aswin1906/github-advisory-2020.csv huggingface dataset:
Malicious Package in erquest
Advisory: GHSA-4pmg-jgm5-3jg6 ()
Published: 2020-09-02T21:16:26Z

All versions of `erquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: erquest, ranges: type: ECOSYSTEM, events: introduced: 0
personnummer/php vulnerable to Improper Input Validation 
Advisory: GHSA-2p6g-gjp8-ggg9 ()
Published: 2020-09-09T17:29:34Z

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.

The vulnerability is determined to be low severity.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2  
D 3.0.1  
[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3  
Elixir 3.0.0  
[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1  
[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0  
[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2  
Perl 3.0.0  
[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2  
[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1  
[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

Affected packages:
package: ecosystem: Packagist, name: personnummer/personnummer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.2
Malicious Package in maybemaliciouspackage
Advisory: GHSA-m9r7-q9fc-qwx5 ()
Published: 2020-09-03T17:22:24Z

All versions of `maybemaliciouspackage` contain malicious code. The package prints the system's SSH keys to the console as a postinstall script.


## Recommendation

Remove the package from your environment. There are no further signs of compromise.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: maybemaliciouspackage, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in caolilinode
Advisory: GHSA-2958-5r4r-wvv6 (CVE-2017-16159)
Published: 2020-09-01T17:27:05Z

Affected versions of `caolilinode` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: caolilinode, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in freshdom
Advisory: GHSA-8qm2-24qc-c4qg ()
Published: 2020-09-01T19:57:56Z

Version 0.0.6 of `freshdom` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 0.0.6 of this module is found installed you will want to replace it with a version before or after 0.0.6. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: freshdom, versions: 0.0.6
Malicious Package in dhkey
Advisory: GHSA-qxrj-x7rm-2h49 ()
Published: 2020-09-03T17:05:59Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: dhkey, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in nextcloud-vue-collections
Advisory: GHSA-whv6-rj84-2vh2 ()
Published: 2020-09-04T17:21:58Z

Versions of `nextcloud-vue-collections` prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS).  The `v-tooltip` component has an insecure `defaultHTML` configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's browser.


## Recommendation

Upgrade to version 0.4.2 or later.

Affected packages:
package: ecosystem: npm, name: nextcloud-vue-collections, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.4.2
Directory Traversal in wind-mvc
Advisory: GHSA-7g8m-5qh9-9pgw (CVE-2017-16220)
Published: 2020-09-01T18:07:51Z

Affected versions of `wind-mvc` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: wind-mvc, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in mqtt
Advisory: GHSA-hg78-c92r-hvwr (CVE-2016-1000242)
Published: 2020-09-01T16:01:24Z

Affected versions of `mqtt` will cause the node process to crash when receiving specially crafted MQTT packets, making the application vulnerable to a denial of service condition.



## Recommendation

Update to v1.0.0 or later

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: mqtt, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.0.0, database_specific: last_known_affected_version_range: <= 0.3.13
Malicious Package in require-ports
Advisory: GHSA-qj3g-wfr7-3cv7 ()
Published: 2020-09-02T21:41:53Z

Version 10.4.0 of `require-ports` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opens a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: require-ports, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in buffer-hor
Advisory: GHSA-wh87-3959-vfrq ()
Published: 2020-09-03T21:51:58Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-hor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in leetlog
Advisory: GHSA-gfm8-g3vm-53jh ()
Published: 2020-09-03T17:21:19Z

Versions 0.1.2 and 0.1.3 of `leetlog` contain malicious code. The package adds an arbitrary hardcoded SSH key identified as `hacker@evilmachine` to the system's `authorized_keys`


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: leetlog, ranges: type: ECOSYSTEM, events: introduced: 0.1.2
Cross-Site Scripting (XSS) in pivottable
Advisory: GHSA-cjj8-wfrx-jqcf (CVE-2016-1000241)
Published: 2020-09-01T16:00:18Z

Affected versions of `pivottable` are vulnerable to cross-site scripting, due to a new mechanism used to render JSON elements.


## Recommendation

Update to version 2.0.0 or later.

Affected packages:
package: ecosystem: npm, name: pivottable, ranges: type: ECOSYSTEM, events: introduced: 1.4.0
fixed: 2.0.0
Malicious Package in jqeury
Advisory: GHSA-4964-cjrr-jg97 ()
Published: 2020-09-02T21:38:43Z

Version 3.3.1 of `jqeury` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server, executes it and opened a backdoor.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: jqeury, ranges: type: ECOSYSTEM, events: introduced: 0
Directory Traversal in hcbserver
Advisory: GHSA-mwj7-r5vc-hmc9 (CVE-2017-16171)
Published: 2020-09-01T17:35:38Z

Affected versions of `hcbserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: hcbserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in malicious-do-not-install
Advisory: GHSA-6879-xr95-5gf4 ()
Published: 2020-09-03T17:20:15Z

All versions of `malicious-do-not-install` contain malicious code. The package copies the contents of `/etc/passwd` and `/etc/shadow` to files in the local `/tmp/` folder.


## Recommendation

Remove the package from your environment and rotate affected credentials.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: malicious-do-not-install, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in mongodb
Advisory: GHSA-mh5c-679w-hh4r ()
Published: 2020-09-03T21:12:01Z

Versions of `mongodb` prior to 3.1.13 are vulnerable to Denial of Service. The package fails to properly catch an exception when a collection name is invalid and the DB does not exist, crashing the application.


## Recommendation

Upgrade to version 3.1.13 or later.

Affected packages:
package: ecosystem: npm, name: mongodb, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.1.13
Server-Side Request Forgery in ftp-srv
Advisory: GHSA-r4m5-47cq-6qg8 ()
Published: 2020-09-04T17:25:13Z

All versions of `ftp-srv` are vulnerable to Server-Side Request Forgery (SSRF). The package fails to prevent remote clients to access other resources in the network, for example when connecting to the server through telnet. This allows attackers to access any network resources available to the server, including private resources in the hosting environment.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: ftp-srv, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Local Privilege Escalation in npm
Advisory: GHSA-v3jv-wrf4-5845 (CVE-2013-4116)
Published: 2020-09-01T16:03:34Z

Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation.



## Recommendation

Update to version 1.3.3 or later.

Affected packages:
package: ecosystem: npm, name: npm, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.3.3
XSS in Action View
Advisory: GHSA-cfjv-5498-mph5 (CVE-2020-15169)
Published: 2020-09-11T15:19:57Z

There is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks.

### Impact

When an HTML-unsafe string is passed as the default for a missing translation key [named `html` or ending in `_html`](https://guides.rubyonrails.org/i18n.html#using-safe-html-translations), the default string is incorrectly marked as HTML-safe and not escaped. Vulnerable code may look like the following examples:

```erb
<%# The welcome_html translation is not defined for the current locale: %>
<%= t("welcome_html", default: untrusted_user_controlled_string) %>

<%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %>
<%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
```

### Patches

Patched Rails versions, 6.0.3.3 and 5.2.4.4, are available from the normal locations.

The patches have also been applied to the `master`, `6-0-stable`, and `5-2-stable` branches on GitHub. If you track any of these branches, you should update to the latest.

To aid users who aren’t able to upgrade immediately, we’ve provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* [5-2-translate-helper-xss.patch](https://gist.github.com/georgeclaghorn/a466e103922ee81f24c32c9034089442#file-5-2-translate-helper-xss-patch) — patch for the 5.2 release series
* [6-0-translate-helper-xss.patch](https://gist.github.com/georgeclaghorn/a466e103922ee81f24c32c9034089442#file-6-0-translate-helper-xss-patch) — patch for the 6.0 release series

Please note that only the 5.2 and 6.0 release series are currently supported. Users of earlier, unsupported releases are advised to update as soon as possible, as we cannot provide security fixes for unsupported releases.

### Workarounds

Impacted users who can’t upgrade to a patched Rails version can avoid this issue by manually escaping default translations with the `html_escape` helper (aliased as `h`):

```erb
<%= t("welcome_html", default: h(untrusted_user_controlled_string)) %>
```

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected packages:
package: ecosystem: RubyGems, name: actionview, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 5.2.4.4, database_specific: last_known_affected_version_range: <= 5.2.4.3
package: ecosystem: RubyGems, name: actionview, ranges: type: ECOSYSTEM, events: introduced: 6.0.0.0
fixed: 6.0.3.3, database_specific: last_known_affected_version_range: <= 6.0.3.2
Improper Authorization in passport-cognito
Advisory: GHSA-v6c5-hwqg-3x5q (CVE-2019-19723)
Published: 2020-09-04T17:23:03Z

All versions of `passport-cognito` are vulnerable to Improper Authorization. The package fails to properly scope the variables containing authorization information, such as access token, refresh token and ID token. This causes a race condition where simultaneous authenticated users may receive authorization tokens for a different user. This would allow a user to take actions on another user's behalf.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: passport-cognito, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in bootstrap-select
Advisory: GHSA-9r7h-6639-v5mw ()
Published: 2020-09-03T15:54:00Z

Versions of `bootstrap-select` prior to 1.13.6 are vulnerable to Cross-Site Scripting (XSS).  The package does not escape `title` values on `<option>` tags. This may allow attackers to execute arbitrary JavaScript in a victim's browser.


## Recommendation

Upgrade to version 1.13.6 or later.

Affected packages:
package: ecosystem: npm, name: bootstrap-select, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.13.6
Denial of Service in node-sass
Advisory: GHSA-9v62-24cr-58cx ()
Published: 2020-09-11T21:12:39Z

Affected versions of `node-sass` are vulnerable to Denial of Service (DoS). Crafted objects passed to the `renderSync` function may trigger C++ assertions in `CustomImporterBridge::get_importer_entry` and `CustomImporterBridge::post_process_return_value` that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.


## Recommendation

Upgrade to version 4.13.1 or later

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected packages:
package: ecosystem: npm, name: node-sass, ranges: type: ECOSYSTEM, events: introduced: 3.3.0
fixed: 4.13.1
Improper Authorization in loopback
Advisory: GHSA-8wgc-jjvv-cv6v ()
Published: 2020-09-02T15:54:52Z

Vulnerable versions of `loopback` may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's `userId`. This will allow the attacker to access the user's data and their privileges.


## Recommendation

For loopback 2.x, upgrade to version 2.40.0 or later
For loopback 3.x, upgrade to version 3.22.0 or later

Affected packages:
package: ecosystem: npm, name: loopback, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.40.0, database_specific: last_known_affected_version_range: <= 2.39.2
package: ecosystem: npm, name: loopback, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.22.0, database_specific: last_known_affected_version_range: <= 3.21.0
Directory Traversal in weather.swlyons
Advisory: GHSA-2r4h-2ghh-5hpx (CVE-2017-16110)
Published: 2020-09-01T17:18:33Z

Affected versions of `weather.swlyons` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Severity: type: CVSS_V3
score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: weather.swlyons, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in gm
Advisory: GHSA-pjh3-jv7w-9jpr (CVE-2015-7982)
Published: 2020-09-01T15:18:55Z

Versions of `gm` prior to 1.21.1 are affected by a command injection vulnerability. The vulnerability is triggered when user input is passed into `gm.compare()`, which fails to sanitize input correctly before calling the graphics magic binary.


## Recommendation

Update to version 1.21.1 or later.

Affected packages:
package: ecosystem: npm, name: gm, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.21.1, database_specific: last_known_affected_version_range: <= 1.20.0
Malicious Package in buffer-xob
Advisory: GHSA-gpg2-7r7j-4pm9 ()
Published: 2020-09-03T22:09:56Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xob, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Cross-Site Scripting in cmmn-js-properties-panel
Advisory: GHSA-vmh4-322v-cfpc ()
Published: 2020-09-03T18:18:06Z

Versions of `cmmn-js-properties-panel` prior to 0.8.0 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize input in specially configured diagrams, which may allow attackers to inject arbitrary JavaScript in the embedding website.


## Recommendation

Upgrade to version 0.8.0 or later.

Affected packages:
package: ecosystem: npm, name: cmmn-js-properties-panel, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 0.8.0
Malicious Package in requuest
Advisory: GHSA-frxq-v7fm-m4pv ()
Published: 2020-09-02T20:27:53Z

All versions of `requuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: requuest, ranges: type: ECOSYSTEM, events: introduced: 0
Cross-Site Scripting in swagger-ui
Advisory: GHSA-w992-2gmj-9xxj ()
Published: 2020-09-11T21:23:29Z

Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the `swagger.apiInfo.description` value without proper sanitization, which may allow attackers to execute arbitrary JavaScript.


## Recommendation

Upgrade to version 2.2.1 or later.

Affected packages:
package: ecosystem: npm, name: swagger-ui, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.2.1
personnummer/python vulnerable to Improper Input Validation
Advisory: GHSA-rxq3-5249-8hgg ()
Published: 2020-09-09T17:29:41Z

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.

The vulnerability is determined to be low severity.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2  
D 3.0.1  
[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3  
Elixir 3.0.0  
[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1  
[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0  
[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2  
Perl 3.0.0  
[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2  
[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1  
[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

Affected packages:
package: ecosystem: PyPI, name: personnummer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.2
Denial of Service in subtext
Advisory: GHSA-5854-jvxx-2cg9 ()
Published: 2020-09-03T15:46:57Z

Versions of `subtext` >=4.1.0 are vulnerable to Denial of Service. The Content-Encoding HTTP header parser has a vulnerability which will cause the function to throw a system error if the header contains some invalid values. Because hapi rethrows system errors (as opposed to catching expected application errors), the error is thrown all the way up the stack. If no unhandled exception handler is available, the application will exist, allowing an attacker to shut down services.


## Recommendation

This package is deprecated and is now maintained as `@hapi/subtext`. Please update your dependencies to use `@hapi/subtext`. 

Affected packages:
package: ecosystem: npm, name: subtext, ranges: type: ECOSYSTEM, events: introduced: 4.1.0
Remote Code Execution in pomelo-monitor
Advisory: GHSA-m5ch-gx8g-rg73 ()
Published: 2020-09-02T15:43:53Z

All versions of `pomelo-monitor` are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Affected packages:
package: ecosystem: npm, name: pomelo-monitor, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in 1337qq-js
Advisory: GHSA-7wgh-5q4q-6wx5 ()
Published: 2020-09-04T17:30:39Z

All versions of `1337qq-js` contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes:
- Environment variables
- Running processes
- /etc/hosts
- uname -a
- npmrc file


## Recommendation

Remove the package from your system and rotate any compromised credentials.

Affected packages:
package: ecosystem: npm, name: 1337qq-js, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in electron-native-notify
Advisory: GHSA-j8qr-rvcv-crhv ()
Published: 2020-09-11T21:18:05Z

All versions of `electron-native-notify` contain malicious code. The package was part of a targeted attack to steal cryptocurrency wallet seeds and upload them to a remote server, effectively giving attackers access to users wallets.


## Recommendation

Remove the package from your environment and [follow the recommendations by Komodo](https://komodoplatform.com/vulnerability-discovered-in-komodos-agama-wallet-this-is-what-you-need-to-do/)

Affected packages:
package: ecosystem: npm, name: electron-native-notify, ranges: type: ECOSYSTEM, events: introduced: 0
personnummer/ruby vulnerable to Improper Input Validation
Advisory: GHSA-vp9c-fpxx-744v ()
Published: 2020-09-23T17:19:55Z

This vulnerability was reported to the personnummer team in June 2020. The slow response was due to locked ownership of some of the affected packages, which caused delays to update packages prior to disclosure.

The vulnerability is determined to be low severity.

### Impact

This vulnerability impacts users who rely on the for last digits of personnummer to be a _real_ personnummer.  

### Patches

The issue have been patched in all repositories. The following versions should be updated to as soon as possible:

[C#](https://github.com/advisories/GHSA-qv8q-v995-72gr) 3.0.2  
D 3.0.1  
[Dart](https://github.com/advisories/GHSA-4xh4-v2pq-jvhm) 3.0.3  
Elixir 3.0.0  
[Go](https://github.com/advisories/GHSA-hv53-vf5m-8q94) 3.0.1  
[Java](https://github.com/advisories/GHSA-q3vw-4jx3-rrr2) 3.3.0  
[JavaScript](https://github.com/advisories/GHSA-vpgc-7h78-gx8f) 3.1.0  
Kotlin 1.1.0  
Lua 3.0.1  
[PHP](https://github.com/advisories/GHSA-2p6g-gjp8-ggg9) 3.0.2  
Perl 3.0.0  
[Python](https://github.com/advisories/GHSA-rxq3-5249-8hgg) 3.0.2  
[Ruby](https://github.com/advisories/GHSA-vp9c-fpxx-744v) 3.0.1  
[Rust](https://github.com/advisories/GHSA-28r9-pq4c-wp3c) 3.0.0  
Scala 3.0.1  
Swift 1.0.1  

If you are using any of the earlier packages, please update to latest.

### Workarounds

The issue arrieses from the regular expression allowing the first three digits in the last four digits of the personnummer to be
000, which is invalid. To mitigate this without upgrading, a check on the last four digits can be made to make sure it's not
000x.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [Personnummer Meta](https://github.com/personnummer/meta/issues)
* Email us at [Personnummer Email](mailto:security@personnummer.dev)

Affected packages:
package: ecosystem: RubyGems, name: personnummer, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.1
Malicious Package in bs58chek
Advisory: GHSA-3cpj-mj3q-82wr ()
Published: 2020-09-04T16:49:43Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bs58chek, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in sdfjghlkfjdshlkjdhsfg
Advisory: GHSA-gcfc-mgg3-8j2c ()
Published: 2020-09-03T18:11:29Z

All versions of `sdfjghlkfjdshlkjdhsfg` contain malicious code. The package is essentially a worm that fetches all packages owned by the user, adds a script to self-replicate as a preinstall script and publishes a new version.


## Recommendation

Remove the package from your environment and ensure all packages owned were not impacted.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: sdfjghlkfjdshlkjdhsfg, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in grunt-radical
Advisory: GHSA-4627-w373-375v ()
Published: 2020-09-11T21:22:24Z

Version 0.0.14 of `grunt-radical` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

Remove the package from your environment and evaluate your application to determine whether or not user data was compromised.

Affected packages:
package: ecosystem: npm, name: grunt-radical, ranges: type: ECOSYSTEM, events: introduced: 0.0.14
fixed: 0.0.13, versions: 0.0.14
Out-of-bounds Read in base64url
Advisory: GHSA-rvg8-pwq2-xj7q ()
Published: 2020-09-01T20:42:44Z

Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.


## Recommendation

Update to version 3.0.0 or later.

Affected packages:
package: ecosystem: npm, name: base64url, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.0
pullit vulnerable to command injection
Advisory: GHSA-8px5-63x9-5c7p (CVE-2018-25083)
Published: 2020-09-03T16:47:30Z

Versions of `pullit` prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names  and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system.

## Recommendation

Upgrade to version 1.4.0 or later.

## Credits

This vulnerability was discovered by @lirantal

Affected packages:
package: ecosystem: npm, name: pullit, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.4.0
Prototype Pollution in unflatten
Advisory: GHSA-6fh5-8wq8-w3wr ()
Published: 2020-09-04T15:09:55Z

All versions of `unflatten` are vulnerable to prototype pollution. The function `unflatten` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: unflatten, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Directory Traversal in zwserver
Advisory: GHSA-whcm-29f4-j4mx (CVE-2017-16149)
Published: 2020-09-01T16:56:50Z

Affected versions of `zwserver` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.

**Example request:**
```http
GET /../../../../../../../../../../etc/passwd HTTP/1.1
host:foo
```


## Recommendation

No patch is available for this vulnerability.

It is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.

Affected packages:
package: ecosystem: npm, name: zwserver, ecosystem_specific: affected_functions: , ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in bs85check
Advisory: GHSA-4hq8-v42x-9wx3 ()
Published: 2020-09-04T16:51:52Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: bs85check, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in dictum.js
Advisory: GHSA-j5jc-jf8f-86q7 ()
Published: 2020-09-01T20:38:30Z

Version 1.0.5 of `dictum.js` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.5 of this module is found installed you will want to replace it with a version before or after 1.0.5. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Users may consider downgrading to version 1.0.4

Affected packages:
package: ecosystem: npm, name: dictum.js, versions: 1.0.5
Sandbox Breakout / Arbitrary Code Execution in safe-eval
Advisory: GHSA-9pcf-h8q9-63f6 ()
Published: 2020-09-03T17:12:41Z

All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code.  

For example, the payload 
```
((() => { 
const targetKey = Object.keys(this)[0]; 
Object.defineProperty(this, targetKey, { 
get: function() { 
return arguments.callee.caller.constructor( 
"return global.process.mainModule.require('child_process').execSync('pwd').toString()" 
)(); 
} 
}); 
})();```
may be used to print the `pwd` to the console.


## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: safe-eval, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in evil-package
Advisory: GHSA-p62r-jf56-h429 ()
Published: 2020-09-03T20:29:58Z

All versions of `evil-package` contain malicious code. The package uploads the contents of `process.env` to `example.com/log`.


## Recommendation

Remove the package from your environment. Given the host where the information was uploaded to there is no further indication of compromise.

Affected packages:
package: ecosystem: npm, name: evil-package, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in js-she3
Advisory: GHSA-f8jj-45fj-44r6 ()
Published: 2020-09-03T23:05:43Z

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: js-she3, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Command Injection in strapi
Advisory: GHSA-9p2w-rmx4-9mw7 ()
Published: 2020-09-04T16:54:02Z

Versions of `strapi` before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the `/admin/plugins/install/` route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server.


## Recommendation

Upgrade to version 3.0.0-beta.17.8 or later

Affected packages:
package: ecosystem: npm, name: strapi, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 3.0.0-beta.17.8, database_specific: last_known_affected_version_range: <= 3.0.0-beta.17.7
Malicious Package in cordova-plugin-china-picker
Advisory: GHSA-x9gm-qxhh-rf75 ()
Published: 2020-09-01T19:51:28Z

Version 1.0.910 of `cordova-plugin-china-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`



## Recommendation

If version 1.0.910 of this module is found installed you will want to replace it with a version before or after 1.0.910. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: cordova-plugin-china-picker, versions: 1.0.910
Denial of Service in markdown-it-toc-and-anchor
Advisory: GHSA-x6m6-5hrf-fh6r ()
Published: 2020-09-01T21:26:50Z

All versions of `markdown-it-toc-and-anchor` are vulnerable to Denial of Service. Parsing markdown containing `**text**+\n@[toc]` causes the application to enter and infinite loop.


## Recommendation

No fix is currently available. Consider using an alternative module until a fix is made available.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/
Affected packages:
package: ecosystem: npm, name: markdown-it-toc-and-anchor, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 4.2.0
Malicious Package in reques
Advisory: GHSA-g8jc-mm3c-cwhj ()
Published: 2020-09-02T20:31:06Z

All versions of `reques` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process was running as sudo. There is no further compromise.


## Recommendation

Remove the package from your dependencies and always ensure package names are typed correctly upon installation.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: reques, ranges: type: ECOSYSTEM, events: introduced: 0
Malicious Package in commandre
Advisory: GHSA-r8hx-3qx6-hxq9 ()
Published: 2020-09-03T19:41:14Z

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected packages:
package: ecosystem: npm, name: commandre, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Prototype Pollution in get-setter
Advisory: GHSA-ch82-gqh6-9xj9 ()
Published: 2020-09-04T15:13:19Z

All versions of `get-setter` are vulnerable to prototype pollution. The function `set` does not restrict the modification of an Object's prototype, which may allow an attacker to add or modify an existing property that will exist on all objects.




## Recommendation

No fix is currently available. Consider using an alternative package until a fix is made available.

Affected packages:
package: ecosystem: npm, name: get-setter, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Sensitive Data Exposure in loopback
Advisory: GHSA-724c-6vrf-99rq ()
Published: 2020-09-02T21:49:48Z

Versions of `loopback` prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.


## Recommendation

If you're using `loopback` 3.x upgrade to version 3.26.0 or later.
If you're using `loopback` 2.x upgrade to version 2.42.0 or later.

Affected packages:
package: ecosystem: npm, name: loopback, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 2.42.0, database_specific: last_known_affected_version_range: <= 2.41.0
package: ecosystem: npm, name: loopback, ranges: type: ECOSYSTEM, events: introduced: 3.0.0
fixed: 3.26.0, database_specific: last_known_affected_version_range: <= 3.25.0
Path Traversal in 626
Advisory: GHSA-r4r9-mgjc-g6q3 (CVE-2018-3727)
Published: 2020-09-01T19:06:15Z

All versions of `626` are vulnerable to path traversal. This enables a remote attacker to read arbitrary files from the remote server using this module.


## Recommendation

No fix is currently available for this vulnerability.
It is our recommendation to not install or use this module at this time.
 

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected packages:
package: ecosystem: npm, name: 626, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Malicious Package in buffer-xop
Advisory: GHSA-jqjg-v355-hr9q ()
Published: 2020-09-03T22:11:02Z

Version 2.0.2 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user.


## Recommendation

Remove the package from your environment. Ensure no Ethereum funds were compromised.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: buffer-xop, ranges: type: ECOSYSTEM, events: introduced: 0.0.0
Denial of Service in express-fileupload
Advisory: GHSA-q3w9-g74q-vp5f ()
Published: 2020-09-03T21:14:12Z

Versions of `express-fileupload` prior to 1.1.6-alpha.6 are vulnerable to Denial of Service. The package causes server responses to be delayed (up to 30s in internal testing) if the request contains a large `filename` of `.` characters.




## Recommendation

Upgrade to version 1.1.6-alpha.6 or later.

Affected packages:
package: ecosystem: npm, name: express-fileupload, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.6-alpha.6
package: ecosystem: npm, name: express-fileupload, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.6-alpha.6, database_specific: last_known_affected_version_range: <= 1.1.3-alpha.2
package: ecosystem: npm, name: express-fileupload, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.6-alpha.6, database_specific: last_known_affected_version_range: <= 1.1.2-alpha.1
package: ecosystem: npm, name: express-fileupload, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.6-alpha.6, database_specific: last_known_affected_version_range: <= 1.1.1-alpha.3
package: ecosystem: npm, name: express-fileupload, ranges: type: ECOSYSTEM, events: introduced: 0
fixed: 1.1.6-alpha.6, database_specific: last_known_affected_version_range: <= 1.0.0-alpha.1
Malicious Package in sj-tw-test-security
Advisory: GHSA-rcv7-4w2m-gj9v ()
Published: 2020-09-03T23:24:26Z

All versions of `sj-tw-test-security` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system.


## Recommendation

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Severity: type: CVSS_V3
score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected packages:
package: ecosystem: npm, name: sj-tw-test-security, ranges: type: ECOSYSTEM, events: introduced: 0.0.0