aswin1906/github-advisory-2020.csv huggingface dataset:
Undefined behavior in Tensorflow
Advisory: GHSA-q8qj-fc9q-cphr (CVE-2020-15191)
Published: 2020-09-25T18:28:25Z

### Impact
If a user passes an invalid argument to `dlpack.to_dlpack` the expected validations will cause variables to bind to `nullptr` while setting a `status` variable to the error condition.

However, this `status` argument is not properly checked:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L265-L267

Hence, code following these methods will bind references to null pointers:
https://github.com/tensorflow/tensorflow/blob/0e68f4d3295eb0281a517c3662f6698992b7b2cf/tensorflow/c/eager/dlpack.cc#L279-L285

This is undefined behavior and reported as an error if compiling with `-fsanitize=null`.

### Patches
We have patched the issue in 22e07fb204386768e5bcbea563641ea11f96ceb8 and will release a patch release for all affected versions.

We recommend users to upgrade to TensorFlow 2.2.1 or 2.3.1.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been discovered during variant analysis of [GHSA-rjjg-hgv6-h69v](https://github.com/tensorflow/tensorflow/security/advisories/GHSA-rjjg-hgv6-h69v).

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected packages:
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-cpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.2.0
fixed: 2.2.1, versions: 2.2.0
package: ecosystem: PyPI, name: tensorflow-gpu, ranges: type: ECOSYSTEM, events: introduced: 2.3.0
fixed: 2.3.1, versions: 2.3.0
Malicious Package in asymc
Advisory: GHSA-x6ch-c6rv-f7wh ()
Published: 2020-09-02T18:34:22Z

All versions of `asymc` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: asymc, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in midway-xtpl
Advisory: GHSA-w65v-hx54-xrqx ()
Published: 2020-09-03T17:41:23Z

All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: midway-xtpl, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Arbitrary JavaScript Execution in typed-function
Advisory: GHSA-3qh4-r86r-grvm (CVE-2017-1001004)
Published: 2020-09-02T18:24:39Z

Versions of `typed-function` prior to 0.10.6 are vulnerable to Arbitrary JavaScript Execution. Function names are not properly sanitized and may allow an attacker to execute arbitrary code.


## Recommendation

Upgrade to version 0.10.6 or later.

Affected packages:
package: ecosystem: npm, name: typed-function, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.10.6
Directory Traversal in section2.madisonjbrooks12
Advisory: GHSA-h372-w3xp-2jg3 (CVE-2017-16172)
Published: 2020-09-01T18:54:34Z

Affected versions of `section2.madisonjbrooks12` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: section2.madisonjbrooks12, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Arbitrary File Overwrite in decompress-zip
Advisory: GHSA-73v8-v6g4-vrpm ()
Published: 2020-09-02T15:58:13Z

Vulnerable versions of `decompress-zip` are affected by the Zip-Slip vulnerability, an arbitrary file write vulnerability. The vulnerability occurs because `decompress-zip` does not verify that extracted files do not resolve to targets outside of the extraction root directory.



## Recommendation

For `decompress-zip` 0.2.x upgrade to 0.2.2 or later.
For `decompress-zip` 0.3.x upgrade to 0.3.2 or later.

Affected packages:
package: ecosystem: npm, name: decompress-zip, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.2.2
package: ecosystem: npm, name: decompress-zip, ranges: type: ECOSYSTEM, events: introduced: 0.3.0
fixed: 0.3.2
Malicious Package in bictoin-ops
Advisory: GHSA-xrrg-wfwc-c7r3 ()
Published: 2020-09-04T15:33:52Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bictoin-ops, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffer-xov
Advisory: GHSA-3h9m-9g3g-5wqx ()
Published: 2020-09-03T22:13:14Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xov, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bugfer-xor
Advisory: GHSA-8g64-9cm2-838j ()
Published: 2020-09-03T22:29:26Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bugfer-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in requestt
Advisory: GHSA-2563-83p7-f34p ()
Published: 2020-09-02T20:24:41Z

All versions of `requestt` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: requestt, ranges: type: ECOSYSTEM, events: introduced: 0
Denial of Service in http-proxy
Advisory: GHSA-6x33-pw7p-hmpq ()
Published: 2020-09-04T17:59:49Z

Versions of `http-proxy` prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an `ERR_HTTP_HEADERS_SENT` unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the `proxyReq.setHeader` function.   

For a proxy server running on `http://localhost:3000`, the following curl request triggers the unhandled exception:  
```curl -XPOST http://localhost:3000 -d "$(python -c 'print("x"*1025)')"```


## Recommendation

Upgrade to version 1.18.1 or later

Affected packages:
package: ecosystem: npm, name: http-proxy, ecosystem_specific: affected_functions: http-proxy.createProxyServer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.18.1
Malicious Package in uglyfi-js
Advisory: GHSA-9xww-fwh9-95c5 ()
Published: 2020-09-02T21:43:59Z

Version 3.4.6 of `uglyfi-js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: uglyfi-js, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in babel-laoder
Advisory: GHSA-qp6m-jqfr-2f7v ()
Published: 2020-09-04T15:27:11Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: babel-laoder, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in markdown-it-katex
Advisory: GHSA-5ff8-jcf9-fw62 ()
Published: 2020-09-04T17:55:35Z

All versions of `markdown-it-katex` are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser by triggering an error.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: markdown-it-katex, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in @hapi/boom
Advisory: GHSA-2ggq-vfcp-gwhj ()
Published: 2020-09-04T17:33:53Z

Versions of `@hapi/boom` prior t 0.3.8 are vulnerable to Cross-Site Scripting (XSS). The package fails to properly escape error messages, which may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 0.3.8 or later.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: @hapi/boom, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.3.8
Malicious Package in sj-labc
Advisory: GHSA-4fqg-89cc-5pv5 ()
Published: 2020-09-04T14:58:44Z

All versions of `sj-labc` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: sj-labc, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in yeoman-genrator
Advisory: GHSA-fm7r-2pr7-rw2p ()
Published: 2020-09-02T21:45:02Z

Version 3.1.1 of `yeoman-genrator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: yeoman-genrator, ranges: type: ECOSYSTEM, events: introduced: 0
Command Injection in cocos-utils
Advisory: GHSA-rffp-mc78-wjf7 ()
Published: 2020-09-02T18:26:48Z

All versions of `cocos-utils` are vulnerable to Remote Code Execution. The `unzip()` function concatenates user input to `exec()` which may allow attackers to execute arbitrary commands  on the server.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: cocos-utils, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in rqeuest
Advisory: GHSA-pj97-j597-ppm7 ()
Published: 2020-09-02T21:15:22Z

All versions of `rqeuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: rqeuest, ranges: type: ECOSYSTEM, events: introduced: 0
Cross-Site Scripting in jquery
Advisory: GHSA-2pqj-h3vj-pqgw (CVE-2012-6708)
Published: 2020-09-01T16:41:46Z

Affected versions of `jquery` are vulnerable to cross-site scripting. This occurs because the main `jquery` function uses a regular expression to differentiate between HTML and selectors, but does not properly anchor the regular expression. The result is that `jquery` may interpret HTML as selectors when given certain inputs, allowing for client side code execution.

## Proof of Concept
```
$("#log").html(
    $("element[attribute='<img src=\"x\" onerror=\"alert(1)\" />']").html()
);
```




## Recommendation

Update to version 1.9.0 or later.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: npm, name: jquery, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.0, database_specific: last_known_affected_version_range: <= 1.8.3
package: ecosystem: Maven, name: org.webjars.npm:jquery, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.0, database_specific: last_known_affected_version_range: <= 1.8.3
package: ecosystem: NuGet, name: jQuery, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.9.0, database_specific: last_known_affected_version_range: <= 1.8.3
package: ecosystem: RubyGems, name: jquery-rails, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.0
Cross-Site Scripting in lazysizes
Advisory: GHSA-w4vp-3mq7-7v82 ()
Published: 2020-09-03T15:49:48Z

Versions of `lazysizes` prior to 5.2.1-rc1 are vulnerable to Cross-Site Scripting.  The `video-embed` plugin fails to sanitize the following attributes: data-vimeo, `data-vimeoparams`, `data-youtube` and `data-ytparams`. This allows attackers to execute arbitrary JavaScript in a victim's browser if the attacker has control over the vulnerable attributes.


## Recommendation

Upgrade to version 5.2.1-rc1 or later.

Affected packages:
package: ecosystem: npm, name: lazysizes, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.2.1-rc1, database_specific: last_known_affected_version_range: <= 5.2.1-rc0
Malicious Package in css_transform_support
Advisory: GHSA-45cp-hpc9-8347 ()
Published: 2020-09-01T19:52:35Z

Version 1.0.2 of `css_transform_support` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.1

Affected packages:
package: ecosystem: npm, name: css_transform_support, versions: 1.0.2
Malicious Package in s3asy
Advisory: GHSA-3wjm-33mw-h388 ()
Published: 2020-09-01T20:34:14Z

Version 0.4.8 of `s3asy` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.4.8 of this module is found installed you will want to replace it with a version before or after 0.4.8. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.4.7

Affected packages:
package: ecosystem: npm, name: s3asy, versions: 0.4.8
Malicious Package in maleficent
Advisory: GHSA-cr5w-6rv4-r2qg ()
Published: 2020-09-03T02:37:45Z

All versions of `maleficent` contain malicious code. The package is a demonstration of possible risks when installing npm packages. It gathers system information such as: environment variables, OS information, network interface, AWS credentials, npm credentials and ssh keys. The package prints the information to a local file but does not upload it to a remote server.



## Recommendation

Remove the package from your environment. There is no further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: maleficent, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in kraken-api
Advisory: GHSA-fgfj-rj24-mj7q ()
Published: 2020-09-02T21:47:08Z

Version 0.1.8 of `kraken-api` contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.


Users may consider downgrading to version 0.1.7
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Affected packages:
package: ecosystem: npm, name: kraken-api, versions: 0.1.8
Cross-Site Scripting in bleach
Advisory: GHSA-5634-rv46-48jf ()
Published: 2020-09-03T17:13:45Z

All versions of `bleach` are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as `"<<script><</script>script>alert('xss');</<script><</script>script>"` regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: bleach, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
HTML Injection in marky-markdown
Advisory: GHSA-pxmp-fwjc-4x7q ()
Published: 2020-09-03T15:45:23Z

All versions of `marky-markdown` are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is `youtube.com` but it is possible to bypass the validation with sources where `youtube.com` is the sub-domain, such as `youtube.com.evil.co`. This 


## Recommendation

This package is no longer maintained. Please upgrade to `@npmcorp/marky-markdown`

Affected packages:
package: ecosystem: npm, name: marky-markdown, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in serverwg
Advisory: GHSA-2f29-pmpx-vj62 (CVE-2017-16101)
Published: 2020-09-01T16:52:33Z

`serverwg` is a simple http server.

`serverwg` is vulnerable to a directory traversal issue, giving an attacker access to the filesystem by placing "../" in the URL.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```
and response:
```
HTTP/1.1 200 OK
Date: Wed, 17 May 2017 22:52:08 GMT
Connection: keep-alive

{contents of /etc/passwd}
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: serverwg, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in dcdcdcdcdc
Advisory: GHSA-8vmc-g99q-xj94 (CVE-2017-16190)
Published: 2020-09-01T18:23:52Z

Affected versions of `dcdcdcdcdc` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: dcdcdcdcdc, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in ripedm160
Advisory: GHSA-9272-59x2-gwf2 ()
Published: 2020-09-03T17:04:13Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: ripedm160, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Bitcoin Inventory Out-of-Memory Denial-of-Service Attack (CVE-2018-17145)
Advisory: GHSA-hx3r-jv9q-85jw (CVE-2018-17145)
Published: 2020-09-10T19:44:58Z

There was an easily exploitable uncontrolled memory resource consumption denial-of-service vulnerability that existed in the peer-to-peer network code of three implementations of Bitcoin and several alternative chains.

For more details please see:
https://invdos.net/

For the paper:
https://invdos.net/paper/CVE-2018-17145.pdf

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: bcoin, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.2
Malicious Package in bufger-xor
Advisory: GHSA-2w8q-69fh-9gq6 ()
Published: 2020-09-03T22:25:09Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: bufger-xor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in react-datepicker-plus
Advisory: GHSA-4wcx-c9c4-89p2 ()
Published: 2020-09-11T21:23:30Z

Versions 2.4.3 and 2.4.2 of `react-datepicker-plus` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: react-datepicker-plus, ranges: type: ECOSYSTEM, events: introduced: 2.4.2
fixed: 2.4.6, database_specific: last_known_affected_version_range: <= 2.4.3
Malicious Package in oauth-validator
Advisory: GHSA-cxcf-78mr-wpg7 ()
Published: 2020-09-01T20:29:59Z

Version 1.0.2 of `oauth-validator` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.1

Affected packages:
package: ecosystem: npm, name: oauth-validator, versions: 1.0.2
Malicious Package in impala
Advisory: GHSA-92px-q4w8-hrr5 ()
Published: 2020-09-01T19:56:52Z

Version 1.1.7 of `impala` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.1.7 of this module is found installed you will want to replace it with a version before or after 1.1.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: impala, versions: 1.1.7
Authorization Bypass in Spring Security
Advisory: GHSA-wmv4-5w76-vp9g (CVE-2014-3527)
Published: 2020-09-15T20:16:22Z

When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request.

This means if there are access control restrictions on which CAS services can authenticate to one another, those restrictions can be bypassed.

If users are not using CAS Proxy tickets and not basing access control decisions based upon the CAS Service, then there is no impact to users.

## Mitigation
Users of affected versions should apply the following mitigation:
- Users of 3.2x should upgrade to 3.2.5 or later
- Users of 3.1.x should upgrade to 3.1.7 or later

## Credit
This issue was identified by David Ohsie and brought to our attention by the CAS Development team.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.7
package: ecosystem: Maven, name: org.springframework.security:spring-security-core, ranges: type: ECOSYSTEM, events: introduced: 3.2.0
fixed: 3.2.5
Malicious Package in ripmed160
Advisory: GHSA-gmjp-776j-2394 ()
Published: 2020-09-03T17:04:24Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: ripmed160, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in graylog-web-interface
Advisory: GHSA-9qgh-7pgp-hp7r ()
Published: 2020-09-03T17:10:31Z

All versions of  `graylog-web-interface` are vulnerable to Cross-Site Scripting (XSS). The package fails to escape output on the `TypeAhead` and `QueryInput` components, which may allow attackers to execute arbitrary JavaScript on the victim's browser.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: graylog-web-interface, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in smartsearchwp
Advisory: GHSA-fgp6-8g62-qx6w ()
Published: 2020-09-03T17:01:45Z

All versions of `smartsearchwp` contain malicious code. The package is malware intended to steal credentials from websites it is loaded in. It traverses DOM elements looking for fields such as `username` and `password` and uploads it to a remote server. The package also port-scans the local gateway and uploads the information to the remote server. It has a feature to fetch commands from the remote server and execute them with `eval`. The npm security team analysis found several bugs in the malware that prevent it from actually performing its actions. The malicious code is also not invoked upon installation or require; it would require transpiling TypeScript code and using it in a website.



## Recommendation

Remove the package from your environment. There is no indication of further compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: smartsearchwp, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in ecruve
Advisory: GHSA-fpf2-pr3j-4cm3 ()
Published: 2020-09-03T17:06:06Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: ecruve, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in retcodelog
Advisory: GHSA-j8hw-49gg-vq3w ()
Published: 2020-09-03T17:45:41Z

All versions of `retcodelog` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: retcodelog, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in flatmap-stream
Advisory: GHSA-9x64-5r7x-2q53 ()
Published: 2020-09-01T21:21:32Z

Version 0.1.1 of `flatmap-stream` is considered malicious.

This module runs an encrypted payload targeting a very specific application, `copay` and because they shared the same description it would have likely worked for `copay-dash`.

The injected code:

- Read in AES encrypted data from a file disguised as a test fixture
- Grabbed the npm package description of the module that imported it, using an automatically set environment variable
- Used the package description as a key to decrypt a chunk of data pulled in from the disguised file

The decrypted data was part of a module, which was then compiled in memory and executed.

This module performed the following actions:

- Decrypted another chunk of data from the disguised file
- Concatenated a small, commented prefix from the first decrypted chunk to the end of the second decrypted chunk
- Performed minor decoding tasks to transform the concatenated block of code from invalid JS to valid JS (we believe this was done to evade detection by dynamic analysis tools)
- Wrote this processed block of JS out to a file stored in a dependency that would be packaged by the build scripts: 

The chunk of code that was written out was the actual malicious code, intended to be run on devices owned by the end users of Copay.

This code would do the following:

- Detect the current environment: Mobile/Cordova/Electron
- Check the Bitcoin and Bitcoin Cash balances on the victim's copay account
- If the current balance was greater than 100 Bitcoin, or 1000 Bitcoin Cash:
  - Harvest the victim's account data in full
  - Harvest the victim's copay private keys
  - Send the victim's account data/private keys off to a collection


## Recommendation

If you find this module in your environment it's best to remove it. The malicious version of event-stream and flatmap-stream have been removed from the npm Registry.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: flatmap-stream, versions: 0.1.1
Denial of Service in grpc-ts-health-check
Advisory: GHSA-m86m-5m44-pc93 ()
Published: 2020-09-03T19:05:46Z

Versions of `grpc-ts-health-check` prior to 2.0.0 are vulnerable to Denial of Service. The package exposes an API endpoint that may allow attackers to set the service's health status to failing. This can lead to Denial of Service as Kubernetes blocks traffic to services with a failing status.


## Recommendation

Upgrade to version 2.0.0 or later.

Affected packages:
package: ecosystem: npm, name: grpc-ts-health-check, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.0.0
Path Traversal in swagger-injector
Advisory: GHSA-v4x8-gw49-7hv4 ()
Published: 2020-09-03T20:37:42Z

All versions of `swagger-injector` are vulnerable to Path Traversal. The package fails to sanitize URLs, allowing attackers to access server files outside of the configured `dist` folder using relative paths.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: swagger-injector, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-7f59-x49p-v8mq (CVE-2016-1000226)
Published: 2020-09-01T15:28:45Z

Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.

Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.

## Proof of Concept

```
http://<USER_HOSTNAME>/swagger-ui/index.html?url=http://<MALICIOUS_HOSTNAME>/malicious-swagger-file.json
````



## Recommendation

Update to version 2.2.1 or later.

Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.1
Spoofing attack due to unvalidated KDC in node-krb5
Advisory: GHSA-4v9q-hm2p-68c4 (CVE-2016-1000238)
Published: 2020-09-01T15:57:01Z

Affected versions of `node-krb5` do not validate the KDC prior to authenticating, which might allow an attacker with network access and enough time to spoof the KDC and impersonate a valid user without knowing their credentials.


## Recommendation

It appears that this will remain unfixed indefinitely, as the Github issue for this vulnerability has been open since 2015, with no work on it since then.

At this time, the best available mitigation is to use an alternative module that is actively maintained and provides similar functionality. There are [multiple modules fitting this criteria available on npm.](https://www.npmjs.com/search?q=kerberos).

Affected packages:
package: ecosystem: npm, name: node-krb5, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in arsenic-tabasco-cyborg-peanut-butter
Advisory: GHSA-r742-7j4h-hjr8 ()
Published: 2020-09-03T23:27:36Z

All versions of `arsenic-tabasco-cyborg-peanut-butter` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: arsenic-tabasco-cyborg-peanut-butter, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Authorization Bypass in graphql-shield
Advisory: GHSA-hx78-272p-mqqh ()
Published: 2020-09-03T19:21:11Z

Versions of `graphql-shield` prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option `no_cache` relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision.


## Recommendation

Upgrade to version 6.0.6 or later.

Affected packages:
package: ecosystem: npm, name: graphql-shield, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 6.0.6
Directory Traversal in scott-blanch-weather-app
Advisory: GHSA-jp46-fw6c-3pm9 (CVE-2017-16184)
Published: 2020-09-01T18:46:58Z

Affected versions of `scott-blanch-weather-app` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: scott-blanch-weather-app, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in cal_rd
Advisory: GHSA-226w-6hhj-69hp ()
Published: 2020-09-03T19:06:52Z

Version 0.1.1 of `rc_cal` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: cal_rd, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Authentication Bypass in express-laravel-passport
Advisory: GHSA-v66p-w7qx-wv98 ()
Published: 2020-09-04T17:29:34Z

All versions of `express-laravel-passport` are vulnerable to an Authentication Bypass. The package fails to properly validate JWTs, allowing attackers to send HTTP requests impersonating other users.


## Recommendation

Upgrade to version 2.0.5 or later.

Affected packages:
package: ecosystem: npm, name: express-laravel-passport, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Improper Authorization in react-oauth-flow
Advisory: GHSA-65m9-m259-7jqw ()
Published: 2020-09-03T15:49:29Z

All versions of `react-oauth-flow` fail to properly implement the OAuth protocol. The package stores secrets in the front-end code. Instead of using a public OAuth client, it uses a confidential client on the browser. This may allow attackers to compromise server credentials.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: react-oauth-flow, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in react-server-native
Advisory: GHSA-fwvp-x5gj-773j ()
Published: 2020-09-01T20:33:10Z

Version 0.0.7 of `react-server-native` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.7 of this module is found installed you will want to replace it with a version before or after 0.0.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 0.0.6

Affected packages:
package: ecosystem: npm, name: react-server-native, versions: 0.0.7
Sandbox Breakout / Arbitrary Code Execution in notevil
Advisory: GHSA-7r5f-7qr4-pf6q ()
Published: 2020-09-03T19:03:33Z

Versions of `notevil` prior to 1.3.2 are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to prevent access to the `Function` constructor by not checking the return values of function calls. This allows attackers to access the Function prototype's constructor leading to the Sandbox Escape. An example payload is:  
```
var safeEval = require('notevil')
var input = "" + 
"function fn() {};" + 
"var constructorProperty = Object.getOwnPropertyDescriptors(fn.__proto__).constructor;" + 
"var properties = Object.values(constructorProperty);" + 
"properties.pop();" + 
"properties.pop();" + 
"properties.pop();" + 
"var Function = properties.pop();" + 
"(Function('return this'))()"; 
safeEval(input)```


## Recommendation

Upgrade to version 1.3.2 or later.

Affected packages:
package: ecosystem: npm, name: notevil, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.2
personnummer/java vulnerable to Improper Input Validation
Advisory: GHSA-q3vw-4jx3-rrr2 ()
Published: 2020-09-23T17:20:09Z

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.

The vulnerability is determined to be low severity.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2  
D 3.0.1  
[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3  
Elixir 3.0.0  
[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1  
[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0  
[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2  
Perl 3.0.0  
[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2  
[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1  
[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

Affected packages:
package: ecosystem: Maven, name: dev.personnummer:personnummer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.3.0
Directory Traversal in qinserve
Advisory: GHSA-cxwc-8pqp-2whw (CVE-2017-16197)
Published: 2020-09-01T18:20:40Z

Affected versions of `qinserve` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: qinserve, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0