatchQueryResult.php:

```php
public function __sleep()
{
    throw new \BadMethodCallException('Cannot serialize '.__CLASS__);
}

public function __wakeup()
{
    throw new \BadMethodCallException('Cannot unserialize '.__CLASS__);
}
```

### For more information

If you have any questions or comments about this advisory, [contact us through security form](https://www.yiiframework.com/security).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
Affected packages:
package: ecosystem: Packagist, name: yiisoft/yii2, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.38
Directory Traversal in sgqserve
Advisory: GHSA-m8pw-hgvj-cwcm (CVE-2017-16215)
Published: 2020-09-01T18:08:55Z

Affected versions of `sgqserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: sgqserve, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Privilege Escalation in cordova-plugin-inappbrowser
Advisory: GHSA-c6pw-q7f2-97hv (CVE-2019-0219)
Published: 2020-09-04T17:57:43Z

Versions of `cordova-plugin-inappbrowser` prior to 3.1.0 are vulnerable to Privilege Escalation. A website running in the InAppBrowser webview on Android could execute arbitrary JavaScript in the main application's webview using a specially crafted gap-iab: URI. This affects Cordova Android applications using the package.


## Recommendation

Upgrade to version 3.1.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: cordova-plugin-inappbrowser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.0
Malicious Package in experss
Advisory: GHSA-mmph-wp49-r48h ()
Published: 2020-09-02T20:20:26Z

All versions of `experss` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: experss, ranges: type: ECOSYSTEM, events: introduced: 0
Prototype Pollution in subtext
Advisory: GHSA-g64q-3vg8-8f93 ()
Published: 2020-09-03T15:47:10Z

All versions of `subtext` are vulnerable to Prototype Pollution. A multipart payload can be constructed in a way that one of the parts’ content can be set as the entire payload object’s prototype. If this prototype contains data, it may bypass other validation rules which enforce access and privacy. If this prototype evaluates to null, it can cause unhandled exceptions when the request payload is accessed.


## Recommendation

This package is deprecated and is now maintained as `@hapi/subtext`. Please update your dependencies to use `@hapi/subtext`. 

Affected packages:
package: ecosystem: npm, name: subtext, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Sensitive Data Exposure in put
Advisory: GHSA-v6gv-fg46-h89j ()
Published: 2020-09-03T16:48:36Z

All versions of `put` are vulnerable to Uninitialized Memory Exposure. The package incorrectly calculates the allocated Buffer size and does not trim the bytes written, which may allow attackers to access uninitialized memory containing sensitive data. This vulnerability only affects versions of Node.js <=6.x.


## Recommendation

Upgrade your Node.js version or consider using an alternative package.

Affected packages:
package: ecosystem: npm, name: put, ranges: type: ECOSYSTEM, events: introduced: 0
Information Exposure in cordova-android
Advisory: GHSA-gwpf-62xp-vrg6 (CVE-2016-6799)
Published: 2020-09-11T21:14:49Z

Versions of `cordova-android` prior to 6.0.0 are vulnerable to Information Exposure through log files. The application calls methods of the Log class. Messages passed to these methods (Log.v(), Log.d(), Log.i(), Log.w(), and Log.e()) are stored in a series of circular buffers on the device. By default, a maximum of four 16 KB rotated logs are kept in addition to the current log. The logged data can be read using Logcat on the device. When using platforms prior to Android 4.1 (Jelly Bean), the log data is not sandboxed per application; any application installed on the device has the capability to read data logged by other applications.


## Recommendation

Upgrade to version 6.0.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: cordova-android, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.0.0
Directory Traversal in jansenstuffpleasework
Advisory: GHSA-f8rj-4v7g-p5rj (CVE-2017-16176)
Published: 2020-09-01T18:53:29Z

Affected versions of `jansenstuffpleasework` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: jansenstuffpleasework, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
DLL Injection in kerberos
Advisory: GHSA-m2mx-rfpw-jghv (CVE-2020-13110)
Published: 2020-09-04T18:01:59Z

Version of `kerberos` prior to 1.0.0 are vulnerable to DLL Injection. The package loads DLLs without specifying a full path. This may allow attackers to create a file with the same name in a folder that precedes the intended file in the DLL path search. Doing so would allow attackers to execute arbitrary code in the machine.


## Recommendation

Upgrade to version 1.0.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: kerberos, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.0
Directory Traversal in shit-server
Advisory: GHSA-6x8c-mvpv-5366 (CVE-2017-16147)
Published: 2020-09-01T18:18:32Z

Affected versions of `shit-server` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: shit-server, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in subtext
Advisory: GHSA-2mvq-xp48-4c77 ()
Published: 2020-09-03T20:35:29Z

All versions of `subtext` are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with arbitrary payload sizes, which may exhaust system resources leading to Denial of Service.


## Recommendation

This package is not actively maintained and has been moved to `@hapi/subtext` where version 6.1.2.

Affected packages:
package: ecosystem: npm, name: subtext, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in mfrserver
Advisory: GHSA-p2r2-h92r-w2mg (CVE-2017-16213)
Published: 2020-09-01T18:11:03Z

Affected versions of `mfrserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: mfrserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Downloads Resources over HTTP in apk-parser
Advisory: GHSA-5g4r-87v2-jqvx (CVE-2016-10564)
Published: 2020-09-01T16:05:44Z

apk-parser is a tool to extract Android Manifest info from an APK file.

apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks.  It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


## Recommendation

Update to version 0.1.6 or later.

Affected packages:
package: ecosystem: npm, name: apk-parser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.6
Malicious Package in eslint-config-eslint
Advisory: GHSA-pv55-r6j3-wp94 ()
Published: 2020-09-01T20:45:57Z

Version 5.0.2 of `eslint-config-eslint` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to a remote server.


## Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens

Users may consider downgrading to version 5.0.1

Affected packages:
package: ecosystem: npm, name: eslint-config-eslint, versions: 5.0.2
Malicious Package in requet
Advisory: GHSA-h44f-769q-j6px ()
Published: 2020-09-02T20:33:14Z

All versions of `requet` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: requet, ranges: type: ECOSYSTEM, events: introduced: 0
Command Injection in wizard-syncronizer
Advisory: GHSA-wgw3-gf4p-62xc ()
Published: 2020-09-11T21:16:59Z

All versions of `wizard-syncronizer` are vulnerable to Command Injection. The package does not validate input on the `cloneAndSync` function  and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the `gitURL` value or through a MITM attack since the package does not enforce HTTPS. This may allow attackers to run arbitrary commands in the system.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: wizard-syncronizer, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Tracking Module in botbait
Advisory: GHSA-4r5x-qjqc-p579 (CVE-2017-16126)
Published: 2020-09-01T18:57:44Z

The module `botbait` is a tool to be used to track bot and automated tools usage with-in the npm ecosystem.

`botbait` is known to record and track user information.

The module tracks the following information.
- Source IP
- process.versions
- process.platform
- How the module was invoked (test, require, pre-install)


## Recommendation

This package has no functional value, and should be removed from your environment if discovered.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: botbait, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Remote Memory Exposure in bl
Advisory: GHSA-pp7h-53gx-mx7r (CVE-2020-8244)
Published: 2020-09-02T15:26:19Z

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected packages:
package: ecosystem: npm, name: bl, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.3
package: ecosystem: npm, name: bl, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.2.1
package: ecosystem: npm, name: bl, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.1, versions: 3.0.0
package: ecosystem: npm, name: bl, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.0.3
Prototype Pollution in mithril
Advisory: GHSA-c3px-v9c7-m734 ()
Published: 2020-09-03T19:04:39Z

Affected versions of `mithril`are vulnerable to prototype pollution. The function `parseQueryString` may allow a malicious user to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects. A payload such as `__proto__%5BtoString%5D=123` in the query string would change the `toString()` function to `123`.



## Recommendation

If you are using mithril 2.x, upgrade to version 2.0.2 or later.
If you are using mithril 1.x, upgrade to version 1.1.7 or later.

Affected packages:
package: ecosystem: npm, name: mithril, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.7
package: ecosystem: npm, name: mithril, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.2
yargs-parser Vulnerable to Prototype Pollution
Advisory: GHSA-p9pc-299p-vxgp (CVE-2020-7608)
Published: 2020-09-04T18:00:54Z

Affected versions of `yargs-parser` are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of `Object`, causing the addition or modification of an existing property that will exist on all objects.  
Parsing the argument `--foo.__proto__.bar baz'` adds a `bar` property with value `baz` to all objects. This is only exploitable if attackers have control over the arguments being passed to `yargs-parser`.



## Recommendation

Upgrade to versions 13.1.2, 15.0.1, 18.1.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: yargs-parser, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 13.1.2
package: ecosystem: npm, name: yargs-parser, ranges: type: ECOSYSTEM, events: introduced: 14.0.0
fixed: 15.0.1
package: ecosystem: npm, name: yargs-parser, ranges: type: ECOSYSTEM, events: introduced: 16.0.0
fixed: 18.1.1
package: ecosystem: npm, name: yargs-parser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.0.1, database_specific: last_known_affected_version_range: <= 5.0.0
Downloads Resources over HTTP in apk-parser3
Advisory: GHSA-4p7j-5ppx-rfhm (CVE-2016-10574)
Published: 2020-09-01T16:06:49Z

Affected versions of `apk-parser3` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `apk-parser3`.


## Recommendation

Update to version 0.1.3 or greater.

Affected packages:
package: ecosystem: npm, name: apk-parser3, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.3
Malicious Package in bitcoimjs-lib
Advisory: GHSA-rv6q-p3x7-43fx ()
Published: 2020-09-04T16:37:50Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitcoimjs-lib, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in shenliru
Advisory: GHSA-f2rc-6xjq-95gq (CVE-2017-16161)
Published: 2020-09-01T17:24:57Z

Affected versions of `shenliru` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: shenliru, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Path Traversal in @wturyn/swagger-injector
Advisory: GHSA-4x7w-frcq-v4m3 ()
Published: 2020-09-03T20:38:47Z

All versions of `@wturyn/swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: @wturyn/swagger-injector, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in yui
Advisory: GHSA-mj87-8xf8-fp4w (CVE-2013-4939)
Published: 2020-09-01T16:42:51Z

Affected versions of `yui` are vulnerable to cross-site scripting in the `uploader.swf` and `io.swf` utilities, via script injection in the url.



## Recommendation

YUI has published their recommendation to fix this issue. 
Their recommendation is to:
 - Delete self-hosted copies of these files if you are not using them
 - Use the Yahoo! CDN hosted files
 - Use the patched files provided on the YUI Library [here](https://yuilibrary.com/support/20130515-vulnerability/#resolution).

Affected packages:
package: ecosystem: npm, name: yui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.10.3, database_specific: last_known_affected_version_range: < 3.10.2
Malicious Package in buffer-por
Advisory: GHSA-6xg2-cf6h-x4v8 ()
Published: 2020-09-03T21:53:05Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-por, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in snekserve
Advisory: GHSA-hv4w-jhcj-6wfw ()
Published: 2020-09-03T20:34:23Z

All versions of `snekserve` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: snekserve, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Remote Code Execution in mongodb-query-parser
Advisory: GHSA-97mg-3cr6-3x4c ()
Published: 2020-09-04T17:27:23Z

Versions of `mongodb-query-parser` prior to 2.0.0 are vulnerable to Remote Code Execution. The package fails to sanitize queries, allowing attackers to execute arbitrary code in the system.  Parsing the following payload executes `touch test-file`: 

```'(function () { return (clearImmediate.constructor("return process;")()).mainModule.require("child_process").execSync("touch test-file").toString()})()'```



## Recommendation

Upgrade to version 2.0.0 or later.

Affected packages:
package: ecosystem: npm, name: mongodb-query-parser, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0
Malicious Package in json-serializer
Advisory: GHSA-7xfq-xh6v-4mrm ()
Published: 2020-09-01T20:27:53Z

Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 2.0.10 of this module is found installed you will want to replace it with a version before or after 2.0.10. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: json-serializer, ranges: type: ECOSYSTEM, events: introduced: 2.0.10
fixed: 2.0.11, versions: 2.0.10
Malicious Package in eslint-config-airbnb-standard
Advisory: GHSA-m852-866j-69j8 ()
Published: 2020-09-01T20:47:01Z

Version 2.0.0 of `eslint-config-airbnb-standard` was published with a bundled version of `eslint-scope` that  was found to contain malicious code. This code would read the users `.npmrc` file and send it's contents to a remote server.


## Recommendation

The best course of action if you found this package installed in your environment is to revoke all your npm tokens and use a different version of the module. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: eslint-config-airbnb-standard, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.1.0, versions: 2.0.0
Malicious Package in js-shq3
Advisory: GHSA-766v-7gjx-55hf ()
Published: 2020-09-03T23:08:34Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-shq3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffgr-xor
Advisory: GHSA-r9cj-xj33-4q42 ()
Published: 2020-09-03T22:21:54Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffgr-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Heap Overflow in PyMiniRacer
Advisory: GHSA-vwcg-7xqw-qcxw (CVE-2020-25489)
Published: 2020-09-18T18:03:59Z

A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption.

More details on https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/.

Affected packages:
package: ecosystem: PyPI, name: py-mini-racer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.0
Malicious Package in regenraotr
Advisory: GHSA-5x7p-gm79-383m ()
Published: 2020-09-01T21:11:57Z

All versions of `regenraotr` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

This package was published to the npm Registry for a very short period of time. If you happen to find it in your environment you should revoke and rotate all credentials  found on the compromised machine, as well as completely erase the affected machine and reinstall your Operating System.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: regenraotr, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in wangguojing123
Advisory: GHSA-xpqw-fqpw-35fc (CVE-2017-16150)
Published: 2020-09-01T16:57:54Z

Affected versions of `wangguojing123` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: wangguojing123, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in logsymbles
Advisory: GHSA-vcg5-9xw6-r56c ()
Published: 2020-09-02T21:40:49Z

Version 2.2.0 of `logsymbles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: logsymbles, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in xoc
Advisory: GHSA-54cr-gv8w-8324 ()
Published: 2020-09-01T20:36:22Z

Version 1.0.7 of `xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.7 of this module is found installed you will want to replace it with a version before or after 1.0.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.5

Affected packages:
package: ecosystem: npm, name: xoc, versions: 1.0.7
Cross-Site Scripting in fomantic-ui
Advisory: GHSA-788m-pj96-7w2c ()
Published: 2020-09-02T21:23:51Z

Versions of `fomantic-ui` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text.


## Recommendation

Upgrade to version 2.7.0 or later.

Affected packages:
package: ecosystem: npm, name: fomantic-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.7.0
Cross-Site Scripting in diagram-js
Advisory: GHSA-8fw4-xh83-3j6q ()
Published: 2020-09-11T21:18:05Z

Versions of `diagram-js` prior to 3.3.1 (for 3.x) and 2.6.2 (for 2.x) are vulnerable to Cross-Site Scripting. The package fails to escape output of user-controlled input in `search-pad`, allowing attackers to execute arbitrary JavaScript.


## Recommendation

If you are using diagram-js 3.x, upgrade to version 3.3.1.
If you are using diagram-js 2.x, upgrade to version 2.6.2.

Affected packages:
package: ecosystem: npm, name: diagram-js, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.6.2
package: ecosystem: npm, name: diagram-js, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.3.1
Cross-Site Scripting in dojo
Advisory: GHSA-39cx-xcwj-3rc4 (CVE-2008-6681)
Published: 2020-09-01T15:25:29Z

Affected versions of `dojo` are susceptible to a cross-site scripting vulnerability in the `dijit.Editor` and `textarea` components, which execute their contents as Javascript, even when sanitized.


## Recommendation

Update to version 1.1.0 or later.

Affected packages:
package: ecosystem: npm, name: dojo, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.0
Directory Traversal in cuciuci
Advisory: GHSA-w3cg-6577-wx9f (CVE-2017-16122)
Published: 2020-09-01T17:20:41Z

Affected versions of `cuciuci` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: cuciuci, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in deasyncp
Advisory: GHSA-qfc9-x7gv-27jr ()
Published: 2020-09-03T18:12:36Z

All versions of `deasyncp ` contain malicious code. The package shuts down the machine upon installation as a preinstall script.


## Recommendation

Remove the package from your environment. There is no further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: deasyncp, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in zs-sha3
Advisory: GHSA-7696-qr5q-pg37 ()
Published: 2020-09-03T23:19:08Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: zs-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in plotter
Advisory: GHSA-65xx-c85x-wg76 ()
Published: 2020-09-04T17:20:52Z

All versions of `plotter` are vulnerable to Command Injection. The package fails to sanitize plot titles, which may allow attackers to execute arbitrary code in the system if the title value is supplied by a user. The following proof-of-concept creates a `testing` file in the current directory:

```
var plot = require('plotter').plot;

const title = 'Example "\nset title system("touch testing")#';

plot({
data: [ 3, 1, 2, 3, 4 ],
filename: 'output.pdf',
style: 'linespoints',
title: title,
logscale: true,
xlabel: 'time',
ylabel: 'length of string',
format: 'pdf'
});

```


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: plotter, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in scrytsy
Advisory: GHSA-vv7g-pjw9-4qj9 ()
Published: 2020-09-03T17:03:56Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: scrytsy, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in alico
Advisory: GHSA-jfx5-7mr2-g8hg ()
Published: 2020-09-03T17:31:41Z

All versions of `alico` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: alico, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffer-xgr
Advisory: GHSA-mp55-2274-4pj8 ()
Published: 2020-09-03T21:54:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xgr, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in nothing-js
Advisory: GHSA-353r-3v84-9pjj ()
Published: 2020-09-01T20:40:36Z

`nothing-js` contained a malicious script that attempted to delete all files when `npm test` was run.


## Recommendation

This module has been unpublished from the npm Registry. If you find this module in your environment remove it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: nothing-js, ranges: type: ECOSYSTEM, events: introduced: 0
Sandbox Breakout / Arbitrary Code Execution in sandbox
Advisory: GHSA-gc25-3vc5-2jf9 ()
Published: 2020-09-04T15:00:58Z

All versions of `sandbox` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through `this.constructor.constructor` . This may allow attackers to execute arbitrary code in the system. Evaluating the payload `this.constructor.constructor('return process.env')()` prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: sandbox, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Regular Expression Denial of Service in simple-markdown
Advisory: GHSA-4xf9-pgvv-xx67 ()
Published: 2020-09-03T20:27:46Z

Versions of `simple-markdown` prior to 0.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS). The `SimpleMarkdown.defaultInlineParse()` function has significantly degraded performance when parsing inline code blocks.


## Recommendation

Upgrade to version 0.5.2 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: npm, name: simple-markdown, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.5.2
Directory Traversal in liyujing
Advisory: GHSA-m3j9-p4x2-97q6 (CVE-2017-16120)
Published: 2020-09-01T17:22:49Z

Affected versions of `liyujing` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: liyujing, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Configuration Override in helmet-csp
Advisory: GHSA-c3m8-x3cg-qm2c ()
Published: 2020-09-03T20:39:53Z

Versions of `helmet-csp` before to 2.9.1 are vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the `default-src` CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.


## Recommendation

Upgrade to version 2.9.1 or later. Setting the `browserSniff` configuration to `false` in vulnerable versions also mitigates the issue.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: helmet-csp, ranges: type: ECOSYSTEM, events: introduced: 1.2.2
fixed: 2.9.1
Denial of Service in @commercial/subtext
Advisory: GHSA-cvfm-xjc8-f2vm ()
Published: 2020-09-03T15:46:36Z

Version 5.1.1 of `@commercial/subtext` is vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

Upgrade to version 5.1.2 or later.

Affected packages:
package: ecosystem: npm, name: @commercial/subtext, ranges: type: ECOSYSTEM, events: introduced: 5.1.1
fixed: 5.1.2, versions: 5.1.1
Malicious Package in cionstring
Advisory: GHSA-xh8g-j88w-6v59 ()
Published: 2020-09-03T19:42:16Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: cionstring, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in reggae
Advisory: GHSA-q9wr-gcjc-hq52 ()
Published: 2020-09-04T15:12:13Z

All versions of `reggae` are vulnerable to prototype pollution. The function `set` does not restrict the modification of an Object's prototype, which may allow a malicious to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: reggae, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in owl-orchard-apple-sunshine
Advisory: GHSA-h24p-2c3m-5qf4 ()
Published: 2020-09-03T23:23:23Z

All versions of `owl-orchard-apple-sunshine` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: owl-orchard-apple-sunshine, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in lodash.mergewith
Advisory: GHSA-5947-m4fg-xhqg ()
Published: 2020-09-03T18:08:10Z

Versions of `lodash.mergewith` before 4.6.1 are vulnerable to Prototype Pollution. The function 'mergeWith' may allow a malicious user to modify the prototype of `Object` via `__proto__` causing the addition or modification of an existing property that will exist on all objects.




## Recommendation

Update to version 4.6.1 or later.

Affected packages:
package: ecosystem: npm, name: lodash.mergewith, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.6.1
Directory Traversal in @vivaxy/here
Advisory: GHSA-m4vv-p6fq-jhqp ()
Published: 2020-09-01T19:04:07Z

The @vivaxy/here module is a small web server that serves files with the process' working directory acting as the web root.

It is vulnerable to a directory traversal attack. 

This means that files on the local file system which exist outside of the web root may be disclosed to an attacker. This might include confidential files.

Mitigating Factors:
If the node process is run as a user with very limited filesystem permissions, there is significantly less risk of exposing confidential/private information.


Proof of Concept:
```
curl "http://${SERVER_IP}:${SERVER_PORT}/..%2f..%2fetc/passwd"
```


## Recommendation

Run `npm i @vivaxy/here` to install the latest version that addresses this vulnerability.

Affected packages:
package: ecosystem: npm, name: @vivaxy/here, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.2.2, database_specific: last_known_affected_version_range: <= 3.2.1
Missing Origin Validation in browserify-hmr
Advisory: GHSA-77q4-m83q-w76v (CVE-2018-14730)
Published: 2020-09-01T21:18:20Z

Versions of `browserify-hmr` prior to 0.4.0 are missing origin validation on the websocket server. 

This vulnerability allows a remote attacker to steal a developer's source code because the origin of requests to the websocket server that is used for Hot Module Replacement (HMR) are not validated.


## Recommendation

Upgrade to version 0.4.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: browserify-hmr, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.0
Downloads Resources over HTTP in npm-test-sqlite3-trunk
Advisory: GHSA-mf7c-58q5-7v65 (CVE-2016-10695)
Published: 2020-09-01T16:15:28Z

Affected versions of `npm-test-sqlite3-trunk` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `npm-test-sqlite3-trunk`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Affected packages:
package: ecosystem: npm, name: npm-test-sqlite3-trunk, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Renovate vulnerable to Azure DevOps token leakage in logs
Advisory: GHSA-36rh-ggpr-j3gj ()
Published: 2020-09-14T16:38:40Z

### Impact

Applies to Azure DevOps users only. The bot's token may be exposed in server or pipeline logs due to the `http.extraheader=AUTHORIZATION` parameter being logged without redaction. It is recommended that Azure DevOps users revoke their existing bot credentials and generate new ones after upgrading if there's a potential that logs have been saved to a location that others can view.

### Patches

Fixed in 

### Workarounds

Do not share Renovate logs with anyone who cannot be trusted with access to the token.


Affected packages:
package: ecosystem: npm, name: renovate, ranges: type: ECOSYSTEM, events: introduced: 19.180.0
fixed: 23.25.1