aswin1906/github-advisory-2020.csv huggingface dataset:
SQL injection in Django
Advisory: GHSA-3gh2-xw74-jmcw (CVE-2020-9402)
Published: 2020-06-05T14:52:07Z

Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: django, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.11.29
package: ecosystem: PyPI, name: django, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.2.11
package: ecosystem: PyPI, name: django, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.0.4
Directory traversal attack in Spring Cloud Config
Advisory: GHSA-g86w-v5vg-9gxf (CVE-2020-5405)
Published: 2020-06-05T16:11:36Z

Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: org.springframework.cloud:spring-cloud-config-server, ranges: type: ECOSYSTEM, events: introduced: 2.1.0
fixed: 2.1.7
package: ecosystem: Maven, name: org.springframework.cloud:spring-cloud-config-server, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.2
Insufficient Entropy in Spring Security
Advisory: GHSA-2ppp-9496-p23q (CVE-2020-5408)
Published: 2020-06-15T19:34:31Z

Spring Security versions 5.3.x prior to 5.3.2, 5.2.x prior to 5.2.4, 5.1.x prior to 5.1.10, 5.0.x prior to 5.0.16 and 4.2.x prior to 4.2.16 use a fixed null initialization vector with CBC Mode in the implementation of the queryable text encryptor. A malicious user with access to the data that has been encrypted using such an encryptor may be able to derive the unencrypted values using a dictionary attack.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 5.3.0
fixed: 5.3.2
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 5.2.0
fixed: 5.2.4
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 5.1.0
fixed: 5.1.10
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 5.0.0
fixed: 5.0.16
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.2.16
Phar unserialization vulnerability in phpMussel
Advisory: GHSA-qr95-4mq5-r3fh (CVE-2020-4043)
Published: 2020-06-10T19:40:30Z

### Impact
_What kind of vulnerability is it? Who is impacted?_

Anyone using >= v1.0.0 < v1.6.0.

### Patches
_Has the problem been patched? What versions should users upgrade to?_

Yes. Upgrading to at least >= v1.6.0 (the earliest safe version) will resolve the problem. However, as multiple new major versions have been released since that version, upgrading to the latest available version is recommended, in order to protect against any potential future vulnerabilities, unknown at the time of writing this advisory.

### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_

Yes. In the package's configuration, disable archive checking by setting `check_archives` to `false` (thus avoiding execution of the affected parts of the codebase entirely).

### References
_Are there any links users can visit to find out more?_

Yes. The vulnerability is documented at [SECURITY.md](https://github.com/phpMussel/phpMussel/security/policy) and also at [#167](https://github.com/phpMussel/phpMussel/issues/167).

### For more information
If you have any questions or comments about this advisory:
* Comment at the issue linked to this advisory, or..
* Contact [the package author](https://github.com/Maikuolan).


Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: phpmussel/phpmussel, ranges: type: ECOSYSTEM, events: introduced: 1.0.0
fixed: 1.6.0
package: ecosystem: Packagist, name: maikuolan/phpmussel, ranges: type: ECOSYSTEM, events: introduced: 1.0.0
fixed: 1.6.0
Cross-site Scripting in Sanitize 
Advisory: GHSA-p4x4-rw2p-8j8m (CVE-2020-4054)
Published: 2020-06-16T22:08:06Z

When HTML is sanitized using Sanitize's "relaxed" config or a custom config that allows certain elements, some content in a `<math>` or `<svg>` element may not be sanitized correctly even if `math` and `svg` are not in the allowlist.

You are likely to be vulnerable to this issue if you use Sanitize's relaxed config or a custom config that allows one or more of the following HTML elements:

- `iframe`
- `math`
- `noembed`
- `noframes`
- `noscript`
- `plaintext`
- `script`
- `style`
- `svg`
- `xmp`

### Impact

Using carefully crafted input, an attacker may be able to sneak arbitrary HTML through Sanitize, potentially resulting in XSS (cross-site scripting) or other undesired behavior when that HTML is rendered in a browser.

### Releases

This problem has been fixed in Sanitize 5.2.1.

### Workarounds

If upgrading is not possible, a workaround is to override the default value of Sanitize's `:remove_contents` config option with the following value, which ensures that the contents of `math` and `svg` elements (among others) are removed entirely when those elements are not in the allowlist:

```ruby
%w[iframe math noembed noframes noscript plaintext script style svg xmp]
```

For example, if you currently use Sanitize's relaxed config, you can create a custom config object that overrides the default value of `:remove_contents` like this:

```ruby
custom_config = Sanitize::Config.merge(
  Sanitize::Config::RELAXED,
  :remove_contents => %w[iframe math noembed noframes noscript plaintext script style svg xmp]
)
```

You would then pass this custom config to Sanitize when sanitizing HTML.

### For more information

If you have any questions or comments about this advisory:

- Open an issue in the [Sanitize repo](https://github.com/rgrove/sanitize).
- See Sanitize's [security policy](https://github.com/rgrove/sanitize/security/policy).

### Credits

Many thanks to Michal Bentkowski of Securitum for reporting this bug and helping to verify the fix.

### References

- [GHSA-p4x4-rw2p-8j8m](https://github.com/rgrove/sanitize/security/advisories/GHSA-p4x4-rw2p-8j8m)
- [CVE-2020-4054](https://nvd.nist.gov/vuln/detail/CVE-2020-4054)
- https://github.com/rgrove/sanitize/releases/tag/v5.2.1

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: RubyGems, name: sanitize, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 5.2.1
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Advisory: GHSA-vwqq-5vrc-xw9h (CVE-2020-9488)
Published: 2020-06-05T14:15:51Z

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: org.apache.logging.log4j:log4j, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.13.2
package: ecosystem: Maven, name: org.apache.logging.log4j:log4j-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.13.2
Privilege escalation in Presto
Advisory: GHSA-f6pc-crhh-cp96 (CVE-2020-15087)
Published: 2020-06-30T16:33:23Z

### Affected
This affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver.

### Impact
Authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured.

This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure.

### Patches
This issue has been fixed starting with PrestoSQL version 337.

### Workarounds
This issue can be mitigated by blocking network access to internal APIs on the coordinator and workers. 

### References
See the Presto documentation for [Secure Internal Communication](https://trino.io/docs/current/security/internal-communication.html).

### For more information
If you have any questions or comments about this advisory:
* Join the **#security** channel on [Slack](https://trino.io/slack.html).
* Contact the security team at [security@trino.io](mailto:security@trino.io)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Affected packages:
package: ecosystem: Maven, name: io.prestosql:presto-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 337
Advisory: GHSA-32vw-r77c-gm67 ()
Published: 2020-08-03T17:57:05Z
Withdrawn: 2020-08-03T17:57:05Z

Versions 0.3.2 and earlier of marked are affected by a cross-site scripting vulnerability even when sanitize:true is set.

Affected packages:
package: ecosystem: npm, name: marked, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.3
Cross Site Scripting in baserCMS
Advisory: GHSA-cpxc-67rc-c775 (CVE-2020-15154)
Published: 2020-08-28T20:48:12Z

baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS).

* Impact: XSS via Arbitrary script execution.
* Attack vector is: Administrator must be logged in.
* Components are: content_fields.php, content_info.php, content_options.php, content_related.php, index_list_tree.php, jquery.bcTree.js
* Tested baserCMS Version : 4.3.6 (Latest)
* Affected baserCMS Version : 4.0.0 ~ 4.3.6
* Patches : https://basercms.net/security/20200827

Found by Aquilao Null

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: baserproject/basercms, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.7, database_specific: last_known_affected_version_range: <= 4.3.6
Denial of Service in protobufjs
Advisory: GHSA-4gpv-cvmq-6526 ()
Published: 2020-08-19T22:23:09Z
Withdrawn: 2020-08-19T22:23:09Z

Withdrawn: Duplicate of GHSA-762f-c2wg-m8c8

Affected packages:
package: ecosystem: npm, name: protobufjs, ranges: type: ECOSYSTEM, events: introduced: 6.0.0
fixed: 6.8.6
package: ecosystem: npm, name: protobufjs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.0.3
DataTable Vulnerable to Cross-Site Scripting
Advisory: GHSA-4mv4-gmmf-q382 (CVE-2015-6584)
Published: 2020-08-31T22:42:29Z

Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.


## Recommendation

Update to a version greater than 1.10.8. A [fix](https://github.com/DataTables/DataTablesSrc/commit/ccf86dc5982bd8e16d) appears in [version 1.10.10](https://github.com/DataTables/DataTablesSrc/commits/1.10.10?after=9780a3693572757d87bf70e48bd7555faf974f28+34&branch=1.10.10&qualified_name=refs%2Ftags%2F1.10.10).

Affected packages:
package: ecosystem: npm, name: datatables, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.10
package: ecosystem: Packagist, name: datatables/datatables, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.10.10
Hidden Directories Always Served in inert
Advisory: GHSA-g4xp-36c3-f7mr (CVE-2014-10068)
Published: 2020-08-31T22:47:41Z

Versions 1.1.1 and earlier of `inert` are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.

The inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false.


## Recommendation

Update to version >= 1.1.1.

Affected packages:
package: ecosystem: npm, name: inert, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.1
Potential Command Injection in hubot-scripts
Advisory: GHSA-hwch-749c-rv63 (CVE-2013-7378)
Published: 2020-08-31T22:46:38Z

Versions 2.4.3 and earlier of hubot-scripts are vulnerable to a command injection vulnerablity in the `hubot-scripts/package/src/scripts/email.coffee` module.


### Mitigating Factors
The email script is not enabled by default, it has to be manually added to hubot's list of loaded scripts.


## Recommendation

Update hubot-scripts to version 2.4.4 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: hubot-scripts, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.4.5, database_specific: last_known_affected_version_range: <= 2.4.3
Operation on a Resource after Expiration or Release in Jetty Server
Advisory: GHSA-x3rh-m7vp-35f2 (CVE-2019-17638)
Published: 2020-08-05T14:52:59Z

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with response2 data. Thread1 then proceeds to write the buffer that now contains response2 data. This results in client1, which issued request1 and expects responses, to see response2 which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Affected packages:
package: ecosystem: Maven, name: org.eclipse.jetty:jetty-server, ranges: type: ECOSYSTEM, events: introduced: 9.4.27
fixed: 9.4.30.v20200611, database_specific: last_known_affected_version_range: <= 9.4.30.v20200610
Regular Expression Denial of Service in highcharts
Advisory: GHSA-m45f-4828-5cv5 ()
Published: 2020-08-19T22:39:44Z
Withdrawn: 2020-08-19T22:39:44Z

Withdrawn: Duplicate of GHSA-xmc8-cjfr-phx3

Affected packages:
package: ecosystem: npm, name: highcharts, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.1.0
CSS Injection in Chartkick gem
Advisory: GHSA-3j95-fjv2-3m4p (CVE-2020-16254)
Published: 2020-08-12T14:29:15Z

The Chartkick gem through 3.3.2 for Ruby allows Cascading Style Sheets (CSS) Injection (without attribute).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: RubyGems, name: chartkick, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.4.0
CSRF Vulnerability in jquery-ujs
Advisory: GHSA-6qqj-rx4w-r3cj ()
Published: 2020-08-31T22:48:44Z

Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains.

When an attacker controls the href attribute of an anchor tag, or
the action attribute of a form tag triggering a POST action, the attacker can set the
href or action to " https://attacker.com". By prepending a space to the external domain, it causes jQuery to consider it a same origin request, resulting in the user's CSRF token being sent to the external domain.


## Recommendation

Upgrade jquery-ujs to version 1.0.4 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: jquery-ujs, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.4, database_specific: last_known_affected_version_range: <= 1.0.3
Prototype Pollution in express-fileupload
Advisory: GHSA-9wcg-jrwf-8gg7 (CVE-2020-7699)
Published: 2020-08-05T14:53:16Z

This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: express-fileupload, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.9
Open Redirect in serve-static
Advisory: GHSA-c3x7-gjmx-r2ff (CVE-2015-1164)
Published: 2020-08-31T22:57:02Z

Versions of `serve-static` prior to 1.6.5 ( or 1.7.x prior to 1.7.2 ) are affected by an open redirect vulnerability on some browsers when configured to mount at the root directory.


## Proof of Concept

A link to `http://example.com//www.google.com/%2e%2e` will redirect to `//www.google.com/%2e%2e`

Some browsers will interpret this as `http://www.google.com/%2e%2e`, resulting in an external redirect.


## Recommendation

Version 1.7.x: Update to version 1.7.2 or later.
Version 1.6.x: Update to version 1.6.5 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Affected packages:
package: ecosystem: npm, name: serve-static, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.7.2, database_specific: last_known_affected_version_range: < 1.6.5
package: ecosystem: npm, name: serve-static, ranges: type: ECOSYSTEM, events: introduced: 1.7.0
fixed: 1.7.2
Multiple Content Injection Vulnerabilities in marked
Advisory: GHSA-9cw2-jqp5-7x39 (CVE-2014-3743)
Published: 2020-08-31T22:52:52Z

Versions 0.3.0 and earlier of `marked` are affected by two cross-site scripting vulnerabilities, even when `sanitize: true` is set.

The attack vectors for this vulnerability are GFM Codeblocks and JavaScript URLs.


## Recommendation

Upgrade to version 0.3.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: marked, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.1, database_specific: last_known_affected_version_range: <= 0.3.0
Integer Overflow or Wraparound and Use of a Broken or Risky Cryptographic Algorithm in bcrypt
Advisory: GHSA-5wg4-74h6-q47v (CVE-2020-7689)
Published: 2020-08-20T14:38:49Z

In bcrypt (npm package) before version 5.0.0, data is truncated wrong when its length is greater than 255 bytes.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bcrypt, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.0.0
CSRF tokens leaked in URL by canned query form
Advisory: GHSA-q6j3-c4wc-63vw ()
Published: 2020-08-11T14:54:40Z

### Impact

The HTML form for a read-only canned query includes the hidden CSRF token field added in #798 for writable canned queries (#698).

This means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhood_search submitting the form took me to:

https://latest.datasette.io/fixtures/neighborhood_search?text=down&csrftoken=CSRFTOKEN-HERE

This token could potentially leak to an attacker if the resulting page has a link to an external site on it and the user clicks the link, since the token would be exposed in the referral logs.

### Patches

A fix for this issue has been released in Datasette 0.46.

### Workarounds

You can fix this issue in a Datasette instance without upgrading by copying the [0.46 query.html template](https://raw.githubusercontent.com/simonw/datasette/0.46/datasette/templates/query.html) into a custom `templates/` directory and running Datasette with the `--template-dir=templates/` option.

### References

Issue 918 discusses this in details: https://github.com/simonw/datasette/issues/918

### For more information

Contact swillison at gmail with any questions.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: PyPI, name: datasette, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.46
Arbitrary Code Generation
Advisory: GHSA-9x4c-63pf-525f (CVE-2020-15142)
Published: 2020-08-20T14:38:24Z

### Impact
Clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution.

Giving this a CVSS of 8.0 (high) with CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:P/RL:U/RC:C .

### Patches
Fix will be included in version 0.5.3

### Workarounds
Inspect OpenAPI documents before generating, or inspect generated code before executing.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [openapi-python-client](https://github.com/triaxtec/openapi-python-client/issues)
* Email us at [danthony@triaxtec.com](mailto:danthony@triaxtec.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected packages:
package: ecosystem: PyPI, name: openapi-python-client, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.5.3
Sandbox Breakout / Arbitrary Code Execution in safe-eval
Advisory: GHSA-hrpq-r399-whgw (CVE-2020-7710)
Published: 2020-08-25T23:40:53Z

All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context through Error objects. This may allow attackers to execute arbitrary code in the system. 

Evaluating the payload 
```js
(function (){
  var ex = new Error
  ex.__proto__ = null
  ex.stack = {
    match: x => {
      return x.constructor.constructor("throw process.env")()
    }
  }
  return ex
})()
``` 

prints the contents of `process.env`.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: safe-eval, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
last_affected: 0.4.1
Directory Traversal in fancy-server
Advisory: GHSA-m273-wwfv-h6jp (CVE-2014-10066)
Published: 2020-08-31T22:44:33Z

Versions 0.1.4 and earlier of fancy-server are vulnerable to a directory traversal attack. 

Standard attack vectors such as `../` will allow an attacker to read files outside of the served directory.


## Recommendation

Upgrade to version 0.1.4 or greater.

Affected packages:
package: ecosystem: npm, name: fancy-server, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.4
Withdrawn
Advisory: GHSA-p56r-jr4p-4wgh ()
Published: 2020-08-03T18:16:37Z
Withdrawn: 2020-08-03T18:16:37Z

Withdrawn: duplicate of GHSA-wjr4-2jgw-hmv8

Affected packages:
package: ecosystem: npm, name: whereis, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.1
XSS due to lack of CSRF validation for replying/publishing
Advisory: GHSA-43m5-c88r-cjvv (CVE-2020-15156)
Published: 2020-08-26T18:55:38Z

### Impact
Due to lack of CSRF validation, a logged in user is potentially vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum.

### Patches
Upgrade to the latest version v0.7.0

### Workarounds
You can cherry-pick the following commit: [https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618](https://github.com/psychobunny/nodebb-plugin-blog-comments/commit/cf43beedb05131937ef46f365ab0a0c6fa6ac618)

### References
Visit https://community.nodebb.org if you have any questions about this issue or on how to patch / upgrade your instance.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: nodebb-plugin-blog-comments, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.7.0
Withdrawn
Advisory: GHSA-chgg-rrmv-5q7x ()
Published: 2020-08-03T18:05:48Z
Withdrawn: 2020-08-03T18:05:48Z

Withdrawn: Duplicate of GHSA-vgrx-w6rg-8fqf

Affected packages:
package: ecosystem: npm, name: jwt-simple, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.1
Command Injection in dns-sync
Advisory: GHSA-c6h2-mpc6-232h ()
Published: 2020-08-27T22:26:15Z
Withdrawn: 2020-08-27T22:26:15Z

Withdrawn: Duplicate of GHSA-jcw8-r9xm-32c6

Affected packages:
package: ecosystem: npm, name: dns-sync, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.1.3
Command Injection in ungit
Advisory: GHSA-vjfr-p6hp-jqqw (CVE-2015-4130)
Published: 2020-08-31T23:00:10Z

Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter.


## Recommendation

Update version 0.9.0 or later.

Affected packages:
package: ecosystem: npm, name: ungit, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.9.0, database_specific: last_known_affected_version_range: <= 0.8.4
Open Redirect in hekto
Advisory: GHSA-c5j4-vw9m-xc95 ()
Published: 2020-08-27T22:44:08Z
Withdrawn: 2020-08-27T22:44:08Z

Withdrawn: Duplicate of GHSA-qmm9-x5gr-4gfm

Affected packages:
package: ecosystem: npm, name: hekto, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.4
CSRF Vulnerability in polaris-website
Advisory: GHSA-whrh-9j4q-g7ph ()
Published: 2020-08-05T21:43:19Z

### Impact
CSRF vulnerability:
In some very specific circumstances, an attacker would be able to update your settings.
Basically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your settings.

### Patches
As of v1.1.1 this has been patched by implementing the Double submit pattern using a cookie.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Polaris-React](https://github.com/polaris-rbx/polaris-react)
* Email us at [hi@nezto.re](mailto:hi@nezto.re)
* Join our discord (preferred): https://discord.gg/QevWabU

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: polaris-website, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.1
LDAP Injection in ldapauth
Advisory: GHSA-82mg-x548-gq3j (CVE-2015-7294)
Published: 2020-08-31T22:49:46Z

Versions 2.2.4 and earlier of `ldapauth-fork` are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.



## Recommendation

ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use [ldapauth-fork](https://www.npmjs.com/package/ldapauth-fork) 2.3.3 or greater.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: ldapauth-fork, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.3.3
package: ecosystem: npm, name: ldapauth, ranges: type: ECOSYSTEM, events: introduced: 0, database_specific: last_known_affected_version_range: < 2.2.4
Regular Expression Denial of Service in validator
Advisory: GHSA-f5w6-r7rg-mcgq (CVE-2014-8882)
Published: 2020-08-31T23:01:13Z

Versions of `validator` prior to 3.22.1 are affected by a regular expression denial of service vulnerability in the `isURL` method.


## Recommendation

Update to version 3.22.1 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: validator, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.22.1
CSRF in Play Framework
Advisory: GHSA-cf8j-64h9-6q58 (CVE-2020-12480)
Published: 2020-08-18T17:30:25Z

In Play Framework 2.6.0 through 2.8.1, the CSRF filter can be bypassed by making CORS simple requests with content types that contain parameters that can't be parsed.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected packages:
package: ecosystem: Maven, name: com.typesafe.play:play_2.12, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.7.5
package: ecosystem: Maven, name: com.typesafe.play:play_2.12, ranges: type: ECOSYSTEM, events: introduced: 2.8.0
fixed: 2.8.2
DOM-based XSS in auth0-lock
Advisory: GHSA-6gg3-pmm7-97xc (CVE-2020-15119)
Published: 2020-08-19T21:05:03Z

### Overview
Versions before and including `11.25.1` are using `dangerouslySetInnerHTML` to display an informational message when used with a Passwordless or Enterprise connection.

- For Passwordless connection, the value of the input (email or phone number) is displayed back to the user while waiting for verification code input.  
- For Enterprise connection, the value of the input (IdP Domain) from the Enterprise connection setup screen (Auth0 Dashboard) is displayed back to the user when the `lock` widget opens.

When Passwordless or Enterprise connection is used, the application and its users might be exposed to cross-site scripting (XSS) attacks.

### Am I affected?
You are affected by this vulnerability if all of the following conditions apply:

- You are using auth0-lock
- You are using Passwordless or Enterprise connection mode

### How to fix that?
Upgrade to version `11.26.3`

### Will this update impact my users?
The fix provided in patch will not affect your users.

### Credit
https://github.com/mvisat

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: auth0-lock, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 11.26.3, database_specific: last_known_affected_version_range: <= 11.25.1
Denial of Service in https-proxy-agent
Advisory: GHSA-qrg3-f6h6-vq8q ()
Published: 2020-08-19T22:15:57Z
Withdrawn: 2020-08-19T22:15:57Z

Withdrawn: Duplicate of GHSA-8g7p-74h8-hg48

Affected packages:
package: ecosystem: npm, name: https-proxy-agent, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.0
Server secret was included in static assets and served to clients
Advisory: GHSA-r587-7jh2-4qr3 ()
Published: 2020-08-26T19:32:50Z

### Impact
Server JWT signing secret was included in static assets and served to clients.

This ALLOWS Flood's builtin authentication to be bypassed. Given Flood is granted access to rTorrent's SCGI interface (which is unprotected and ALLOWS arbitrary code execution) and usually wide-ranging privileges to files, along with Flood's lack of security controls against authenticated users, the severity of this vulnerability is **CRITICAL**. 

### Background
Commit 8d11640b imported `config.js` to client (frontend) components to get `disableUsersAndAuth` configuration variable. Subsequently contents of `config.js` are compiled into static assets and served to users. Unfortunately `config.js` also includes `secret`.

Intruders can use `secret` to sign authentication tokens themselves to bypass builtin access control of Flood.

### Patches
Commit 042cb4ce removed imports of `config.js` from client (frontend) components. Additionally an eslint rule was added to prevent config.js from being imported to client (frontend) components.

Commit 103f53c8 provided a general mitigation to this kind of problem by searching static assets to ensure `secret` is not included before starting server (backend). 

### Workarounds
Users shall upgrade if they use Flood's builtin authentication system.

While maintainers will do their best to support it, Flood cannot guarantee its in-house access control system can stand against determined attackers in high-stake environments. 

> Use `HTTP Basic Auth` or other battle-hardened authentication methods instead of Flood's in-house one. You can use `disableUsersAndAuth` to avoid duplicate authentication.

Users are advised to check out the [wiki](https://github.com/jesec/flood/wiki) for more information on security precautions.

### References
[Wiki - Security precautions](https://github.com/jesec/flood/wiki/Security-precautions)

[Introduction to JSON Web Tokens](https://jwt.io/introduction/)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [issue tracker](https://github.com/jesec/flood/issues)
* Email us at [jc@linux.com](mailto:jc@linux.com)

Affected packages:
package: ecosystem: npm, name: flood, ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 3.0.0
Cross-Site Scripting in @progress/kendo-angular-editor
Advisory: GHSA-j7wp-vjj6-cp5m ()
Published: 2020-08-11T19:40:10Z

Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed.
Adding the following content to the Editor value demonstrates the issue: `<img src="" onerror=alert(document.domain)>`.

Affected packages:
package: ecosystem: npm, name: @progress/kendo-angular-editor, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.2.3
Command Injection in macaddress
Advisory: GHSA-q9r2-f3vc-rjg8 ()
Published: 2020-08-19T22:28:51Z
Withdrawn: 2020-08-19T22:28:51Z

Withdrawn: Duplicate of GHSA-pp57-mqmh-44h7

Affected packages:
package: ecosystem: npm, name: macaddress, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.9
SQL Injection in waterline-sequel
Advisory: GHSA-mpcx-8qqw-rmcq ()
Published: 2020-08-19T21:51:20Z
Withdrawn: 2020-08-19T21:51:20Z

Withdrawn: Duplicate of GHSA-cgpp-wm2h-6hqx

Affected packages:
package: ecosystem: npm, name: waterline-sequel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.5.1
Rosetta-Flash JSONP Vulnerability in hapi
Advisory: GHSA-363h-vj6q-3cmj (CVE-2014-4671)
Published: 2020-08-31T22:45:35Z

This description taken from the pull request provided by Patrick Kettner.



Versions 6.1.0 and earlier of hapi are vulnerable to a rosetta-flash attack, which can be used by attackers to send data across domains and break the browser same-origin-policy.





## Recommendation

- Update hapi to version 6.1.1 or later.

Alternatively, a solution previously implemented by Google, Facebook, and Github is to prepend callbacks with an empty inline comment. This will cause the flash parser to break on invalid inputs and prevent the issue, and how the issue has been resolved internally in hapi.

Affected packages:
package: ecosystem: npm, name: hapi, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.1.0
Authentication Weakness in keystone
Advisory: GHSA-9xgp-hfw7-73rq ()
Published: 2020-08-19T21:30:04Z
Withdrawn: 2020-08-19T21:30:04Z

There is an authentication weakness vulnerability in keystone before version 0.3.16.  Due to a bug in the the default sign in functionality, incomplete email addresses could be matched. A correct password is still required to complete sign in.

Affected packages:
package: ecosystem: npm, name: keystone, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.16
Cross-Site Scripting in Prism
Advisory: GHSA-wvhm-4hhf-97x9 (CVE-2020-15138)
Published: 2020-08-07T22:28:30Z

### Impact
The easing preview of the Previewers plugin has an XSS vulnerability that allows attackers to execute arbitrary code in Safari and Internet Explorer.

This impacts all Safari and Internet Explorer users of Prism >=v1.1.0 that use the _Previewers_ plugin (>=v1.10.0) or the _Previewer: Easing_ plugin (v1.1.0 to v1.9.0).

### Patches
This problem is patched in v1.21.0.

### Workarounds
To workaround the issue without upgrading, [disable the easing preview](https://prismjs.com/plugins/previewers/#disabling-a-previewer) on all impacted code blocks. You need Prism v1.10.0 or newer to apply this workaround.

### References
The vulnerability was introduced by this [commit](https://github.com/PrismJS/prism/commit/4303c940d3d3a20e8ce7635bf23331c75060f5c5) on Sep 29, 2015 and fixed by [Masato Kinugawa](https://twitter.com/kinugawamasato) (#2506).

### For more information
If you have any questions or comments about this advisory, please [open an issue](https://github.com/PrismJS/prism/issues).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
Affected packages:
package: ecosystem: npm, name: prismjs, ranges: type: ECOSYSTEM, events: introduced: 1.1.0
fixed: 1.21.0
XSS via JQLite DOM manipulation functions in AngularJS
Advisory: GHSA-5cp4-xmrw-59wf ()
Published: 2020-08-05T21:47:02Z

### Summary
XSS may be triggered in AngularJS applications that sanitize user-controlled HTML snippets before passing them to `JQLite` methods like `JQLite.prepend`, `JQLite.after`, `JQLite.append`, `JQLite.replaceWith`, `JQLite.append`, `new JQLite` and `angular.element`.

### Description

JQLite (DOM manipulation library that's part of AngularJS) manipulates input HTML before inserting it to the DOM in `jqLiteBuildFragment`.

One of the modifications performed [expands an XHTML self-closing tag](https://github.com/angular/angular.js/blob/418355f1cf9a9a9827ae81d257966e6acfb5623a/src/jqLite.js#L218).

If `jqLiteBuildFragment` is called (e.g. via `new JQLite(aString)`) with user-controlled HTML string that was sanitized (e.g. with [DOMPurify](https://github.com/cure53/DOMPurify)), the transformation done by JQLite may modify some forms of an inert, sanitized payload into a payload containing JavaScript - and trigger an XSS when the payload is inserted into DOM.

This is similar to a bug in jQuery `htmlPrefilter` function that was [fixed in 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/).

### Proof of concept

```javascript
const inertPayload = `<div><style><style/><img src=x onerror="alert(1337)"/>` 
```
Note that the style element is not closed and `<img` would be a text node inside the style if inserted into the DOM as-is.
As such, some HTML sanitizers would leave the `<img` as is without processing it and stripping the `onerror` attribute.

```javascript
angular.element(document).append(inertPayload);
```
This will alert, as `<style/>` will be replaced with `<style></style>` before adding it to the DOM, closing the style element early and reactivating `img`.

### Patches
The issue is patched in `JQLite` bundled with angular 1.8.0. AngularJS users using JQuery should upgrade JQuery to 3.5.0, as a similar vulnerability [affects jQuery <3.5.0](https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2).

### Workarounds
Changing sanitizer configuration not to allow certain tag grouping (e.g. `<option><style></option>`) or inline style elements may stop certain exploitation vectors, but it's uncertain if all possible exploitation vectors would be covered. Upgrade of AngularJS to 1.8.0 is recommended.

### References
https://github.com/advisories/GHSA-mhp6-pxh8-r675
https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2
https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
https://snyk.io/vuln/SNYK-JS-ANGULAR-570058

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected packages:
package: ecosystem: npm, name: angular, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.8.0
Server-Side Request Forgery in ftp-srv
Advisory: GHSA-jw37-5gqr-cf9j (CVE-2020-15152)
Published: 2020-08-17T21:44:54Z

### Background

The FTP protocol creates two connections, one for commands and one for transferring data.
This second data connection can be created in two ways, on the server by sending the PASV command, or on the client by sending the PORT command.

The PORT command sends the IP and port for the server to connect to the client with.

### Issue
Since the client can send an arbitrary IP with the PORT command, this can be used to cause the server to make a connection elsewhere.

### Patches

* _fix: disallow PORT connections to alternate hosts_: e449e75219d918c400dec65b4b0759f60476abca

Deprecation notices have been published for older versions.

### Workarounds

Blacklisting the FTP Command `PORT` will prevent the server from exposing this behaviour through active connections until a fix is applied.
```js
const ftp = new FtpSrv({
  blacklist: ['PORT']
});
```

### References
https://www.npmjs.com/advisories/1445

### Credits

Thank you to;
@trs for fixing it
@andreeleuterio for reporting it to us for an anonymous user (Vincent) through the NPM platform
@quiquelhappy for bringing it to our attention after it slipped through the cracks during Christmas

### For more information
If you have any questions or comments about this advisory:
* Open an issue at [https://github.com/autovance/ftp-srv](https://github.com/autovance/ftp-srv)
* Email us directly; security@autovance.com

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: ftp-srv, ranges: type: ECOSYSTEM, events: introduced: 1.0.0
fixed: 2.19.6
package: ecosystem: npm, name: ftp-srv, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.1.2
package: ecosystem: npm, name: ftp-srv, ranges: type: ECOSYSTEM, events: introduced: 4.0.0
fixed: 4.3.4
Unauthenticated Remote Command Injection in ep_imageconvert
Advisory: GHSA-28gr-86hg-r48w (CVE-2013-3364)
Published: 2020-08-31T22:43:31Z

ep_imageconvert is a plugin for [Etherpad Lite](https://github.com/ether/etherpad-lite). ep_imageconvert <= 0.0.2 is vulnerable to remote command injection.

Authentication is not required for remote exploitation.


## Recommendation

Update to version 0.0.3 or greater.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Affected packages:
package: ecosystem: npm, name: ep_imageconvert, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.0.3, database_specific: last_known_affected_version_range: <= 0.0.2
Directory Traversal in st
Advisory: GHSA-69rr-wvh9-6c4q (CVE-2014-3744)
Published: 2020-08-31T22:58:04Z

Versions of `st` prior to 0.2.5 are affected by a directory traversal vulnerability. Vulnerable versions fail to properly handle URL encoded dots, which caused `%2e` to be interpreted as `.` by the filesystem, resulting the potential for an attacker to read sensitive files on the server.


## Recommendation

Update to version 0.2.5 or later.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: st, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.5
Cross-Site Scripting in keystone
Advisory: GHSA-h29r-4vqp-8jxf ()
Published: 2020-08-20T17:21:46Z
Withdrawn: 2020-08-20T17:21:46Z

Withdrawn: Duplicate of GHSA-7qcx-jmrc-h2rr

Affected packages:
package: ecosystem: npm, name: keystone, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.0.0
Moped Rubygem Data Injection Vulnerability
Advisory: GHSA-f93j-hmcr-jcwh (CVE-2015-4410)
Published: 2020-08-19T16:45:49Z

`The Moped::BSON::ObjecId.legal?` method in rubygem-moped before [commit dd5a7c14b5d2e466f7875d079af71ad19774609b](https://github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24) allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: RubyGems, name: moped, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.5.3
package: ecosystem: RubyGems, name: moped, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 2.0.0
fixed: 2.0.5
Withdrawn
Advisory: GHSA-wx84-69jh-jjp2 ()
Published: 2020-08-03T18:22:36Z
Withdrawn: 2020-08-03T18:22:36Z

Withdrawn: duplicate of GHSA-2m39-62fm-q8r3

Affected packages:
package: ecosystem: npm, name: sshpk, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.13.2
package: ecosystem: npm, name: sshpk, ranges: type: ECOSYSTEM, events: introduced: 1.14.0
fixed: 1.14.1, versions: 1.14.0
Remote Code Execution in SyliusResourceBundle
Advisory: GHSA-p4pj-9g59-4ppv (CVE-2020-15143)
Published: 2020-08-19T21:04:25Z

### Impact

Request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter, allowing for Remote Code Execution.

The vulnerable versions include: `<=1.3.13 || >=1.4.0 <=1.4.6 || >=1.5.0 <=1.5.1 || >=1.6.0 <=1.6.3`.

### Example

```yaml
foo:
    path: /foo/{id}
    defaults:
        _sylius:
            repository:
                method: findSome
                arguments:
                    entity: "expr:service('repository').find($id)"
```

In this case, `$id` can be prepared in a way that calls other services. 

If you visit `/foo/"~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"`, it will result in a following expression `expr:service('repository').find(""~service('doctrine').getManager().getConnection().executeQuery("DELETE * FROM TABLE")~"")`, which will execute a query on the currently connected database.

To find a vulnerability in your application, look for any routing definition that uses request parameters inside expression language.

### Patches

This issue has been patched for versions 1.3.14, 1.4.7, 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.

### Workarounds

The fix requires adding `addslashes` in `ParametersParser::parseRequestValueExpression` to sanitize user input before evaluating it using the expression language.

```php
- return is_string($variable) ? sprintf('"%s"', $variable) : $variable;
+ return is_string($variable) ? sprintf('"%s"', addslashes($variable)) : $variable;
```

### Acknowledgements

This security issue has been reported by Craig Blanchette (@isometriks), thanks a lot!

### For more information

If you have any questions or comments about this advisory:
* Email us at [security@sylius.com](mailto:security@sylius.com)

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected packages:
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.14
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.4.0
fixed: 1.4.7
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.5.0
fixed: 1.5.2
package: ecosystem: Packagist, name: sylius/resource-bundle, ranges: type: ECOSYSTEM, events: introduced: 1.6.0
fixed: 1.6.4
Directory Traversal in nhouston
Advisory: GHSA-44g9-w23c-5rw7 (CVE-2014-8883)
Published: 2020-08-31T22:53:54Z

All versions of the static file server module nhouston are vulnerable to directory traversal. An attacker can provide input such as `../` to read files outside of the served directory.


## Recommendation

It is recommended that a different module be used, as we have been unable to reacher the maintainer of this module. We will continue to reach out to them, and if an update becomes available that fixes the issue, we will update this advisory accordingly.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected packages:
package: ecosystem: npm, name: nhouston, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
methodOverride Middleware Reflected Cross-Site Scripting in connect
Advisory: GHSA-3fw8-66wf-pr7m (CVE-2013-7370)
Published: 2020-08-31T22:41:27Z

Connect is a stack of middleware that is executed in order in each request.

The "methodOverride" middleware allows the http post to override the method of the request with the value of the "_method" post key or with the header "x-http-method-override".

Because the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the "Cannot `[method]` `[url]`" content. The method was not properly encoded for output in the browser.


###Example:
```
~ curl "localhost:3000" -d "_method=<script src=http://nodesecurity.io/xss.js></script>"
Cannot <SCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS></SCRIPT> /
```

## Recommendation

Update to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.

Affected packages:
package: ecosystem: npm, name: connect, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.8.1, database_specific: last_known_affected_version_range: <= 2.8.0