aswin1906/github-advisory-2020.csv huggingface dataset:
Denial of Service in Tensorflow
Advisory: GHSA-x5cp-9pcf-pp3h (CVE-2020-15199)
Published: 2020-09-25T18:28:24Z

### Impact
The `RaggedCountSparseOutput` does not validate that the input arguments form a valid ragged tensor. In particular, there is no validation that the `splits` tensor has the minimum required number of elements. Code uses this quantity to initialize a different data structure:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/core/kernels/count_ops.cc#L241-L244

Since `BatchedMap` is equivalent to a vector, it needs to have at least one element to not be `nullptr`. If user passes a `splits` tensor that is empty or has exactly one element, we get a `SIGABRT` signal raised by the operating system.

### Patches
We have patched the issue in 3cbb917b4714766030b28eba9fb41bb97ce9ee02 and will release a patch release.

We recommend users to upgrade to TensorFlow 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability is a variant of [GHSA-p5f8-gfw5-33w4](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-p5f8-gfw5-33w4)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
SQL Injection in mysql
Advisory: GHSA-fvq6-55gv-jx9f (CVE-2015-9244)
Published: 2020-09-01T15:21:05Z

Versions of `mysql` prior to 2.0.0-alpha8 are affected by a SQL Injection vulnerability in the `mysql.escape()` function, which does not properly escape object keys.


## Recommendation

Update to version 2.0.0-alpha8 or later.

Affected packages:
package: ecosystem: npm, name: mysql, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0-alpha8, database_specific: last_known_affected_version_range: <= 2.0.0-alpha7
Malicious Package in bitconi-ops
Advisory: GHSA-w9hw-v97w-g5f5 ()
Published: 2020-09-04T16:43:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bitconi-ops, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in ng-ui-library
Advisory: GHSA-2xw5-3767-qxvm ()
Published: 2020-09-11T21:21:20Z

Version 1.0.987 of `ng-ui-library` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ng-ui-library, ranges: type: ECOSYSTEM, events: introduced: 1.0.987
fixed: 1.0.990, versions: 1.0.987
Malicious Package in uploader-plugin
Advisory: GHSA-fx6f-fpfv-5hmc ()
Published: 2020-09-03T19:10:12Z

Version 1.0.2 of `uploader-plugin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.1

Affected packages:
package: ecosystem: npm, name: uploader-plugin, versions: 1.0.2
Path Traversal in serve
Advisory: GHSA-48gc-5j93-5cfq ()
Published: 2020-09-11T21:15:54Z

Versions of `serve` prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files.


## Recommendation

Upgrade to version 10.1.2 or later.

Affected packages:
package: ecosystem: npm, name: serve, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 10.1.2
Malicious Package in ecuvre
Advisory: GHSA-cgvm-rvfv-c92r ()
Published: 2020-09-03T17:05:51Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: ecuvre, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in geoheat
Advisory: GHSA-p32g-242c-76h3 ()
Published: 2020-09-11T21:14:49Z

Version 1.3.2 of `geoheat` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.3.1

Affected packages:
package: ecosystem: npm, name: geoheat, versions: 1.3.2
Byass due to validation before canonicalization in serve
Advisory: GHSA-wm7q-rxch-43mx ()
Published: 2020-09-01T19:38:33Z

Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames.



Example:
Here we have a server that ignores the file test.txt.
```
const serve = require('serve')
const server = serve(__dirname, {
      port: 1337,
      ignore: ['test.txt']
})
```

Using the URL encoded form of a letter (%65 instead of e) attacker can bypass the ignore control accessing the file. 

`curl http://localhost:1337/t%65st.txt`

Additionally this technique can be used to get directory listings of ignored directories.


## Recommendation

Update to version 6.5.2 or later.

Affected packages:
package: ecosystem: npm, name: serve, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.5.2
personnummer/csharp vulnerable to Improper Input Validation
Advisory: GHSA-qv8q-v995-72gr ()
Published: 2020-09-09T17:29:38Z

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.

The vulnerability is determined to be low severity.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2  
D 3.0.1  
[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3  
Elixir 3.0.0  
[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1  
[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0  
[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2  
Perl 3.0.0  
[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2  
[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1  
[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

Affected packages:
package: ecosystem: NuGet, name: Personnummer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.2
Malicious Package in mysql-koa
Advisory: GHSA-x45v-pvpg-hcrh ()
Published: 2020-09-03T19:54:36Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: mysql-koa, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in jingo
Advisory: GHSA-mpjf-8cmf-p789 ()
Published: 2020-09-01T21:25:46Z

Versions of `jingo` prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as `<script>alert(1)</script>` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as text.


## Recommendation

Upgrade to version 1.9.2

Affected packages:
package: ecosystem: npm, name: jingo, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.2
Malicious Package in coinstrig
Advisory: GHSA-4m3j-h8f2-4xh4 ()
Published: 2020-09-03T19:41:31Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: coinstrig, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in serializes
Advisory: GHSA-j899-348x-h3rq ()
Published: 2020-09-03T19:57:54Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: serializes, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in hs-sha3
Advisory: GHSA-6mrq-7r7m-hh4p ()
Published: 2020-09-03T22:52:58Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: hs-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Local File Inclusion in domokeeper
Advisory: GHSA-cr67-78jr-j94p ()
Published: 2020-09-03T18:14:47Z

All versions of `domokeeper` are vulnerable to Local File Inclusion. The `/plugin/` route passes a GET parameter unsanitized to a `require()` call. It then returns the output of `require()` in the server response. This may allow attackers to load unintended code in the application. It also allows attackers to exfiltrate information in `.json` files.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: domokeeper, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bictore-lib
Advisory: GHSA-f8vf-6hwg-hw55 ()
Published: 2020-09-04T15:38:21Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bictore-lib, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bictoind-rpc
Advisory: GHSA-jqvv-r4w3-8f7w ()
Published: 2020-09-04T15:35:00Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bictoind-rpc, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in modlibrary
Advisory: GHSA-94m7-w873-6wwf ()
Published: 2020-09-01T20:28:56Z

Version 0.1.1 of `modlibrary` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.1.1 of this module is found installed you will want to replace it with a version before or after 0.1.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.1.0

Affected packages:
package: ecosystem: npm, name: modlibrary, versions: 0.1.1
mysqljs is malware
Advisory: GHSA-8gv6-g7vp-hr34 (CVE-2017-16047)
Published: 2020-09-01T18:58:47Z

The `mysqljs` package is a piece of malware that steals environment variables and sends them to attacker controlled locations. 

All versions have been unpublished from the npm registry.


## Recommendation

As this package is malware, if you find it installed in your environment, the real security concern is determining how it got there. 

If you have found this installed in your environment, you should:
1. Delete the package
2. Clear your npm cache
3. Ensure it is not present in any other package.json files on your system
4. Regenerate your registry credentials, tokens, and any other sensitive credentials that may have been present in your environment variables. 

Additionally, any service which may have been exposed via credentials in your environment variables, such as a database, should be reviewed for indicators of compromise as well.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: mysqljs, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in gnuplot
Advisory: GHSA-cfwc-xjfp-44jg ()
Published: 2020-09-04T17:19:48Z

All versions of `gnuplot` are vulnerable to Command Injection. The package fails to sanitize plot titles, which may allow attackers to execute arbitrary code in the system if the title value is supplied by a user. The following proof-of-concept creates a `testing` file in the current directory:

```
var gnuplot = require('gnuplot');

const title = '"\nset title system("touch testing")\n#';

gnuplot()
.set('term png')
.set('output "out.png"')
.set(`title "${title}"`)
.set('xrange [-10:10]')
.set('yrange [-2:2]')
.set('zeroaxis')
.plot('(x/4)**2, sin(x), 1/x')
.end();
```


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: gnuplot, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in requst
Advisory: GHSA-8qx4-r7fx-xc4v ()
Published: 2020-09-11T21:08:19Z

All versions of `requst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: requst, ranges: type: ECOSYSTEM, events: introduced: 0
Sandbox Breakout / Arbitrary Code Execution in value-censorship
Advisory: GHSA-xrr6-6ww3-f3qm ()
Published: 2020-09-02T21:25:58Z

All versions of `value-censorship` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: value-censorship, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in tiny-http
Advisory: GHSA-cch6-5x4h-6qc5 (CVE-2017-16097)
Published: 2020-09-01T16:46:04Z

Affected versions of `tiny-http` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: tiny-http, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in requeest
Advisory: GHSA-8vj3-jgcf-77jv ()
Published: 2020-09-02T20:26:49Z

All versions of `requeest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: requeest, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in hw-trnasport-u2f
Advisory: GHSA-4363-x42f-xph6 ()
Published: 2020-09-03T17:05:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: hw-trnasport-u2f, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in blingjs
Advisory: GHSA-hfc6-79wv-5hpw ()
Published: 2020-09-01T19:48:13Z

Version 0.0.4 of `blingjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.4 of this module is found installed you will want to replace it with a version before or after 0.0.4. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: blingjs, versions: 0.0.4
Malicious Package in import-mysql
Advisory: GHSA-whjr-jj69-7prm ()
Published: 2020-09-03T19:44:35Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: import-mysql, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in @fangrong/xoc
Advisory: GHSA-pjxp-f379-6284 ()
Published: 2020-09-03T19:13:27Z

Version 1.0.6 of `@fangrong/xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.5

Affected packages:
package: ecosystem: npm, name: @fangrong/xoc, versions: 1.0.6
Command Injection in tree-kill
Advisory: GHSA-884p-74jh-xrg2 ()
Published: 2020-09-04T16:57:20Z

Versions of `tree-kill` prior to 1.2.2 are vulnerable to Command Injection. The package fails to sanitize values passed to the  `kill` function. If this value is user-controlled it  may allow attackers to run arbitrary commands in the server. The issue only affects Windows systems.


## Recommendation

Upgrade to version 1.2.2 or later.

Affected packages:
package: ecosystem: npm, name: tree-kill, ecosystem_specific: affected_functions: tree-kill, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.2
Cross-Site Scripting in diagram-js-direct-editing
Advisory: GHSA-j8r2-2x94-2q67 ()
Published: 2020-09-11T21:19:09Z

Versions of `diagram-js-direct-editing` prior to 1.4.3 are vulnerable to Cross-Site Scripting. The package fails to sanitize input from the clipboard, allowing attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

Upgrade to version 1.4.3 or later.

Affected packages:
package: ecosystem: npm, name: diagram-js-direct-editing, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.3
Sensitive Data Exposure in ibm_db
Advisory: GHSA-p77h-hv6g-fmfp ()
Published: 2020-09-03T20:43:16Z

Versions of `ibm_db` prior to 2.6.0 are vulnerable to Sensitive Data Exposure. The package printed database credentials in plaintext in logs while in debug mode.


## Recommendation

Upgrade to version 2.6.0 or later and ensure sensitive information was not logged.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: ibm_db, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.6.0
Malicious Package in dynamo-schema
Advisory: GHSA-vp8g-53fw-r9f2 ()
Published: 2020-09-01T19:54:44Z

Version 0.0.3 of `dynamo-schema` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.3 of this module is found installed you will want to replace it with a version before or after 0.0.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: dynamo-schema, versions: 0.0.3
Malicious Package in stream-combine
Advisory: GHSA-w6xj-45gv-fw35 ()
Published: 2020-09-02T15:57:06Z

Version 2.0.2 of `stream-combine` has malicious code design to steal credentials and credit card information. The code searches all form elements for passwords, credit card numbers and CVC codes. It then uploads the information to a remote server using HTML links embedded in the page or form actions. If your application has Content Security Policy set you are not affected by this issue.


## Recommendation

This package is not available on the npm Registry anymore. If you used this module and your application processed credentials or credit card information, it is possible that information was stolen.

Users may consider downgrading to version 2.0.1

Affected packages:
package: ecosystem: npm, name: stream-combine, versions: 2.0.2
Sandbox Breakout / Prototype Pollution in notevil
Advisory: GHSA-9gxr-rhx6-4jgv ()
Published: 2020-09-04T15:18:57Z

Versions of `notevil` prior to 1.3.3 are vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing attacker to add or modify an object's prototype.

Evaluating the payload ```try{a[b];}catch(e){e.constructor.constructor('return __proto__.arguments.callee.__proto__.polluted=true')()}``` add the `polluted` property to Function.


## Recommendation

Upgrade to version 1.3.3 or later.

Affected packages:
package: ecosystem: npm, name: notevil, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.3
Malicious Package in js-regular
Advisory: GHSA-qcc9-q247-3m2m ()
Published: 2020-09-03T19:46:49Z

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server.


## Recommendation

Remove the package from your environment. There are no indications of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-regular, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in secure_identity_login_module
Advisory: GHSA-59x8-7wx6-4hj9 ()
Published: 2020-09-03T17:47:52Z

All versions of `secure_identity_login_module` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: secure_identity_login_module, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Regular Expression Denial of Service in marked
Advisory: GHSA-ch52-vgq2-943f ()
Published: 2020-09-03T18:15:53Z

Affected versions of `marked` are vulnerable to Regular Expression Denial of Service (ReDoS). The `_label` subrule may significantly degrade parsing performance of malformed input.


## Recommendation

Upgrade to version 0.7.0 or later.

Affected packages:
package: ecosystem: npm, name: marked, ranges: type: ECOSYSTEM, events: introduced: 0.4.0
fixed: 0.7.0
Malicious Package in awesome_react_utility
Advisory: GHSA-m25q-fwg4-9v2p ()
Published: 2020-09-01T19:47:07Z

Version 1.0.2 of `awesome_react_utility` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`


## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: awesome_react_utility, versions: 1.0.2
Malicious Package in uglyfi.js
Advisory: GHSA-8jf2-cq6v-w234 ()
Published: 2020-09-03T21:10:53Z

Version 0.17.3 of `uglyfi.js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: uglyfi.js, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in getsetdeep
Advisory: GHSA-8j49-49jq-vwcq ()
Published: 2020-09-04T15:15:34Z

All versions of `getsetdeep` are vulnerable to prototype pollution. The `setDeep()` function does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: getsetdeep, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bowe
Advisory: GHSA-xmmp-hrmx-x5g7 ()
Published: 2020-09-02T21:32:22Z

Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bowe, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in rrequest
Advisory: GHSA-wc7q-qpm4-8pqv ()
Published: 2020-09-02T20:32:10Z

All versions of `rrequest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: rrequest, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in jq-sha3
Advisory: GHSA-x8m7-cv39-xmg9 ()
Published: 2020-09-03T22:56:10Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jq-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in reqquest
Advisory: GHSA-4jfq-q299-g4cr ()
Published: 2020-09-02T20:28:57Z

All versions of `reqquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: reqquest, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in reqest
Advisory: GHSA-hg5q-rj62-c43g ()
Published: 2020-09-02T21:29:08Z

All versions of `reqest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: reqest, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in j3-sha3
Advisory: GHSA-p3jx-g34v-q56j ()
Published: 2020-09-03T22:54:02Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: j3-sha3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bcion
Advisory: GHSA-2fwq-wx47-hm6x ()
Published: 2020-09-04T15:31:39Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bcion, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
frames-compiler downloads Resources over HTTP
Advisory: GHSA-9chw-xrwx-f86j (CVE-2016-10649)
Published: 2020-09-01T16:07:53Z

Affected versions of `frames-compiler` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `frames-compiler`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: frames-compiler, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in fast-requests
Advisory: GHSA-wjf2-7f9g-86f5 ()
Published: 2020-09-03T18:23:38Z

All versions of `fast-requests` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts.


## Recommendation

Remove the package from your environment. Review your Discord account access and rotate tokens if possible. If a credit card was linked to a compromised account contact your credit card company.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: fast-requests, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in xtalk
Advisory: GHSA-cqv6-7fwc-8m3c (CVE-2017-16091)
Published: 2020-09-01T16:44:59Z

Affected versions of `xtalk` are vulnerable to directory traversal, allowing access to the filesystem by placing "../" in the URL.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:localhost
```




## Recommendation

No patch is currently available for this vulnerability, and the package has not been updated since 2014.

The best mitigation is currently to avoid using this package, and using a different, functionally equivalent package.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: xtalk, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.2
Malicious Package in ali-contributor
Advisory: GHSA-h3m2-h22h-695r ()
Published: 2020-09-03T17:29:31Z

All versions of `ali-contributor` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: ali-contributor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in serverwzl
Advisory: GHSA-g87g-4x3w-f8jp (CVE-2017-16105)
Published: 2020-09-01T16:51:28Z

Affected versions of `serverwzl` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: serverwzl, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Path Traversal in sapper
Advisory: GHSA-f3vw-587g-r29g ()
Published: 2020-09-03T15:50:38Z

Versions of `sapper` prior to 0.27.11 are vulnerable to Path Traversal. It is possible to access sensitive files on the server through HTTP requests containing URL-encoded `../`.  

You may test a `sapper` application running in prod mode with `curl -vvv http://localhost:3000/client/750af05c3a69ddc6073a/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/etc/passwd`.


## Recommendation

Upgrade to version 0.27.11 or later.

Affected packages:
package: ecosystem: npm, name: sapper, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.27.11
Malicious Package in shrugging-logging
Advisory: GHSA-qv78-398w-cxp7 ()
Published: 2020-09-11T21:08:19Z

All versions of `shrugging-logging` contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking,


## Recommendation

Remove the package from your system. If you own any packages that were compromised please contact npm security immediately at security@npmjs.com. Also enable 2FA for publishing to further secure packages you maintain.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: shrugging-logging, ranges: type: ECOSYSTEM, events: introduced: 0
Command Injection in node-wifi
Advisory: GHSA-4x6x-782q-jfc4 ()
Published: 2020-09-03T02:38:47Z

Versions of `node-wifi` prior to 2.0.12 are vulnerable to Command Injection. The package fails to sanitize user input, allowing attackers to inject commands through the `ssid` variable and possibly achieving Remote Code Execution on the system.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: node-wifi, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.12
Malicious Package in buffez-xor
Advisory: GHSA-7frr-c83r-fm22 ()
Published: 2020-09-03T22:20:49Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffez-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in donotinstallthis
Advisory: GHSA-73hr-6785-f5p8 ()
Published: 2020-09-02T21:24:55Z

The package `donotinstallthis` contained malicious code. The package contained a script that was run as part of the install script. The script contacted a remote service tracking how many installations were done. There is no further compromise.


## Recommendation

Remove the package from your environment.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: donotinstallthis, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in lessindex
Advisory: GHSA-frcq-4ffq-v4mw (CVE-2017-16211)
Published: 2020-09-01T18:12:07Z

Affected versions of `lessindex` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: lessindex, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in harmlesspackage
Advisory: GHSA-8hmr-w35f-3qgj ()
Published: 2020-09-03T21:07:37Z

Version 0.0.1 of `harmlesspackage` contains malicious code as a postinstall script. The package printed a message to the console and performed a GET request to a remote server.


## Recommendation

Remove the package from your environment. There is no evidence of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: harmlesspackage, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Downloads Resources over HTTP in pm2-kafka
Advisory: GHSA-7ww4-c3mj-93cf (CVE-2016-10693)
Published: 2020-09-01T16:16:33Z

Affected versions of `pm2-kafka` insecurely download an executable over an unencrypted HTTP connection. 

In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution on the system running `pm2-kafka`.


## Recommendation

No patch is currently available for this vulnerability.

The best mitigation is currently to avoid using this package, using a different package if available. 

Alternatively, the risk of exploitation can be reduced by ensuring that this package is not installed while connected to a public network. If the package is installed on a private network, the only people who can exploit this vulnerability are those who have compromised your network or those who have privileged access to your ISP, such as Nation State Actors or Rogue ISP Employees.

Affected packages:
package: ecosystem: npm, name: pm2-kafka, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in jqtree
Advisory: GHSA-gjhx-gxwx-jx9j (CVE-2016-1000234)
Published: 2020-09-01T15:35:22Z

Affected versions of `jqtree` are vulnerable to cross-site scripting in the drag and drop functionality for modifying tree data. 

When a user attempts to drag a node to a different position in the hierarchy, script content existing within the node will be executed.


## Recommendation

Update to 1.3.4 or later.

Affected packages:
package: ecosystem: npm, name: jqtree, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.4, database_specific: last_known_affected_version_range: <= 1.3.3
Malicious Package in aasync
Advisory: GHSA-9mjp-gv34-3jcf ()
Published: 2020-09-02T18:37:35Z

All versions of `aasync` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: aasync, ranges: type: ECOSYSTEM, events: introduced: 0